Due Diligence is the investigation a buyer, investor or partner carries out before committing to a transaction, to confirm that the target is what the seller says it is and to price or contract around anything that is not. In the acquisition of a licensed fintech it splits into financial, legal, tax, technology and regulatory workstreams. Financial work rebuilds revenue by product and client, while regulatory work tests whether the licence is valid, in good standing and transferable in practice to a new owner, reading regulator correspondence, breach logs and safeguarding returns. Findings turn into price cuts, escrow, conditions and delayed signing, and they feed the change-in-control approval that usually decides whether the deal closes.
What does due diligence involve in fintech M&A
Financial diligence rebuilds revenue by product and client, tests margins, and separates recurring income from one-off fees. Legal diligence reviews corporate records, client and partner contracts, intellectual property, litigation and employment. Technology diligence looks at ownership of code, third-party dependencies, security incidents and outsourcing arrangements.
Regulatory diligence asks whether the licence is valid, in good standing and usable by a new owner. Reviewers read correspondence with the regulator, breach logs, suspicious activity reporting volumes, complaint data and any open remediation programmes. For an EMI or payment institution, the central item is safeguarding: whether client money is held in segregated accounts or covered by insurance, reconciled correctly, and returnable on insolvency.
Regulatory due diligence on a UK EMI or PI
The FCA's safeguarding rules for payment and e-money firms require reconciliations on every reconciliation day, monthly safeguarding returns filed within 15 business days of each month-end, and up-to-date resolution packs. A buyer asks for the last twelve returns, the auditor's safeguarding report and any shortfall that was topped up after the fact. Under the Electronic Money Directive 2009/110/EC, e-money funds had to be safeguarded no later than five business days after issuance, and gaps in that timing are a frequent finding.
AML files come next. Reviewers sample customer due diligence records, check that enhanced due diligence was applied to high-risk clients, and compare transaction monitoring alerts with how many were closed and why.
Change in control approval
Due diligence feeds the regulatory approval the buyer needs. In the UK, anyone acquiring 10% or more of an authorised payment institution or EMI must notify the FCA and obtain approval before completion, with further notifications at 20%, 30% and 50%. The FCA has up to 60 working days from a complete notification to decide, plus any interruption to request more information, and acquiring control without approval is a criminal offence under section 191F of FSMA.
A worked example of due diligence findings
An illustrative EMI is offered at £6 million. Diligence finds that £1.2 million of client funds sat in an unsegregated operating account for nine days during a bank migration, that 40% of revenue comes from three merchants on 30-day termination notice, and that the FCA has an open query on transaction monitoring. The buyer cuts the price, puts £750,000 in escrow against regulatory fines, makes renewal of the top three merchant contracts a condition, and delays signing until the FCA query closes.
The output of diligence is not a report for its own sake: each finding becomes a price change, a specific indemnity, a condition precedent or a reason to walk away.