Change of Control in Regulated Financial M&A: A Buyer's Complete Guide

Acquiring a regulated financial business is fundamentally different from acquiring an unregulated company. The moment a buyer seeks to take a qualifying holding — typically 10% or more of shares or voting rights — in a regulated entity, they trigger a mandatory regulatory process known as change of control. Understanding this process is essential for any buyer approaching the regulated financial M&A market.

What is Change of Control?

In regulated financial services, change of control refers to the acquisition of a qualifying stake in a licensed entity that requires prior regulatory approval. Most jurisdictions set the threshold at 10% of shares or voting rights, though the specific rules vary by regulator and jurisdiction.

The regulatory rationale is straightforward: regulators need to ensure that the people who own and control regulated financial businesses are fit and proper to do so. A change of ownership is therefore an opportunity for the regulator to assess the incoming owner with the same rigour applied to the original license application.

FCA Change of Control (UK)

Under Part XII of the Financial Services and Markets Act 2000, any person proposing to acquire control of an FCA-authorised firm must notify the FCA and receive approval before completing the acquisition.

The FCA has 60 working days from receipt of a complete notification to issue its assessment. The FCA assesses: the reputation and experience of the proposed controller, the financial soundness of the acquisition, the likely influence of the acquirer on the firm's compliance, and the ongoing fitness and propriety of senior management.

In practice, the FCA process takes 3 to 6 months from submission of a complete notification. Incomplete notifications are returned without assessment. Buyers should engage experienced regulatory counsel before submitting.

CySEC Change of Control (Cyprus)

CySEC's change of control framework operates under Article 38 of the Investment Services and Activities and Regulated Markets Law, implementing MiFID II requirements. The process mirrors the FCA in many respects: notification, fitness and propriety assessment, and a 60 working day assessment period.

CySEC requires notification when a proposed acquirer seeks to hold 10%, 20%, 30% or 50% or more of shares or voting rights. Each threshold triggers a separate notification requirement. Practically, most acquisitions involve a single majority acquisition and a single notification.

The documentation package for a CySEC change of control notification typically includes: personal questionnaires for all new qualifying shareholders and management, audited financial statements of the acquiring entity, a revised business plan, updated AML programme, and source of funds documentation.

ASIC Change of Control (Australia)

For Australian Financial Services Licensees, ASIC does not operate a pre-approval change of control regime in the same way as the FCA or CySEC. However, significant changes to the ownership or control structure of an AFSL holder must be notified to ASIC, and ASIC retains the power to vary, suspend or cancel an AFSL if it considers the licensee is no longer fit to hold it.

Buyers of Australian AFSL entities should conduct thorough due diligence on the compliance history of the target and engage Australian regulatory counsel to assess the specific notification requirements for the proposed transaction structure.

Offshore Jurisdictions

For offshore regulators — Seychelles FSA, Labuan FSA, Mauritius FSC, BVI FSC, Dominica FSU — change of control processes are generally more streamlined than their EU and UK counterparts, though no less important.

Labuan FSA typically requires notification and approval of new beneficial owners and directors, with the process taking 4 to 8 weeks for straightforward transactions. Seychelles FSA operates a similar notification regime. Mauritius FSC requires a formal change of control application and assessment, typically taking 6 to 12 weeks.

Key Practical Points for Buyers

Several practical points consistently arise in regulated financial M&A transactions:

Completion cannot occur before regulatory approval. Any transfer of shares or control before receiving regulatory approval constitutes a regulatory breach and can result in enforcement action against both buyer and seller.

Due diligence must cover regulatory history. A target entity's regulatory record — including any correspondence with the regulator, past enforcement actions, and current compliance standing — is as important as its financial statements.

Management continuity matters. Most regulators assess not just the incoming owner but the proposed management team post-acquisition. Buyers who intend to replace the existing management team should factor regulatory assessment of new appointees into their timeline.

Working with specialist advisors pays dividends. The difference between a smooth 3-month change of control process and an extended 12-month process frequently comes down to the quality and completeness of the initial notification package.