The two routes
A new authorisation is obtained by application to the regulator. In the UK, an application for permission under Part 4A of the Financial Services and Markets Act 2000 must be determined within six months of the FCA receiving a complete application, and within twelve months of receiving an application that is incomplete. Applications by payment institutions and electronic money institutions under the Payment Services Regulations 2017 and the Electronic Money Regulations 2011 must be determined within three months of a complete application and twelve months of an incomplete one. In each case the period runs from completeness, and the time spent preparing the application and answering the regulator's questions comes before and around it.
An acquisition transfers ownership of a company that is already authorised. The firm keeps its permissions, its regulatory record, its banking and safeguarding arrangements and, in the EU, its passports. What changes is the identity of the people who control it, and that change requires the regulator's approval before it takes place. The acquisition route therefore replaces one regulatory assessment with another; it does not remove the assessment.
The regulator's approval of the buyer
In the UK, a person who decides to acquire control of an authorised firm must notify the FCA in writing before making the acquisition. A person acquires control by holding 10 per cent or more of the shares or voting power in the firm or its parent, or by holding shares or voting power that allow significant influence over its management, and a controller whose holding reaches 20, 30 or 50 per cent increases control and must notify again. Completing the acquisition before the FCA has approved it is a criminal offence. The same regime applies to authorised payment institutions and electronic money institutions.
The FCA has 60 working days from its acknowledgement of a complete notice to approve the acquisition, approve it with conditions, or propose to object. It may interrupt that period once by asking for further information, for up to 20 working days, or 30 where the buyer is situated or regulated outside the UK. It assesses the reputation of the buyer, the reputation, knowledge, skills and experience of anyone who will direct the firm's business, the buyer's financial soundness, whether the firm will continue to meet its prudential requirements and threshold conditions, whether the group structure allows effective supervision, and whether there are grounds to suspect money laundering or terrorist financing in connection with the acquisition. A business plan is required where the buyer will hold more than 50 per cent, and the FCA treats the notice as incomplete until it has one. Our note on the FCA's change in control process sets this out in detail.
The EU position is similar. Under MiFID II, the competent authority has a maximum of 60 working days to assess a proposed acquisition of a qualifying holding in an investment firm, with one interruption of up to 20 working days for further information, or 30 in certain cases. Under the Markets in Crypto-Assets Regulation, a proposed acquirer of a qualifying holding in a crypto-asset service provider notifies the competent authority, which has 60 working days from its acknowledgement to complete its assessment against criteria that mirror those above.
Comparing the timetables
On the statutory periods alone, a change in control is shorter than a new Part 4A application: 60 working days, with a possible interruption, against six months. For payment and electronic money institutions the difference is smaller, since a complete application under the Payment Services Regulations or the Electronic Money Regulations is determined within three months. In the EU, a new investment firm must be told within six months of a complete application whether it is authorised, and a crypto-asset service provider's application is assessed within 40 working days of being complete, after a completeness check of up to 25 working days.
The statutory periods are not the whole timetable. An acquisition also involves identifying a suitable firm, negotiating with its owners, conducting due diligence and agreeing the sale and purchase agreement, all before the notice can be given. A new application involves preparing the business plan, the financial projections, the policies and the forms for the individuals who will manage the firm. Which route is quicker in practice depends less on the statutory periods than on how long the buyer needs to find and agree a transaction, and on how ready the buyer's own management and plans are for the regulator's scrutiny.
What the firm brings with it
A buyer acquires the whole company along with its permission. The firm's regulatory history, including any open matters with the regulator, past breaches, complaints and the files behind them, passes with it, as do its contracts with clients, banks, agents and suppliers, and its liabilities. Due diligence should therefore examine the firm as the regulator would: its permissions and any requirements or limitations attached to them, its correspondence with the regulator, its capital position and regulatory returns, its policies and whether they are followed, its financial crime controls, its safeguarding or client money arrangements, and the documentation of each senior management function.
The permissions must also match what the buyer intends to do. A firm whose permissions cover a narrower business than the buyer's plans will need to apply to vary its permission after completion, and a significant variation is assessed in a similar way to a new application. A firm with permissions it has not used, or a business model the buyer intends to replace entirely, invites the question of what the acquisition achieves that an application would not.
When a new application is the better route
A new application is usually preferable where no available firm holds the permissions the buyer needs, where the buyer intends to change the firm's business, management and systems so substantially that little of the existing firm would remain, or where due diligence reveals a regulatory history the buyer would not want to inherit. It is also preferable where the buyer's own plans and management would not yet satisfy the regulator, since the change in control assessment examines the buyer and its plans as closely as an application examines a new firm, and a notice that is objected to leaves the buyer without a firm or an authorisation.
An acquisition is usually preferable where a firm with the right permissions and a clean record is available, where its existing clients, banking relationships or, in the EU, passports have value to the buyer, and where the buyer intends to continue the business broadly as it is. In either case the assessment should be made before heads of terms are agreed, so that the regulatory route is settled before the commercial terms.
How we can help
We assess whether an acquisition or a new application is the appropriate route, review a target's regulatory position, and prepare either the change in control notification or the application. We work on transactions in which the buyer acquires control of the firm; the price and the sale and purchase agreement are agreed between the parties and their lawyers and corporate finance advisers. See looking to buy and change of control, or speak to us.
Sources
- Financial Services and Markets Act 2000, section 55V and Part 12, sections 178, 181, 182, 186, 189, 190 and 191F
- The Payment Services Regulations 2017, regulation 9, and the Electronic Money Regulations 2011, regulation 9
- Financial Conduct Authority, Change in control
- Directive 2014/65/EU (MiFID II), Articles 7, 11 and 12, and Regulation (EU) 2023/1114 (MiCA), Articles 63 and 83, as published on EUR-Lex
Checked 17 October 2026.