Will CFIUS get in the way of the Gemalto Thales deal?

Gemalto and Thales issued a statement earlier this month about the intended acquisition of Gemalto by Thales in which they confirm “they are making good progress on the preparation for the Offer.” The companies expect to submit this week “a request for review and approval of the offer document in relation to the Offer with the Netherlands Authority for the Financial Markets.” They add that they are currently in the process” to obtain the required regulatory approvals and clearances,” and anticipate they will conclude the deal in “the second half of 2018.”

As, so far, most of the business of Thales and Gemalto were in different activity fields, one may suppose competition authorities will find nothing objectionable in the acquisition proposal. However, a segment my raise some particular attention, the HSM (Hardware Security Module) business.

Hardware Security Modules (HSMs) are tamper-resistant pieces of hardware that play a key role in setting up large-scale secure systems. A HSM is typically used to generate and store cryptographic keys and to execute crypto computations in a secure manner. A HSM guarantees the security, integrity and confidentiality of exchanges by providing services such as key generation and storage, authentication, encryption, decryption, and signature computation and verification. Major markets for HSMs include government identification, payments, mobile payments, tokenization and enterprise security.

Key players on the HSM market include Gemalto especially thanks to the acquisition of SafeNet, Thales through its Thales e-Security business unit, IBM, Utimaco, Hewlett Packard Enterprise, Atos (including the product line it acquired from Bull), FutureX, Swift, Ultra Electronics, Cavium, … Interestingly, Gemalto and Thales are both headquartered in France with the French government being part of their shareholders, Atos is also from France, while IBM, HPE and FutureX are US companies, Ultra Electronics is based in the UK, Utimaco in Germany, and Swift positions itself as an international organization headquartered in Belgium.

The value of the HSM market is difficult to evaluate: Markets and Markets considers the HSM market was worth US$ 520 million (EUR 420 million) in 2016 and anticipates it to reach US$ 1,101 million (EUR 889 million) by 2022, while Transparency Market Research estimates it will account for US$ 40.4 billion (EUR 32.6 billion) in revenue by 2025.

Thales and Gemalto say they are confident they will get the approval of CFIUS, the Committee on Foreign Investment in the United States, a US Government inter-agency committee in charge of reviewing “transactions that could result in control of a US business by a foreign person, in order to determine the effect of such transactions on the national security of the United States,” according to the US Department of Treasury. The CFIUS is composed of the Heads of various US government departments, including Homeland Security, Commerce, Defense and others along with representatives from the Office of the US Trade and the Office of Science & Technology Policy, and of the National Security Agency (NSA) when appropriate.

Thales has a strong presence in the US, and has already been under the attention of the CFIUS in the past. The HSM market, especially in the US, is essentially served by Thales, Gemalto, IBM and HPE. Some of these HSMs are used for financial transactions applications while others directly relate with enterprise security and government ID applications which can be seen as a lot more sensitive by the CFIUS, especially as both Thales and Gemalto have the French government among their shareholders

The CFIUS is in a positon to have a decisive influence on the conclusion of deals. For instance, the proposed acquisition of MoneyGram by Ant Financial (Alibaba’s financial arm) has just been blocked by the CFIUS over “national security concerns,” according to Reuters.

Also, one may remember that in 2008, SafeNet, a US company, was considering the acquiring British security expert nCipher, a project that had been blocked as it would have created a dominant position for SafeNet. At this time, Thales came out and benefited from the blocking as it acquired nCipher. Later, in 2014-2015, SafeNet was acquired by Gemalto for US$ 890 million (EUR 718 million), leading to the current situation where Gemalto and Thales are in a very strong position on the US HSM market.

The coming months will tell whether the CFIUS derails or influences the ambitious project set up by Gemalto and Thales management.

Disclaimer: I own some Gemalto shares.