Top five things you need to know about software deals before the UK’s Competition and Markets Authority (“CMA”)

While the CMA unconditionally clears the vast majority of software deals at Phase I, 50% (3) of the CMA’s active Phase II investigations concern software companies (NortonLifeLock/Avast, NEC Software Solutions/Capita Secure Solutions and Services, and Dye & Durham/TM Group). Coupled with other recent CMA interventions in software deals, gone may be the days when the CMA viewed software markets as competitive, fast-paced, and innovative.

Below, we identify five key points that investors should keep in mind when contemplating transactions involving software enterprises.

1. The CMA is more interventionist in software mergers compared to other antitrust authorities

Of the ~35 software cases that the CMA reviewed since 1 January 2019, the CMA referred to Phase II, prohibited, and/or required remedies in 13 cases (two of which the parties abandoned). The CMA’s intervention rate in software deals is therefore 37%, which is significantly higher than the European Commission’s (“EC”) intervention rate of ~4%.

2. The CMA may go to significant lengths to establish jurisdiction over software deals with very little UK nexus

The “share of supply” limb of the UK jurisdictional thresholds provides the CMA with broad discretion over the transactions it reviews. The CMA does not need to define an “antitrust” market (which it must for the substantive antitrust assessment) before establishing that parties account for 25% or more of UK supply. The CMA can instead consider “any reasonable description of a set of goods or services” and account for any goods or services within that description that concern the UK. For example:

• The CMA’s Mergers Intelligence Committee (“MIC”) called in the completed acquisition of Looker Data Sciences by Google late in 2019. Looker provides business intelligence (“BI”) tools (predominantly in the US) designed for data exploration, analytics, and online advertising services generated by providers such as Google. The CMA adopted a broad frame of reference concerning the provision of BI services in the UK that “automate the ingestion, analysis and visualization of web analytics data” in order to create a horizontal overlap for the purpose of the share of supply threshold.¹ The CMA rejected the parties’ arguments that their products were differentiated, and held that the share of supply test only requires the CMA to consider “any reasonable description of a set of goods or services” – not an antitrust market.
• In June 2019, for example, the CMA prohibited the anticipated acquisition of Farelogix by Sabre Corporation (“Sabre”). The CMA found that Farelogix was engaged in the supply of travel booking and related IT services in the UK on the basis of its relationship with American Airlines, which had an interline agreement with UK airline British Airways. Farelogix processed only a small number of American Airlines tickets (around 60) that included a British Airways interline segment. The CMA nevertheless held that British Airways took “active and conscious steps” to procure Farelogix’s services, that Farelogix was entitled to some value as a result of these ticket sales, and that the share of supply test does not require a minimum increment. In May 2021, the CAT agreed.

These two cases demonstrate the CMA’s ability to define exceptionally narrow or broad categories of supply and identify UK nexus based on limited UK activities to establish jurisdiction over transactions it wishes to investigate.

Further, the CMA’s revised jurisdictional thresholds, which were announced in April 2022, aim to expand CMA jurisdiction over “so-called ‘killer acquisitions’ that risk the development of new products or services”. They propose a new alternative threshold, which would be satisfied in deals where the acquirer has both:

• An existing share of supply of goods or services of 33% or more in the UK or a substantial part of the UK; and
• UK turnover in excess of £350 million.

This new threshold would eliminate the need for the CMA to demonstrate that merging parties compete (e.g., on the basis of a pipeline product) and will mean that a large business or private equity sponsor acquiring a target company with no UK activities could still be within the CMA’s reach.²

These reforms are not expected to come into force until at least 2023, but the current case law provides the CMA with enough ammunition to review the most significant global transactions.

3. Small transactions will not necessarily escape scrutiny

No case seems too small for the CMA. In August 2018, Swedish company Tobii completed its acquisition of UK rival Smartbox for £11 million. Both parties are active in the supply of bespoke communication software and devices for people with complex speech and language needs (also known as augmentative and assistive communication (AAC) solutions) and generated just £7.8 million in UK sales combined. The CMA called in the transaction and issued an initial enforcement order (“IEO”) in September 2018 preventing further integration.

At Phase I, the CMA rejected the parties’ arguments that the markets were de minimis and concluded that the transaction resulted in a substantial lessening of competition. The CMA identified concerns, for example, of potential non-price partial foreclosure – whether the merged entity might degrade the quality of its software to rivals (e.g., by reducing interoperability), or tailor improvements in its software to benefit its own downstream business.³ The CMA appeared to prioritise qualitative evidence (such as the views of customers, competitors, and evidence from internal documents) over quantitative evidence (such as diversion ratios).⁴

Having rejected behavioural remedies offered by Tobii, the CMA opened a Phase II investigation, and ultimately issued its first ever unwinding order in March 2019, obliging the parties to reverse the deal. The order forced the parties to terminate a reseller agreement under which Smartbox had agreed to act as a reseller of Tobii products in the UK and Ireland, and forced Smartbox to resume supply of a range of products it had agreed not to supply and to reinstate R&D projects that it had agreed to suspend. The CMA issued its final report in August 2019, requiring Tobii to divest Smartbox to an approved buyer.⁵

Similarly, Bottomline Technologies completed its acquisition of certain technology and assets from Experian (the Experian Payments Gateway (EPG)) in March 2019 for approximately $12.5 million. The CMA called in the transaction, imposing an IEO in May 2019. In August 2019, before launching a Phase I investigation, the CMA issued an unwinding order, obliging the parties to reverse any integration, restore pre-integration market conditions, and to not use any commercially sensitive gleaned from the deal. Through its IEO, the CMA intended to avoid prejudicing the CMA’s merger investigation and any possible remedies that may have been required. Despite its IEO and unwinding order, the CMA ultimately approved the deal.

4. Transactions involving software in sensitive industries are more likely to attract scrutiny

The CMA’s appetite for intervention and intense scrutiny in software deals may increase as the sensitivity of the sector(s) concerned increases. For example, the CMA intervened in software deals concerning:

• Bespoke communication software and devices for people with complex speech and language needs in Tobii/Smartbox. (Ultimately blocked – discussed above.)
• Payments software that enabled payments via the Bacs and Faster Payments Direct Corporate Access systems in Bottomline Technologies/Experian. (Ultimately cleared – discussed above.)
• Parental engagement software, management information system software to UK schools, and payments software to UK schools in Montagu/ParentPay. The CMA eventually dismissed horizontal concerns on the basis of the parties’ “modest” combined share of supply (below 15%), but not before detailed consideration of a wide range of evidence, from economic projections of lost margins, technical ability to affect product integration and interoperability, evolution of shares of supply going back almost a decade, and relative costs of switching.
• Essential software solutions to emergency service providers (including police forces, fire and rescue services, and ambulance trusts) and transport service providers (such as Transport for London and rail operators) in NEC Software Solutions/Capita Secure Solutions and Services. The parties provide a variety of software solutions, including (i) “integrated communication and control services” used by control room personnel in day-to-day duties such as urgent communications with emergency response staff, (ii) specialised software to police forces to enable the planning and scheduling of shifts, and (iii) records management systems that enable the police to record and manage case-related information such as the processing of people in custody and case file management for prosecutions. The CMA referred the deal to Phase II in May 2022 after NEC refused to offer remedies in Phase I. The CMA found that each software market is concentrated, with the parties generally being two of the three available suppliers, each with a large established customer base.

Each of these deals arguably involved software companies active in sensitive sectors (such as education, health care, and vulnerable consumers), and each involved intense scrutiny (and in one instance prohibition).

5. CMA processes are unpredictable, convoluted, long, and often expensive, and the CMA may depart from the approach adopted by other authorities even in global markets

CMA processes can be notoriously unpredictable and extremely burdensome. In Bottomline Technologies/Experian, the CMA unconditionally cleared the deal, but only after it ordered the parties to unwind the transaction, opened an in-depth investigation, and rejected the parties’ offer of undertakings, all over a 12-month period.

In November 2019, the US Department of Justice (“DOJ”) cleared Google’s acquisition of Looker Data Sciences, with Austrian clearance shortly thereafter. In December 2019, however, the CMA issued an IEO and called in the transaction. The CMA ultimately unconditionally cleared the transaction in Phase I, but it worked closely with the DOJ and undertook a detailed assessment both of horizontal effects (including potential competition) and vertical effects on global markets.

In November 2020, the CMA initially prohibited financial software company FNZ’s proposed acquisition of GBST (notwithstanding that the CMA had previously informed the parties that it had “no further questions” in response to a briefing paper). On appeal, the CMA asked the CAT to remit the CMA’s decision for reconsideration, having identified “market share errors” in its analysis. The CMA subsequently accepted undertakings offered by FNZ to sell GBST but with the right to buy back limited assets concerning GBST’s capital markets business.

After receiving unconditional Phase I approvals in the US, Germany, and Spain, the CMA in April 2022 became the only major competition authority to refer NortonLifeLock’s $8 billion acquisition of Avast to Phase II. The CMA concluded that the parties’ differentiated offerings (NortonLifeLock focused on paid-for solutions and Avast on so-called “freemium” solutions), and the competitive constraints posed both by Microsoft (the largest provider by volume) and other OS providers such as Apple and Google, were insufficient to offset the loss of competition. In stark contrast, the German Federal Cartel Office cleared the transaction despite the parties’ high combined shares, in light of increased competition from platforms with security solutions integrated in their OS. Similarly, the Spanish National Markets and Competition Commission concluded that the market share estimates may, in fact, overestimate the parties’ position since they exclude free cybersecurity solutions such as Microsoft’s Defender. The CMA will now be under significant pressure to substantiate its divergent approach.

Top tips for software deals going forward

• Consider whether the software falls into a sensitive sector.
• Consider overlaps even on seemingly conservative bases or edge cases.
• Consider whether the target provides services to UK businesses or customers, even if small or based on an agreement between the target and non-UK third party.
• Always conduct a merger feasibility analysis – do not rely on the limited size of a transaction or international approvals and consider whether there is a realistic (and commercially acceptable) fix to any problem.
• Consider likelihood of CMA call-in when considering global notification strategy. In IAG/Air Europa for example, the CMA opened an investigation very late in the EC’s Phase II investigation. The parties subsequently abandoned the deal.
• Account for potentially considerable uncertainty, delays, risk allocation (e.g., HOHW) and the need for target cooperation in any deal documents.

More generally, investors should keep in mind the following when considering transactions with UK nexus:

• The CMA can review acquisitions of “material influence”, which is significantly lower than the EC’s “decisive influence”/“control” standard, and which has been found based on an equity interest of as little as 15% and a single board seat.
• Transactions involving significant multiples may attract greater scrutiny. In PayPal/iZettle, the CMA considered whether the high consideration value for iZettle (almost twice that of a parallel initial public offering valuation) reflected a reduction in competition.
• Document procompetitive rationale(s) for the acquisition in internal and external analyses, and prepare for the possibility of the CMA questioning directors on the contents of internal documents and their interpretation (Inspired/Novomatic).
• Remember that the UK’s foreign direct investment (National Security and Investment Act) regime may also apply and be a means through which the CMA learns of a deal. The regime is acquirer-agnostic (it bites foreign and UK acquirers) and can apply even in the absence of a UK subsidiary or assets (i.e., UK sales alone are sufficient).

Conclusion

The UK merger control thresholds remain voluntary and non-suspensory. However, the CMA’s liberal interpretation of its jurisdiction and interventionist approach to software deals in recent years (largely supported by the CAT) highlights the risks of not notifying the CMA of software deals. Parties should conduct a detailed pre-transaction assessment of the antitrust (and FDI) risk associated with the deal, including the sensitivity of the software involved, when deciding whether to notify the CMA and the implications for deal timelines and obligations in deal documents. And if parties proceed with completion despite material risk, they should consider the cost of reversing any integration undertaken.