🇬🇧Change of Control and Buying a Licensed Company

The request arrives in the same shape every time: there is a company with a licence, we buy it, we are live next month. The assumption is that the licence is an asset that travels with the shares. In every jurisdiction where a licence is worth having, it does not. A change of owner in a licensed company is a separate consent procedure and, in substance, a second authorisation: the regulator re-examines whoever is taking the wheel, and it can say no after the price is agreed and the money is committed.

The regime carries different names — change in control in the UK, qualifying holding in the EU, acquisition of control in the US and Canada, "controller" in Singapore and Hong Kong — but the architecture repeats. There is a threshold that triggers a duty to notify the regulator before completion. There is an assessment clock that starts not on filing but on the regulator accepting the file as complete. There is a closed list of criteria: reputation, source of funds, financial soundness, business plan, the target's continuing ability to meet requirements. And there is a sanction for closing without approval, built more finely than most commentary suggests.

Control itself does not track company law or merger control. It begins at 10% in an EU bank, 20% in a PSD2 payment institution, one-third in a Canadian PSP, 25% in a US money transmitter under the state model act — and it can exist with no shares at all, where the directors are accustomed to act on someone's instructions.

What counts as a change of control

There is no single threshold, and not even one threshold per jurisdiction. In the UK, s.181 FSMA 2000 defines acquiring control as reaching 10% of shares or voting power in the authorised firm or its parent, or acquiring the ability to exercise significant influence over management; s.182 adds 20%, 30% and 50%. The FCA extends those bands to payment institutions and EMIs, leaves a single 20% band for non-directive firms, applies 33% to limited permission consumer credit firms and 25% to registered cryptoasset firms via the beneficial owner concept (thresholds page, updated 30 June 2026).

In the EU the banking threshold sits in Article 22 CRD: 10% of capital or voting rights or the ability to exercise significant influence, then 20/30/50% and subsidiary status. For payment institutions, Article 6 PSD2 frames the trigger differently: notification is due where the holding "would reach or exceed 20%, 30% or 50%", or where the institution becomes a subsidiary. The 10% band that advisers routinely transplant onto European payments does not exist at directive level for PIs — it appears only where a member state has gold-plated. The UK gold-plated: Schedule 6 to the Payment Services Regulations 2017 applies FSMA Part XII to PIs and EMIs in full, 10% band included. The practical consequence is sharp: 12% of a UK EMI needs FCA approval, while the same 12% of a Lithuanian EMI may trigger nothing under Article 6 PSD2, and the answer is in national law, not the directive.

MiCA copied the payments construction for crypto: Article 83 of Regulation (EU) 2023/1114 requires notification on acquiring a qualifying holding and on crossing 20/30/50% or making the CASP a subsidiary; assessment is 60 working days, suspension 20 working days, 30 where the acquirer sits outside the Union. Article 84(2) allows opposition not only on the merits but because the information supplied is incomplete or false.

Ownership chains: control first, multiplication second

The most common structuring error is assuming indirect holdings always dilute by multiplying percentages up the chain. The EBA, ESMA and EIOPA Joint Guidelines JC/GL/2016/01 run the other way: the control criterion applies first (para 6.3), and the multiplication criterion (para 6.6) only where control is absent. Acquire control of a company that holds 12% of a bank and the whole 12% is attributed to you — whether you bought 51% or 100% of that company. Multiplication applies only without control: 30% of a holder of 12% yields 3.6% and triggers nothing. Either way, every natural person at the top of the control chain is an indirect acquirer. Hong Kong solves the same problem mechanically: under the SFO an indirect substantial shareholding arises through a chain in which each link carries 35% of voting power. The FCA is blunter still — parents of minority controllers are themselves controllers of the authorised firm (identifying controllers).

Acting in concert is the second layer: s.178(2) FSMA aggregates the holdings of persons acting in concert. The indicators in the Joint Guidelines (para 4.6) are shareholder and corporate governance agreements, family relationships, a shared source of finance for the acquisition, consistent voting patterns and the ability to appoint a member of the management body. Pure share purchase agreements, tag-along and drag-along rights and statutory pre-emption rights are expressly excluded. Para 4.1 adds that passivity does not defeat a finding of concert, since inaction can itself create the conditions for an acquisition.

Control can exist without a single share. The Singapore Payment Services Act defines an indirect controller as a person acting alone or with others, "whether with or without holding shares or controlling voting power", in accordance with whose directions the directors are accustomed to act, or who is in a position to determine the company's policy. Changing key people while the register of members stays still is also a consent event: s.34 of the PS Act bars appointing a CEO, director or partner without MAS approval; s.8ZZV of the PSSVFO requires the HKMA's consent for the CEO and directors of a Hong Kong SVF licensee; and the US model act gives the licensee 15 days to notify a new key individual and 45 days to complete the file, after which the regulator has 90 days to disapprove.

The 60 working days do not start when you file

The 60-working-day formula is identical across CRD, MiCA and FSMA, but the start point is not the filing date. Joint Guidelines para 9.1 is explicit: acknowledgement is issued within two working days, but it starts the 60-day clock only for a complete file; an incomplete notification is also acknowledged, yet the clock does not run, and the regulator may set out what is missing in a separate letter "within a reasonable time period". Acknowledging completeness does not stop the regulator later opposing precisely because the information turned out to be incomplete. Suspension is available once — up to 20 working days, 30 for an acquirer outside the EU; further requests create no further pause. Section 190 FSMA works the same way: the request must come by the 50th working day, and there is one pause of 20 or 30 working days.

More dangerous than suspension is restart. The ECB Guide on qualifying holding procedures (section 6.4.1) states that any material change touching one of the five Article 23 CRD criteria calls the completeness of the application into question and "may result in a new qualifying holding procedure and the formal assessment period being restarted". Not a 20-day pause — a fresh count. The material change need not come from the acquirer: information reaching the supervisor from other sources, on reputation for example, counts.

Actual outcomes run shorter than the statutory ceiling. The FCA's Q4 2025/26 authorisations metrics put the median change-in-control determination at 41 calendar days from receipt of the notification to decision, with a lower quartile of 18 and an upper quartile of 65. Across the four quarters the FCA closed 276 cases with one determined past the deadline, and it holds the green threshold for this metric at 100% while lowering it to 95% for everything else. The median is only relevant to a clean structure: 60 working days is at least 84 calendar days, and the clock starts on completeness.

What the regulator actually tests

The criteria in the EU and the UK are near-identical — s.186 FSMA reproduces Article 23 CRD: the acquirer's reputation; the reputation, knowledge, skills and experience of those who will direct the business after the deal; the acquirer's financial soundness relative to the target's type of business; the target's continuing ability to meet prudential requirements; a group structure transparent enough for effective supervision; and whether there are reasonable grounds to suspect money laundering or an increase in that risk in connection with the acquisition.

The FCA fills those lines in more concretely than most acquirers expect in FG24/5. For an acquisition of 50% or more the business plan must cover three to five years, with projected financials and the proposed group structure (paras 4.55–4.56). Criminal record checks on individual controllers and beneficial owners must be no older than six months at the date of notification. Significant influence is assessed on the practical ability to shape board decisions: the power to appoint or remove a board member, recommendations the board almost always follows, veto rights over changes to the business plan, and material recurring transactions with the licensee — including owning its intellectual property or acting as a material outsourcing vehicle.

Two passages read as a direct warning to shell buyers. Para 3.5.1: on a "transformative" change in control the FCA may request the acquirer's own cost-benefit analysis in order to understand "the rationale for the acquisition vs another regulatory application route" — in plain terms, why you are buying rather than applying. Para 4.60.7: the money laundering risk indicators include an acquirer valuing the target "significantly higher than its market value considering its status as either a trading or dormant firm".

The sanction for closing without approval is split

The stock line that "closing without approval is a criminal offence carrying imprisonment" is inaccurate in UK law. Section 191F FSMA creates seven offences, but the penalties are split. Under subsection (8), failing to notify, completing before the assessment period expires, breaching conditions, completing after approval has ceased to be effective, providing materially false information and breaching a restriction notice are punishable by fine only — the statutory maximum on summary conviction, an unlimited fine on indictment. Imprisonment of up to two years, under subsection (9), attaches to one scenario: acquiring in contravention of a warning notice or decision notice by which the regulator objected.

Section 191B operates separately: a restriction notice can render the agreement to transfer shares and the transfer itself void other than by court order, disable voting power, block further share issues to the holder and stop payments on the shares outside a liquidation. The exposure is therefore not merely financial — a signed SPA can become unenforceable.

The EU logic matches. Article 6(4) PSD2 requires member states to provide for suspension of the corresponding voting rights, nullity of votes cast or the possibility of annulling them where a holding is acquired despite opposition. The ECB Guide lists the Article 26(2) CRD measures — injunctions, penalties against members of the management body, suspension of voting rights — and notes that in some jurisdictions voting rights are suspended automatically. Enforcement reaches non-supervised persons: in the ECB's 2025 annual report on supervisory activities, three of the four outstanding sanctioning proceedings concerned governance and qualifying holding requirements, and the ECB issued four requests to national authorities to open proceedings — including against "non-supervised entities and natural persons responsible for the acquisition of qualifying holdings in a significant institution".

Singapore is a rare case of imprisonment for the bare act. Under s.32 of the PS Act, becoming a 20% controller without approval exposes an individual to a fine of up to SGD 125,000 or up to three years' imprisonment or both, and a body corporate to a fine of up to SGD 250,000, plus up to SGD 25,000 for each day of a continuing offence. Ignorance is a defence only where MAS is notified within 14 days of the person becoming aware.

Approval has a shelf life

The point most often missing from deal timetables is that consent is not perpetual. Under s.191 FSMA approval lasts for the period the regulator specifies, and where none is specified, for one year from the notice of approval, the deemed approval or a tribunal decision; completing after expiry is a standalone offence under s.191F(5). The ECB is tighter: footnote 49 of its guide records that non-objection decisions "normally include a limitation on the period of validity (usually six months after issue)". The ECB may also set a maximum period for concluding the acquisition under Article 22(7) CRD, and a non-objection can be subject to conditions precedent only — conditions subsequent are not available, and failure to satisfy a condition precedent means the transaction is opposed.

That drives drafting from the outset. Change of control is a classic condition precedent, but the long-stop date has to fit inside the validity of the approval, not the other way round. Material changes between approval and completion — different terms, new participants, a revised structure — must be reported so the regulator can decide whether reassessment is needed (ECB Guide, section 6.4.2). The interim period does not let the buyer run the target: control in any sense, including de facto, is exactly what is prohibited before approval. Escrow and earn-outs address price, not refusal risk. Refusal risk is allocated expressly: who funds the filing work, who bears cost if the notification is withdrawn, what happens to the deposit if the regulator objects, and whether the seller must keep the licence, the compliance function and the banking relationships alive throughout. Wind-down of a live licence is worth agreeing in advance: if the deal fails, the target stays with the seller having lost a year.

Formal refusals are rare, and that is a reason not to be reassured by refusal statistics. In 2025 the ECB was notified of 110 acquisitions of or increases in qualifying holdings (91 in 2024, 112 in 2023); three of those notifications and one licence application were withdrawn before a decision was finalised owing to a negative assessment. Formal opposition is almost always replaced by withdrawal: the deal does not get refused, it quietly disappears.

The US: approval in every state where the licence exists

There is no national money transmitter licence. Coverage is assembled from state, District of Columbia and territorial licences, and a change of control needs approval in each of them (how the regime works). Harmonisation runs through the CSBS model act: as of 26 February 2026, the Money Transmission Modernization Act has been enacted in full or in part by 31 states, and licensees in adopting states account for 99% of reported money transmission activity.

Control under the MTMA means the power to vote 25% of voting shares or interests, the power to appoint a majority of key individuals, or the power to exercise a controlling influence; from 10% a rebuttable presumption of controlling influence applies, and the burden of rebutting it as a passive investor sits on the acquirer, not on the licensee. Holdings are aggregated with those of immediate family, including spouses, parents, children, siblings, in-laws and anyone sharing the person's home. Approval or denial is due within 60 days of the completion date; absent a decision the application is deemed approved, though the commissioner may extend for good cause. A streamlined route with 30-day deemed approval exists for persons already approved in the system, but it requires the target to make no material changes to its business plan — precisely what an acquirer usually intends.

New York shows the spread inside a single regulator. Under Banking Law § 652-a a change of control of a money transmitter needs the Superintendent's prior approval, control is presumed from 25% of voting stock, and the application is deemed approved unless denied in writing within 150 days of filing. For a BitLicense holder the rules differ: 23 NYCRR 200.11 presumes control from 10% of voting stock and requires the Superintendent to approve or deny within 120 days of a complete application, with no deemed approval.

The federal layer runs afterwards. Under 31 CFR 1022.380(b)(4) an MSB must re-register with FinCEN where a change of ownership required re-registration under state law, or where more than 10% of voting power or equity interests is transferred — but the form is due no later than 180 days after the event, not before it. The same provision carries a trigger almost nobody writes about: re-registration is also required where the number of agents increases by more than 50% during a registration period, and the year of the event becomes year one of a new two-year cycle.

Canada: two regimes with opposite mechanics

Canada is the most underestimated item in a deal timetable. Under s.24(1) of the Retail Payment Activities Act a planned acquisition of control obliges the PSP itself, not the acquirer, to submit a new application for registration, and the PSP must be re-registered before the acquisition closes. The control threshold is one-third of the votes to elect directors, directly or indirectly, alone or with affiliates; for a limited partnership the addition of a new general partner is itself an acquisition of control; convertible securities require re-registration before conversion, not after. For state-owned enterprises as defined in the Investment Canada Act there is no lower bound at all: re-registration is required before the acquisition of any voting interest, any ownership unit in a non-corporate PSP, and even before the power to appoint a CEO or a director is granted.

The clocks stack. The Bank of Canada has up to 45 days to decide on refusal once the application is deemed complete; the Minister of Finance has 60 days to decide whether to conduct a national security review, extendable by further 60-day periods, and 180 days to complete a review, also extendable. The Bank states plainly that timelines will not be expedited for late filers. If re-registration is refused, the PSP keeps its existing registration and may continue to operate — but it cannot close the deal. Queueing makes it worse: the PSP registry only began to be populated on 8 September 2025 and is filled on a rolling basis as national security screenings conclude, while applicants not yet on the registry carry the same RPAA obligations as registered PSPs (the regime in detail).

The second Canadian regime is the mirror image. FINTRAC MSB registration is valid for two years and changes to registration information need only be reported within 30 days after the fact, with no prior approval. The same company, registered as both an MSB and a PSP, runs its change of control on two incompatible calendars: one requires everything to be finished before closing, the other allows a report a month later.

Why buying a shell often loses to applying from scratch

The time saving that motivates buying a licensed company frequently fails to materialise. The regulator studies the new beneficial owner no less closely than it would study an applicant: same criteria, same three-to-five-year business plan, same source-of-funds work. The difference is that applying yourself means answering only for yourself, while buying means inheriting the target's history.

The UK adds the risk that the subject of the deal disappears. Since 2022 the FCA has been able to cancel a permission through an expedited process: two warnings, then cancellation 28 days after the first if the firm has not acted. Unpaid fees, missing returns and incomplete annual declarations are treated as indicators that a permission is not being used. By the time the FCA announced the power it had run 1,090 assessments of permission use, following which 264 firms applied to cancel voluntarily and a further 47 to vary their permissions. A dormant licence is precisely the profile that process selects for.

Olampicaran Limited shows how this plays out. On 10 January 2025 the FCA issued a Final Notice objecting to Mr Ahmed's proposed acquisition of that small money remittance firm. He had neither notified nor obtained approval; he had previously acquired a regulated firm and ended his tenure without notifying the regulator — both offences under FSMA — and failed to disclose that when he did notify. Olampicaran itself was not registered with HMRC as its anti-money laundering supervisor. Following the Decision Notice the firm cancelled its permissions and ceased to be regulated: the buyer acquired an investigation rather than a licence.

Diligence on a licensed target

Diligence here differs from ordinary corporate work in that some findings make the deal pointless rather than cheaper.

• Open directions and supervisory measures. Public registers show them: the Bank of Canada publishes enforcement decisions and keeps them online for five years. On 17 February 2026 it issued a temporary order to XTM Inc. under RPAA s.94(4), recording that the company's own public financial statements confirmed a failure to safeguard end-user funds and the accrual of a significant shortfall; on 27 February the order was amended to allow activity to resume under a Monitor appointed by the Ontario Superior Court of Justice under the CCAA.
• Safeguarding shortfalls. Test balances, not policies: actual balances in safeguarding accounts against liabilities to customers on several dates.
• The AML programme and registration with the relevant supervisor. Olampicaran shows that a missing AML registration surfaces exactly at change of control. The working configuration is set out in the compliance stack for a licensed operator.
• Agents and their registration. For a US MSB, growth in the agent count of more than 50% in a registration period independently triggers FinCEN re-registration — an open item that passes to the buyer.
• Banking relationships. A licence without an account does not trade, and a change of beneficial owner is a standard trigger for correspondent re-KYC; the practice is covered in banking for a licensed operator.
• Actual activity perimeter. A dormant or near-dormant firm is cheap for a reason.

Common mistakes

Counting shares and ignoring votes and influence. A 9.9% stake carrying a veto over the business plan and the right to appoint a director is control under FCA methodology and under the CRD significant influence test. Rebuilding the structure after filing resets the file.

Multiplying percentages up the chain. Control over an intermediate holder attributes its entire holding: "we buy 51% of a company holding 15% of the bank, so we get 7.65%" does not work — you get 15%.

Filing and assuming the clock has started. The clock runs from acceptance of a complete file; an incomplete notification is acknowledged but does not start time, and the list of what is missing may arrive later in a separate letter.

Setting a long-stop date beyond the validity of the approval. One year under FSMA and the usual six months in ECB decisions are not formalities: completing after expiry is a standalone offence.

Changing deal terms after filing. A new co-investor, a different financing structure, a revised business plan — each is a material change that under the ECB Guide can restart the procedure from zero.

Running the target before completion. Placing your own people on the board, taking system access, participating in decisions — all of this is exercising control, the very act that requires prior approval. Nor does one US state's approval travel: the MTMA encourages regulators to accept a lead investigative state's findings but does not oblige them to.

Scenarios

Buying a trading licensed company for speed to market. Budget for time to closing, not time to decision: pre-notification, file assembly, acceptance of completeness, 60 working days, a possible pause, and the validity window of the approval. Across several jurisdictions each file is accepted as complete on its own date — and all of it must fit inside the long-stop date.

Taking a minority stake with no intention to manage. Look past the percentage to the shareholder agreement. In the US the passive investor case must be made by the investor once the holding reaches 10%; in the EU and the UK it is cheaper to ask the regulator for a view on significant influence in advance than to argue it afterwards.

Changing the CEO, the board or the group structure without moving shares at the ultimate level. In Singapore and Hong Kong appointing a CEO or director is a consent event in its own right; in the US a key individual attracts 15-day notice, a 45-day file and a 90-day disapproval window. Internal reorganisations bring no automatic exemption: in the EU they routinely generate separate qualifying holding procedures, albeit under the simplified approach, and the US model act requires notice within 15 days after the event.

Buying a Canadian PSP. Start with the queue, not the SPA: the target files, re-registration must precede closing, and the ministerial review calendar extends without limit. Where the target is also an MSB, the FINTRAC and RPAA tracks run in parallel.

Buying a shell for its licence. Compare the timeline for your own application against the change-of-control timeline plus the time to remediate what you inherit. The FCA asks for exactly that comparison on transformative deals and treats overpayment for a dormant firm as a money laundering risk indicator. The answer is often to apply directly and treat operating under someone else's licence as a temporary bridge, keeping in mind where the regulatory perimeter is moving.