How to Buy or Sell a Licensed Payments Company

The market for regulated payment companies is full of misleading shorthand. Listings advertise “an EMI license for sale,” “a U.S. MSB license”, “a turnkey money transmitter,” or “a clean crypto authorization.” The language suggests that the buyer can purchase a certificate, change the company name, connect a bank account, and begin operating.

That is rarely how regulated acquisitions work.

A license is generally attached to a legal entity, its owners, directors, capital, systems, compliance framework, business plan, and supervisory history. The transaction is therefore usually a purchase of shares or assets in a regulated business, followed by regulatory notifications, change-of-control approval, re-registration, bank review, provider consent, and operational transition. The license may be the most visible asset, but the liabilities around it determine whether the deal creates value.

The direct answer is: buy or sell the regulated company through a controlled transaction process that verifies authority, tests change-of-control requirements, values the operating platform, and protects both sides against hidden regulatory and financial exposure.

First Determine What is Actually Being Sold

A seller may offer one of several very different things:

• A legal entity with an active license and operating history;

• A legal entity with licenses but no current customers;

• A dormant or suspended authorization

• A federal or AML registration rather than an operating license;

• An exemption or local filing described as a license;

• A pending application;

• Selected assets from a regulated company without the regulated entity;

• A book of customers and contracts; or

• An entire business including staff, technology, banking, providers, and revenue.

These are not comparable assets. The buyer must identify the exact legal entity, regulator, permission, status, scope, conditions, jurisdictions, branches, agents, and permitted activities. It must also determine whether the authorization remains effective after a change in ownership, business model, management, or control.

A genuine license can still be commercially useless. It may not cover the intended product. It may require local management or capital the buyer cannot provide. It may be linked to a bank account that will not survive the transaction. It may be restricted to a narrow geography or customer segment. It may have no value outside the specific entity and facts under which it was granted.

The Four Common Transaction Structures

Share Purchase

The buyer acquires shares in the licensed legal entity. This is the most common route when preservation of the entity and its permissions is essential.

The advantage is continuity: contracts, employees, licenses, accounts, and records remain with the company unless counterparties require consent. The disadvantage is that the buyer inherits historical liabilities, including regulatory breaches, customer claims, taxes, litigation, compliance failures, data issues, and contract obligations.

A share purchase therefore requires deep diligence and robust warranties, indemnities, conditions, and regulatory approvals.

Asset Purchase

The buyer acquires selected assets such as technology, customers, intellectual property, contracts, or equipment. Liabilities can be more selectively assumed, subject to law and negotiation.

The limitation is that regulatory permissions usually do not transfer automatically as ordinary assets. The buyer may need its own licenses or a separate regulator-approved transfer. Customer migration, data transfer, contract assignment, safeguarding, and continuity must be planned carefully.

Merger or Reorganization

A merger, contribution, or group reorganization may be used where the buyer and target need a specific legal, tax, or regulatory outcome. This can be efficient but tends to require specialized advice and regulator engagement.

Management, Option, or Staged-Control Arrangement

Parties sometimes propose an option, management agreement, nominee arrangement, or staged acquisition while regulatory approval is pending. These structures can create serious risk if the buyer obtains de facto control before approval. Rights over directors, bank accounts, budgets, compliance, customers, or key decisions may be treated as control even if legal ownership has not transferred.

The interim structure should be reviewed carefully and disclosed where required.

Change of Control is the Central Regulatory Issue

Regulators care about who controls a regulated company because ownership affects governance, financial resources, competence, reputation, and risk. A transaction may require prior approval, notice, a new application, re-registration, background checks, fingerprints, business-plan updates, financial statements, or evidence of source of funds.

The threshold for control varies. It may be based on percentage ownership, voting power, board rights, the ability to direct management, or other forms of influence. Indirect ownership through holding companies can also count.

The transaction timetable must be built around these requirements. A commercial signing date is not necessarily the date the buyer can take control. Closing conditions should address regulator approval, bank and provider consent, required capital, management appointments, and the absence of adverse changes.

The buyer should also understand what the regulator will review beyond ownership. A new product, customer segment, corridor, stablecoin strategy, or volume profile may require a business-plan variation or additional permission. Buying a company to immediately replace its business with a different one can invite a full reassessment.

The Value of a Regulated Company

Valuation begins with the license footprint but does not end there. The following factors can create value:

• Active permissions in difficult or strategically important jurisdictions

• Clean regulatory and examination history;

• Experienced management and compliance staff;

• Current banking, safeguarding, sponsor, or payment-rail relationships;

• Functioning AML, sanctions, fraud, and operational controls

• Tested technology, ledger, and reconciliation;

• Customer contracts and recurring revenue

• Documented policies, audits, and regulatory reporting;

• Capital and permissible investments already in place; and

• A credible path for change-of-control approval

• The following factors reduce value:

• Dormant permissions with no operating substance;

• Unclear or exaggerated license descriptions;

• Unresolved regulator findings;

• Weak customer files or transaction monitoring;

• Suspicious or high-risk historical activity;

• Account closures or unstable banking;

• Unpaid taxes, claims, litigation, or customer liabilities;

• Inadequate capital or safeguarding shortfalls;

• Dependence on one owner, employee, bank, or provider;

• Technology that cannot be separated or transferred; and

• A business plan fundamentally different from the buyer’s intended use.

A license-only valuation often ignores the cost of remediation. A seemingly cheap target can be more expensive than a new application after legal, compliance, capital, audit, bank migration, and technology work are included.

A Buyer’s Due Diligence Matrix

Regulatory Diligence Must Go Beyond the Registry

A public registry is the first check, not the final one. It can confirm that an entity appears to hold an authorization, but it may not reveal pending enforcement, supervisory concerns, overdue reports, capital deficiencies, informal restrictions, or the regulator’s view of a proposed acquisition.

The buyer should request original licenses, regulator correspondence, examination reports, applications, business-plan variations, annual filings, compliance attestations, and evidence of fees and renewals. It should reconcile the target’s claims with public records and legal advice.

Where appropriate, the transaction should include a regulator engagement plan. Sellers may need permission before sharing certain confidential supervisory information. Counsel should manage that issue rather than simply omitting the material.

Compliance Diligence: Test the Files

A seller may have impressive policies and still operate poorly. The buyer should sample customer files, beneficial-ownership records, sanctions results, transaction alerts, suspicious-activity decisions, complaints, refunds, reconciliations, and audit remediation.

The objective is to determine whether controls were actually performed, documented, and escalated. Weak historical files can create ongoing remediation duties and expose the buyer to activity that occurred before closing.

For crypto businesses, diligence should include wallets, chain analytics, asset and chain policies, Travel Rule processes where applicable, source-of-funds practices, blocked or frozen addresses, custody controls, and exchange counterparties.

For remittance and payment companies, review should include agents, authorized delegates, merchants, sub-merchants, payout partners, transaction monitoring, fraud, returns, and customer-funds protection.

Banking and Provider Continuity

One of the most dangerous assumptions is that accounts and contracts automatically survive the acquisition. Banks, sponsors, card networks, exchanges, custodians, processors, and payout partners often require notice or consent. They may re-underwrite the new owners and business plan.

A seller’s “active bank account” may be an ordinary operating account rather than a customer-funds account. It may also depend on personal relationships, low historical volume, or an activity profile that will change after closing.

The buyer should obtain written clarity on account purpose, limits, balances, reserves, open issues, and change-of-control provisions. The closing plan should assume some relationships may need to be replaced.

Deal Terms that Matter

The purchase agreement should be built around regulatory risk, not copied from an ordinary software acquisition.

Important terms may include:

• Conditions precedent for regulator and provider approvals;

• A long-stop date and termination rights;

• Conduct-of-business covenants before closing;

• Restrictions on new customers, products, dividends, or liabilities;

• Warranties on licenses, compliance, customer funds, reports, taxes, data, and contracts;

• Specific indemnities for known risks;

• Escrow or holdback;

• Leakage protection;

• Management retention and transition services;

• Access to books, systems, keys, and records;

• Post-closing remediation obligations;

• Non-compete and non-solicitation provisions where lawful; and

• Allocation of responsibility if approval is refused.

• Earn-outs can align value with future performance, but they can also create incentives to increase volume or risk during a sensitive transition. Metrics should be designed carefully.

Preparing a Regulated Company for Sale

A seller can materially improve value by making the business understandable and transferable.

The preparation process should include:

1. Confirming every license, registration, and legal entity;

2. Resolving overdue filings and regulator findings;

3. Completing independent compliance and financial reviews;

4. Reconciling customer funds and reserves;

5. Organizing customer, vendor, bank, and provider contracts;

6. Documenting technology and intellectual-property ownership;

7. Creating a clean data room;

8. Preparing historical and normalized financials;

9. Identifying required consents and change-of-control steps;

10. Retaining key management and compliance personnel; and

11. Describing the business accurately.

Inflating a registration or exemption may attract initial inquiries but damages the process during diligence. Sophisticated buyers pay for clarity and operational quality.

The Transaction Sequence

A disciplined sale or acquisition usually follows this sequence:

• Define the buyer’s or seller’s thesis;

• Prepare a confidential summary

• Screen counterparties and sign an NDA;;

• Provide a first-stage data room;

• Agree valuation and structure in a letter of intent;

• Prepare the regulator and provider engagement plan;

• Negotiate definitive agreements;

• Submit change-of-control or other applications;

• Satisfy closing conditions;

• Close only when control can lawfully transfer; and

• Execute a structured transition and remediation plan.

Skipping stages rarely makes the transaction faster. It usually moves the problem closer to closing, where the cost of failure is higher.

Is Buying Faster Than Applying?

Sometimes. A clean, operational company with a predictable change-of-control process can provide a meaningful head start. In other cases, the buyer spends months on diligence and approval, then must replace banking, staff, policies, technology, and capital. A new application may have been cleaner.

The comparison should include total cost, approval risk, hidden liabilities, operating continuity, time to the buyer’s intended product, and the enterprise value of the acquired platform. The relevant question is not “how quickly can we own the company?” It is “how quickly can the company lawfully and reliably operate our model after ownership changes?”

How Faisal Khan LLC Can Help

Faisal Khan LLC helps buyers and sellers evaluate and structure transactions involving MSBs, money transmitters, payment institutions, EMIs, SPIs, crypto businesses, and other regulated financial-services companies. The work can include opportunity positioning, license and operating-model assessment, buyer or seller qualification, commercial structuring, diligence coordination, and change-of-control planning.

The objective is to distinguish a valuable regulated platform from an expensive certificate, then structure a transaction that can survive regulator, bank, provider, and operational review.

Selected Authoritative References

These references support the current regulatory and supervisory context. They are not a substitute for jurisdiction-specific legal advice.

1. Bank of Canada - Acquisitions of Control and Prescribed Changes

2. CSBS - Money Transmission Modernization Act

3. New York DFS - Regulated Entities and Licensing

4. OCC - Interagency Third-Party Risk Management Guidance