Buying a Licensed Financial Firm: Risks & Due Diligence
Most buyers of regulated financial businesses start from the same piece of arithmetic. A fresh payment institution or investment firm authorisation can take a year or more in many European jurisdictions, so buying a company that already holds one looks like a way to skip the queue. Sometimes it is. More often the queue just moves: the buyer stops waiting on an authorisation decision and starts waiting on a change-of-control approval, and the company they agreed to buy turns out to carry problems nobody priced in.
None of that makes the route a bad one. For a group that needs a regulated footprint quickly, acquiring an already-licensed financial firm can still save months and bring staff, systems and banking relationships with it. But the transactions that close cleanly tend to share a handful of habits, and the ones that collapse usually fail at the same few points.
You are buying a permission, not an object
A licence is not a certificate that travels with the share register. It is a permission granted to a particular entity, run by particular people, to carry on particular activities. Change the owners and the regulator is entitled to look again.
In the EU, anyone who intends to acquire a qualifying holding (broadly 10% or more of the capital or voting rights) must notify the competent authority before completing, and further notifications are triggered as the stake crosses 20%, 30% and 50%. The supervisor then works to a 60-working-day assessment period, which it can pause once to ask for more information. The UK is built the same way. The FCA has up to 60 working days from the point a change-in-control notification is complete, interruptions excluded, and acquiring control without prior approval is a criminal offence.
Sixty working days is roughly three calendar months before anyone has written a request for information. Add the weeks it takes to assemble a complete file and the clock is rarely as short as buyers hope. “Skip the queue” really means swapping an authorisation timeline for an approval timeline, and the second one is only shorter if the file is clean.
Five places where due diligence earns its fee
The regulator’s correspondence file. Ask for every letter, inspection report and remediation plan from the last several years, not a summary written by the seller. An open remediation programme does not disappear at completion. It becomes the new owner’s programme, with the new owner’s name on the follow-up letters.
Capital and safeguarding. Own funds requirements are not fixed numbers. For payment and e-money institutions they scale with business volume, so a firm that sits comfortably above its minimum today may need fresh capital the moment the buyer’s growth plan kicks in. Look at the safeguarding reconciliations themselves, not just the policy that describes them. A policy is easy to write; a clean year of daily reconciliations is much harder to fake.
Key function holders. The approved directors, the compliance officer and the MLRO are part of what the buyer is paying for. If they leave on completion, replacements need to be found and, in most regimes, assessed by the regulator before they can act. Retention arrangements for these people belong in the sale agreement, not in a handshake after closing.
Banking and payment partners. Safeguarding accounts, correspondent relationships and card scheme sponsorships frequently contain change-of-control clauses. Banks will run their own onboarding checks on the incoming owner, entirely separate from the regulator’s assessment, and they do not work to a statutory deadline.
Whether the licence is actually alive. A permission that has not been used is not necessarily safe. Under both PSD2 and MiFID II, a regulator may withdraw an authorisation if the firm has not used it within 12 months or has stopped carrying on business for more than six months. Shelf companies marketed as “licensed, never traded” deserve a direct question to the regulator, or at least a legal opinion, before any money moves.
The buyer is under review too
Change-of-control assessments look hard at the acquirer: reputation, financial soundness, whether the firm will still be able to meet its obligations under new ownership, and whether there is any reason to suspect money laundering behind the deal. Buyers who treat this as paperwork tend to lose weeks.
The documents regulators ask for are predictable, so there is no excuse for assembling them late. A structure chart running all the way up to the ultimate beneficial owners. A source-of-wealth narrative that a stranger could follow. Audited accounts for the acquiring entity. A business plan for the next three years that matches what the buyer has actually told the seller. If that plan involves new services, the buyer may also need a variation of the firm’s permissions, which is a separate process running on its own timetable.
What the premium should pay for
Licensed companies usually sell at a premium to their net assets. That premium is a fee for time saved and infrastructure inherited, and it should move with the evidence. Remediation work, thin compliance staffing, an unhappy banking partner or a business that has barely traded should all pull it down. Regulatory capital that cannot be extracted without breaching requirements should not be counted as if it were spare cash.
Deal structure does a lot of the work here. Conditional completion with a long-stop date tied to regulatory approval, interim covenants that stop the seller changing the business before closing, and some portion of consideration deferred or held in escrow against warranty claims are standard tools. They are not signs of distrust. They are how both sides avoid arguing later about things neither could see at signing.
A sequence that tends to work
Sign the NDA and get the information memorandum. Run regulatory due diligence before commercial due diligence, because a regulatory problem can kill the deal while a commercial one only changes the price. Where the regulator offers pre-notification meetings, use them. Then sign a conditional agreement, file a complete notification rather than a fast one, and keep the seller’s management engaged until approval arrives.
Buying a licensed firm remains one of the quicker ways into a regulated market. It just isn’t a shortcut around the regulator, and the buyers who plan for that from the first call are usually the ones who end up owning the company.
