Payment Institution Acquisition Case Study

A payment institution acquisition case study is rarely about finding a company with the right licence number. The value sits in whether that entity can continue operating after the share transfer, retain its banking relationships and meet the regulator’s expectations under new ownership. A cheap acquisition can become an expensive remediation project if the licence scope, safeguarding arrangements or compliance records do not withstand diligence.

This anonymised case study reflects the issues that regularly arise when a fintech buyer seeks a faster route to market through the acquisition of an authorised payment institution.

The transaction: buying speed, not just a licence

The buyer was a non-EEA fintech group planning to launch business payment accounts, cross-border transfers and foreign exchange services to European SMEs. Building an application from scratch would have required a detailed regulatory business plan, governance appointments, capital evidence, AML documentation, safeguarding arrangements and a lengthy authorisation process.

The group identified an EU payment institution with an existing authorisation, a small operational team and limited but genuine customer activity. Its licence covered payment execution and money remittance, with services offered in its home state and several passported jurisdictions. At first sight, the target appeared to offer an immediate European operating platform.

The commercial objective was clear: acquire control, strengthen the product, appoint an experienced management team and begin a phased launch within months. The legal objective was less straightforward. A payment institution does not become a blank operating shell merely because its shares change hands. The buyer would inherit its regulatory history, its control environment, its contractual exposure and every weakness embedded in its files.

Payment institution acquisition case study: the diligence findings

The acquisition team began with a premise that prevented several costly assumptions: authorisation is not the same as operational readiness. The target’s licence was valid, but its ability to support the buyer’s proposed model depended on far more than its permissions.

Licence scope did not match the full product plan

The target could execute payment transactions and provide money remittance. It could not issue electronic money, hold customer value in the manner envisaged for the proposed account product, or carry out activities reserved for a credit institution. The buyer’s initial commercial materials used terms such as “wallet balance” and “stored funds”, creating a real risk that the planned service would fall outside the target’s permissions.

The solution was to separate the launch into regulated components. The acquired payment institution would provide permitted payment services, while e-money functionality would require either a separate authorised entity, a partnership structure or an application for an expanded permission where available. This changed the launch architecture, but it avoided an even more serious problem: building a product that the acquired company could not lawfully provide.

Licence scope must also be checked against the jurisdictions where customers will be served. Passporting rights, local conduct requirements and the practical position of correspondent banks all require review. A payment institution may hold permissions that look broad on paper but have no operating history in the markets most important to the buyer.

Safeguarding arrangements needed remediation

The target maintained a safeguarding account, but the reconciliation process was manual and performed too infrequently for the buyer’s anticipated transaction volumes. The safeguarding policy did not clearly allocate responsibility between operations, finance and compliance. There was also no tested procedure for an account disruption or insolvency scenario.

This was not a technical drafting issue. Safeguarding failures can expose customer funds, prompt regulatory intervention and make banks reluctant to continue the relationship. Before closing, the buyer required a remediation plan with defined owners, daily reconciliations, evidence standards, escalation thresholds and independent testing.

The deal documents reflected the point. Certain remedial work became a condition to completion, while other actions were tied to a post-closing timetable backed by indemnity protection. The appropriate approach depends on the severity of the gap. A theoretical inconsistency in an old policy may be manageable after closing. A live shortfall or unreliable safeguarding process is usually not.

AML controls existed, but evidence was weak

The target had an AML manual, a risk assessment and customer onboarding procedures. However, the documents had not been properly aligned with the target’s actual business profile. The institution had historically served low-risk domestic merchants, whereas the buyer intended to onboard cross-border SMEs with more complex ownership structures and higher transaction volumes.

More concerningly, the target could not consistently evidence how customer risk ratings had been assigned, how adverse media decisions were recorded or why particular transaction-monitoring alerts were closed. A regulator reviewing these files would not assess the policy alone. It would assess whether the firm could demonstrate that its controls worked in practice.

The pre-closing work therefore included a refreshed enterprise-wide risk assessment, revised risk appetite, new onboarding questionnaires, beneficial ownership standards and a monitoring rule review. The buyer also committed to staffing the second line properly rather than treating the MLRO appointment as a formal requirement. A capable compliance officer with insufficient authority, budget or management access does not solve a governance problem.

Governance was the real change-of-control issue

The buyer initially focused on its share purchase agreement and financing arrangements. The regulator focused on something else: who would ultimately control the institution, whether proposed qualifying holders were fit and proper, and whether the new board could manage a regulated payments business.

The proposed directors had strong commercial backgrounds but limited direct payment-services experience. One group shareholder also had a complex holding structure spanning several jurisdictions. This did not prevent the transaction, but it made the change-of-control filing more detailed and more sensitive to timing.

The team prepared a transparent ownership chart, source-of-funds materials, personal questionnaires, criminal-record documents where required, CVs, financial projections and a post-acquisition business plan. The proposed governance model was strengthened with a locally credible director and a compliance lead whose remit was clear from day one.

Regulatory approval for the acquisition cannot be treated as a post-signing formality. In many jurisdictions, completing a qualifying holding acquisition without the required notification or approval can create serious consequences for the buyer and target. The transaction timetable must allow for regulator questions, document refreshes and possible requests for additional information.

Structuring the deal around regulatory reality

The final structure was a share acquisition rather than an asset purchase because the licence, operating contracts and existing regulatory permissions were central to the value proposition. That choice brought inherited liabilities, so the legal and financial diligence needed to be deeper than in an ordinary technology acquisition.

The purchase agreement dealt specifically with regulatory warranties, outstanding supervisory correspondence, customer-fund treatment, AML breaches, tax exposure, data protection and material banking contracts. A portion of the consideration was deferred against measurable regulatory and operational milestones. This gave the seller an incentive to complete remediation and protected the buyer if disclosed weaknesses proved more significant than expected.

The buyer also avoided announcing a launch date before the regulator had been notified and critical third parties had been consulted. Bank account providers, card partners, technology vendors and key employees may all reassess their position following a change in control. A licence can survive an acquisition while the operational infrastructure around it does not.

What made the acquisition viable

The transaction proceeded because the buyer accepted that it was purchasing a regulated business, not a shortcut around regulation. The revised plan reduced the initial product scope, increased the compliance budget and delayed the public launch until governance and safeguarding controls had been tested.

Four decisions were particularly material:

• The buyer mapped every planned product feature against the target’s actual permissions before committing to the acquisition.

• The change-of-control submission was prepared early, with full beneficial ownership and source-of-funds transparency.

• Material safeguarding and AML gaps were treated as transaction risks with owners, deadlines and contractual consequences.

• The post-closing plan included banking continuity, management appointments, regulatory reporting and a realistic operational launch sequence.

The result was not the fastest theoretical route to market. It was the fastest defensible route. That distinction matters when the institution will need to persuade regulators, banking partners and sophisticated customers that its controls are credible.

Questions buyers should ask before signing

A prospective acquirer should be able to answer a small set of hard questions before relying on a payment institution as its market-entry vehicle. Does the licence cover the intended product and customer journey? Is the institution genuinely operational, with active safeguarding and functioning compliance controls? Can the buyer obtain change-of-control approval within the proposed timetable? Will its shareholders, directors and source of funds withstand scrutiny? And can the company retain or replace every essential third-party relationship after completion?

If any answer is uncertain, the deal may still be possible. It may simply need a different valuation, stronger conditions precedent, a staged launch or an alternative regulatory structure. Speed has value, but regulated-market speed only counts when it is bankable and sustainable.

For buyers considering this route, NUR Legal can assess the target’s permissions, transaction risks and remediation requirements before a headline valuation turns into a binding commitment. The right acquisition should give the business a credible operating base, not a licence-shaped problem that surfaces after closing.