Buying a licensed company: how change of control actually works

A financial services licence or registration is not a document that changes hands at completion. It attaches to the legal entity that earned it. When you buy a licensed company, the authorisation stays exactly where it has always been - inside the company - and what changes is who controls that company. That single distinction drives everything else in the deal.

Regulators authorise entities, but they trust people. Every serious regime therefore has a mechanism - called change of control in the UK, qualifying holding in the EU - through which the regulator either approves the incoming owner before completion or is notified and given the opportunity to review. You are not transferring a licence. You are asking a regulator to accept you as the person behind one.

The two models differ in where the regulator sits in the timeline. Approval-based regimes put the assessment before completion: the deal legally cannot close until the regulator has cleared the new controller. Notification-based regimes let the parties move while requiring the regulator to be kept accurately informed, with review happening around rather than ahead of the transaction. Which model applies is a property of the jurisdiction and licence type, not something the parties can negotiate - which is why it should be one of the first facts you establish about any target, before price is even discussed.

This is why "licence for sale" is shorthand at best. What is actually for sale is a company in a defined standing with its regulator, and the sale only works if the regulator remains comfortable once you appear on the share register. The practical consequence follows directly: the regulatory workstream is not paperwork you bolt on after signing. In an approval-required jurisdiction, it is the deal - the longest workstream, the binding condition, and the one item neither side can accelerate by negotiating harder.

It also cuts both ways. The seller cannot simply hand the company over, because doing so without the regulatory step puts the entity's own standing at risk - the very asset being sold. A seller who proposes to skip or "sort out later" the change-of-control process is not offering you a shortcut; they are offering you a company whose authorisation may not survive the transaction. In our experience, how a seller talks about the regulatory step is itself due diligence: the ones who have the process mapped are usually the ones whose files are in order.

In the UK, acquiring control of an FCA-authorised firm requires a section 178 notice before you take control. The statutory assessment window is 60 working days, and the clock can stop each time the FCA requests further information. Market commentary reports real-world approvals often taking longer than the statutory window, and we plan UK mandates on that basis rather than on the statute alone.

The EU framework works the same way for e-money and payment institutions. Acquiring a qualifying holding - thresholds start at 10% and step upward - requires prior notification to the regulator, for example the Bank of Lithuania, and an assessment window of up to 60 working days that likewise pauses on information requests. As of July 2026, MiCA extends the pattern to crypto-asset service providers: qualifying-holding changes in a CASP are notified to and assessed by the national competent authority before completion, under the Articles 83-84 framework. In the UAE, VARA and ADGM FSRA both require prior approval of controller changes, with timelines scoped case-by-case.

The honest read: where prior approval is required, the regulatory window dominates the deal timeline. Price, documents and commercial terms can all be agreed in weeks; the regulator will still take the time the statute allows, plus every pause the file earns. Plan months, not weeks, and treat any promise of a quicker outcome with suspicion - no adviser controls the regulator's clock.

Sequencing follows from that. Because the window only starts once a complete notice is filed, the buyer file should be assembled in parallel with negotiation, not after signing - every week spent gathering documents after exchange is a week added to an already long calendar. Sale agreements in this space commonly pair the approval condition with a long-stop date, so both sides know when a stalled assessment lets them walk away rather than wait indefinitely. And because a stopped clock is the single biggest source of slippage, the discipline that matters most during the window is unglamorous: complete answers, delivered promptly, with the seller contractually bound to supply whatever the regulator asks about the target's side of the file.

Canada illustrates the other model. FINTRAC operates no EU-style prior-approval regime for MSB acquisitions, but that is not the same as no scrutiny. Registration information, including ownership, must be kept current, and FINTRAC applies both pre-registration and ongoing review - a buyer who treats the registration as fire-and-forget will meet the regulator eventually, on worse terms. If the business also holds a Bank of Canada registration under the RPAA, that is a separate regime with its own requirements; assess it independently rather than assuming the MSB analysis covers it. Our Canadian MSB guide covers the registration mechanics in more depth.

In our own mandates, clean entities under notification-based regimes typically close in one to two weeks, subject to regulator timelines. "Clean" is doing the work in that sentence: a documented ownership chain, current filings, a live registration and a buyer file ready on day one. Remove any of those and the notification model's speed advantage evaporates.

The comparison with approval regimes is therefore less about paperwork volume than about who holds the clock. Under a notification model, a prepared buyer and a clean target control most of the timeline themselves. Under an approval model, the same buyer and the same target still wait for the regulator to finish - preparation shortens the queue of questions, but it cannot waive the window. That difference should shape target selection as much as price does: a slightly more expensive entity in a regime you can actually complete in matters more to most buyers than a bargain that sits in assessment for two quarters.

This sequence - screening, conditional agreement, buyer file, regulatory window, handover - mirrors stage five of how we run a mandate. The stages are the same in every jurisdiction; what changes is who holds the clock.

Whatever the regime, the centre of gravity is the buyer's own file. The regulator's question is not whether the target is a good business; it is whether you are an acceptable controller of a regulated one. Three elements carry most of the weight: the ultimate beneficial ownership chain, mapped through every intermediate holding company to named natural persons; source of funds for this specific purchase; and source of wealth - how the money behind the money was made.

The two money questions are related but distinct, and conflating them is a common cause of information requests. Source of funds asks where the purchase price for this transaction is coming from - which account, which asset sale, which facility. Source of wealth asks the longer question of how that money was accumulated in the first place: the business sold, the salary earned, the inheritance received. A buyer who can evidence the first but only narrate the second should expect the clock to stop while the gap is filled.

Buyers routinely underestimate this file. A structure that is perfectly legal but hard to explain reads, to a regulator, like a structure built to be hard to explain. Layered holding companies across several jurisdictions are workable, but every layer needs a document and a reason. The buyers who move fastest through assessment windows are the ones who prepared the file before signing, not after.

We cover the evidence pack in detail in our guide to what regulators check in a fit-and-proper review. The short version: assemble it early, make it boring, and answer information requests completely the first time - every incomplete answer restarts a stopped clock later than it needed to.