Economic Security and the Financial Sector: Italian FDI Legislation Reformed to Cope with the EU Commission Infringement Procedure

By Andrea Gemmi and Linda Lorenzon

Introduction

The opening of infringement procedure INFR(2025)2152 concerning Italy's FDI screening legislation (so-called “golden power” legislation) —following its application to the UniCredit/Banco BPM transaction—has brought to the surface unresolved tensions between national FDI controls and EU competences in banking supervision, prudential regulation, and free movement of capital.

The European Commission’s challenge appears related to how the golden power legislation operates in sectors already subject to dense EU regulation. In response, Italy’s January 2026 reform seeks to realign the golden power framework by clarifying its residual nature in the financial sector and by introducing procedural coordination with EU authorities, notably delaying FDI screening until ECB or Commission procedures are completed.

This post examines the source of the infringement procedure, and whether Italy's recent amendments genuinely address the concerns underlying the infringement procedure—or whether they merely manage procedural overlap while leaving unresolved the substantive issue of how far “economic and financial security” may extend without encroaching on EU‑level regulatory competences.

Overview of infringement procedures against Italian FDI set-up

Italy’s trajectory from the “golden share” legislation to the current FDI screening legislation has been shaped by successive EU infringement proceedings and jurisprudence from the Court of Justice of the European Union (‘CJEU’), insisting on clear aims and precise, publicly available, criteria for any derogation from the freedoms of establishment and capital.

Under CJEU jurisprudence national laws are required to set objective and controllable conditions for the exercise of investment screening powers, including cases in which national legislations merely indicate generic reasons of national interest or in cases the list of criteria for the screening of FDI was not exhaustive and precise (Commission v. Portugal, 2010; Commission v. Greece, 2012). This is because, under the CJEU’s case law on national golden share regimes, the notion of “public order and security” in Article 65(1)(b) of the Treaty on the Functioning of the European Union (‘TFEU’) does not correspond to a predetermined list of legitimate objectives. Instead, it sets only the outer bounds—namely, the exclusion of purely economic interests—of a broader concept (“essential interests”) whose concrete definition is left to the Member States. Indeed, the Court has repeatedly affirmed that Member States remain essentially free to determine, in line with their national needs, the specific requirements of public order and public security.

The Commission first challenged the Italian golden share framework in 1994, resulting in the CJEU ruling of 23 May 2000 (C-58/99). In the ruling, the CJEU argued that the Italian regulation provided for excessive discretionary power not based on clear and predictable criteria. Italy subsequently amended the legislation, providing criteria for the exercise of special powers. The new list of criteria was non-exhaustive, and included a broad reference to imperative grounds of public interest, related to public order, public safety, public health, and defense.

In 2003, the Commission sent another letter of formal notice for infringement of EU principles, this time for violation of the proportionality principle, after which Italy reformed its legislation once more. Specifically, the newly revised list of criteria sought to take account of the CJEU’s case law by framing the screening criteria as “serious and genuine threats” to public order and security. Nevertheless, the criteria remained inherently vague.

In its judgment of 26 March 2009 (Case C-326/07), the CJEU once again challenged the Italian screening legislation, referencing the inadequacy and indeterminacy of the operative criteria governing the exercise of the powers at issue. The Court pointed out that “although the criteria in question concern various types of general interests, they are formulated in a generic and imprecise manner”. To comply with this ruling and to avoid further reproaches by the CJEU under the infringement procedure no. 2255 of 2009, the Italian legislator replaced the entirety of the golden‑share architecture with the 2012 “golden power” legislation (Decree‑Law No. 21/2012), which included a closed list of specific criteria for the exercise of the special powers[1].

However, in 2017, against the backdrop of heightened geopolitical concerns, Italy revisited that list by introducing a residual ground for the exercise of special powers in all further sectors that fell outside of the defense and national security scope, that were broadly defined as situations posing a “threat to security or public order” (Art. 2(7)(b-bis), as introduced by Decree-Law No. 148/2017, converted into Law No. 172/2017).

It may be argued that the 2017 reopening of the screening legislation through the inclusion of a residual “security/public order” clause resurrected problems of vagueness and overreach of the golden power regime, and therefore of compliance with CJEU case law. However, no infringement procedure was initiated by the European Commission, that is, until recently.

Banking and finance steps into the Security Arena

For years, the EU’s doctrine of non-economic considerations in FDI screening set a boundary: Member States could restrict investments only to protect essential public interests—not to pursue economic goals like competitiveness or financial stability. The CJEU reinforced this principle in cases such as the Commission v. Spain (C‑463/00), where the Court considered the interest in commercial banking activity as falling outside the scope of “public order and security”. That framework is now under pressure.

Geopolitical tensions and systemic risks have pushed the EU to rethink its approach to investment screening, which is evidenced by Regulation (EU) 2019/452 on the establishment of a framework on the screening of Foreign Direct Investment. While designed as a coordination tool, the Regulation signaled a shift in its reference to “financial infrastructure” among sensitive sectors that member states could consider screening in. Italy followed suit by expanding its golden power regime—which had initially applied only to defense, energy, transport, and telecommunications—to include the banking and insurance sectors in 2020, first as part of a Covid-related temporary regime, and which subsequently became permanent in 2022.

Italian FDI rules, before the most recent reforms, clearly outlined that special powers could only be exercised when the essential interests at stake are not already safeguarded by existing sector-specific regulations. In other words, only transactions presenting exceptional situations not covered by national or European sectoral rules could be subject to a veto or conditions. Under such rules the golden powers could not be applied when the same interests are already protected by another competent authority, such as banking regulators.

UniCredit/Banco BPM case; economic security

 On 21 November 2025, the EU Commission sent a formal letter to Italy pursuant to the infringement procedure (INFR(2025)2152) for “failing to comply with the Single Supervisory Mechanism Regulation (Council Regulation (EU) No 1024/2013), with the Capital Requirements Directive (Directive 2013/36/EU), as well as Articles 49 and 63 of the TFEU (free movement of capitals and services). This recent notice concerning the application of FDI screening legislation in the banking sector follows a highly debated case where special powers were exercised over a public takeover bid involving two major Italian commercial banks —the UniCredit/BPM case.

The case concerns the public exchange offer of 25 November 2024 from UniCredit on Banco BPM’s shares. The regulatory market authority (CONSOB) approved the voluntary public exchange offer (Offerta Pubblica di Scambio), and the European Commission approved the transaction under merger control regulation. However, by Prime Minister’s decree of 18 April 2025, the Italian FDI competent authority exercised its special powers by imposing certain obligations on UniCredit. Notably, the FDI authority highlighted the following risks for national security and mitigating measures:

1. given UniCredit’s “transnational” shareholding and activities, the FDI authority supported the need to “ensure the overall stability of the group’s lending by avoiding possible trade-offs between the credit policies of the two banks”[2]. Therefore, the FDI authority forbid reducing the loan-to-deposit ratio applied by Banco BPM S.p.A. and UniCredit S.p.A. for 5 years. It also imposed not to reduce the current project finance portfolio of Banco BPM S.p.A. and UniCredit S.p.A. in Italy.
2. as regards the asset management activity, carried out by Anima Holding S.p.A. (which belongs to the BPM group and manages over 200 billion euro of national savings), the Authority considered it “necessary to safeguard the maintenance of the current weight of Anima Holding S.p.A.‘s investments in Italian issuers’ securities.” Therefore, the authority required Anima Holding S.p.A., for a period of at least five years, to not reduce the current weight of its investments in Italian issuers’ securities.
3. concerning Unicredit presence in Russia, the conditions imposed on the merger were designed to avert the slightest risk that the savings collected by Banco BPM S.p.A. in Russia would be involved in transactions benefiting the Russian economic and financial system. In short, despite UniCredit’s compliance with the decision of the European Central Bank of 22 April 2024 establishing prudential requirements to reduce risks connected with the conduct of business of UniCredit in Russia, the Italian screening authority deployed its golden powers to require UniCredit to cease all activities in Russia within nine months.

UniCredit challenged the decision, stating -among others- that the conditions were grounded solely on economic reasons, and it encroached on the European Commission’s exclusive competency in merger control. The judge rejected these claims and upheld the petition only with regard to the wording of certain conditions and their deadlines.

The Italian court ruled that the FDI golden power framework is a special regime which, despite not possessing as core objective the regulation of economic dynamics, operates alongside independent economic authorities and concepts of “national security” and “public security” also encompass “economic security”. In particular, according to the judge, objectives such as ensuring the stability of the “national economic public order,” protecting “the interests of […] savers”, safeguarding “national savings,” and maintaining “credit flows to sectors and/or customer bases deemed […] relevant, such as SMEs and households”, are legitimate and not merely economic in nature. The judge further stated that the FDI authority assesses the characteristics of the transaction “within the framework and context of the general goals of national policy.” Therefore, “preserving the current credit volumes allocated by BPM to households and SMEs constitutes […] a measure fully consistent with economic and financial policy objectives”, and “maintaining the weight of investments in securities issued by Italian entities and the obligation to support corporate development likewise aim to ensure that managed savings continue to benefit the national economy”.

In short, the Italian court ruled that the FDI authority can lawfully intervene in a transaction to preserve credit flows and support Italian investments as part of national policy objectives considering that “the obligation to support corporate development likewise aims to ensure that managed savings continue to benefit the national economy”.

The ruling sets the precedent for wide intervention of the State in the banking sector, by extending the concept of public security (through that of economic security) to the protection of savings, thus making the “stability of the financial group” (including the loan-to-deposit ratio) a matter of national security.

Following the dispute, UniCredit withdrew its takeover bid, concluding that the conditions imposed could not be met. However, the Italian court ruling is currently under appeal, and it therefore remains to be seen whether the Council of State as the court of last appeal will adopt a less deferential approach than the court of first instance, as was the case last month with Cedacri.

Italian last reform on Golden Power regime

Italian Government Law No. 4 of 15 January 2026 (published in the Official Gazette and entered into force as of 20 January 2026), introduced sensitive amendments to its FDI screening legislation.

The amendments modify Article 2 of Decree-Law No. 21/2012, as converted into law, with the following key changes:

1. Expanded the scope of the sectoral regulation (Paragraph 3):The Prime Minister, following a Council of Ministers resolution, is entitled to issue a veto on resolutions, acts, and transactions (referred to in paragraphs 2 and 2-bis of the same article) if they create an exceptional situation not already regulated by national or European sectoral legislation. The amendment now clarifies that this also includes any relevant national and European prudential assessment of acquisitions of qualified holdings in the financial sector and rules on merger control.
2. Coordination with European Authorities (Paragraph 4 & 6-bis): A mechanism of coordination with regulatory authorities in the financial sector (including banking and insurance) was created, setting forth that if a transaction also requires authorization from competent European authorities regarding prudential or competition matters, the exercise of special powers by the FDI authority is delayed until the completion of the pending European procedures. Consequently, the deadlines for notification to the Prime Minister’s office do not start until these procedures are concluded.
3. Redefinition of National Security Risks (Paragraph 7, letter b-bis): The concept of risk has been broadened: it now includes threats to national economic and financial security, particularly where existing sector-specific regulations do not sufficiently protect essential State interests.

The new provisions are conceived only for the banking and insurance sectors, reflecting the reform’s connection to the infringement procedure. However, these sectors do not encompass all the “Italian and EU sectoral regulations” that the FDI authority should be required to consider. It therefore remains unclear why such a distinction exists, and why the FDI authority would not also await the decisions of other competent regulators, such as the Transport Authority (ART), the Communications Authority (AGCOM), or the Energy Authority (ARERA), as may be the case.

Concerning the procedure, the golden power proceedings being postponed until after the proceedings before the Commission or the ECB entails a material effect on the timing. The FDI screening procedure ordinarily takes 45 days, extendable up to 75 days. As of today, all procedures are initiated in parallel to mitigate the impact of FDI screening on the transaction timeline. However, if the FDI screening —effectively required to close the deal— must take place after the others, this additional step becomes a burden, adding to already lengthy timelines such as those of the merger control procedure before the European Commission.

Conclusions and thoughts

As anticipated, the Commission’s press release did not specify the exact elements that triggered the infringement procedure. Nonetheless, the core issues appear to relate to the overlap between the objectives of economic authorities and those of the FDI framework. This overlap results from the purpose assigned to the golden power legislation: if “national security” is understood to include the protection of savings and the prudential oversight of financial institutions —as suggested by the Italian court in the UniCredit case— then the assessments of the FDI authority inevitably intersects with those of independent economic regulators.

Within this framework, the reforms recently proposed by the Italian government reportedly address the Commission’s concerns. According to public press, the European Commission is expected to withdraw the infringement procedure; the formal decision, however, still rests with the Board of Commissioners —the body that initially opened the case.

It may therefore still be argued that the recent reform does not entirely eliminate the underlying tension, and questions may still remain. If the objectives of the FDI and economic authorities are genuinely distinct, their assessments should in principle diverge. If, on the contrary, the FDI authority pursues the same aim as the European economic authority, waiting for the latter’s decision would not resolve the issue of overstepping the competence of European economic authorities.

Therefore, the issue is in the definition of the goals of the FDI screening legislation. This concern echoes the 2006 CJEU observations on Italian legislation, which highlighted the “generic and imprecise” wording of decision criteria that permitted the broad exercise of special powers. A more structural issue also remains under EU law: the often unclear boundary between security-related interests and purely economic interests, as emphasized in the Commission v. Spain (C‑463/00) ruling on commercial banking activities.

Finally, any assessment of the adequacy of the current Italian national framework must also take into account that further legislative developments that are expected at the EU level, most notably the revision of EU Regulation 2019/452, which will likely be followed by corresponding adjustments to the Italian domestic FDI screening regime.

 

 

[1] Among them: (i) integrity and security of infrastructures and systems relevant to defence and national security; (ii) continuity of strategic supplies; (iii) protection of classified information; (iv) maintenance of essential productive and technological capabilities.

[2] All quotes are the author’s translation of the original Italian.