Speed Read

Internal documents and ordinary course of business information are some of the key sources of evidence used by the UK's Competition and Markets Authority ("CMA") in merger control proceedings. Managing information requests from the CMA in the face of tight deadlines has always been a burden associated with the UK merger control process. What has changed in the last few years, however, is the remarkable intensity with which the CMA scrutinises the completeness of the parties' responses with the use of formal, statutory requests and associated procedural penalties for non-compliance. Companies now face a real risk of having the standard of their responses called into question as being incomplete, even when the transaction does not raise any substantive issues.

In light of this enforcement shift, we recommend that companies take the following five steps to manage the CMA's information requests:

  • Pick the best possible methodology: choose a search and review methodology, which is rigorous enough to capture responsive documents whilst being practical in light of the deadline, and consult it with the CMA.

  • Staff appropriately: allocate sufficient internal and external resources to manage the search and review process.

  • Quality control: have a quality control and monitoring process in place to ensure the methodology is correctly implemented.

  • Prioritise senior management: take particular care that responses to requests concerning senior management custodians are as complete as possible.

  • Always be open with the CMA: maintain a co-operative and transparent dialogue with the CMA about the practicalities of complying with the requests and any search or production errors identified.

What powers does the CMA have to request information?

The CMA can request documents and information from the merging parties informally, or by using its formal, statutory powers under s. 109 Enterprise Act 2002 ("the Act").1 Whilst the parties are expected to comply with both types of request, compliance with a s. 109 notice is mandatory under the Act and subject to a legally binding deadline. Failure, without a reasonable excuse, to comply with a s. 109 notice is subject to statutory penalties, including an administrative fine of up to GBP 15,000 per day or a fixed amount of GBP 30,000.2 The CMA may also choose to penalise non-compliant parties by extending the review timetable (such as prolonging the 40 working day Phase I period for a Phase II reference,3 or the 24-week period for reaching a Phase II decision4).

What has changed about the way the CMA requests information?

Formal requests: the new norm, even for straightforward transactions

Historically, formal requests under s. 109 were typically a feature of Phase II, the in-depth review phase affecting a minority of transactions raising a realistic prospect of competition concerns. This is no longer the case - formal requests are now a matter of routine even in the voluntary pre-notification stage. The CMA has clearly signalled in published guidance that such requests are now likely to be used as standard in Phase I, as well as Phase II.5 In our experience, the parties should expect to receive s. 109 notices alongside informal requests, even as early as pre-notification. This is likely due to the fact that the CMA has, in its view, received a number of substandard notifications in recent years, which has led to a heightened concern as to the completeness of the information it receives from the parties in Phase I. A more extensive use of s. 109 notices earlier in the merger process, allows the CMA to bridge this perceived evidential gap.

Wide-ranging scope and even shorter deadlines

The CMA's internal document requests have not only become increasingly extensive, following the global trend for more document-heavy merger review processes,6 but also tend to be drafted in an open-ended manner7 instead of designating specific search terms and custodians. This leaves room for a significant degree of interpretation (and disagreement) as to what information is responsive. At the same time, the responsibility for ensuring a complete response and developing an appropriate search strategy is placed firmly on the parties. The CMA may provide non-binding comments but will not formally "sign off" on a given methodology.8

The initial deadlines imposed by the CMA are typically unrealistically short (e.g., a few business days) and whilst the CMA is usually open to discussing the possibility of extra time, it may be reluctant to grant lengthy extensions to formal s. 109 notices, particularly those issued later in the review process. It can therefore be extremely challenging to carry out all the necessary search and review steps in the available timeframe.9

Active enforcement and fines

The CMA is adopting a more heavy-handed approach with parties who fail to adequately comply with s. 109 requests. The first administrative fine was issued in 2017, with three further penalties imposed in 2019 (see the Annex for a summary of these cases), with the largest fine totalling GBP 27,000 (close to the fixed statutory maximum).

Importantly, these are not cases where the parties failed to respond altogether. Rather, for a variety of reasons (ranging from problems with the search methodology to technical oversight) the parties unintentionally submitted an inadequate initial submission, which was only perfected weeks after the legally binding deadline.

Although the CMA is now actively fining parties for failure to comply with s. 109 notices, the level of penalties is relatively low compared to fines imposed by the European Commission for similar violations,10 or in comparison to the overall deal value.11 Nevertheless, it still remains prudent for companies to think ahead about how best to manage information requests in the changing enforcement climate. A procedural investigation is associated with a number of costs beyond financial penalties such as additional legal fees,12 wasted management time and reputational impact. Perhaps most importantly, however, the perception that a party is failing to seriously engage with the CMA's procedural requests will inevitably sour the working relationship with the CMA during the substantive review process, potentially resulting in a more thorough review – and possibly a Phase II process - and delay to closing.

What can companies do to effectively comply with information requests?

The CMA has issued guidance13 setting out the general principles that it expects parties to apply when responding to information requests. However, there remains a significant degree of uncertainty on how best to apply these principles within the short deadlines imposed by the CMA. The large volume of hard copy and electronic records generated by even small-sized businesses mean that managing the CMA's requests often requires a specialist understanding of complex search protocols and technical discovery solutions, which not all businesses will necessarily be familiar with.

Whilst the risk of missing relevant documents or providing incomplete information can never be eliminated (even the best-designed search and review process is never completely exhaustive), companies can significantly reduce the likelihood of their responses being called into question by adopting the following best practices, informed by the CMA's approach in recent penalty cases.

STEP 1: Design a robust search and review methodology

Identify the most appropriate search methodology

  • The search and review process must be prima facie capable of identifying responsive documents. It pays to take the time at the outset assessing the scale and scope of the request, the complexity of the required search, the custodians most likely to hold responsive documents, the extent of relevant IT environments and the likely number of documents in the review pool. The CMA has previously penalised half-hearted search attempts.

  • There is no "one size fits all" methodology. It may not always be necessary to conduct a forensic IT search; a manual search may be sufficient.14 Indeed, there may not be enough time to instruct third parties within the short deadlines set by the CMA and carrying out a manual search may realistically be the default option in many cases.

  • Although there is more scope for human error with a manual search, using technology or a third party service provider does not in itself guarantee that the CMA will not question the resulting responses. The CMA has previously imposed a penalty where a search tool lacked the appropriate functionality to cover a custodian's IT environment - the notifying party is expected to understand the limits of the tools it chooses to interrogate its own IT environment.

Keep a written search and review protocol

  • The CMA may ask for an explanation of the approach adopted and more complex requests may include a standardised methodology question at the outset. It is therefore essential to keep accurate and complete records of the chosen search and review protocol.

Avoid narrow search terms

  • Limiting the search through keywords and search terms may realistically be the only way to comply effectively with the request. It is important, however, that the search does not become too selective. The CMA has previously penalised the use of unduly narrow and unreliable search terms, which were clearly incapable of capturing all categories of documents requested. The CMA has emphasised that the parties' obligation to produce relevant documents overrides the inconvenience of having to review additional documents captured by more comprehensive keywords.15 Any decision to significantly narrow search terms should therefore be taken with caution and the justification for doing so should be robust and thoroughly documented.

STEP 2: Allocate sufficient resources

  • The CMA will expect senior management to do what is necessary to deliver a complete response within the deadline (including, where required, hiring external legal reviewers or data discovery consultants). The CMA has previously rejected arguments that resourcing difficulties, competing business pressures on senior management or difficulties with coping with the intensification of information gathering requests in Phase II were a reasonable excuse for failing to provide responsive information.

  • In transactions undergoing review in a large number of jurisdictions, the CMA's requests will be one of many the parties will need to manage in parallel and with consistency. In such cases it is cost- and process-efficient for the parties to consider engaging advisors with global experience of co-ordinating document reviews across multiple jurisdictions and procedural standards.

STEP 3: Correctly implement the methodology

  • Even a sensible and practical search protocol will be inadequate if it is not properly followed. The CMA has previously imposed fines in circumstances where it was impossible to verify whether the search had complied with the protocol (e.g., because no written instructions were circulated to reviewers).

  • Acting in good faith is not a reasonable excuse for manifest and obvious deficiencies in the output of the search. Companies should factor in time to carry out a sense-check of the search results to identify any "red flags". These might include a failure of the search to capture "hot documents" identified by in-house legal counsel; an atypically low number of documents addressing a particular issue; or where an unusually large number of documents are designated as privileged.

STEP 4: Take extra care with documents involving senior management

  • The CMA's requests will often focus on documents and communications involving senior management and a common feature in a number of the CMA's penalty decisions is the parties' failure to disclose such categories of documents. The CMA has also treated the close involvement of senior management in the coordination of the document review process as an aggravating factor, on the basis that management should have been personally aware of the errors arising from the search.

  • Where time is tight, it is therefore worth prioritising processing senior management custodians over others and (where possible) carrying out additional quality and compliance checks specifically for parts of the production involving senior management.

STEP 5: Maintain a co-operative dialogue with the CMA

Consult with CMA on scope and search methodology

  • As full technical compliance with an information request is often impractical (and arguably impossible), maintaining an active dialogue with the CMA is one of the most important steps the parties can take to mitigate the risk of a procedural breach.

  • Whilst the CMA may give its views on whether the methodology appears to be "sensible and practical", it will not give any firm guarantees.16 It is ultimately the parties' responsibility to ensure the response is complete. Nevertheless, there is clear strategic value in consulting with the CMA on the methodology prior to implementing the search (particularly for more comprehensive requests), as doing so puts the CMA on notice as to what type of search can reasonably be conducted in the timeframe. Indeed, such transparent engagement has previously been taken into account by the CMA as a factor mitigating the penalty amount.

  • For more extensive requests, the CMA may first invite the parties to comment on a draft form of the notice, prior to formally issuing it.17 We recommend that parties fully take up such opportunities. The CMA has previously considered that a failure to comment on a draft notice only served to aggravate the parties' ultimate failure to comply with its requirements.

Rectify any problems as soon as possible

  • If the parties identify errors, compliance issues or missing documents, it is advisable to take immediate steps to rectify the shortcomings and consider pro-actively raising the issue with the CMA (particularly if the breach is significant or systemic). Doing so might persuade the CMA not to open a formal investigation into the breach, or alternatively, be considered as a mitigating factor when setting the fine.


The CMA has increased both the frequency and intensity of its information gathering practices, with formal information requests now commonplace even in cases, which do not raise significant substantive issues. Companies should therefore prepare for this enforcement shift by developing at an early stage an adequately resourced and robustly implemented search and review strategy and actively engaging with the CMA throughout the process.



1 Equivalent information gathering powers and penalties apply in the context of the CMA's Market Study and Investigation powers under s.174A of the Act and the guidance set out in this alert will also be helpful in that context. Indeed, the CMA has recently imposed a GBP 20,000 fine on AppNexus for failure without reasonable excuse to comply with the requirements of a s.174A notice issued in the context of the Online Platforms and Digital Advertising market study. AppNexus had submitted a partial response over three weeks after the stated deadline, only completing its response over seven weeks later.

2 s. 110(1) and s. 111 of the Act.

3 s. 34ZB(1) of the Act

4 s. 110(2) and s. 39(4) of the Act

5 Guidance on requests for internal documents in merger investigations ("Guidance"), CMA 100 (15 January 2019), paragraph 16.

6 For example, the European Commission reviewed 2.7 million internal documents in the review of Bayer's acquisition of Monsanto.

7 For example, the definition of "internal documents" might be "all documents (including any presentations, Word documents, drafts, documents stored on proprietary systems etc.) which have been prepared for, or received by, any member of the board of directors (or equivalent body) or senior management or shareholders of either of the Parties (whether prepared internally or by external consultants) in the last [two or three] years.". In terms of substantive scope, requested documents will typically cover strategic plans for the target, rationale of the transaction, background to negotiations, the parties' business plans or simply any document which "sets out the competitive conditions, market conditions, market shares, competitors, and/or the Parties' business plans" in relation to a particular area.

8 Guidance, paragraph 26-28

9 For example, identify the correct custodians and search parameters, gain access to IT environments, review potentially responsive information across different sites and time zones, apply quality checks, process the output and prepare the submission.

10 By contrast, in 2017 the European Commission fined Facebook EUR 110 million for providing misleading information in relation to its acquisition of WhatsApp, and in 2019 it fined General Electric EUR 52 million for providing incorrect information in relation to its acquisition of LM Wind.

11 The CMA has called on the UK Government to introduce a turnover-based penalty regime, similar to that of the EU though it remains to be seen whether these proposals will come to fruition. PDF available here

12 Even if a company chooses not to defend the allegations, it is usually sensible to at least attempt to mitigate the amount of the fine.

13 See footnote 5, above.

14 This may be justified, for example, where there are only a few relevant custodians and the request relates to a discrete and targeted issue, or if the deadline required by the CMA does not permit a more complex search protocol.

15 In one case, the CMA rejected arguments that reviewing an additional one thousand documents in several days to accommodate wider keywords was overly burdensome.

16 Guidance, paragraph 28

17 Guidance, paragraph 27

Explore More Insight