In financial services, a company's regulatory licences are central to its value. A firm that cannot meet its ongoing obligations, or that could lose or have restrictions placed on its permissions, carries a risk that ordinary financial and legal diligence will not fully capture.
Regulatory due diligence establishes the target's regulatory position and its ability to keep operating under its licence. It sits alongside financial, legal, operational and technology diligence and covers compliance culture, governance, risk management, regulatory reporting and the target's relationship with its regulator. Done early, it identifies issues while there is still time to price them, remediate them or restructure the deal.
The same work serves different purposes depending on which side of the transaction commissions it.
| Side | Purpose | Main output |
|---|---|---|
| Buy-side | Confirm the target complies with its rules, find issues that affect value, limit exposure to penalties and plan integration | A findings report that feeds price, warranties, indemnities and conditions |
| Sell-side | Identify and fix gaps before marketing the business, and shorten the buyer's review | A vendor report and a remediation plan completed before launch |
| Investor | Assess a minority or growth investment and the governance rights needed to protect it | A risk summary and conditions for investment |
Investors taking a minority stake have their own priorities, covered in due diligence for investors in financial services companies.
Every review starts with the public record. The FCA Register confirms what the target is permitted to do and whether the FCA has placed any limits on it.
| Check | What it shows |
|---|---|
| Status | Authorised, registered, cancelled or in a temporary regime |
| Permissions | The regulated activities and investment types the firm may carry on |
| Requirements | Any requirements or restrictions on the business, including voluntary requirements agreed with the FCA |
| Individuals | Senior managers and other approved individuals, with their roles and dates |
| Appointed representatives | Firms trading under the target's permission, for which it is responsible |
| Trading names and passports | Names used by the firm and any remaining cross-border notices |
| Disciplinary history | Final notices and other published enforcement outcomes |
The Register shows what the firm may do; the diligence then tests whether what it actually does matches. Products launched outside the permissions, or activities carried on through appointed representatives without adequate oversight, are among the most valuable findings to establish before signing.
Licence health is the question of whether the firm will continue to meet the conditions of its authorisation after the transaction. For firms authorised under FSMA, these are the threshold conditions in the FCA's COND sourcebook: the firm's head office and effective supervision, appropriate resources, suitability and a viable business model. Payment and e-money institutions meet equivalent conditions under the Payment Services Regulations 2017 and the Electronic Money Regulations 2011, including initial capital, ongoing own funds, safeguarding and sound governance.
A sound review tests each condition against evidence: capital and liquidity headroom, the adequacy of the compliance and financial crime functions, the fitness and propriety of the board and key staff, and whether the business model described to the FCA is the one the firm operates. A buyer should also consider whether its own plans for the business would change the firm's risk profile enough to require a variation of permission or new authorisation.
Review financial statements, cash flow, assets, liabilities and profitability, and reconcile them to regulatory capital and liquidity returns. Confirm that the firm has met its capital requirement throughout the review period and assess the headroom under the buyer's plans.
Examine how responsibilities are allocated and how risks are managed, including internal controls and the three lines of defence: the business, an independent risk and compliance function, and internal audit. Board and committee minutes should show challenge and decisions, not only reports received.
Assess anti-money laundering, customer due diligence, sanctions and data protection policies and test them against customer files. Review the MLRO's annual reports, suspicious activity reporting volumes, staff training records and the business-wide risk assessment.
Confirm the firm holds the licences and registrations needed in every market it serves. Review correspondence with the FCA and other regulators, supervisory letters, attestations, skilled person reviews under section 166 of FSMA, voluntary requirements and any open investigations.
Review the Consumer Duty board report, complaints data, upheld rates, Financial Ombudsman Service outcomes and any past remediation exercises. Complaint themes often point to conduct issues that have not yet reached the regulator.
Review the corporate structure, material contracts, banking and safeguarding agreements, scheme memberships and any current or threatened litigation. Change of control clauses in banking, card scheme and key supplier contracts can be as important as the regulatory approval itself.
Review outsourcing arrangements and partner contracts, and assess whether material providers meet the regulatory standards the firm relies on them for. Exit plans and concentration on single providers should be tested.
Check that regulatory returns were submitted on time and reconcile to the books, and that operational processes and audit trails support the figures. Late or restated returns indicate weaknesses in data and governance.
Each regulated sector has its own priority areas. The table lists the items most likely to affect value.
| Sector | Priority checks |
|---|---|
| Payment institutions and EMIs | CASS 15 safeguarding audit, monthly safeguarding returns, daily reconciliations, own funds, safeguarding bank relationships |
| Cryptoasset firms | MLR registration status and whether the firm has applied in the FCA window that closes on 28 February 2027, ahead of the new regime on 25 October 2027 |
| Investment firms | MIFIDPRU capital and liquidity, client money and assets under CASS, best execution and suitability |
| Consumer credit firms | Affordability, arrears handling under CONC, and historical complaint and redress exposure |
| Banks | PRA capital, liquidity and Basel 3.1 readiness from 1 January 2027, alongside FCA conduct |
| Insurers and intermediaries | Fair value assessments, claims outcomes, delegated authority oversight and Solvency UK for insurers |
For payment and e-money targets, safeguarding is usually the single most important workstream, because a shortfall in customer funds is both a regulatory and a financial liability. The requirements are set out in CASS 15 explained. For cryptoasset targets, the transition to authorisation is covered in the guide to the UK cryptoasset regime.
Groups with entities in several countries need diligence in each jurisdiction where a licence is held. UK firms lost EU passporting rights on 31 December 2020, so a UK payment or e-money institution serves EU customers only through a separate entity authorised in an EU member state, and each entity has its own regulator, change in control process and timetable.
For cryptoasset businesses in the EU, the MiCA transitional periods ended on 1 July 2026 at the latest in every member state, so an EU target without MiCA authorisation can no longer rely on a national registration. The diligence should confirm which entity holds which licence, which customers each entity serves, and whether the group's activity in each country is covered.
If the target is FCA-regulated, the buyer must notify the FCA and obtain approval before acquiring or increasing control. The regime applies to FSMA firms and, by extension, to payment and e-money institutions.
| Point | Position |
|---|---|
| Acquiring control | 10% or more of the shares or voting power in the firm or its parent, or significant influence over management (FSMA s181) |
| Increasing control | Crossing 20%, 30% or 50%, or becoming a parent undertaking (FSMA s182) |
| Assessment period | Up to 60 working days from a complete notification, excluding any interruption period |
| Who files | A notification form for each proposed controller; a business plan where control will exceed 50% |
| Completing without approval | A criminal offence under FSMA s191F |
The diligence findings feed directly into the notification, since the FCA assesses the buyer's reputation, financial soundness and plans for the firm. A clean regulatory history and a credible business plan support a smooth assessment. The process is set out in the guide to FCA change of control applications.
A well-run review moves from the public record to the evidence and then to the deal documents. The stages below apply to most transactions; their length depends on the size of the target and the quality of its records.
| Stage | Work |
|---|---|
| Scoping | Register checks, licence map, agreement of priority areas with the deal team |
| Document review | Data room review against the checklist, with written questions to management |
| Management sessions | Interviews with the chief executive, compliance officer, MLRO and finance lead |
| Testing | Sample testing of customer files, reconciliations, complaints and returns |
| Reporting | Findings ranked by severity, with recommended deal protections |
| Regulatory filing | Change in control notification prepared using the diligence findings |
| Area | Documents and evidence to request |
|---|---|
| Regulatory status | Register extract, permissions, requirements, approved individuals, appointed representatives |
| Regulator relationship | Correspondence for at least three years, supervisory letters, attestations, s166 reports, breach notifications |
| Capital and liquidity | Regulatory returns, capital calculations, forecasts and wind-down plan |
| Governance | Board and committee minutes, responsibilities map, organisation chart, terms of reference |
| Compliance | Monitoring plan and reports, breach log, policy suite, training records |
| Financial crime | Business-wide risk assessment, MLRO reports, sample customer files, sanctions and monitoring alerts |
| Customers | Consumer Duty board report, complaints MI, Ombudsman decisions, remediation history |
| Safeguarding (PIs and EMIs) | Safeguarding audits, monthly returns, reconciliation records, bank acknowledgement letters, resolution pack |
| Third parties | Outsourcing register, material contracts, due diligence files and exit plans |
| Legal | Corporate records, material contracts, litigation and change of control clauses |
| Technology | Security assessments, incident log, operational resilience self-assessment |
Findings are rarely a reason on their own to stop a transaction. They are reflected in the price and the terms.
On the sell side, the same list becomes a preparation plan: issues fixed before the sale process starts no longer need to be priced.
Regulatory integration starts on the day of completion. The new owner should confirm the board and senior management structure, update the responsibilities map and the FCA Register entries for approved individuals, align policies with group standards where appropriate, and deliver the remediation items agreed in the deal.
Any change to the business model that was described in the change in control notification should be discussed with the FCA before it is made. Keeping the regulator informed of progress against the plan builds confidence in the new ownership.
The firm carries out regulatory due diligence on banks, payment institutions, e-money institutions, cryptoasset firms and investment firms for buyers, sellers and investors. Its transactions and change of control work covers regulatory, financial, legal, operational and technology diligence, the FCA notification and the integration plan, and its marketplace lists licensed companies available for acquisition.
A review of a regulated firm's licences, compliance history, governance, capital and relationship with its regulator, to establish whether it can keep operating under its licence after a transaction.
Before acquiring 10% or more of the shares or voting power in the firm or its parent, or significant influence over its management, and again before crossing 20%, 30% and 50%.
The FCA has up to 60 working days from a complete notification, excluding any period in which it has interrupted the assessment to ask for more information.
Acquiring or increasing control without approval is a criminal offence under section 191F of FSMA, and the buyer should notify the FCA as soon as possible after the event.
The firm's status, permissions, any requirements or restrictions, approved individuals, appointed representatives, trading names and disciplinary history.
Safeguarding: the CASS 15 audit, monthly returns and daily reconciliations show whether customer funds are fully protected.
It depends on the size and complexity of the target; a focused regulatory review of a small payment firm is typically shorter than a full review of a multi-licence group.
Buckingham Capital Consulting has worked on payment, e-money, cryptoasset and investment firm authorisations since 2013, obtaining FCA authorisations for firms including Dzing Finance, Hryze and Nexpay, and supports buyers and sellers of regulated firms through due diligence and FCA change in control. The firm assesses licence health, safeguarding and compliance so that findings can be priced or resolved before completion.
Speak to an expert: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or info@buckinghamcapitalconsulting.co.uk.
This article is general information, reviewed against the regulator’s published requirements on the date shown. It is not legal advice; the regulator’s current publications take precedence.