A Melbourne defence-tech founder is closing a $4 million Series A in mid-2026. The lead is a Singapore-based VC. The second-largest cheque comes from a US fund with a Canadian sovereign-wealth limited partner sitting on roughly a quarter of its committed capital. Two angels are NRIs holding Australian permanent residency. The company sells a sensor-fusion product to two Five Eyes defence primes and stores some of the test data on AWS Sydney. The founder’s commercial lawyer says FIRB “won’t bite under $347 million.” On the same week’s call, an M&A partner from a Tier 1 firm says the company has needed approval since week one and probably still does. Both can’t be right.
They aren’t — and the gap between them is where most startup capital raises get into trouble with the Foreign Acquisitions and Takeovers Act 1975 (Cth) (FATA). The $347 million number is a real threshold, but it is only one of four pathways into the regime, and the three other pathways — foreign government investor, national security business, and sensitive business — have monetary thresholds of either $0 or $347 million. For a Series A startup with the wrong investor mix or the wrong product category, the FIRB question is rarely about size. It is about who is investing and what the company does.
The Four Pathways That Catch Startups
A foreign person’s acquisition is potentially caught by FATA if any one of four pathways applies. Founders need to map their cap table against all four — not just the first.
- Significant action / notifiable action — general business. A foreign person who acquires a direct interest (generally 10% or, with control influence, lower) or a substantial interest (20%) in an Australian entity must notify when the consideration exceeds the general business threshold. For 2026, that threshold is $347 million for non-FTA private investors and $1,498 million for investors from most FTA partners (US, UK, Canada, NZ, Japan, Singapore, Korea, Chile, China and others) where the target is not a sensitive business.
- Sensitive business threshold. Where the target carries on a sensitive business — defined to include media, telecommunications, transport, defence and military-related industries, encryption and security technologies, the extraction of uranium or plutonium and the operation of nuclear facilities — the FTA uplift is unavailable and the threshold is $347 million for both FTA and non-FTA investors.
- Foreign government investor — $0. Almost every direct interest acquisition by a foreign government investor (FGI) is notifiable, regardless of value. The FGI definition is exceptionally wide and is the most common reason a startup raise gets unexpectedly captured.
- Notifiable national security action — $0. Introduced by the Foreign Investment Reform (Protecting Australia’s National Security) Act 2020 with effect from 1 January 2021, this pathway requires prior approval where a foreign person acquires a direct interest (10% or more, or any interest with influence rights) in a national security business or starts a national security business in Australia. The threshold is zero and the consequences for failing to notify before completion are personal liability for officers, civil penalties and the prospect of a divestment order under s 69.
Two of these — FGI and national security — are the live risk areas for early-stage companies. The $347 million pathway is largely theoretical until exit.
Why “Foreign Government Investor” Catches So Much VC Money
The FGI definition in s 17 of FATA and reg 17 of the Foreign Acquisitions and Takeovers Regulation 2015 is structural, not behavioural. An entity is an FGI if any single foreign government and its associates hold at least 20% of it, or if two or more foreign governments and their associates collectively hold at least 40%. Sovereign wealth funds (GIC, Temasek, CIC, Mubadala, NZ Super, CDPQ-equivalents), foreign public pension funds, and state-affiliated development banks all count as foreign governments for this purpose.
Crucially, the tracing rules in the regulation push FGI status up through fund structures. A US VC fund with a single Singaporean sovereign-wealth LP holding 21% of committed capital is itself an FGI for FATA purposes. That fund’s investment into an Australian startup — at any size — is a notifiable action requiring FIRB approval before the share issue completes. The fund’s GP almost certainly knows this. The startup very often does not, until the GP’s Australian counsel raises it three weeks into the term-sheet period.
The associate concept compounds the problem. Two unrelated foreign governments each holding 21% of separate LP commitments to the same fund will trip the 40% aggregate test if they are associates — and the associates definition in s 6 includes parties “acting in concert” in relation to a FATA-relevant action. Co-investment side letters and parallel commitments can, in practice, push that needle.
What Counts as a National Security Business
The national security business definition in reg 8B is the door most defence-adjacent and dual-use tech startups walk through without realising. The reg captures, among others, a business that:
- is a responsible entity of a critical infrastructure asset under the Security of Critical Infrastructure Act 2018 (Cth) (SOCI Act), or carries on a business involving a critical infrastructure asset — including critical electricity, gas, water, ports, data storage, financial services, communications, energy market operator and (post-2021 amendments) eleven new sectors covering defence, space, food and grocery, education, transport and healthcare;
- is a telecommunications carrier or carriage service provider regulated under the Telecommunications Act 1997 (Cth);
- develops, manufactures or supplies critical goods or critical technology intended for, or that may be intended for, a military end-use;
- stores or has access to information that has a security classification; or
- stores or maintains personal information of defence and intelligence community personnel that, if disclosed, could compromise national security.
The defence-tech founder above is plainly in. Less obvious but real: a SaaS company hosting payroll data for an ADF prime contractor; an analytics startup with read access to a Department of Home Affairs dataset; a quantum-comms startup with no defence customers yet but a product roadmap that is plausibly “intended for” military end-use. Once the company is a national security business, every direct interest acquisition by any foreign person — including a $50,000 angel cheque from a Singapore-resident sophisticated investor — requires FIRB approval before the share issue.
How Convertibles and SAFEs Are Treated
FATA looks through the legal form to the interest acquired. A convertible note that is genuinely contingent — uncapped, no discount, no automatic conversion — may not crystallise an interest on issue, but the universal Australian market form does. A capped SAFE or convertible with a defined discount and a mandatory conversion event almost always confers a current equitable or contractual right that FIRB will treat as a present acquisition. The cleaner working assumption: if the instrument will deterministically convert into equity above the relevant threshold, treat the issue date as the FATA test time, not the conversion. Waiting until conversion to apply is how startups discover their bridge round needed approval six months ago.
The Practical Founder Checklist
- Map the look-through cap table before the term sheet. For every foreign investor, identify their LPs to the 20%/40% lines. A single sovereign LP can change the FIRB analysis for the whole round.
- Test national security business status at every product pivot. Defence customers, intelligence-classified data, SOCI-listed sectors and critical technology are all moving targets in 2026. Re-test at every milestone.
- Apply early. FIRB statutory clocks (30 days, extendable) start only when the application and fee are accepted. The 2025 Portal launch has speeded triage; substantive review on a contested national security matter still routinely runs 60–90 days.
- Build the fee into the deal. Business-acquisition fees are tiered by consideration and reset on 1 July each year. Allocate the cost in the term sheet; lead investors typically wear it but founders should not assume.
- Document the carve-out. If the round is structured around an exempt non-foreign tranche while an FGI tranche is held in escrow pending approval, paper the conditional closing properly. A premature issue of shares is a contravention; rectification is expensive.
The Bottom Line
The 2026 FIRB regime is not a “big-deal” problem. For Australian startups, the live exposure is the foreign government investor pathway sitting silently in the LP base of an otherwise ordinary US or Singaporean VC, and the national security business pathway sitting silently in the defence, critical infrastructure or sensitive-data profile of the company itself. Both have a zero-dollar threshold and both carry civil penalties and personal officer liability for completion-before-approval. The founders who get this right do the look-through analysis on the cap table at term-sheet stage, re-test national security status at every product milestone, and treat FIRB sign-off as a discrete workstream alongside legal due diligence — not as a clean-up at closing.
Viridian Lawyers advises Australian startup founders and foreign investors on FIRB notification strategy, national security business classification, foreign government investor analysis and conditional-closing structures. If you are preparing a capital raise that involves overseas capital, restructuring a fund stack to manage FGI exposure, or assessing whether your product profile has tipped you into the national security business definition, get in touch.
