Palo Alto Networks is pushing on with its prospective $25 billion purchase of CyberArk, requesting approval for the deal in Germany.

According to filings with the country’s competition agency (Bundeskartellamt, FCO), Palo Alto Networks requested clearance for the deal in late November.

Acquisition rules in Germany require businesses are required by law to have potential acquisitions cleared by the FCO if a transaction value exceeds €400 million ($465 million), or if combined turnover exceeds €500 million ($580 million).

According to law firm Osborne Clarke, deals in Germany take on average three to six months to complete. The FCO will look at Palo Alto Networks’ CyberArk acquisition initially in a preliminary investigation. Should the agency find potential competition concerns, a more in-depth investigation would kick in, subsequently elongating the acquisition clearance process.

The deal for CyberArk is expected to close during the second half of Palo Alto Networks' fiscal 2026. It would be the second-largest cybersecurity acquisition, surpassed only by Google’s ongoing efforts to snap up Wiz for $32 billion.

The prospective purchase is one of several acquisitions made by Palo Alto Networks in the past year as it looks to position itself as an end-to-end security provider.

Having picked up AI security firm Protect AI for an undisclosed fee in July, the vendor went on to strike deals for observability platform Chronosphere as well as CyberArk. No fee was also disclosed for Chronosphere, though the vendor was recently valued at $3.35 billion.

One deal that didn’t come to fruition was SentinelOne, an Israeli AI-powered cybersecurity provider valued between $8 billion and $10 billion. Both parties denied rumors of a potential takeover, with that purchase now superseded by the CyberArk acquisition.

If the CyberArk deal goes ahead, it will be the second biggest acquisition of the year, passed only by Google Cloud’s ongoing $32 billion Wiz buyout, and outnumbering Palo Alto’s biggest acquisition to date, 2024’s $1.1  billion grab of IBM’s QRadar software-as-a-service (SaaS) assets.

More on German M&A rules

While the FCO has authority on mergers and acquisitions, in some exceptional cases, the Federal Ministry for Economic Affairs and Energy (Bundesministerium für Wirtschaft und Energie, BMWE) can greenlight a deal the agency blocked if it feels that its advantages to the overall economy or an overriding public interest outweigh the restraint of competition.

FCO decisions can be appealed; these are heard in the Higher Regional Court in Düsseldorf. The next step after that sees cases head to the Federal Court of Justice (BGH) – the highest court for ordinary civil and criminal cases.

If a deal is implemented prior to receiving FCO clearance – otherwise known as “gun jumping” – firms would face fines of up to 10% of global turnover.