PRIVILEGED AND CONFIDENTIAL ATTORNEY WORK PRODUCT
CALDERWOOD & HARKNESS LLP 599 Lexington Avenue New York, NY 10022
MEMORANDUM
PRIVILEGED AND CONFIDENTIAL — ATTORNEY WORK PRODUCT
To: Harrison Wexford, Responsible Partner, M&A Elaine Forsythe, Specialist Partner, Antitrust & Competition
From: Tiffany Rosenthal, Lead Associate, M&A Andrew Fitzpatrick, Working Associate, M&A
Date: December 8, 2023
Re: German Foreign Direct Investment Screening Analysis — Acquisition of Cloudium Technologies plc by Solara Digital Infrastructure Fund VI LP
Matter No.: 1041-00003
I. Executive Summary
The purpose of this memorandum is to analyze whether the proposed acquisition of Cloudium Technologies plc ("Cloudium" or the "Target") by Solara Digital Infrastructure Fund VI LP ("Fund VI" or the "Buyer") triggers a mandatory or voluntary notification obligation under Germany's foreign direct investment ("FDI") screening regime established by the Außenwirtschaftsgesetz ("AWG," the German Foreign Trade and Payments Act) and the Außenwirtschaftsverordnung ("AWV," the German Foreign Trade and Payments Regulation).
The proposed transaction (the "Transaction") is structured as a reverse triangular merger in which Stratos Merger Sub Inc. ("Merger Sub"), a newly formed Delaware corporation and wholly owned subsidiary of Fund VI, will merge with and into Cloudium, with Cloudium surviving the merger as a wholly owned subsidiary of Fund VI. The aggregate deal value of the Transaction is approximately $6,800,000,000 (the "Deal Value"). Execution of the definitive merger agreement is anticipated for January 22, 2024, with closing expected in mid-2024 following satisfaction of customary regulatory and shareholder approval conditions.
The German nexus arises because Cloudium holds a wholly owned subsidiary, Cloudium Solutions GmbH ("Cloudium Germany"), incorporated in Berlin, Germany, which employs approximately 400 personnel focused on DACH-region (Germany, Austria, and Switzerland) sales, customer success, and account management operations. As a result of the Transaction, the indirect ultimate beneficial ownership of Cloudium Germany will shift from the dispersed public shareholders of Cloudium to Fund VI, a United States-based private equity fund and thus a non-EU/non-EFTA acquirer for purposes of the AWV.
Conclusion: Based on our analysis of the applicable provisions of the AWG and AWV as in effect on the date hereof, and based upon the due diligence materials and management representations reviewed through the date hereof, we conclude that no mandatory German FDI notification is required under either the sector-specific screening provisions (Section 60 AWV) or the cross-sectoral screening provisions (Section 55 AWV). Cloudium Solutions GmbH does not operate in any sector classified as sensitive under the AWV, does not develop or manufacture defense goods or IT security products, does not operate critical infrastructure, and does not hold classified German government contracts. The applicable voting-rights thresholds, while met in a purely arithmetic sense (the Transaction results in the indirect acquisition of 100% of Cloudium Germany's shares by a non-EU/non-EFTA acquirer), are relevant only where the German target entity operates in a sector falling within the scope of the AWV screening provisions. Because no sector-based criterion is satisfied, no notification obligation arises.
Furthermore, we do not recommend that the parties file a voluntary notification with the Bundesministerium für Wirtschaft und Klimaschutz ("BMWK," the Federal Ministry for Economic Affairs and Climate Action). While a voluntary filing could in principle provide additional legal certainty by obtaining a clearance certificate, the risk of an ex officio review is negligible given Cloudium Germany's profile, and the incremental delay and cost of a voluntary filing (typically two to four months of additional processing time) are not justified under the circumstances.
We recommend that the parties proceed with the Transaction without a German FDI filing, subject to the qualifications and monitoring recommendations set forth in Parts VII and VIII below.
II. Background on the Transaction
A. Parties
1. The Buyer
Solara Digital Infrastructure Fund VI LP ("Fund VI") is a Delaware limited partnership formed for the purpose of making private equity investments in digital infrastructure and enterprise software businesses. Fund VI is the sixth flagship investing vehicle managed by Solara Digital Infrastructure LP ("Solara"), a Delaware-based private equity sponsor. Solara is headquartered at 1200 Market Street, Suite 3400, Wilmington, Delaware 19801. Solara's managing partners are Marcus Elliston (Founder & Managing Partner) and Priya Narasimhan (Co-Managing Partner & Chief Investment Officer). Fund VI closed fundraising in 2022 with approximately $12.4 billion in committed capital from a diversified base of institutional limited partners, including public pension funds, sovereign wealth funds, endowments, and family offices. Fund VI's investment strategy is focused on control buyouts and take-private transactions of growth-stage and mature enterprise software and digital infrastructure companies in North America and Western Europe.
Fund VI is managed by its general partner, Solara Digital Infrastructure GP VI LLC, a Delaware limited liability company. Investment decisions for Fund VI are made by Solara's Investment Committee, which is comprised of Marcus Elliston, Priya Narasimhan, David Lim (Partner), and Rebecca Okonjo (Partner). For purposes of the German FDI analysis, Fund VI is a non-EU, non-EFTA acquirer domiciled in the United States.
2. The Target
Cloudium Technologies plc ("Cloudium") is a public limited company incorporated under the laws of England and Wales (Company No. 09734521). Cloudium's ordinary shares are listed on the Nasdaq Global Select Market under the ticker symbol "CLDM." Cloudium's registered office is located at 45 Broadwick Street, London W1F 0DB, United Kingdom, and its United States headquarters are located at 600 Townsend Street, Suite 800, San Francisco, California 94103.
Cloudium is a cloud-native enterprise software company providing enterprise resource planning ("ERP"), customer-relationship management ("CRM"), and business-intelligence ("BI") software-as-a-service ("SaaS") solutions to mid-market and enterprise customers globally. Cloudium was founded in 2014 and has grown rapidly through organic expansion and selective bolt-on acquisitions to serve over 8,500 customers across more than 40 countries.
Cloudium's senior management team includes Jonathan Hargrove (Chief Executive Officer), Sienna Whitfield (Chief Financial Officer), and Nadia Chowdhury (General Counsel and Company Secretary). Nadia Chowdhury has served as the primary management-side contact for due diligence and regulatory analysis in connection with the Transaction.
3. The Merger Sub
Stratos Merger Sub Inc. ("Merger Sub") is a Delaware corporation formed solely for the purpose of effecting the Transaction. Merger Sub was incorporated on January 8, 2024, with the Delaware Division of Corporations under File No. 7923841. Merger Sub is a wholly owned subsidiary of Fund VI. Merger Sub has not conducted, and will not conduct, any business operations other than those incidental to its formation, the execution and delivery of the merger agreement and related transaction documents, and the consummation of the merger.
B. German Subsidiary — Cloudium Solutions GmbH
The entity that creates the German jurisdictional nexus for purposes of this analysis is Cloudium Solutions GmbH ("Cloudium Germany"), the key characteristics of which are summarized below:
• Full Legal Name: Cloudium Solutions GmbH
• Entity Type: Gesellschaft mit beschränkter Haftung (GmbH), a German limited liability company
• Jurisdiction of Incorporation: Berlin, Germany (registered with the Amtsgericht Charlottenburg, HRB No. 198247 B)
• Registered Capital: €100,000
• Employees: Approximately 400 (as of November 30, 2023)
• Managing Directors (Geschäftsführer): Stefan Richter (Geschäftsführer, Managing Director — DACH Commercial Operations) and Clara Engel (Geschäftsführer, Managing Director — Finance & Administration)
• Business Activities: Cloudium Germany serves as the primary commercial hub for Cloudium's DACH-region operations. Its activities encompass direct sales, partner channel management, customer success, account management, pre-sales solution engineering, and professional services coordination for Cloudium's cloud-native ERP, CRM, and BI SaaS solutions serving mid-market and enterprise customers in Germany, Austria, and Switzerland. Cloudium Germany is a sales and services entity. Critically for purposes of this analysis:
(a) Cloudium Germany does not perform core research and development activities. Software development for Cloudium's platform is conducted primarily by engineering teams at Cloudium's US headquarters in San Francisco and its India development center (Cloudium Technologies India Pvt. Ltd., Bangalore);
(b) Cloudium Germany does not hold material intellectual property. All patents, copyrights, trade secrets, and other proprietary intellectual property relating to Cloudium's platform are held by Cloudium Technologies plc or its US holding entities;
(c) Cloudium Germany does not develop or manufacture defense goods or dual-use goods within the meaning of the Kriegswaffenkontrollgesetz, the Außenwirtschaftsliste, or Annex I to the EU Dual-Use Regulation (Regulation (EU) 2021/821);
(d) Cloudium Germany does not operate critical infrastructure in Germany within the meaning of the BSI-Kritisverordnung (BSI-KritisV) or the relevant provisions of the AWV; and
(e) Cloudium Germany does not hold classified German government contracts and does not have access to classified information (Verschlusssachen) of any classification level.
• Ownership: Cloudium Germany is a 100% wholly owned subsidiary of Cloudium Technologies plc. Following the consummation of the merger, Cloudium Germany will become an indirect wholly owned subsidiary of Fund VI.
C. Transaction Structure
The Transaction is structured as a reverse triangular merger under the Delaware General Corporation Law ("DGCL"). Pursuant to the merger agreement (the form of which is currently in advanced negotiation), Merger Sub will merge with and into Cloudium, with Cloudium surviving the merger as a wholly owned subsidiary of Fund VI (the "Surviving Company"). Upon the effectiveness of the merger:
(a) Each outstanding ordinary share of Cloudium (other than shares owned by Fund VI, Merger Sub, or their affiliates, and dissenting shares, if any) will be converted into the right to receive $36.92 in cash, without interest thereon;
(b) Each share of Merger Sub common stock outstanding immediately prior to the effective time will be converted into one ordinary share of the Surviving Company; and
(c) As a result, Cloudium will become a wholly owned subsidiary of Fund VI, and the indirect ownership of all Cloudium subsidiaries — including Cloudium Solutions GmbH — will transfer from the former public shareholders of Cloudium to Fund VI.
The indirect ownership change of Cloudium Solutions GmbH results from the change in ultimate beneficial ownership of Cloudium from its dispersed public shareholders to Fund VI. Under the AWV, indirect acquisitions of German companies through the acquisition of a foreign parent are within the scope of the screening regime, and the relevant inquiry is directed at the activities of the German entity whose ownership is changing.
D. Other Subsidiaries (for Completeness)
In addition to Cloudium Germany, Cloudium maintains the following material subsidiaries:
• Cloudium Technologies UK Ltd. (England and Wales, Company No. 11287456): Headquartered at 45 Broadwick Street, London W1F 0DB. Approximately 1,200 employees engaged in product management, UK/Ireland sales, and certain platform engineering functions.
• Cloudium Technologies India Pvt. Ltd. (Bangalore, Karnataka, India, CIN: U72200KA2016PTC090321): Approximately 2,400 employees engaged primarily in software development, quality assurance, technical support, and data operations.
In total, Cloudium employs approximately 6,800 personnel globally across its parent entity and subsidiaries. The UK and India subsidiaries are not relevant to the German FDI analysis but are noted here for completeness and because they are the subject of separate regulatory analyses referenced in Part VI below.
E. Deal Financials (Relevant Context)
The following financial metrics are provided for context in understanding the scale and profile of the Transaction and the Target:
For purposes of this memorandum, we note that Cloudium Germany's standalone revenues for the twelve months ended September 30, 2023, were approximately €187 million, representing intercompany commission and service fee income earned in connection with DACH-region sales facilitated by Cloudium Germany on behalf of its parent entity. Cloudium Germany does not independently generate subscription revenues; customer contracts are entered into with Cloudium Technologies plc or its UK subsidiary, and Cloudium Germany earns commissions and service fees under intercompany arrangements.
III. Overview of the German FDI Screening Regime
A. Legal Framework
Germany's foreign direct investment screening regime is established by two principal instruments of German trade and payments law:
Primary Legislation — the Außenwirtschaftsgesetz ("AWG"). The AWG (the German Foreign Trade and Payments Act) provides the overarching statutory framework for the regulation of cross-border trade and payments, including the authority of the German federal government to review and, where necessary, restrict or prohibit foreign acquisitions of domestic companies where such acquisitions threaten Germany's public order or security (öffentliche Ordnung oder Sicherheit). Section 4(1) of the AWG authorizes the federal government to issue regulations restricting foreign trade and payments transactions to protect the essential security interests of the Federal Republic of Germany, to prevent disturbances to the peaceful coexistence of nations, or to prevent a substantial impairment of Germany's foreign relations. Section 5 of the AWG provides the specific legal basis for investment screening, authorizing the BMWK to examine and, if necessary, prohibit the acquisition of domestic companies by foreign investors.
Implementing Regulation — the Außenwirtschaftsverordnung ("AWV"). The AWV (the German Foreign Trade and Payments Regulation) implements the AWG's investment screening provisions in detail. The AWV specifies the types of transactions subject to screening, the applicable voting-rights thresholds, the sectors deemed sensitive, the procedural requirements for notifications and reviews, and the remedies available to the BMWK. The key operative provisions for purposes of this analysis are Sections 55 through 62 of the AWV.
Relevant Amendments. The German FDI screening regime has been subject to significant and frequent legislative amendments in recent years, reflecting a broader European trend toward more robust foreign investment controls:
(a) The 17th amendment to the AWV, which entered into force on May 1, 2021, substantially expanded the scope of cross-sectoral screening by broadening the list of sensitive sectors and lowering the applicable voting-rights thresholds. The 17th amendment, among other things, brought cloud computing service providers, artificial intelligence developers, and various other technology-related activities within the scope of cross-sectoral review for the first time;
(b) Subsequent amendments through 2023 have further refined the scope of sensitive sectors, adjusted procedural timelines, and aligned the AWV with the EU's Regulation (EU) 2019/452 establishing a framework for the screening of foreign direct investments into the Union (the "EU FDI Screening Regulation"). The EU FDI Screening Regulation does not impose a mandatory screening obligation on Member States but establishes a cooperation mechanism under which the European Commission and other Member States may provide comments on transactions notified to any single Member State; and
(c) Practitioners should note that the German government has signaled a continued willingness to further expand and tighten the FDI screening regime in response to geopolitical developments, and additional amendments may be forthcoming.
Competent Authority. The competent authority for German FDI screening is the Bundesministerium für Wirtschaft und Klimaschutz ("BMWK"), the Federal Ministry for Economic Affairs and Climate Action. Within the BMWK, investment screening is handled by Division VI B 3 (Investment Screening). The BMWK is responsible for initiating and conducting reviews, issuing clearance certificates and non-objection notices, negotiating mitigation agreements, and, in extreme cases, prohibiting transactions. In practice, the BMWK consults with other relevant federal ministries and agencies (including the Bundesministerium der Verteidigung, the Bundesamt für Sicherheit in der Informationstechnik, and the intelligence services) during the review process.
B. Types of Investment Screening
The AWV establishes two distinct investment screening tracks, each with its own scope, thresholds, and procedural characteristics:
1. Sector-Specific Screening (Section 60 AWV). The sector-specific screening track applies to acquisitions of German companies that operate in the defense and IT security sectors. This track applies to acquisitions by any non-German acquirer, including acquirers from other EU and EFTA Member States. A mandatory filing obligation is triggered when a non-German acquirer acquires 10% or more of the voting rights in a German target company operating in one of the following areas:
(a) Companies that manufacture or develop war weapons within the meaning of the Kriegswaffenkontrollgesetz (War Weapons Control Act) or defense goods listed in Part I, Section A of the Außenwirtschaftsliste (Foreign Trade List);
(b) Companies that develop or produce IT security products for the processing of classified government information (Verschlusssachen), including cryptographic systems, IT security components certified by the Bundesamt für Sicherheit in der Informationstechnik ("BSI"), and related products;
(c) Companies that hold or have held within the past five years classified government contracts or have been granted access to classified information of the German federal government or its agencies; and
(d) Companies that manufacture certain components specifically designed for the goods described in (a) above.
Sector-specific acquisitions are subject to a mandatory pre-closing notification obligation. The acquirer must notify the BMWK before completing the transaction, and closing may not occur until the BMWK has either issued a clearance certificate or the applicable review periods have expired without the BMWK opening a formal review.
2. Cross-Sectoral Screening (Section 55 AWV). The cross-sectoral screening track applies to acquisitions of German companies across a broader range of sensitive sectors, but only where the acquirer is a non-EU/non-EFTA investor. The cross-sectoral screening track was originally narrower in scope but was significantly expanded by the 17th amendment to the AWV (effective May 1, 2021) and subsequent amendments. Under the cross-sectoral track, the BMWK may review acquisitions where a non-EU/non-EFTA acquirer acquires voting rights in a German company exceeding the applicable threshold and the German company operates in a sensitive sector enumerated in the AWV. In contrast to the sector-specific track, the cross-sectoral track does not impose a mandatory filing obligation in all cases; rather, the BMWK has the authority to open a review ex officio, and acquirers may submit voluntary notifications to obtain legal certainty.
It is important to note, however, that for certain particularly sensitive sub-categories of cross-sectoral acquisitions — specifically, those involving German target companies that are operators of critical infrastructure within the meaning of the BSI-KritisV, or that fall within other specified high-sensitivity categories — a mandatory notification obligation applies. Where a mandatory notification obligation applies under the cross-sectoral track, closing may not occur prior to clearance (or expiry of the review periods) in the same manner as under the sector-specific track.
C. Triggering Thresholds
The applicable voting-rights thresholds under each screening track are as follows:
Sector-Specific (Section 60 AWV): A mandatory filing is triggered when a non-German acquirer acquires 10% or more of the voting rights in a German company operating in the defense or IT security sectors described above. This threshold was lowered from 25% to 10% by the 2020 amendments to the AWV. The 10% threshold captures not only direct acquisitions of shares but also indirect acquisitions (e.g., through the acquisition of a foreign parent company that holds a German subsidiary) and situations in which the acquirer obtains comparable influence over the German target through contractual or other arrangements.
Cross-Sectoral (Section 55 AWV): The applicable thresholds vary depending on the sensitivity of the sector in which the German target company operates:
(a) 25% of voting rights — the general threshold applicable to acquisitions by non-EU/non-EFTA acquirers of German companies operating in the broader list of sensitive sectors enumerated in the AWV;
(b) 20% of voting rights — the reduced threshold applicable to acquisitions of German companies operating in certain sensitive infrastructure sectors, including operators of critical infrastructure and certain telecom-related activities; and
(c) 10% of voting rights — the lowest threshold, applicable to acquisitions of German companies in specified highly sensitive sectors, including operators of critical infrastructure as defined in the BSI-KritisV, certain healthcare companies, certain media companies exceeding specified audience thresholds, and companies with access to classified government information.
Application to the Transaction. In the present Transaction, Fund VI — a United States-based limited partnership and thus a non-EU/non-EFTA acquirer — will indirectly acquire 100% of the shares and voting rights of Cloudium Solutions GmbH through its acquisition of Cloudium Technologies plc. The arithmetic voting-rights threshold is therefore clearly met at every level (10%, 20%, and 25%). However, the mere satisfaction of the voting-rights threshold is a necessary but not sufficient condition for the application of the AWV screening regime. The screening regime is triggered only where both the voting-rights threshold and the sector-based criteria are satisfied — i.e., the German target company must operate in a sector falling within the scope of either the sector-specific or cross-sectoral screening provisions. As analyzed in detail in Part IV below, Cloudium Solutions GmbH does not operate in any such sector, and accordingly no notification obligation arises notwithstanding the fact that 100% of its voting rights will change hands.
D. Sensitive Sectors Under Cross-Sectoral Screening (Section 55 AWV)
The cross-sectoral screening provisions of the AWV enumerate a detailed list of sensitive sectors and activities. The following is a summary of the key categories, reflecting the expanded scope introduced by the 17th amendment (May 2021) and subsequent amendments through the date of this memorandum:
(a) Critical infrastructure operators — entities that operate critical infrastructure in the sectors of energy, water, food, information technology and telecommunications, health, finance, and transport, as defined by the BSI-Kritisverordnung (BSI-KritisV) and meeting the applicable quantitative thresholds (Schwellenwerte) specified therein;
(b) Cloud computing service providers — entities that themselves provide cloud computing services in Germany, particularly those providing services to German government entities or operating at a scale that qualifies as critical infrastructure under the BSI-KritisV;
(c) Artificial intelligence — entities that develop or have developed artificial intelligence for specific sensitive applications, including AI used in the areas of cybersecurity, surveillance, autonomous weapon systems, and certain critical infrastructure applications;
(d) Telecommunications — entities that operate public telecommunications networks in Germany or provide publicly available telecommunications services, as well as manufacturers and developers of telecommunications network equipment and components;
(e) Media companies — entities that publish or broadcast editorial content and reach a significant audience in Germany, subject to specified quantitative thresholds;
(f) Developers of software for critical infrastructure — entities that develop software specifically designed for the operation of facilities or systems constituting critical infrastructure within the meaning of the BSI-KritisV;
(g) Operators of high-value data processing facilities — entities that operate data centers or data processing facilities in Germany exceeding specified capacity or significance thresholds;
(h) Semiconductor and IT security companies — entities that design, manufacture, or develop semiconductors, semiconductor equipment, or IT security products, components, or systems;
(i) Companies with access to classified government information — entities that hold or have held classified government contracts (Verschlusssachen) or that have been granted access to classified information by German federal or state authorities;
(j) Defense and dual-use goods — entities that manufacture, develop, or trade in defense goods or dual-use items subject to export controls under the Außenwirtschaftsliste or the EU Dual-Use Regulation;
(k) Healthcare and pharmaceutical companies — entities that develop, manufacture, or distribute pharmaceuticals, vaccines, medical devices, personal protective equipment, or diagnostic products of certain categories and scale;
(l) Agricultural and food supply companies — entities that operate in the agricultural or food supply chain at a scale sufficient to be relevant to Germany's food security; and
(m) Other specified categories — including entities providing telematics infrastructure services, entities providing personal data processing services to German government authorities at scale, and other categories added by subsequent amendments.
This list is not exhaustive, and the AWV provisions are drafted in a manner that provides the BMWK with a degree of interpretive latitude. However, for the reasons set forth in Part IV below, Cloudium Solutions GmbH does not fall within any of the above categories.
IV. Application of the AWV Screening Regime to Cloudium Solutions GmbH
In this Part IV, we systematically analyze each of the relevant screening categories under both the sector-specific and cross-sectoral tracks to determine whether Cloudium Solutions GmbH's activities bring it within the scope of the AWV screening regime. For each category, we set forth the applicable legal standard, the relevant facts regarding Cloudium Germany's operations, and our conclusion.
A. Sector-Specific Screening (Section 60 AWV) — Defense and IT Security
1. Defense Goods
Legal Standard. Section 60 AWV requires a mandatory notification where a non-German acquirer acquires 10% or more of the voting rights in a German company that manufactures, develops, or modifies war weapons within the meaning of the Kriegswaffenkontrollgesetz (KrWaffKontrG) or defense goods listed in Part I, Section A of the Außenwirtschaftsliste (AL). This category encompasses manufacturers of military equipment, weapon systems, ammunition, military vehicles, and other items listed in the German War Weapons List (Kriegswaffenliste) or the defense portion of the Foreign Trade List.
Application to Cloudium Germany. Cloudium Solutions GmbH does not manufacture, develop, modify, or trade in war weapons, defense goods, military equipment, or any items listed in the Kriegswaffenliste or the Außenwirtschaftsliste. Cloudium Germany is a sales and customer-success office for commercial enterprise SaaS products (ERP, CRM, and BI solutions). Its business is entirely commercial in nature and has no connection to the defense sector. No materials reviewed in the virtual data room suggest any defense-related activities, and management has confirmed the absence of any defense activities in representations provided by target's counsel, Ridgeway Phelps & Sato LLP, dated October 14, 2023.
Conclusion: Section 60 AWV, as applied to defense goods, is not triggered.
2. IT Security Products
Legal Standard. Section 60 AWV also captures German companies that develop or produce IT security products, including: (i) cryptographic systems and components designed for the protection of classified government information; (ii) IT components certified by the BSI for the processing of classified information; and (iii) products and systems specifically designed to protect information systems against unauthorized access or interference. The focus of this provision is on companies that develop the underlying IT security technology, not on end users or resellers of commercially available security features.
Application to Cloudium Germany. Cloudium Solutions GmbH does not develop, produce, or modify IT security products, cryptographic systems, or IT components designed for the processing of classified information. Cloudium Germany's activities are exclusively focused on DACH-region sales, customer success, and account management for Cloudium's commercial SaaS offerings.
We note that Cloudium's parent company, Cloudium Technologies plc, operates a SaaS platform that incorporates standard commercial-grade encryption and security features (e.g., TLS/SSL encryption in transit, AES-256 encryption at rest, role-based access controls, and SOC 2 Type II certified operational controls). These are standard security features present in virtually all enterprise SaaS products and do not constitute "IT security products" within the meaning of Section 60 AWV, which is directed at companies whose core business involves the development of specialized security products for classified information processing. Moreover, and dispositively, the German subsidiary itself does not develop the platform software or its security features. Platform development occurs primarily at Cloudium's US headquarters in San Francisco and its India development center (Cloudium Technologies India Pvt. Ltd., Bangalore). Cloudium Germany is a downstream commercial entity with no engineering or product development function.
Conclusion: Section 60 AWV, as applied to IT security products, is not triggered.
3. Classified Government Contracts
Legal Standard. Section 60 AWV further applies to German companies that hold or have held within the past five years classified government contracts (Verschlusssachenaufträge) or that have been granted access to classified information (Verschlusssachen) by German federal or state authorities. Classified information in the German system is categorized into four levels: VS-NUR FÜR DEN DIENSTGEBRAUCH (restricted), VS-VERTRAULICH (confidential), GEHEIM (secret), and STRENG GEHEIM (top secret). Any access to classified information at any level triggers this provision.
Application to Cloudium Germany. Based on our review of the due diligence materials, including the virtual data room materials accessed since September 18, 2023, as well as specific inquiries made to target's counsel and management, there is no indication that Cloudium Solutions GmbH holds or has held any classified German government contracts. Cloudium Germany has not been granted facility security clearance (Geheimschutzbetreuung) by the BMWK or any other German authority, and it does not have access to classified information at any classification level. Cloudium Germany's government-sector customer base in the DACH region consists of commercial contracts with public-sector entities (e.g., municipalities and state-owned enterprises) for Cloudium's standard commercial SaaS products, none of which involve access to classified information.
Conclusion: Section 60 AWV, as applied to classified government contracts, is not triggered.
4. Overall Sector-Specific Screening Conclusion
Based on the foregoing analysis, none of the sector-specific screening provisions of Section 60 AWV are triggered by the indirect acquisition of Cloudium Solutions GmbH. No mandatory notification under the sector-specific track is required.
B. Cross-Sectoral Screening (Section 55 AWV) — Sensitive Sectors Analysis
We now turn to the cross-sectoral screening provisions of Section 55 AWV, which apply to acquisitions by non-EU/non-EFTA acquirers of German companies operating in the enumerated sensitive sectors. As noted above, Fund VI is a non-EU/non-EFTA acquirer (domiciled in the United States), and the Transaction would result in the indirect acquisition of 100% of Cloudium Germany's voting rights, which exceeds all applicable thresholds (10%, 20%, and 25%). The determinative question is therefore whether Cloudium Solutions GmbH operates in any of the sensitive sectors enumerated in Section 55 AWV. We address each relevant category below.
1. Critical Infrastructure Operator
Legal Standard. The AWV subjects to screening acquisitions of German companies that are operators of critical infrastructure within the meaning of the BSI-Kritisverordnung (BSI-KritisV). The BSI-KritisV defines critical infrastructure by reference to specific sectors — energy, water, food, information technology and telecommunications, health, finance, and transport — and specifies quantitative thresholds that determine whether a particular facility or system within each sector qualifies as critical infrastructure. An entity is a "critical infrastructure operator" only if it actually operates facilities or systems meeting these sector-specific definitions and thresholds.
Application to Cloudium Germany. Cloudium Solutions GmbH does not operate critical infrastructure in Germany within the meaning of the BSI-KritisV or any related legislative or regulatory framework. It does not operate energy generation or distribution facilities, water treatment or supply systems, food production or distribution facilities, information technology or telecommunications infrastructure, healthcare facilities, financial market infrastructure, or transportation systems. Cloudium Germany is a commercial sales and customer-success office with approximately 400 employees. Its function is to facilitate the sale and post-sale support of Cloudium's SaaS products to customers in the DACH region. It does not operate any infrastructure, physical or digital, that would fall within the BSI-KritisV definitions.
Conclusion: Not triggered.
2. Cloud Computing Services
Legal Standard. The 17th amendment to the AWV (effective May 1, 2021) added cloud computing service providers to the list of sensitive sectors subject to cross-sectoral screening. This provision targets entities that themselves operate cloud computing infrastructure or provide cloud computing services in Germany. The provision is particularly focused on cloud computing providers that serve German government entities or that operate at a scale sufficient to qualify as critical infrastructure under the BSI-KritisV. The BMWK has indicated in its guidance materials that the provision is directed at entities whose core operational function involves the provision of cloud computing infrastructure or platform services, such as infrastructure-as-a-service ("IaaS"), platform-as-a-service ("PaaS"), or, in certain cases, software-as-a-service ("SaaS") delivered from cloud infrastructure operated by the entity in Germany.
Application to Cloudium Germany. Cloudium Solutions GmbH is a sales and customer-success entity. It does not operate cloud computing infrastructure, data centers, or hosting services in Germany or elsewhere. The cloud computing infrastructure underlying Cloudium's SaaS platform is operated by Cloudium Technologies plc (the parent company) and is hosted on third-party public cloud infrastructure provided by major hyperscale cloud providers. Cloudium Germany does not provision, manage, or control any cloud infrastructure. Its role is limited to commercial activities — sales, marketing, account management, and customer success — in support of Cloudium's SaaS products.
We acknowledge that Cloudium's parent company operates a SaaS platform that serves, among others, German customers, and that there exists an analytical question as to whether the parent's SaaS activities could, in certain circumstances, be attributed to the German subsidiary. However, we conclude that this attribution is not appropriate under the AWV framework for the following reasons:
(a) The relevant inquiry under the AWV is whether the German entity being indirectly acquired — i.e., Cloudium Solutions GmbH — itself operates in the sensitive sector. The AWV screening regime is entity-focused, and the activities of the parent company are relevant only to the extent they are conducted through or by the German subsidiary;
(b) Cloudium Germany does not itself provide cloud computing services. It facilitates sales and provides customer support, but customer contracts for SaaS subscriptions are entered into with Cloudium Technologies plc or Cloudium Technologies UK Ltd., not with Cloudium Germany. Cloudium Germany earns intercompany commissions and service fees, not subscription revenues;
(c) Cloudium Germany does not operate any servers, data centers, or cloud infrastructure in Germany. The platform is hosted on third-party infrastructure located in multiple regions globally; and
(d) The BMWK's guidance and enforcement practice focus on entities that actually operate cloud infrastructure, not on sales affiliates of foreign cloud or SaaS providers.
Conclusion: Not triggered.
3. Software for Critical Infrastructure
Legal Standard. The AWV covers entities that develop software specifically designed for the operation of facilities or systems constituting critical infrastructure within the meaning of the BSI-KritisV. This provision targets developers of operational technology (OT) software, supervisory control and data acquisition (SCADA) systems, industrial control systems (ICS), and other software whose primary function is to operate critical infrastructure.
Application to Cloudium Germany. Cloudium's ERP, CRM, and BI products are general-purpose enterprise software solutions used by customers across a wide range of industries. They are not specifically designed for the operation of critical infrastructure sectors. Cloudium's SaaS platform is used by customers in sectors including technology, financial services, manufacturing, retail, and professional services, among others. While it is possible that some Cloudium customers may themselves be critical infrastructure operators, Cloudium's products are not designed to operate critical infrastructure — they are back-office enterprise applications (resource planning, customer management, business analytics) rather than operational control systems.
Moreover, and dispositively, Cloudium Solutions GmbH does not develop software at all. It is a sales and customer-success entity. Software development occurs at Cloudium's US and India operations.
Conclusion: Not triggered.
4. Telecommunications. Legal Standard. The AWV covers entities that operate public telecommunications networks in Germany, provide publicly available telecommunications services, or manufacture and develop telecommunications network equipment and components. This provision is directed at traditional telecommunications operators (e.g., fixed-line and mobile network operators), telecommunications service providers, and manufacturers of critical network components (e.g., routers, switches, base stations, and core network equipment).
Application to Cloudium Germany. Cloudium Solutions GmbH does not operate any telecommunications networks, does not provide telecommunications services, and does not manufacture or develop telecommunications equipment. Cloudium Germany's business is entirely unrelated to the telecommunications sector.
Conclusion: Not triggered.
5. Artificial intelligence
Legal Standard. The AWV covers entities that develop or have developed artificial intelligence for specified sensitive applications, including AI systems used for cybersecurity purposes, surveillance, autonomous systems with potential military applications, and AI for the operation of critical infrastructure.
Application to Cloudium Germany. Cloudium Solutions GmbH does not develop artificial intelligence. Cloudium Germany does not maintain any engineering, R&D, or data science teams. While Cloudium's parent company's SaaS platform may incorporate machine learning features for purposes such as predictive analytics, automated reporting, and business-intelligence insights, these are standard commercial AI/ML features embedded in general-purpose enterprise software and are not developed by the German subsidiary. Even at the parent level, Cloudium's AI capabilities do not fall within the specified sensitive applications (cybersecurity, surveillance, autonomous weapon systems, or critical infrastructure operation) targeted by the AWV provision.
Conclusion: Not triggered.
6. Data Processing / High-Value Data
Legal Standard. The AWV covers operators of data processing facilities (Rechenzentren) in Germany that exceed specified capacity or significance thresholds, as well as entities that process large volumes of personal data or other high-value data in Germany. This provision is directed at companies that operate physical or virtual data center infrastructure in Germany at a significant scale.
Application to Cloudium Germany. Cloudium Solutions GmbH does not operate data centers, server farms, or data processing facilities of any kind in Germany. As noted above, Cloudium's SaaS platform is hosted on third-party public cloud infrastructure, and Cloudium Germany's office premises in Berlin are used exclusively for commercial activities (sales, customer success, and administrative functions). Cloudium Germany does not process customer data; data processing is performed by the parent company's platform infrastructure located outside Germany.
Conclusion: Not triggered.
7. Semiconductor / IT Components
Legal Standard. The AWV covers entities that design, manufacture, or develop semiconductors, semiconductor manufacturing equipment, or IT hardware components of specified categories. This provision was expanded in recent amendments to reflect the strategic importance of the semiconductor supply chain.
Application to Cloudium Germany. Cloudium Solutions GmbH is a software sales entity and does not design, manufacture, process, or distribute semiconductors, semiconductor equipment, or IT hardware components of any kind. Cloudium's entire business is software-based, and the German subsidiary's activities are limited to commercial sales and customer success functions.
Conclusion: Not triggered.
8. Media. Legal Standard. The AWV covers media companies that publish or broadcast editorial content to audiences in Germany, subject to specified quantitative audience thresholds. This provision reflects Germany's interest in protecting media plurality and preventing foreign influence over the domestic information environment.
Application to Cloudium Germany. Cloudium Solutions GmbH is not a media company. It does not publish, broadcast, or distribute editorial content. Its business is the sale and support of enterprise SaaS products. This category is plainly inapplicable.
Conclusion: Not triggered.
9. Healthcare / Pharmaceuticals / Food Supply / Agriculture
Legal Standard. The AWV covers entities that develop, manufacture, or distribute pharmaceuticals, vaccines, medical devices, personal protective equipment, or diagnostic products of certain categories and significance. It also covers entities operating in the agricultural or food supply chain at a scale relevant to Germany's food security. These provisions were added or expanded in response to the COVID-19 pandemic and concerns about the resilience of critical supply chains.
Application to Cloudium Germany. Cloudium Solutions GmbH is a SaaS company sales subsidiary. It does not develop, manufacture, or distribute pharmaceuticals, vaccines, medical devices, PPE, or diagnostic products. It does not operate in the agricultural or food supply sectors. This category is inapplicable.
Conclusion: Not triggered.
10. Government Contracts and Classified Information Access
Legal Standard. Under the cross-sectoral screening provisions, as under the sector-specific provisions, companies that hold classified government contracts or that have access to classified information are subject to screening. This cross-sectoral provision extends the scope beyond the defense and IT security contexts covered by Section 60, capturing any German entity with access to classified information regardless of the sector in which it operates.
Application to Cloudium Germany. As analyzed above in Section IV.A.3, our due diligence review has identified no evidence that Cloudium Solutions GmbH holds any classified German government contracts or has been granted access to classified information at any level. For completeness, we note that there is no evidence that Cloudium Germany has contracts with the Bundeswehr (German armed forces), the Bundesnachrichtendienst ("BND," the German foreign intelligence service), the Bundesamt für Sicherheit in der Informationstechnik ("BSI," the Federal Office for Information Security), or any other German government ministry, agency, or authority that would involve classified information or bring Cloudium Germany within the scope of this cross-sectoral provision. Cloudium Germany's public-sector customer relationships in the DACH region are limited to commercial contracts for standard SaaS products with non-classified public-sector entities.
Conclusion: Not triggered.
11. Overall Cross-Sectoral Screening Conclusion
Based on the foregoing sector-by-sector analysis, none of the cross-sectoral screening provisions of Section 55 AWV are triggered by the indirect acquisition of Cloudium Solutions GmbH. Cloudium Germany does not operate in any of the sensitive sectors enumerated in the AWV. No mandatory or conditionally mandatory notification under the cross-sectoral track is required.
V. Analysis of Whether a Voluntary Filing Is Advisable
Even in circumstances where no mandatory filing obligation exists, the AWV provides the BMWK with the authority to open an ex officio review (Prüfverfahren von Amts wegen) of any cross-sectoral acquisition by a non-EU/non-EFTA acquirer within a period of five years following closing, provided that the applicable voting-rights threshold is met. This ex officio review authority represents a residual risk for acquirers who do not file voluntarily, because the BMWK could, in principle, examine the transaction at any point within the five-year post-closing window and, in a worst-case scenario, could order the unwinding of the acquisition if it determines that the transaction poses a threat to public order or security.
Against this backdrop, acquirers in cross-sectoral transactions sometimes elect to submit a voluntary notification (Antrag auf Unbedenklichkeitsbescheinigung) to the BMWK in order to obtain a clearance certificate (Unbedenklichkeitsbescheinigung) or, if the BMWK declines to open a review, a deemed clearance upon expiry of the applicable review periods. A clearance certificate provides definitive legal certainty that the transaction has been reviewed and approved by the BMWK, thereby eliminating the residual risk of a post-closing ex officio review.
We have considered whether a voluntary filing is advisable in the present case and have assessed the following factors:
Risk of Ex Officio Review. We assess the risk that the BMWK would open an ex officio review of the Transaction as very low — effectively negligible. Cloudium Solutions GmbH does not operate in any identified sensitive sector. It is a commercial sales and customer-success subsidiary with approximately 400 employees, engaged exclusively in DACH-region sales and account management for general-purpose enterprise SaaS products. There is no national security, public order, or critical infrastructure nexus that would prompt BMWK attention. The BMWK's resources for ex officio reviews are limited, and the Ministry focuses its enforcement efforts on transactions involving clearly sensitive sectors — defense, telecommunications, critical infrastructure, and other areas of strategic importance. A routine acquisition of a SaaS sales subsidiary with no sensitive-sector activities is exceedingly unlikely to attract BMWK attention.
We are not aware of any public statements, enforcement actions, or policy signals from the BMWK suggesting that acquisitions of commercial SaaS sales subsidiaries would be considered for ex officio review. Nor are we aware of any media coverage or political attention related to the Transaction that might elevate the BMWK's interest.
Cost-Benefit Analysis of Voluntary Filing. A voluntary filing would require the preparation and submission of a detailed notification package, including information about the acquirer, the target, the German subsidiary, the transaction structure, and the relevant business activities. Based on our experience, the BMWK's processing time for voluntary cross-sectoral notifications is typically two to four months, though timelines can vary depending on the BMWK's caseload and whether the Ministry refers the case for inter-ministerial consultation or engages the EU cooperation mechanism under Regulation (EU) 2019/452. This processing time would need to be factored into the Transaction timeline, potentially delaying closing.
The costs associated with a voluntary filing include: (i) external counsel fees for preparation of the notification and engagement with the BMWK (estimated at €25,000–€50,000 based on our experience with comparable filings); (ii) internal management time and resources to compile the required information; and (iii) the opportunity cost of the additional delay to closing.
Recommendation. Given that Cloudium Solutions GmbH clearly does not fall within any sensitive sector and the risk of an ex officio review is negligible, we do not recommend a voluntary filing. The cost and delay associated with a voluntary notification are not warranted under the circumstances. The parties should proceed with the Transaction without a German FDI filing.
We note, however, that if the deal team has any residual concerns about the risk of an ex officio review — for example, if there are aspects of Cloudium Germany's operations or customer relationships not captured in the due diligence materials reviewed to date — we are available to discuss further. We also note that if Cloudium Germany's business activities were to change materially between now and closing (see Part VII below), the voluntary filing calculus could change, and we would reassess our recommendation at that time.
VI. Interaction with Other Regulatory Filings
The Transaction gives rise to multiple regulatory filing obligations and considerations across multiple jurisdictions. This memorandum addresses solely the German FDI screening analysis under the AWG/AWV. For completeness and to ensure coordination among the various workstreams, we summarize below the other regulatory filings and analyses being conducted in connection with the Transaction:
United States — Hart-Scott-Rodino Antitrust Improvements Act ("HSR Act"). The Transaction exceeds the applicable HSR filing thresholds and will require a pre-merger notification filing with the Federal Trade Commission and the Department of Justice Antitrust Division. The HSR filing is planned for February 9, 2024. A separate HSR pre-filing memorandum is being prepared by this team and is forthcoming.
United Kingdom — Competition and Markets Authority ("CMA"). The Transaction may be subject to review by the UK CMA under the Enterprise Act 2002, given Cloudium's UK incorporation and the significant UK operations of Cloudium Technologies UK Ltd. (approximately 1,200 employees). A merger notice to the CMA is planned for February 2024, and the case has been assigned reference number ME/7184/24. The CMA analysis is being coordinated by Elaine Forsythe (Specialist Partner, Antitrust & Competition, Calderwood & Harkness LLP) in conjunction with Fiona McAllister (Partner, Albright & Kerr LLP, 5 New Street Square, London EC4A 3TW), who is serving as UK antitrust counsel.
European Union — EU Merger Regulation. A separate Calderwood & Harkness memorandum dated December 3, 2023, analyzed whether the Transaction meets the turnover thresholds for a mandatory notification under Council Regulation (EC) No 139/2004 (the "EU Merger Regulation"). That analysis concluded that the EU turnover thresholds are not met and no EU merger filing is required. The Transaction does not have a Community dimension within the meaning of Article 1 of the EU Merger Regulation.
European Union — Foreign Subsidies Regulation ("FSR"). A separate Calderwood & Harkness memorandum dated December 3, 2023, analyzed whether the Transaction triggers a notification obligation under Regulation (EU) 2022/2560 on foreign subsidies distorting the internal market (the "FSR"), which became applicable on October 12, 2023. That analysis concluded that the FSR notification thresholds are not triggered.
India — Competition Commission of India ("CCI") and FDI Approval. A separate Calderwood & Harkness memorandum dated December 10, 2023, analyzed the Indian regulatory implications of the Transaction, including whether a CCI merger notification is required and whether prior FDI approval is needed for the downstream change of control of Cloudium Technologies India Pvt. Ltd. (Bangalore). That analysis concluded that no CCI filing is required (the applicable turnover and asset thresholds under the Competition Act, 2002, are not met in India) and no FDI approval is required (the transaction involves the acquisition of shares in a foreign company, and the Indian subsidiary's sector — IT/software services — is on the automatic route for 100% FDI).
United States — Committee on Foreign Investment in the United States ("CFIUS"). A separate Calderwood & Harkness memorandum dated November 30, 2023, analyzed whether a voluntary CFIUS notice is recommended in connection with the Transaction. That analysis concluded that a voluntary CFIUS notice is not recommended, given that (i) the Transaction does not involve a foreign acquirer (Fund VI is a US-domiciled entity), (ii) the Transaction does not involve the acquisition of a TID US business by a foreign person, and (iii) the Transaction does not otherwise present a national security nexus that would warrant a voluntary CFIUS filing.
German FDI — AWG/AWV. This memorandum constitutes the analysis for the German FDI screening workstream, and our conclusion, as set forth herein, is that no mandatory or voluntary German FDI filing is required.
The foregoing regulatory workstreams are being coordinated by the deal team under the supervision of Harrison Wexford (Responsible Partner, M&A) and Elaine Forsythe (Specialist Partner, Antitrust & Competition). A consolidated regulatory conditions table and timeline is being maintained by Tiffany Rosenthal (Lead Associate, M&A) and will be circulated to the broader deal team on a bi-weekly basis.
VII. Conclusion and Recommendation
Based on the foregoing analysis, we reach the following conclusions:
1. No mandatory notification under either the sector-specific screening provisions (Section 60 AWV) or the cross-sectoral screening provisions (Section 55 AWV) of the German FDI screening regime is triggered by the indirect acquisition of Cloudium Solutions GmbH resulting from the Transaction. Cloudium Germany does not operate in any sector classified as sensitive under the AWV, does not develop or manufacture defense goods or IT security products, does not operate critical infrastructure, does not hold classified German government contracts, does not provide cloud computing services, and does not engage in any other activity that would bring it within the scope of the screening regime.
2. No voluntary filing with the BMWK is recommended. The risk of an ex officio review by the BMWK is negligible given Cloudium Germany's profile as a commercial sales and customer-success subsidiary with no sensitive-sector activities. The cost and delay of a voluntary filing (estimated at two to four months of processing time and €25,000–€50,000 in preparation costs) are not warranted.
3. The parties may proceed with the Transaction without a German FDI filing. The absence of a German FDI filing requirement should be reflected in the regulatory conditions provisions of the merger agreement, and the German FDI workstream should be marked as complete in the deal team's regulatory tracker.
4. Monitoring and Reassessment. If the business activities of Cloudium Solutions GmbH change materially prior to signing or closing — for example, if Cloudium Germany enters into contracts with the Bundeswehr, BND, BSI, or other security-sensitive German government agencies; begins developing IT security products or AI capabilities; commences the operation of data centers or cloud infrastructure in Germany; or otherwise expands into activities that fall within the scope of the AWV's sensitive-sector provisions — this analysis should be promptly revisited and, if warranted, an amended recommendation should be issued. We recommend that the deal team include appropriate representations regarding Cloudium Germany's business activities in the merger agreement's interim operating covenants to ensure that no material changes occur between signing and closing that could alter the German FDI analysis.
VIII. Limitations and Qualifications
This memorandum is subject to the following limitations and qualifications:
1. Currency of Legal Analysis. This memorandum is based on the AWG and AWV as in effect as of December 8, 2023, as well as applicable guidance materials and enforcement practice of the BMWK as of the same date. The German FDI screening regime has been subject to frequent and significant legislative amendments in recent years, and additional amendments may be adopted prior to the anticipated closing of the Transaction in mid-2024. We recommend that the deal team monitor developments in the German FDI regime on an ongoing basis between now and closing, and we are available to update this analysis if any relevant amendments are adopted. In particular, the German government has indicated that it may consider further expanding the list of sensitive sectors and lowering applicable thresholds, and any such changes could potentially affect the analysis set forth herein.
2. Factual Basis. Our analysis is based on the due diligence materials reviewed through the date hereof, including the virtual data room materials accessible via Thackeray Solutions (Project Stratos data room, opened September 18, 2023), management presentations, and information provided by Ridgeway Phelps & Sato LLP (target's counsel). The lead contacts at Ridgeway Phelps & Sato LLP are Catherine Answorth (Lead Partner, 375 Park Avenue, New York, NY 10152) and Alistair Fenn (Lead UK Partner, 1 Angel Court, London EC2R 7HJ). We have relied on management representations regarding the a