[email protected]
WhatsApp +44 7563 115980
Telegram @buckinghamcapital
Buying a firm that already holds an e-money institution (EMI) or payment institution (PI) licence in the EU is a common way to enter the European market. It can save months compared with a new application, and it brings an existing passport, banking relationships and sometimes customers. But it is not a way around regulation. The home regulator must approve the buyer before the deal completes, and the business after the deal must still meet the conditions of the licence.
This guide covers the approval process, the due diligence a buyer should do, how PSD3 changes the picture, and how deals are typically structured. Our FCA change of control guide covers the UK process.
| Factor | New application | Acquisition |
|---|---|---|
| Time to operate | Months of preparation plus regulator review | Regulator approval of the buyer, usually shorter |
| Certainty | Depends on the regulator's review of a new file | Depends on the target's condition and the change of control approval |
| Existing assets | None | Licence, passport, sometimes banking, systems and customers |
| Inherited issues | None | Any compliance, banking or supervisory issues the target has |
| Cost | Advisers, capital and build | Purchase price plus advisers, capital and remediation |
An acquisition makes most sense where a well-run target matches the buyer's business model closely. Where the buyer will change the business substantially, the regulator will review the new plan almost as closely as a new application.
Buyers should compare both routes on the same business plan before deciding.
Under EU rules, anyone who intends to acquire a qualifying holding in a payment institution or EMI, 10% or more of the capital or voting rights or significant influence, must notify the home regulator before completing. Further notifications apply when holdings cross higher thresholds. The regulator assesses:
Most regulators work to a defined assessment period from a complete notification, typically around 60 working days, with the clock paused while they ask questions. Incomplete notifications are the main source of delay. Our change of control service prepares the notification and manages the regulator's questions.
Notifications are made by the buyer, but the seller and the target need to cooperate: the regulator will want information about the institution's current position as well as about the buyer. Agree in the sale documents who prepares what, and who speaks to the regulator, so questions are answered quickly and consistently. Where the buyer is a group outside the EU, expect questions about how the institution's management will be independent enough to run it locally.
| Area | What to check |
|---|---|
| Authorisation | Services authorised, conditions, passports, agents and distributors |
| Supervisory history | Correspondence, inspections, findings and any restrictions |
| Safeguarding | Method, banks, reconciliations and audit findings |
| AML | Risk assessment, monitoring, past reports and any findings |
| Banking | Safeguarding and operating accounts, and whether they survive a change of owner |
| Capital | Own funds against requirements, and any capital commitments |
| People | Key function holders who will stay, and those who must be replaced |
| Technology and outsourcing | Core systems, critical providers and DORA readiness |
| Liabilities | Customer complaints, disputes and tax |
Banking deserves particular attention. Many safeguarding and operating accounts include change of control clauses, and a bank may close accounts after a sale. Agree with the target's banks before signing how they will treat the transaction.
Talk to the target's key function holders before signing. Their view of the business, the regulator's attitude and the state of controls is often more revealing than the documents, and their willingness to stay after completion affects how the regulator views the change of control. Where key people will leave, the buyer needs replacements ready to be assessed by the regulator before completion.
Under PSD3, every EU payment institution and EMI must show its regulator that it meets the new rules within a transition of up to 27 months after PSD3 enters into force. A licence bought today will need a re-authorisation file in 2027 or 2028, including a winding-up plan, recalculated capital and next-day safeguarding for e-money. A buyer should ask for the target's PSD3 gap analysis and plan, and price the remaining work into the deal. Our PSD3 re-authorisation guide explains what the file contains.
Sellers get better prices and faster completions when the business is ready for scrutiny. Before marketing a licensed firm, a seller should assemble a data room with the authorisation, conditions and passport notifications, recent regulatory correspondence, safeguarding audits, the AML risk assessment and recent independent review, board minutes, financial statements and capital calculations, key contracts including banking and outsourcing, and a list of key people and their roles.
Open issues should be disclosed early. A buyer that finds an undisclosed finding late in due diligence will either reduce the price or walk away. A seller that explains the issue and the remediation plan up front keeps control of the conversation.
Some firms obtained a licence but never launched or stopped trading. Buyers find these attractive because there are no customers or legacy issues, but regulators look at them carefully. Many regulators can withdraw a licence that has not been used for a set period, often twelve months, and the buyer must show the regulator that the firm will meet its conditions from day one under new ownership, including capital, governance, safeguarding and AML. A dormant licence is only valuable if it is still in good standing and the regulator is comfortable with the new owner's plans.
The value of a licensed institution depends on more than the licence itself. Buyers pay more for firms with stable safeguarding and operating accounts, a clean supervisory record, experienced key function holders willing to stay, passports to the markets the buyer needs, and systems that can scale. They pay less, or walk away, where banking is fragile, findings are open, or the licence covers services the buyer does not need. Revenue and customers add value where they fit the buyer's model, but some buyers prefer a firm without legacy customers so they can build from a clean base.
Regulatory timing affects value too. A firm that has already prepared its PSD3 re-authorisation plan is worth more than one that has not started, because the buyer avoids that work and that risk.
Completion is the start of the work, not the end. In the first months a new owner typically needs to appoint or confirm key function holders, update policies to the new business plan, notify the regulator of changes in services or agents, refresh banking relationships, align reporting with the group, and begin preparing for PSD3 re-authorisation. A short integration plan agreed with the regulator before completion reduces surprises afterwards.
Buyers of EU institutions most often look at Lithuania, Ireland, the Netherlands, Malta and Cyprus, because of the number of licensed firms there and the regulators' experience with payments businesses. Each regulator has its own approach to change of control and its own expectations on local substance. Our licence guides for Lithuania, Ireland and Malta set out each regulator's approach. Our EU payment institution register lists every authorised firm by country and licence type.
Outside the EU, the UK remains an active market for licensed EMIs and payment institutions, with its own change of control process under the Financial Services and Markets Act and an assessment period of up to 60 working days from a complete notification. Buyers wanting both markets sometimes buy a UK firm and an EU firm together, or a group that already holds both.
Licensed firms come to market in three ways: owners who want to exit, groups that no longer need a subsidiary, and firms that obtained a licence but never launched. The last group can be attractive, but the regulator will check that the licence conditions are still met, including the people, capital and systems. Our marketplace lists licensed companies for sale across Europe and the UK, including listings from partner brokers.
Approach targets with a clear statement of what the buyer intends to do with the business. Sellers and their regulators both prefer buyers with a credible plan.
We identify targets through our marketplace and network, run regulatory due diligence, prepare the change of control notification and manage the regulator's questions through to approval. After completion, we help buyers bring the institution into line with their business plan and prepare for PSD3 re-authorisation.
Yes, but the home regulator must approve you as the new owner before the deal completes.
A holding of 10% or more of the capital or voting rights, or one that gives significant influence. Acquiring one requires prior notification to the regulator.
Most regulators work to an assessment period of around 60 working days from a complete notification, with the clock paused for questions.
Often, where the target closely matches the buyer's business. Large changes to the business plan bring a closer review.
Inherited issues, especially banking that does not survive the sale, open supervisory findings and weak safeguarding.
Yes. Every EU institution must show it meets PSD3 within the transition, so the target's re-authorisation plan should be part of due diligence.
Get in touch: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or [email protected].
This article is general information, not legal advice. Requirements change, and the regulator’s own publications take precedence.
Tell us where you are and where you want to be.
[email protected]
WhatsApp +44 7563 115980
Telegram @buckinghamcapital