Buying a licensed fintech: the due diligence checklist

Dimension one is the register match: legal entity, registration or licence number, instrument type, recorded services and current status, reconciled between the seller's file and the regulator's live public record. Any difference becomes a defined finding to resolve: an inactive service line, a condition on the licence or a pending variation.

Dimension two is instrument quality. Identify the exact registration, membership, authorisation or distribution status and test whether it permits the buyer's intended business at the intended scale - including the services the buyer plans to add, which may require a variation the regulator has to approve.

Dimension three is the cross-border layer. For EU entities, passport notifications per service and state; for groups, the map of which entity carries which corridor. The notification and register schedule in force defines the usable footprint.

Dimension four is safeguarding and client funds: named accounts, designation evidence, reconciliation records, breaks and their resolution. Dimension five is banking and infrastructure continuity - the relationships most exposed to a control change. Banks, scheme memberships, processors and principal issuers can all re-run due diligence on new owners; written continuity positions belong in the closing conditions, not the assumptions.

Dimension six is the financial crime file: AML programme quality, reporting history, regulator correspondence, inspections, findings and remediation. Transaction volumes and operating history provide the context. Dimension seven is people and substance: key-function holders, their regulatory approvals, contracts, retention and whether real decision-making sits where the licence says it does.

Dimension eight is technology and data: platform ownership or licences, source escrow, security testing, incident history, outsourcing register and exit plans. In multi-entity groups, add the intercompany layer - who owns the platform, who bears the costs, and whether service agreements survive separation of any entity from the group.

Dimension nine is the change-of-control plan itself: which approvals, notifications and assessments each jurisdiction requires, in what sequence, with what evidence on the acquirers, funding and business plan. Dimension ten is transaction terms: closing conditions tied to regulatory and continuity outcomes, warranties matched to the findings, and a continuity plan for each key relationship.

The checklist is not a phase that ends before the regulatory process begins; run them as parallel tracks that feed each other. Register reconciliation and instrument-quality findings shape the acquisition structure - what is bought, in what order, with what conditions - and that structure is exactly what the change-of-control file describes to each regulator. Discovering a scope mismatch after the filing is drafted means re-drafting the filing.

Continuity findings drive the closing conditions. If the bank's position on the new ownership is unknown at signing, the agreement should define the available continuity routes, including confirmation, an alternative provider or a commercial adjustment. The same logic applies to principal issuers behind distributor statuses and to scheme memberships - every relationship diligence flags as control-sensitive earns a condition, a warranty or both.

In multi-jurisdiction groups, sequence the filings deliberately: regulators talk to each other, and a submission narrative that differs between authorities creates a consistency issue. One acquirer file, one funding story, one business plan, adapted per regime - prepared once, filed consistently everywhere.