Recently, the German Federal Government passed a new amendment to the BSI Critical Infrastructure Ordinance (BSI-KritisV). More companies in the IT/Telecommunications sector – but also in other sensitive sectors – will qualify as operators of “critical infrastructure”. For example, it is estimated that more than 7 data centers will be affected by these new rules. Acquisition of 10% or more in such companies by non EU/EFTA investors will trigger a notification requirement under the German foreign direct investment (FDI) rules.

Background 

Certain facilities in specific sectors and industries qualify as “critical infrastructure” if they are of vital importance to the nation's society and economy. Whether they are considered critical depends on whether they reach or exceed specified threshold values stipulated in the BSI-KritisV. For operators of critical infrastructure, special IT securities obligations apply.

Why is this important for foreign investors?

Non EU/EFTA investors need to carefully examine whether the relevant threshold values are met. If a target classifies as an operator of critical infrastructure, this means that the German FDI regime also applies. In cases of acquisitions of at least 10% of the voting rights, the transaction needs to be notified to the Federal Ministry for Economic Affairs and Energy. Failure to notify will result in the acquisition being suspended and made invalid. Criminal penalties (imprisonment of up to five years or a fine) can be imposed for intentional violation. Administrative fines of up to EUR 500,000.00 can be imposed in the case of a negligent breach. For more information on the German FDI control regime and for FDI regimes around the world, see the Dentons Foreign Direct Investment (FDI) Global Tracker.

What are the main changes in relation to the IT/Telecommunications sector?

Most importantly, the relevant threshold values for data centers (housing), server farms (hosting) and IXP will decrease significantly. Further, top-level domain registries (TLD) have been introduced as a new category of facilities that is considered critical infrastructure. These are facilities that manage and operate the registration of internet domain names within a specific top-level domain.

In more detail: 

• Data centers: Decrease in threshold value from 5 MW to 3,5 MW contracted capacity.
• Server farms: Decrease in threshold value from 25,000 operated instances to 10,000 physical instances or 15,000 virtual instances.
• IXP: Decrease in threshold value number from 300 to 100 connected autonomous systems.
• TLD: The relevant threshold value for this newly introduced category is 250,000 domains managed or operated. 

The amended BSI-KritisV will come into effect on January 1, 2022.

If you have any questions please reach out to us!