Magnesium Bidco Limited v Mimecast Limited (LM170JAN22) [2022] ZACT 64; [2022] 1 CPLR 9 (CT) (6 April 2022)

COMPETITION

TRIBUNAL OF SOUTH AFRICA

No.: LM170JAN22

Magnesium Bidco Limited (Acquiring Firm)

and

Mimecast Limited (Target Firm)

Heard on: 04

April 2022

Order Issued on: 06 April 2022

REASONS

FOR DECISION

[1] On 6 April 2022, the Competition Tribunal conditionally approved a large merger between Magnesium Bidco Limited (“Magnesium”) and Mimecast Limited (“Mimecast”).

[2] The proposed transaction involves Magnesium acquiring the entire share capital of Mimecast.

Parties to the transaction and their activities

Acquiring firm

[3] Magnesium is registered in accordance with the laws of England and Wales; is a newly incorporated entity and does not conduct any activities. Magnesium is ultimately controlled by Permira Holdings Limited (“Permira”).[1] Permira and all the firms directly and indirectly controlled by it will hereinafter be collectively referred to as the "Acquiring

Group". The Acquiring Group does not have any broad-based black economic empowerment (“B-BBEE”) shareholding.

[4] The Acquiring Group, through its portfolio companies, is active across the consumer, financial services, healthcare, industrial, and technology sectors. In South Africa, the Acquiring Group, through its various investment funds, controls a number of portfolio

companies.[2] Relevant to the proposed transaction are the activities of the Acquiring Group in the broader market for the supply of information technology (“IT”) services in South Africa. The Acquiring Group through its portfolio companies supplies software distribution services, is a data centre provider, provides customer relationship management software, is an employee experience management software provider, is a data integration software provider, and a marketing solution provider. The Acquiring Group through, McAfee Security South Africa Proprietary Limited (“McAfee”),[3] is active in the wider supply of security software, specifically consumer cybersecurity software solutions. McAfee provides consumer-level cybersecurity software solutions.

Target firm

[5] Mimecast is a company registered in accordance with the laws of Bailiwick of Jersey. Mimecast’s ordinary shares are listed on the Nasdaq Global Select Market and it is not controlled by any firms.[4] In South Africa, Mimecast controls Mimecast South Africa (Pty) Ltd (“Mimecast South Africa”). Mimecast and all the firms

directly and indirectly controlled by it will hereinafter collectively be referred to as the “Target Group”. There

are no B-BBEE shareholders within the Target Group.

[6] The Target Group is a provider of cloud security and risk management services for email and corporate information through an integrated

suite of proprietary cloud services that protect enterprise customers from the significant business and data security risks they are exposed to through their emails and other corporate systems.[5] Relevant for the competition assessment, we note that the and approximately [....] of the Target Group’s annual recurring revenue in South Africa is derived through the reseller and managed service provider channel in South Africa, rather than directly to consumers. Further, Mimecast South Africa has

Competition Assessment

Horizontal assessment

[7] Both parties are active in the broad market for IT services in South Africa. More narrowly, both are active in the provision of cybersecurity services. However, the Acquiring Group (through McAfee) solely provides consumer-level cybersecurity software solutions; while the Target Group solely provides enterprise-level cybersecurity software solutions. The Commission investigated the extent to which these two types of services are substitutable.

[8] The investigation revealed that the merging parties do not provide the same products or services to the same customers. A significant degree of investment of both time and resources would be required for a supplier of enterprise security software to enter the market for the supply of consumer security software (and vice versa).[6]

[9] These differences were also confirmed by three Mimecast customers. confirmed that enterprise-level software services are different from the consumer-level software services in packaging, the engagements models, skills requirement, customer base and pricing models. The Commission concluded that the merging parties’ group companies are not close competitors in the market for cybersecurity software solutions; and that, when properly understood, the merging parties’

activities in this market do not present a horizontal overlap.

[10] Taking the above evidence into account, the proposed transaction is unlikely to give rise to substantial lessening of competition as a result of horizontal effects.

Vertical assessment

[11] The merging parties have no existing vertical links. However, the Commission identified potential vertical overlap in relation to their activities; in that, one of the indirect subsidiaries of the acquiring group, Networks Unlimited,[7] distributes enterprise cybersecurity software services on behalf of Mimecast’s rivals.

[12] The Commission is of the view that the merged entity is unlikely to have the ability to foreclose the merging parties’ competitors from access to enterprise cybersecurity software services because (i) the Target Group is not a dominant supplier of enterprise cybersecurity software services ( % market share[8]); (ii) the Target Group does not currently use distributors in South Africa to indirectly distribute its products; rather, it distributes its products through resellers and Managed Service Providers (“MSPs”), which operate at a level downstream from distributors; and (iii) the Acquiring Group is unlikely to have the capacity to distribute all the products/services of the Target Group, given its low market shares.

[13] The Commission found that the proposed transaction is also unlikely to lead to customer foreclosure on account of the Acquiring Group’s low market share (6.2%[9]) and the fact that Mimecast’s rivals would have numerous other distributors in the market to choose from; for example, Axiz (Pty) Ltd, Maxtec Peripherals (Pty) Ltd, First Distribution, and Tarsus Distribution, amongst others. expanded toolkit, additional features and the support of experienced professionals. Furthermore, consumer-level cybersecurity software uses a reactive approach. They cover workstations from being infected with viruses or other malware that attack through websites. This is a defensive force that guards against attacks that are already working against the user. On the other hand, enterprise-level cybersecurity software works proactively. It can protect firms from website attacks just like consumer- level security systems do, however the enterprise-level

security also actively protects the firm from potential threats before they manifest. Moreover, the two types of cybersecurity

software also require different levels of maintenance and expertise to manage. Since cybersecurity threats are constantly evolving,

solutions must always update to thoroughly protect the firm.

[14] As set out in the evidence above, the proposed transaction is unlikely to give rise to a substantial lessening of competition as a result of vertical effects.

Public Interest Assessment

[15] The Acquiring Group has no employees in South Africa. The Target Group’s employees are represented by an employee representative, who did not raise concerns. The merging parties confirmed that no retrenchments were contemplated as a result of the proposed transaction.

[16] Neither the Acquiring nor Target Group are held by historically disadvantaged persons (“HDPs”); however, the Target Group contributes to multiple B-BBEE initiatives regarding (i) skills development; (ii) supplier development; (iii) enterprise development; and (iv) socio-economic development (also called corporate social responsibility).

[17] The Commission engaged the merging parties on a condition to maintain these initiatives going forward. The merging parties agreed to a condition that the B-BBEE initiatives that the Target Group contributes towards, should continue post-merger for period of at least

[18] We approve the proposed transaction subject to the following set of conditions:

18.1. For a period of at least [....] years following the Implementation Date, the Merging Parties will ensure that the Target Group will continue to contribute (at a minimum) to the following initiatives per annum:

18.1.1. Skills development:

18.1.1.1. External bursaries to underprivileged individuals (including stipends) in the amount of, no less than,

18.1.1.2. External bursaries for students with disabilities in the amount of, no less than,

18.1.1.3. Training (including bursaries) for RSA Mimecasters in the amount of, no less than,

18.1.1.4. Youth Employment Services (YES) programme in the amount of, no less than,

18.1.1.5. Partners for Possibilities (mentoring programme) in the amount of, no less than, and

18.1.2. Supplier Development in the amount of, no less than,

18.1.3. Enterprise Development in the amount of, no less than, and

18.1.4. Socio-Economic Development in the amount of, no less than,

Conclusion

[19] We conclude that, on the basis of the above evidence, the proposed transaction is unlikely to substantially prevent or lessen competition. We believe that the proposed transaction, looked at alongside the conditions imposed will have a positive impact on the public interest.

[20] The proposed transaction is approved subject to the abovementioned public interest conditions. The full set of conditions is annexed hereto as Annexure “A”

Date: 11 May 2022

Professor Liberty Mncube

Ms Mondo Mazwai and Professor Imraan I. Valodia concurring

Tribunal Case Manager: Mpumelelo Tshabalala

For the Merging Parties: Wade Graaff, Jocelyn Katz and Keabetswe Magano

For the Commission: Rethabile Ncheche, Ratshidaho Maphwanya and Tamara

Paremoer

[1] Magnesium is indirectly controlled, as to 67.296%, through Permira Fund VIII- 1 SCSp and Permira Fund VIII- 2 SCSp (“Permira Funds VIII”).

[2] [....]

[3] McAfee Corp indirectly controls McAfee South Africa. McAfee Corp is a future portfolio company of Permira. However, neither Magnesium

nor the Permira VIII fund (controller of Mimecast) will acquire any share ownership or voting rights in McAfee Corp. (McAfee Security South Africa Proprietary Limited has not yet closed and is subject to a number of conditions, including the receipt of regulatory approvals. The McAfee Transaction is currently anticipated to close in the first half of 2022.)

[4] The shareholders of Mimecast that own more than 5% are: Blackrock Inc. and Peter Bauer.

[5] The Mimecast Group’s primary offerings (including in South Africa) include: email security; continuity and sync & recover;

archiving; awareness training; web security; DMARC analyzer (which allows customers to more effectively implement and manage complex domain-based message authentication reporting and conformance); brand exploit protection (which provides continuous, proactive monitoring for fake websites being used to launch phishing attacks exploiting an organization’s brand credibility and trusted relationship with its customers or other stakeholders in the supply chain); and threat intelligence.

[6] Consumer-level cybersecurity software are off-the-shelf solutions primarily used by individuals or small businesses. They are created to be easy to use and offer few options for customization. While enterprise-level cybersecurity software represents a more sophisticated approach. They are designed to protect larger organizations with more critical security needs. What they offer includes a vastly

[7] Exclusive Group controls the Networks Unlimited Group by virtue of a recent acquisition approved by the Commission on 14 September 2021 (Commission Case Number: 2021JUL0041).

[8] The Commission calculated this value by assessing the total revenue for the market for enterprise cybersecurity software is [....] and of the total market Mimecast accounts for Converting the [....] into Rands, it is approximately [....] This amount forms part of the total revenue for Mimecast in South Africa.

[8] The Commission calculated this value by assessing the total revenue for the market for enterprise cybersecurity software is [....] and of the total market Mimecast accounts for

Converting the [....] into Rands, it is approximately [....] This amount forms part of the total revenue for Mimecast in South Africa.

[9] The market shares are based on the Commission’s calculations in the previous matter between Exclusive Networks and Network

Limited, Case no. 2021Jul0041.