Buying a Licensed Fintech Company: What Regulators Must Approve

By Aleksei Shulyakovsky, Lawskar  |  Updated October 2026

Quick Note

“Ready-made” payment, e-money, and crypto licences are widely advertised, but in the EU, the U.S., and Canada, a licence or registration almost never transfers to a new owner automatically. What you can buy is a company that already holds one. Regulators then have to approve, or at least be notified of, the change of ownership, and some can refuse it. Buying a licensed entity can still save time compared with a fresh application, but only if the buyer plans for that approval from the start.

What a “Ready-Made Licence” Actually Is

Financial licences are granted to a specific legal entity after the regulator assesses its owners, managers, capital, and controls. When a provider sells a “ready-made” licence, it is selling the shares of a company that already holds the authorization. The licence stays with the company, but the regulator’s original assessment was of the previous owners. That’s why nearly every licensing regime includes change-of-control rules: the regulator gets to assess the new owners as if they were applying.

A share purchase is a business acquisition first, with the usual diligence on liabilities, contracts, tax, and employees. Our overview of legal considerations for business acquisitions covers those general steps. A licensed fintech adds a regulatory layer on top.

European Union: Payment and E-Money Institutions

Payment institutions are authorized under the Payment Services Directive (PSD2), and electronic money institutions under the E-Money Directive. Both require anyone who plans to acquire a “qualifying holding” (generally 10% or more of the capital or voting rights, or significant influence over management) to notify the national regulator in advance. Further notifications are triggered when a holding crosses 20%, 30%, or 50%.

The Central Bank of Ireland’s process is a typical example. After it accepts a notification as complete, it has 60 working days to assess the proposed acquirer, and the clock pauses while it waits for answers to its questions. The Central Bank states that failing to notify renders the acquisition null and void under Irish rules. Other member states’ procedures differ in detail, but the assessment covers the same ground: the acquirer’s reputation, financial soundness, source of funds, and whether the acquisition raises money-laundering concerns.

One more change is coming. The EU’s replacement framework, PSD3 and the new Payment Services Regulation, reached final compromise texts in April 2026. Once adopted, it will bring payment and e-money institutions under a single regime with transitional reauthorization requirements. Anyone buying an EU payment or e-money institution now should ask how the entity will move to the new rules.

European Union: Crypto-Asset Service Providers After July 2026

For crypto businesses, the market changed fundamentally this year. Under the Markets in Crypto-Assets Regulation (MiCA), crypto-asset service providers need authorization as a CASP. Member states could let firms operating under older national “VASP” registrations continue during a transition period, but that period ended no later than July 1, 2026, and several countries, including the Netherlands, Finland, Latvia, Hungary, and Slovenia, ended it a year earlier.

In practice, that means a national VASP registration bought today generally doesn’t allow the holder to serve EU clients. Only a granted MiCA authorization does, and a pending application doesn’t count. Buying a company that holds a MiCA CASP authorization is possible, but MiCA also has its own qualifying-holding rules, so the regulator assesses the new owners before the deal can close.

United States: Federal Registration and State Licences

The U.S. is the most frequently misdescribed market in “ready-made licence” offers.

• FinCEN registration isn’t a licence. Money services businesses register with FinCEN, the Treasury’s anti-money-laundering bureau. Under FinCEN’s re-registration rules, an MSB must re-register within 180 days after a transfer of more than 10% of its voting power or equity, a change in ownership or control that state law requires to be re-registered, or a more than 50% increase in its number of agents.
• State money transmitter licences do the real work. Transmitting money for customers generally requires a licence in each state where the business operates. State regulators require prior approval of a change in control, and acquiring an existing licensee usually means filing in every licensing state, often through the NMLS system.
• The rules are becoming more uniform. The Money Transmission Modernization Act, a model law developed by state regulators, had been enacted in whole or in part by 31 states as of early 2026. It standardizes many licensing and change-of-control requirements, but each state still decides its own applications.

Canada: FINTRAC, the Bank of Canada, and Quebec

Canadian MSBs register with FINTRAC, the federal financial intelligence unit, and must report changes to their registration information, including ownership changes, within set deadlines. FINTRAC registration is also a registration rather than a licence. Since the Retail Payment Activities Act came fully into force on September 8, 2025, most payment service providers also have to register with the Bank of Canada, which supervises operational risk and the safeguarding of customer funds, and the Act requires advance notice of certain significant changes. Businesses serving customers in Quebec may additionally need a licence from Quebec’s financial markets regulator, the AMF.

The Comparison That Matters

The Lithuanian EMI That Came With an Unanswered Regulator Letter

This example is a composite of issues that arise in fintech acquisitions, with identifying details changed. A payments start-up agreed to buy a dormant Lithuanian electronic money institution marketed as “ready to launch.” The price assumed the start-up could go live within weeks of signing.

Diligence by the buyer’s fintech lawyers turned up three problems. The institution hadn’t processed transactions for over a year, which can put an authorization at risk. The previous owner had left a regulator’s information request about anti-money-laundering procedures unanswered. And the share purchase agreement let the deal close before the regulator had assessed the new owners.

The parties restructured the deal so closing depended on regulatory approval, the seller answered the outstanding request, and the buyer prepared its own qualifying-holding file, including source-of-funds evidence for every ultimate beneficial owner. Approval took several months rather than weeks, but the buyer avoided acquiring an institution it couldn’t legally control, and the timeline was still shorter than a fresh application.

Red Flags in “Ready-Made Licence” Offers

• A promise that ownership can change “immediately” or without regulatory involvement
• Crypto “licences” in the EU that are national VASP registrations rather than MiCA authorizations
• A U.S. “MSB licence” that turns out to be only a FinCEN registration
• No access to the regulator correspondence file, audit reports, or AML policies before signing
• An entity that has been dormant for a long period, or whose directors are being replaced with nominees
• Bank or safeguarding accounts presented as part of the package. Banks run their own onboarding on new owners, so existing accounts can be closed after a change of control.

Buying vs. Applying From Scratch

Buying can be faster when the entity has a clean regulatory history, an operational track record, and existing banking relationships. Applying fresh is often better when the buyer’s business model differs from what the entity was authorized for, when the entity carries unknown liabilities, or when the regulator would effectively reassess everything anyway. Either way, licensing is the start of ongoing obligations, not the end. Our guide to managing compliance in highly regulated industries covers the governance a licensed business needs to sustain.

Common Questions

Can I buy an EMI licence and passport it across the EU? Passporting rights stay with the authorized institution, but they don’t bypass change-of-control approval in its home state.

Is a FinCEN MSB registration enough to operate a payments business in the U.S.? Usually not. Most money transmission also requires state licences.

How long does change-of-control approval take? It varies by regulator. In the EU, the assessment period is generally 60 working days once a complete file is accepted, plus time for information requests. U.S. multi-state approvals often take longer.

Disclaimer

This article provides general information about financial services licensing and change-of-control rules in the EU, the United States, and Canada. It is not legal advice, and requirements differ by country, state, province, and type of activity. Regulatory frameworks, including PSD3 and MiCA implementation, are changing, so confirm current rules with the relevant regulator or qualified counsel. The case example is a composite for illustration only.

Authorities & Sources

• Directive (EU) 2015/2366 – Payment Services Directive (PSD2)
• Regulation (EU) 2023/1114 – Markets in Crypto-Assets (MiCA)
• Central Bank of Ireland – Acquisitions of Qualifying Holdings in Payment Institutions
• FinCEN – MSB Re-Registration Requirements
• CSBS – Money Transmission Modernization Act Adoption
• Bank of Canada – Retail Payments Supervision