The UK’s Change in Control (CiC) regime has been the subject of many articles over the years, and that’s just from myself! But, if something is worth saying, it’s worth repeating. In this context, it concerns the continued attraction of the CiC process as a route to obtaining regulatory authorisation in the UK. This is particularly relevant given the heightened scrutiny applied by the Financial Conduct Authority (FCA) to new applications: if you can’t build one, buy one.
What is it?
The concept is relatively straightforward: when a person proposes to acquire “control” of an authorised firm, this must be notified to the regulator in advance, and the change must be approved before it takes effect. Failure to comply is a criminal offence. Having worked in the CiC function at the FCA myself, I remember their mantra: “Licences are not for sale.” While this may be fundamentally true, the reality is that firms are nevertheless regularly bought and sold, they just happen to have a licence attached.
Often, this route is considered more efficient than the time and effort involved in setting up a company and seeking authorisation directly.
Whether this is viewed as a means to an end, or a shortcut to that end, any acquisition must satisfy the FCA that it is not simply regulatory arbitrage, what I have previously described as “authorisation through the back door.”
What Constitutes ‘Control’ — Wider Than Many Assume
The CiC thresholds have been long-established. ‘Control’ arises when a person (or entity) directly or indirectly reaches or crosses any of the following threshold bands:
- 10% or more but less than 20%
- 20% or more but less than 30%
- 30% or more but less than 50%
- 50% or more
For ‘non-Directive firms’, such as non-MiFID investment firms, general insurance intermediaries, and full permission consumer credit firms, there is a single controller band of 20% or more.
‘Control’ is defined broadly, capturing not only majority ownership but also minority holdings that grant significant influence. Even certain indirect stakes, shareholder restructurings and internal group reorganisations can trigger a CiC notification. I recall heated discussions at a European working group, which developed what would become the new Acquisitions Directive, where many (not the UK) considered true control to exist only above 50%. Hence, we see more relaxed references to thresholds in terms of ‘qualifying holdings’.
The Process — A Prudential Assessment of the Acquirer (and More)
The obligation to submit a CiC notice is triggered once a person has made a decision to acquire or increase control in an authorised firm. Upon receipt of a complete application, the statutory clock starts. The FCA (or PRA) has up to 60 working days to assess the proposed acquirer, with the power to “stop the clock” if information is missing or unclear.
The evaluation of the acquirer generally focuses on five key areas:
- Reputation and integrity of the acquirer;
- Financial soundness and funding arrangements;
- Suitability of controllers, including criminal background checks;
- Future business plans, strategy and governance; and
- Risk of financial crime or market abuse.
A common pitfall is underestimating the level of detail required. Incomplete submissions almost guarantee delays. A well-prepared submission significantly reduces the likelihood of stop-the-clock requests and improves the chances of approval within the statutory timeframe.
Importantly, the target firm’s profile is also part of the overall assessment. With any transaction, there are always two sides.
Caveat Emptor
Returning to the issue of regulatory arbitrage: if you are acquiring true control of a regulated firm (i.e. 100%), be sure you are not being ‘sold a pup’, that is, a firm the regulator would find difficult to approve, irrespective of the proposed acquirer.
The FCA uses the CiC process as an opportunity to assess the resilience, transparency, and ongoing suitability of the target firm, regardless of new ownership. You must be able to demonstrate a comprehensive understanding of the target’s business model, customer profile, and operations, and explain your intended future plans.
- Do the Hard Due Diligence Upfront
At a minimum, validate the following:
- Regulatory standing: Check the Financial Services Register and the FCA website for permissions, restrictions, supervisory notices or historical red flags. Conduct adverse media checks, similar to KYB onboarding. Confirm whether the permission is actually being used.
- Corporate and financial history: Review Companies House filings for signs of solvency issues, governance gaps, or ownership changes that the FCA will expect you to understand and explain.
- Compliance healthcheck: Confirm that regulatory reporting is up to date, that capital and liquidity thresholds are met, and that the firm has a credible wind-down plan. These may be reviewed in a data room or independently assessed by a reputable compliance consultant (you know who!) to provide external assurance. This enhances your understanding of what the regulator knows, and what might concern it.
Even if the target has underlying compliance ‘debt’, it may still be viable, but you must be prepared to explain how and when issues will be resolved.
- Check the Permission Matches Your Business Plan
It is surprisingly common for acquirers to focus on the existence of a licence without examining the permission profile, only to find that it does not align with their intended business.
If the activities differ, a Variation of Permission (VoP) will be required post-acquisition. This is a separate regulatory process, with a different FCA team, timeline and application fee.
Ideally, the existing permission should support the future business model. The FCA has been clear: where a firm has not undertaken regulated activities for 12 months or more, it encourages cancellation of permissions. This “use it or lose it” approach is not remedied by a change in control.
Moreover, the less operational change you propose, e.g. staffing or systems – the less likely the FCA is to suspect regulatory arbitrage.
- Be Realistic and Principled About Pricing
There is no benchmark market rate for an FCA-regulated firm. As I have said previously, “there is no eBay for licences.” The value lies in the permissions, operational infrastructure, and the time saved versus direct authorisation.
When pricing:
- You are buying regulatory assets and regulatory risks, alongside financial ones.
- A discounted price may raise questions about regulatory or operational issues, and the FCA will expect you to have identified them.
- A premium price must be justified by value, e.g. permission profile, governance quality or reduced time to market.
Be prepared to explain to the FCA how you arrived at the purchase price.
How Complyport Can Help
The FCA applies the same rigorous standards to CiC transactions as it does to new authorisations. If you are considering acquiring a regulated firm or submitting a Change in Control notification, Complyport’s experienced team is here to help.
We can support with:
- Pre-transaction regulatory assessments: We assess whether your proposed transaction triggers regulatory notifications or approvals, ensuring compliance from the outset.
- Compliance healthchecks: We conduct a thorough review of the target firm’s regulatory status, identifying any potential compliance risks or gaps.
- Submission drafting and documentation: We prepare and quality-assure all required documentation for the Change in Control submission, ensuring clarity, completeness, and alignment with FCA expectations.
- FCA liaison and project management: We manage communications with the FCA and oversee the end-to-end regulatory process to minimise delays and facilitate approval.
Speak with a member of our expert team to ensure a smooth and compliant transaction.
Contact us today to book a meeting with a Subject Matter Expert.
Ask ViCA, your Virtual Compliance Assistant. Claim your complimentary 20 queries today! Register here: https://vica.chat
Author:
Payment Services
