A report by the European Court of Auditors analyzes and documents weaknesses in the European Union's framework for controlling direct foreign investments. It notes that Cyprus, among other countries, conducted no such controls during 2020 to 2022, despite having a significant percentage of such investments.

As highlighted in a related announcement, these investments bring over 100 billion euros annually to the EU. However, the effectiveness of the framework for their control, and in preventing potential emerging threats to security and public order, is compromised by its structure and implementation weaknesses.

Regarding controls between 2020 and 2022, it was found that six countries conducted 92% of all recorded checks, while twelve countries (Cyprus, Luxembourg, Ireland, Belgium, Sweden, Portugal, Slovakia, Bulgaria, Greece, Estonia, Croatia, and Slovenia) did not conduct any. Notably, Cyprus accounted for 2.9% of the EU's incoming investment stock during 2019 - 2021.

The auditors noted that the newly established EU framework is a positive development, as it allows for the identification of potential threats to security and public order within the EU. However, a large portion of the direct foreign investments made between 2020 and 2022 were neither checked nor reported at the EU level.

This is due, among other things, to the lack of a control mechanism in some countries, and differing interpretations of key regulatory concepts among those with such mechanisms.

While direct foreign investments are a fundamental value of the single market and are open to it, investments in strategic sectors crucial for EU security and public order (such as ports, nuclear facilities, semiconductors, or dual-use microcircuits) carry the risk of control falling into the hands of non-EU investors involved in criminal activities or controlled by foreign governments or armed forces.

Mihails Kozlovs, a member of the European Court of Auditors responsible for the report, stated that the control of foreign investments is "a safety net for the EU, but one that is flawed in several areas," which the Commission and member states "must undertake to mend."

The audit team observed that the European Commission took a series of actions to create the framework, and more EU countries are following its lead, developing their own control mechanisms and fostering closer cooperation among themselves.

However, various factors continue to hinder the proper functioning of the system. For example, EU rules do not compel countries to develop a control mechanism, also granting them discretion in defining the scope of their national control regulations.

Moreover, member states are not obliged to report the outcomes of their control decisions to the Commission, even when the Commission issues an opinion or when other EU countries have expressed concerns.

Auditors noted that many member states reported only transactions that might exclusively affect their national public order or security, thereby depriving other member states and the Commission of the opportunity to assess potential impacts on themselves or on EU-wide programs.

Between 2020 and 2022, EU countries reported 886 cases subjected to scrutiny. For some countries, there was no correlation between the number of notifications and the level of incoming investments. Six countries submitted 92% of all cases, and nine others the remaining 8%. Twelve countries did not conduct any checks or report any cases, although they account for nearly half of the incoming investments. Simultaneously, the mechanism is overly burdened with numerous cases that are either low-risk or ineligible.

Improvements are needed in the Commission's eligibility and risk assessments, as well as in its recommendations. Although these assessments identify risks and facilitate deliberation on potential vulnerabilities in the future, the European Court of Auditors identified problems with the assessments and certain aspects of the Commission's recommendations that may hinder their compatibility with a market economy environment.