In most sectors, due diligence tests the numbers, the contracts and the people. In financial services it also tests the licence. A payment institution, electronic money institution (EMI), lender, investment firm or cryptoasset business is worth what it is worth because a regulator has authorised it to do something others cannot, and the value holds only while the firm keeps meeting the conditions of that authorisation.
That changes the questions an investor asks. Revenue growth, margins and cash flow still matter, but so do the firm's standing with its regulator, the quality of its safeguarding, its financial crime controls, its capital headroom and whether the regulator will approve the investor as a new controller. A strong set of accounts can sit alongside a regulatory position that limits what the business can do next.
This guide sets out what investors should examine in a regulated financial services company, the evidence to request, how regulatory approval of the investment works and how to keep monitoring the position after completion. It brings together the firm's earlier guidance on minimising risk in financial services investments. For a fuller treatment of the regulatory workstream on its own, see the firm's guide to regulatory due diligence in financial services.
Every investment in a regulated financial firm carries five categories of risk. Due diligence should reach a view on each, because they interact: a liquidity squeeze can become a regulatory issue within days, and a regulatory restriction can become a revenue issue within weeks.
| Risk | What to examine |
|---|---|
| Regulatory | Licences and permissions, regulatory correspondence, restrictions, capital, safeguarding, Consumer Duty and financial crime controls |
| Market | Exposure to interest rates, foreign exchange, asset prices and economic cycles; concentration of revenue by product and client |
| Operational | Processes, people and systems; outsourcing, cyber security, incident history and operational resilience |
| Credit | Lending book quality, counterparty exposures, arrears, provisioning and underwriting practice |
| Liquidity | Ability to meet short-term obligations, funding sources, settlement exposures and access to banking partners |
Regulatory due diligence answers three questions: does the firm hold the permissions it needs for what it actually does, is it meeting the conditions of those permissions, and is there anything in its relationship with the regulator that limits its future. The firm's free FCA licence checker gives a first view of a UK firm's register entry.
Start with the regulator's public register, such as the FCA Financial Services Register, and compare the permissions, agents, distributors and any requirements or restrictions it shows with the business the firm actually runs. Gaps between the two, such as a payment service offered without the matching permission or an unregistered agent network, are the most material regulatory finding a buyer can make. For groups with EU customers, confirm the EU-authorised entity that serves them, because UK firms lost EU passporting rights on 31 December 2020.
Request all correspondence with the regulator for at least three years: supervisory letters, information requests, attestations, skilled person reviews, voluntary requirements and any enforcement contact. A firm that has agreed a voluntary requirement to stop onboarding customers, for example, may report healthy revenue on an existing base that it cannot grow.
Confirm that the firm meets its initial capital and ongoing own funds requirements with headroom. Under the Payment Services Regulations 2017, payment institutions need initial capital of €20,000, €50,000 or €125,000 depending on their services; under the Electronic Money Regulations 2011, an authorised EMI needs €350,000. Check how own funds are calculated, whether the calculation is reviewed, and what the business plan does to the requirement as volumes grow.
For payment institutions and EMIs, safeguarding is the most important control. The FCA's CASS 15 rules under PS25/12 came into force on 7 May 2026. Firms now carry out internal and external reconciliations each reconciliation day, maintain a resolution pack, submit a monthly safeguarding return and, unless they have safeguarded no more than £100,000 over at least 53 weeks, obtain an annual safeguarding audit. Ask for the latest audit report, the monthly returns, recent reconciliations and any breaches notified to the FCA. The firm's guide to CASS 15 after implementation sets out what good looks like.
Review who holds approved or controlled roles, whether the MLRO and compliance officer are adequately resourced, how the board receives risk information, and whether directors and persons with significant control have completed Companies House identity verification, which became mandatory on 18 November 2025 with a 12-month transition for existing appointments.
| Area | Evidence |
|---|---|
| Permissions | Register extract, authorisation letter, variations of permission, agent and distributor lists |
| Supervision | Three years of regulator correspondence, attestations, requirements and skilled person reports |
| Capital | Own funds calculations, regulatory returns, capital plan |
| Safeguarding | Annual safeguarding audit, monthly returns, reconciliations, resolution pack, safeguarding account letters |
| Conduct | Consumer Duty board report, fair value assessments, complaints data |
| Financial crime | Business-wide risk assessment, MLRO report, monitoring alerts and backlog, SAR log |
| Governance | Board and committee minutes, compliance monitoring plan, breach register |
The core review is the same for every regulated firm, but each business model has its own points of value and exposure.
Where the target's value rests on a licence, buyers should also consider whether acquiring an already authorised firm is the right route at all, or whether a new application would be faster and cleaner. The firm's marketplace of licensed companies lists authorised firms available for acquisition.
Financial health is the foundation of the investment case. The metrics are familiar, but in a regulated firm they should be read alongside the regulatory requirements they support.
Operations separate solid returns from strong ones. The question is whether the firm can execute its plan and scale without weakening its controls.
Banking relationships deserve particular attention. A payment or e-money firm that loses its safeguarding or operating accounts can lose its ability to trade within weeks, so the depth and diversity of those relationships is a valuation point, not an operational detail.
Market position is often the most reliable guide to future performance. Due diligence should test how the firm compares with its competitors and whether its advantages will last.
Strong leadership is central to long-term success in a regulated business, because the regulator assesses the people as well as the firm.
Findings matter for what they do to the price, the terms and the timetable. Most fall into a small number of patterns, each with a standard response.
| Finding | Typical deal response |
|---|---|
| Activity carried on outside the firm's permissions | Stop or regularise before completion; specific indemnity; possible variation of permission as a condition |
| Safeguarding reconciliation breaks or a qualified audit opinion | Remediation plan agreed before signing; escrow or retention; condition of completion |
| Open regulatory requirement or skilled person review | Price adjustment for the growth it limits; completion timed to its removal or a clear remediation path |
| Transaction monitoring backlog or weak customer files | Funded remediation programme; warranties on financial crime controls |
| Thin own funds headroom | Capital injection at completion, sized against the post-deal business plan |
| Dependence on one banking partner | Second banking relationship as a post-completion priority; warranty on the status of existing accounts |
Regulatory findings rarely stop a transaction on their own. They change who bears the cost of putting things right and when, which is why they belong at the start of the process rather than in the final week before signing.
Valuation should be realistic and supported by the growth case. Discounted cash flow, comparable company analysis and precedent transactions are the standard methods, and each should reflect the regulatory findings: remediation costs, capital the business must retain, and any limit on growth from requirements or restrictions.
Plan the exit at entry. A public listing, a sale to a strategic buyer or a secondary transaction each needs the next buyer, in turn, to pass the regulator's change in control assessment, so a clean regulatory record protects the exit value as well as the entry price.
In the UK, anyone who decides to acquire or increase control of an FCA-authorised firm, including an authorised payment institution or EMI, must notify the FCA and obtain approval before completing. Control generally starts at 10% of shares or voting power, with further notifications as holdings cross higher thresholds; for certain firms outside the EU-derived regimes, such as consumer credit firms, the threshold is 20%. Banks and insurers are approved by the PRA.
Transaction documents should make regulatory approval a condition of completion and allow enough time for it. The firm's complete guide to FCA change of control applications covers the notification, evidence and timetable in detail.
Approval rules apply wherever the target holds licences. US money transmitters need the approval of each state regulator that licenses them before a change of control, and a money services business must re-register with FinCEN when more than 10% of its voting power or equity changes hands. EU authorised firms need approval from their national competent authority. A target licensed in several countries needs a single approvals plan, run in parallel.
Due diligence does not end at completion. The investor's protection after closing comes from the same disciplines, applied continuously.
| Phase | Typical duration |
|---|---|
| Scoping and document request | 1–2 weeks |
| Review, management interviews and testing | 3–6 weeks |
| Report, findings and price or terms adjustment | 1–2 weeks |
| FCA change in control assessment | Up to 60 working days from a complete notification |
Regulatory due diligence runs alongside the financial due diligence led by the buyer's accountants and the legal due diligence led by its lawyers. Starting the regulatory workstream first is usually the efficient order, because its findings shape the price, the warranties and the conditions of completion. The firm's transactions and change of control service covers regulatory due diligence for buyers and sellers, and the change in control notification itself.
A review of whether a financial firm holds the permissions it needs, meets the conditions of its authorisation and has any regulatory issues that limit its value or future plans.
The register extract and permissions, three years of regulator correspondence, own funds calculations, the annual safeguarding audit and monthly safeguarding returns, the Consumer Duty board report, the MLRO's annual report and board minutes.
Yes, if you will acquire or increase control, which generally starts at 10% of shares or voting power. Approval must be obtained before completion.
The FCA has up to 60 working days from when it treats the notification as complete, plus any period in which it interrupts the assessment to request information.
It is a criminal offence under section 191F of FSMA 2000, and the FCA should be notified as soon as possible.
Typically five to ten weeks for scoping, review and reporting, with the regulatory approval period running after signing.
Buckingham Capital Consulting has obtained FCA authorisations for payment and e-money firms including Nexpay, Orbital, Dzing Finance and Hryze since 2013, and obtained Moneliq's FCA variation of permission. It carries out regulatory due diligence for buyers and sellers of banking, payments, e-money and cryptoasset businesses, and prepares the change in control notification that follows.
Speak to an expert: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or info@buckinghamcapitalconsulting.co.uk.
This article is general information, reviewed against the regulator’s published requirements on the date shown. It is not legal advice; the regulator’s current publications take precedence.