How do you navigate the regulatory process to acquire ServiceNow in 2027?

Two paths through the gauntlet: fast-close gamble versus staged clearance

Any deal for a company of ServiceNow's scale — a US-listed enterprise software vendor embedded in the IT operations, HR service delivery, and customer workflow stacks of most of the Fortune 500 — forces an early strategic fork. You either structure for speed and accept the risk of an enforcement action, or you structure for certainty and accept a long, expensive tail. The choice is not cosmetic. It changes the merger agreement, the reverse termination fee, the integration plan, and the way you run the target's revenue operations during the pendency period.

Path A — the fast-close gamble. You sign, file HSR, file in the EU and UK, and push for clearance without offering remedies up front. You resist a Second Request by front-loading document production, you argue the markets are broader than the agencies will initially assume, and you bet that no serious overlap theory survives contact with the evidence. This path is genuinely available when the acquirer is a financial sponsor with no competing software assets, or a strategic buyer whose portfolio does not touch ITSM, ITOM, IT asset management, HR case management, GRC, or low-code workflow platforms. Under a clean-hands fact pattern, a Phase I EU clearance and an HSR waiting-period expiry can land in four to six months.

Path B — staged clearance with pre-negotiated remedies. You assume a Second Request from the FTC or DOJ, assume an EU Phase II, and design the transaction so divestitures are identified before signing. You carve the overlapping product lines into a separately managed unit on day one, you line up an upfront buyer, and you accept a hell-or-high-water covenant that obligates you to divest whatever the agencies demand. This path costs more in fees and takes longer, but it converts regulatory risk into a known quantity — which matters enormously if you are financing with debt that has an outside date.

The deciding variable is overlap, not size. Size alone triggers filings; overlap triggers enforcement. A sponsor-led take-private of ServiceNow faces a heavy but largely procedural review — the questions become about roll-up strategy across a software portfolio, about interlocking directorates under Section 8 of the Clayton Act if the sponsor holds a board seat at an adjacent vendor, and about the debt load's effect on continued R&D investment. A strategic acquisition by a hyperscaler or a large enterprise software incumbent faces a substantive review, because the agencies will look at ITSM concentration, at bundling with adjacent cloud infrastructure, and at the platform's role as a system of record that competitors depend on for integration.

There is a third variable most deal teams underweight: the target is a critical vendor to government agencies. ServiceNow holds FedRAMP authorizations and serves federal customers. That drags in a separate approval surface — agency-level novation of contracts, potential facility clearance and foreign ownership, control, and influence (FOCI) mitigation if the acquirer has non-US ownership, and a CFIUS filing that becomes effectively mandatory rather than voluntary when the buyer has any foreign government-linked investor in the fund stack. Path A rarely survives contact with a federal contract portfolio of that shape.

The honest framing for a board: Path A optimizes for the scenario where you are right about the market definition. Path B optimizes for the scenario where you are wrong. Given that the agencies in both Washington and Brussels have spent the last several years pushing broader theories of harm in software and cloud markets — ecosystem effects, conglomerate leverage, data advantages, and the loss of nascent competition — the prior on "we are right about the market definition" should be lower than deal counsel's opening memo suggests.

How to decide between them

The decision is mechanical once you gather four facts: your own product overlap, your share position in any defined market, your foreign-investment exposure, and your financing outside date. Work them in that order, because each one can end the analysis.

Start with overlap mapping. Pull every SKU you sell and every SKU the target sells, and score them for substitutability from a customer's perspective — not from a product marketing perspective. Agencies read customer documents, not vendor positioning decks. If your sales team has ever written "we lose these deals to ServiceNow" in a CRM note, a win/loss dashboard, or a QBR deck, that document will surface in a Second Request and it will define the market for you. This is the single most important reason RevOps belongs in the deal room early: the win/loss data, the competitive displacement tags, and the pipeline source fields in your CRM are the evidentiary record the agencies will use. Audit them before you sign, not after you receive a specification.

Next, size the share. If a plausible market definition puts the combined entity above roughly 35 percent, expect Phase II in Europe and a Second Request in the US as the base case. Between 20 and 35 percent, the outcome turns on entry conditions, customer testimony, and whether the agencies believe switching costs lock customers in. Below 20 percent on every defensible definition, a fast-close structure is defensible.

Then check foreign-investment exposure. Count the jurisdictions where the target has revenue, employees, data centers, or government customers, and count the ones where your own ownership chain includes non-domestic limited partners. Each mandatory FDI regime adds a filing, and several add suspensory effects — you cannot close anywhere until you clear there.

Finally, test the timeline against your financing. Debt commitments with a nine-month outside date cannot survive a Second Request plus an EU Phase II. If the numbers do not reconcile, you either renegotiate the commitment papers before signing or you choose Path B and price the certainty.

The diagram compresses a decision that in practice takes four to eight weeks of antitrust counsel work, economic consulting, and document review. Do not shortcut the overlap step. Deal teams routinely assume no overlap because the two companies sell to different buyer personas, then discover in the Second Request that the agency has defined a market around "enterprise workflow automation platforms" that captures both.

The concrete numbers behind each path

Regulatory cost and duration are estimable within ranges, and boards should see the ranges rather than a single point estimate.

Filing fees and mechanics. The US HSR filing fee is tiered by transaction size, and for the largest deals — the tier covering transactions above the top threshold — the fee runs into the low millions of dollars. That is trivial relative to the deal, but the associated work is not. The 2024 revamp of the HSR form materially expanded what filers must submit: descriptions of overlaps and supply relationships, information on prior acquisitions, minority holders, and a broader set of transaction-related documents including certain ordinary-course plans and reports. Preparing a compliant filing for a target of ServiceNow's complexity is a six-to-ten-week exercise, not the two-week exercise it was under the old form. The initial waiting period is 30 days for most transactions.

Second Request economics. If you receive one, plan on 8 to 14 months from issuance to resolution, and legal and e-discovery costs commonly running into the tens of millions of dollars for a large software deal. The cost driver is custodian count and document volume. A Second Request in a deal like this typically names 30 to 60 custodians across both parties, pulls several years of email and chat, and requires privilege review across millions of documents. Timing agreements with the agency — where you voluntarily agree to limits on custodians and a delayed closing date in exchange for a narrowed specification — are standard practice and are usually worth signing.

European timelines. EU Merger Regulation Phase I is 25 working days, extended to 35 working days if remedies are offered in Phase I or a member state requests referral. Phase II adds 90 working days, extendable to 105 if remedies come in, and up to 125 with agreed extensions. In calendar terms, a Phase II runs roughly six to eight months after formal notification — and formal notification itself typically comes two to four months after signing because of pre-notification discussions with the Commission's case team. Pre-notification is not optional in practice for a deal of this size.

United Kingdom. The CMA operates a voluntary notification regime, but a deal of this profile will be reviewed regardless. Phase 1 is 40 working days after the CMA formally starts its clock; Phase 2 is 24 weeks with a possible 8-week extension. The CMA has shown willingness to take positions independent of Brussels and Washington on large technology deals, which means the UK can become the long pole even when the US and EU clear.

Foreign investment regimes. Beyond CFIUS, expect mandatory or likely filings across a broad set of jurisdictions where the target has meaningful presence — Germany, France, Italy, Spain, Australia, Canada, and others each maintain FDI screening with software and critical-technology hooks. For a global enterprise software target, the aggregate count of merger-control plus FDI filings can reach 15 to 25 jurisdictions. Each carries its own timetable, and the closing condition is the slowest one.

CFIUS specifics. A declaration is 30 days; a full written notice runs 45 days for review, plus a 45-day investigation if the case advances, plus a possible 15-day presidential decision period. Practically, a CFIUS notice for a critical-technology target with federal customers takes four to seven months including the pre-filing draft period, which CFIUS expects and which typically adds three to six weeks.

Total envelope. Path A, clean facts, no Second Request: 5 to 9 months to close, all-in regulatory spend in the single-digit millions. Path B, Second Request plus EU Phase II plus a divestiture package: 14 to 24 months, all-in regulatory spend commonly in the range of tens of millions, plus the value leakage from selling a carved-out business under duress. Price the reverse termination fee accordingly — for deals with meaningful antitrust risk, reverse break fees in the range of 4 to 8 percent of equity value are common, and sellers will push toward the high end when they see a Second Request as likely.

The operating cost nobody models. Employee attrition during a 20-month pendency period is the quiet destroyer of deal value in software. Quota-carrying reps leave when the comp plan is frozen, when accounts are in limbo, and when recruiters call with a clean story. Model 15 to 30 percent voluntary attrition in the go-to-market organization over a two-year regulatory hold if you do nothing to counteract it, and budget retention accordingly. Retention pools for a target this size routinely run into the hundreds of millions of dollars, and the board should see that as a regulatory cost, not a compensation line item.

Sequencing the work, and what RevOps owns during the hold

The mechanics of how you navigate this regulatory process matter as much as the strategy. Sequencing errors — filing before you have your documents in order, or letting integration planning drift into gun-jumping — cause more damage than an aggressive market definition.

Pre-signing, weeks 1 to 8. Antitrust counsel runs the overlap analysis. Economists build the market definition case. Critically, you run a document hygiene review across both sides: what do internal strategy decks, board materials, win/loss analyses, and pricing models actually say about the competitive landscape? You cannot destroy or alter anything — litigation holds attach the moment a deal is contemplated, and spoliation is a far worse problem than a bad document. What you can do is understand what the agency will see and prepare the context. RevOps is central here because the CRM is the document repository nobody thinks of as a document repository: opportunity loss reasons, competitor fields, displacement campaigns, and battlecard content are all discoverable and all highly persuasive to a case team.

Signing to filing, weeks 8 to 20. Draft the HSR form under the expanded 2024 requirements. Open pre-notification contact with the European Commission case team. Identify every jurisdiction requiring a filing and rank them by timetable and suspensory effect. File CFIUS as a draft notice first. Stand up a clean team with a written protocol — a small group, walled off from commercial decision-making, that can receive competitively sensitive information for integration planning without exposing operating executives to it.

Waiting period, months 5 through 20. This is where deals are won or lost operationally. The two companies must continue to compete as independent businesses. Pricing decisions, customer allocation, joint go-to-market, and shared roadmap sessions are gun-jumping risks under Section 1 of the Sherman Act and Article 101 in Europe. The merger agreement's interim operating covenants will permit ordinary-course operation and restrict extraordinary actions; read them literally and route judgment calls through counsel.

Remedy negotiation, if it comes. Agencies prefer structural remedies — divest a standalone business with the assets, people, contracts, and IP needed to compete — over behavioral commitments. An upfront buyer, identified and approved before clearance, converts a risky remedy into a closable one. Expect the divestiture buyer to demand transition services agreements running 12 to 24 months.

Closing and the first 100 days. Contract novation for federal work is not automatic; each agency must consent, and that process runs in parallel with everything else. Have it started before closing.

What the revenue organization owns throughout. Three things. First, evidentiary discipline: competitive fields in the CRM should describe reality accurately, and the team should be trained that everything written is discoverable — not to sanitize the record, but to stop the careless hyperbole that reads terribly in a courtroom. Second, continuity: quota relief, retention grants, and territory stability for the target's sellers, because a two-year hold with frozen comp plans hollows out the asset you are buying. Third, clean-room readiness: a small analytics team, properly walled, builds the day-1 territory, quota, and comp model from aggregated data so that integration can execute in weeks rather than quarters once clearance lands. The clean team's outputs go to the deal team, never back to the operating sales leaders, until the deal closes.

The specific regulatory exposures a ServiceNow deal creates

Certain features of this particular target shape the review in ways a generic playbook misses.

Platform criticality. ServiceNow functions as a workflow system of record. Competing vendors integrate into it. That gives agencies a foreclosure theory: after the acquisition, will the buyer degrade or deprioritize integrations that competitors depend on? Expect requests for API partner agreements, integration roadmaps, and any internal discussion of partner tiering. The defense is documentary — evidence of an open integration posture and commercial terms applied consistently.

Government customer base. FedRAMP-authorized offerings serving federal agencies create three distinct workstreams: CFIUS, agency novation, and potentially a FOCI mitigation agreement negotiated with the Defense Counterintelligence and Security Agency if there is foreign ownership in the acquirer's chain. FOCI mitigation ranges from a board resolution to a proxy agreement, and the heavier instruments materially constrain how the acquirer can direct the business.

Data protection. Cross-border transfer of customer data during due diligence and integration planning triggers GDPR obligations. Personal data in CRM extracts and HR files needs a lawful basis and appropriate transfer mechanisms before it crosses a border, including into a clean room.

Interlocking directorates. If the acquirer or its sponsor holds board seats at competing software vendors, Section 8 of the Clayton Act is live independent of the merger analysis, and the agencies have been enforcing it more actively. Resolve overlapping directorships before filing.

Employment and works councils. European works council information and consultation obligations attach before certain decisions can be implemented. In several jurisdictions consultation must complete before signing or before implementation, and skipping it creates enforceable claims and, in France, potential criminal exposure for the entity.

Related questions

Does a private equity buyer face an easier regulatory path than a strategic acquirer?

Generally yes on the substantive antitrust analysis, because there is usually no horizontal overlap. But sponsors face sharper scrutiny on roll-up strategies, Section 8 interlocking directorates across portfolio boards, foreign limited partners triggering CFIUS, and questions about whether leverage will reduce R&D investment.

What is a hell-or-high-water covenant and should the buyer accept one?

It obligates the buyer to take any action required for clearance, including divesting assets, without a materiality limit. Sellers demand it when antitrust risk is real. Buyers should resist unlimited versions and negotiate a carve-out capping divestitures at a defined revenue threshold, paired with a reverse termination fee.

Can the parties start integrating before clearance?

No. Coordinating pricing, allocating customers, sharing forward-looking commercial plans, or making joint go-to-market decisions before closing is gun-jumping and is separately actionable. Integration planning is permitted through a properly constituted clean team operating under a written protocol, with outputs restricted from operating decision-makers.

How does a Second Request change the closing timeline in practice?

It suspends the waiting period until both parties substantially comply, which typically takes 6 to 10 months of document production alone. Add agency review after compliance and the realistic add is 8 to 14 months. Negotiating a timing agreement narrows custodians in exchange for a fixed pre-closing notice period.

Which jurisdiction usually becomes the critical path?

For large enterprise software deals it is commonly the European Commission if Phase II opens, or the UK CMA, which runs an independent analysis and has taken positions diverging from other regulators on technology transactions. Smaller FDI regimes with slow administrative timetables also surprise deal teams regularly.

FAQ

Is HSR notification mandatory for an acquisition of a public company like this?

Yes. Any acquisition of voting securities or assets exceeding the size-of-transaction threshold — adjusted annually and well below the value of a company of this scale — requires premerger notification to both the FTC and DOJ, followed by a waiting period during which the parties cannot close. Closing without filing, or closing during the waiting period, exposes the parties to substantial civil penalties assessed per day of violation.

How long should a board plan for, worst case?

Plan for 24 months from signing to closing in the adverse scenario: a Second Request that takes 10 months to satisfy, an EU Phase II running six to eight months after a multi-month pre-notification, a UK Phase 2, remedy negotiation, and an upfront-buyer divestiture process. Set the merger agreement's outside date with two extension options rather than a single hard date, and align debt commitment papers to the extended date.

What happens to the target's customers and renewals during the review?

The target continues operating independently and must keep selling, renewing, and competing normally — including against the acquirer. Interim operating covenants permit ordinary-course business and restrict extraordinary actions like large capital commitments or material contract changes. Customers frequently ask for change-of-control assurances; responses should go through a consistent, counsel-reviewed script rather than ad hoc rep messaging.

Does the fact that the target is a critical vendor to government agencies change the analysis?

Substantially. It makes a CFIUS filing effectively unavoidable where any foreign ownership exists in the acquirer's chain, adds agency-by-agency contract novation, and can require FOCI mitigation negotiated with the Defense Counterintelligence and Security Agency. It also raises the political salience of the deal, which affects how agencies exercise discretion.

What is the single highest-leverage thing to do before signing?

Audit your own documents. The agencies' theory of the market will be built from internal materials on both sides — strategy decks, board presentations, win/loss analyses, and CRM competitive fields. Understanding that record before you sign lets you price the risk accurately, structure the reverse termination fee correctly, and avoid the surprise that turns a nine-month plan into a two-year one.

Should the buyer offer remedies proactively in Phase I?

Sometimes. Offering commitments in EU Phase I extends the deadline from 25 to 35 working days but can avoid a Phase II entirely — a trade of ten working days against six-plus months. It works when the overlap is narrow, clearly identified, and cleanly divestible. It backfires when it signals that a broader problem exists and invites the case team to look harder.

Sources

• https://www.ftc.gov/enforcement/premerger-notification-program
• https://www.ftc.gov/enforcement/premerger-notification-program/hsr-resources/second-request-process
• https://www.justice.gov/atr/merger-enforcement
• https://competition-policy.ec.europa.eu/mergers_en
• https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32004R0139
• https://www.gov.uk/government/organisations/competition-and-markets-authority
• https://home.treasury.gov/policy-issues/international/the-committee-on-foreign-investment-in-the-united-states-cfius
• https://www.dcsa.mil/Industrial-Security/Foreign-Ownership-Control-or-Influence-FOCI/
• https://www.fedramp.gov/
• https://www.sec.gov/edgar/searchedgar/companysearch

Related on PULSE

• How do you keep a sales team intact through a 24-month merger review?
• What does a clean-team protocol actually look like for RevOps?
• How do you model reverse termination fees against antitrust risk?
• What breaks in CRM data during a large enterprise software acquisition?
• How do you sequence territory and quota redesign for day one after closing?