Foreign investment screening has evolved rapidly from a niche regulatory consideration into a key feature of transactions with an EU nexus.
In our previous article, we examined the key features of Cyprus’ newly introduced foreign investment screening regime under Law 194(I)/2025 (the “Cyprus FDI Law”) and its implementation of Regulation (EU) 2019/452 (the “Current Regulation”).
Regulation (EU) 2026/1386 on the screening of foreign investments in the Union (the “New Regulation”) entered into force on 16 July 2026 and will apply from 17 January 2028, repealing the Current Regulation.
This development comes shortly after Cyprus brough its FDI screening regime into force on 2 April 2026.
This article examines the key changes introduced at EU level and their practical implications for Cyprus transactions.
A. The New Regulation: Background
The Current Regulation was, by design, a light-touch instrument. It established a cooperation mechanism through which Member States that screened a foreign investment would notify the transaction to the Commission and other Member States, who could submit comments, with the Commission entitled to issue a (non-binding) opinion. Crucially, it never required any Member State to have a screening mechanism in the first place, it simply permitted Member States to maintain, amend or adopt national screening mechanisms. This resulted in a fragmented regulatory landscape across the EU and inconsistent screening regimes with approaches also varying significantly across key concepts including, inter alia, the treatment of indirect investments (as demonstrated by the ECJ’s judgment in Xella (Case C-106/22)).
Against the backdrop of heightened geopolitical uncertainty and increasing EU focus on economic security (as further demonstrated by the proposed EU Industrial Accelerator Act), the Commission concluded that further legislative action was required to address these divergences, leading to the adoption of the New Regulation. Its key development is the move from a framework centred primarily on cooperation and coordination towards a more harmonised system establishing common minimum requirements across all Member States, while preserving national discretion to maintain or adopt more stringent screening measures.
B. The New Regulation: Key Changes
1. Mandatory National Screening Regimes
Under the Current Regulation, Member States were permitted, but not required, to maintain, amend or adopt FDI screening mechanisms. The New Regulation requires all Member States to establish a screening mechanism, in line with common minimum standards, by 17 January 2028. Member States may adopt complementary or more specific national rules, provided they are consistent with the New Regulation, and must notify the Commission of any amendments to their screening mechanisms within 30 days.
In reality, all 27 Member States already operate national FDI screening mechanisms. The New Regulation, however, will ensure all Member States require prior authorisation for investments in a defined set of sensitive sectors.
2. Common Minimum Sector Scope and Risk-based Evaluation
The mandatory common minimum scope for FDI screening is, arguably, the key change. Under the New Regulation, Member States must impose ex-ante authorisation requirements for investments in sensitive sectors – at a minimum: (i) dual use items or defence products; (ii) semiconductor, quantum or AI technologies; (iii) critical transport, energy or digital infrastructure; (iv) strategic raw materials; (v) specific categories of financial service operators or institutions; or (iv) electoral systems.
Member States may extend their screening mechanisms to additional foreign investments (such as medicine or greenfield investments).
For Cyprus, the impact of these changes is expected to be limited as the Cyprus FDI Law already adopts a broad sectoral approach, covering a wide scope of investments of strategic importance including education, healthcare, data processing and storage, media and critical infrastructure.
The New Regulation also introduces a more structured risk-based assessment framework. When determining whether a foreign investment is likely to negatively affect security or public order, both the potential impact of the investment and the profile of the foreign investor must be considered, including the non-exhaustive list of factors set out under Article 19. Any screening decision must be based on a risk-based analysis taking into account all relevant circumstances of the investment, with the New Regulation moving away from a sector-based assessment towards a broader evaluation of the specific risks arising from the nature of the target, the investment structure and the identity of the investor.
Finally, the New Regulation clarifies that the following investments are excluded from its scope: (i) portfolio investments; (ii) acquisitions under resolution frameworks (for banks, investment firms, central counterparties, insurance or reinsurance undertakings); and (iii) internal reorganisations (except where a new non-EU legal entity is introduced in the upstream ownership chain).
3. Ownership Structures
A significant development under the New Regulation is the expansion of key definitions, especially foreign investment and beneficial owner.
The concept of “foreign investment” replaces “foreign direct investment” under the Current Regulation and expands the scope to expressly cover investments carried out through a foreign investor’s EU subsidiary to ensure situations where a foreign investor uses an EU-incorporated subsidiary as an acquisition or investment vehicle. This clarification addresses a potential gap under the Current Regulation arising where foreign investors structure investments through EU-incorporated subsidiaries, as illustrated in Xella (Case C-106/22).
Although the Cyprus FDI Law already adopts a broad approach to foreign investment screening, the New Regulation will require closer scrutiny of indirect investments and layered ownership structures to ensure consistency with the new harmonised EU framework.
The New Regulation also changes the approach to control – focusing on effective participation in the management or control of the EU target (through decisive influence or the ability to materially impact the target’s commercial policy).
Similarly, it introduces a new autonomous definition of “beneficial owner” requiring competent authorities to identify the individuals or entities that ultimately own, control or benefit from an investment.
As per above, in addition to enhancing the ambit of the New Regulation, this new definition is also relevant in the screening of a foreign investment, as Member States are required to consider, inter alia, the impact of the beneficial owner of a foreign investor on security or public order (including connections with third-country policy objectives, previously prohibited or conditioned investments and restrictive measures or illegal activities).
Finally, and in line with the above, the New Regulation also focuses on transparency of ownership structure. Under the new regime, investors with ‘opaque ownership structures’ (involving complex legal structures, nominee arrangements or multiple layers of ownership or other mechanisms that obscure the identity of the beneficial owner) should expect greater scrutiny and the need to provide additional information to enable screening authorities to identify ultimate beneficial ownership and control of the investment.
4. Procedure (Coordination, Timelines and Call-in Powers)
Under the New Regulation, where a transaction triggers screening requirements in multiple Member States, investors are expected to coordinate their filings and endeavour to submit them on the same day, with each filing referencing the parallel proceedings in other Member States. The relevant Member States must also coordinate closely throughout the review process, including by aligning the timing of their assessments and screening decisions where possible.
In practice, this is intended to reduce procedural divergence and ensure a more consistent assessment of transactions with cross-border implications. For investors, particularly those using Cyprus entities as part of wider EU structures, foreign investment planning will need to consider not only the requirements of the Cyprus regime but also potential filing obligations and timelines in other Member States.
The New Regulation also introduces a new ‘harmonised’ two-phase review process: (a) a Phase I (preliminary) review within 45 calendar days from filing; and (b) a Phase II (in-depth) investigation. For Phase II reviews, however, no timeline is prescribed under the New Regulation and, accordingly, review periods between Member States are expected to diverge. Cyprus already adopts a two-phase review process (20 business days for Phase I and 65 business days for Phase II) but the New Regulation may require adjustments to ensure full alignment.
Regarding call-in review powers, Member States are required to ensure that their screening authorities have the right to review investments on their own initiative: (i) for at least 15 months and up to a maximum of five years after completion, for any investment not subject to prior authorisation, where grounds exist to consider that it may affect security or public order; and (ii) for at least 24 months after completion, for foreign investments subject to a prior authorisation requirement that were not filed or filed after completion.
5. Enhanced Cooperation
The New Regulation also placed increased emphasis on the cooperation mechanism.
In particular, it introduces specific rules for the notification of foreign investments undergoing screening to other Member States and the Commission by requiring Member States to establish risk-based conditions for notification of foreign investments in EU targets likely to have a negative effect on security or public order in at least one other Member State, whilst ensuring that the host Member State retains a margin of discretion in determining whether the conditions for notification are fulfilled.
Furthermore, the New Regulation introduces a more formalised and enhanced cooperation mechanism which involves, inter alia, the right of the Commission to propose mitigating measures or request a meeting with the host Member State, as well as an obligation to provide concerned Member States and the Commission with a written explanation where, despite concerns, the host Member State decides not to screen a foreign investment.
To facilitate this enhanced cooperation, the Commission is required to establish and maintain, by July 2027, a secure and encrypted system for the exchange of information between Member States and the Commission.
6. Delegated Powers of Commission
The New Regulation enhances the Commission’s ability to adapt the screening framework through delegated acts, allowing the regime to evolve in response to emerging security concerns and technological developments. In particular, the Commission may amend, through the adoption of delegated acts, the list of projects and programmes of Union interest and the list of technology areas subject to enhanced scrutiny, taking into account factors such as emerging security risks, supply chain vulnerabilities, technological developments and geopolitical changes. This mechanism is intended to ensure that the screening framework remains responsive to changing security and public order considerations.
C. Transitional rules
The New Regulation will apply from 17 January 2028, at which point the Current Regulation will be repealed and replaced. The New Regulation provides for transitional arrangements to ensure a smooth transition between the two frameworks.
Foreign direct investments that are already undergoing screening on 17 January 2028, as well as investments completed by that date, will continue to be governed by the Current Regulation and will not be subject to the New Regulation.
For investors and transaction teams, the key consideration will therefore be the timing of the investment and whether the relevant screening process has commenced before 17 January 2028. Businesses considering transactions with potential EU FDI implications should factor the transition date into their transaction planning and filing strategy.
D. Practical implications for transactions involving Cyprus
Cyprus’ role as a jurisdiction for inbound and outbound investment structuring means that the New Regulation will have practical implications for investors, businesses and transaction advisers active in the Cyprus market. While the New Regulation will only apply from 17 January 2028, the direction of travel is clear: FDI screening should be treated as an integral part of transaction planning, rather than a late-stage regulatory consideration.
In practice, businesses should:
Disclaimer: This article is provided for general information purposes only and does not constitute legal advice. The application of foreign investment screening rules will depend on the specific circumstances of each transaction. Please contact our team for tailored advice on any related matters.
