Read the full article below or download using this link:
Regulatory matters are playing an increasing role in transactions involving financial services firms.
Our regulatory team takes a pragmatic but robust approach to identifying and managing the risks associated with transactions involving regulated firms or assets. This includes:
- Regulatory due diligence: We carry out targeted due diligence focused on identifying risks and practical mitigants, whether through contractual protections, price adjustments or other mechanisms.
- Warranties, indemnities & conditions: We convert due diligence into effective warranties and indemnities, as well as preparing workable regulatory approval conditions. Our team also has extensive experience of working with W&I insurers on due diligence.
- FCA/PRA change in control approval: We guide clients through the FCA/PRA change in control process, including ensuring strong applications and managing engagement with the FCA/PRA.
A key regulatory aspect of M&A involving the purchase or sale of FCA or PRA authorised firms is the change in control approval process. This article:
- Explains when the FCA/PRA must approve acquisitions of authorised firms.
- Outlines the change in control regime.
- Describes the change in control process (including the forms and documents required).
- Sets out the assessment criteria applied by the FCA/PRA.
Purpose of the change in control regime
The purpose of the change in control regime is to allow the FCA/PRA to decide whether to approve acquisitions of control in accordance with section 185 of the Financial Services and Markets Act 2000 (“FSMA”).
This involves the FCA/PRA considering the following:
- Suitability Assessment: Considering the suitability of the proposed controller and the financial soundness of the acquisition in order to ensure the sound and prudent management of the UK authorised person.
- Influence Evaluation: Having regard to the likely influence that the proposed controller will have on the UK authorised person.
- Market Considerations: Disregarding the economic needs of the market.
Acquisitions or increases in control
Section 178(1) FSMA requires that:
“A person who decides to acquire or increase control over a UK authorised person must give the appropriate regulator notice in writing before making the acquisition.”
This duty applies to any person or entity (UK or overseas) proposing to acquire, directly or indirectly, a qualifying holding in an FCA or PRA authorised firm. The obligation is triggered by the decision to acquire, not by completion of the transaction.
Breach of section 178(1) is a criminal offence. The court may impose unlimited fines and/or imprisonment of up to two years.
In addition, section 191F(2) FSMA requires:
“A person who gives notice to the appropriate regulator under section 178(1) and makes the acquisition to which the notice relates before the expiry date of the assessment period is guilty of an offence unless the appropriate regulator has approved the acquisition or given a warning notice under section 189(4)(b)(i).”
Cessations or reductions in control
In relation to cessation or reduction of control, section 191D(1) FSMA requires that:
“A person who decides to reduce or cease to have control over a UK authorised person must give the appropriate regulator notice in writing before making the disposition.”
As for breach of section 178(1), breach of section 191D(1) FSMA is a criminal offence. The court may impose unlimited fines and/or imprisonment of up to two years.
Change in control thresholds
The thresholds at which a change in control occurs vary depending on the status of the FCA/PRA authorised firms as follows:
- Directive Firms (e.g., MiFID investment firms, credit institutions, insurers, UCITS management companies, payment/e-money institutions):
- 10% or more but less than 20% of shares or voting power.
20% or more but less than 30% of shares or voting power.
30% or more but less than 50% of shares or voting power.
- 50% or more of shares or voting power.
- 10% or more but less than 20% of shares or voting power.
- Non-Directive Firms (e.g., non-MiFID investment firms, general insurance intermediaries, full-permission consumer credit firms, small AIFMs):
- Single threshold of 20% or more of shares or voting power.
- Other Thresholds:
- Limited-permission consumer credit firms: 33% or more.
- FCA-registered cryptoasset firms: 25% or more.
Significant influence
In addition to control being acquired by crossing a shares or voting power threshold, control can be acquired as a result of section 422(2)(c) FSMA by holding “shares or voting power in B or P as a result of which A is able to exercise significant influence over the management of B”.
Identifying a controller
Additional areas that are important to consider when identifying controllers include:
- Aggregation and Acting in Concert (section 422(3) FSMA): Holdings are aggregated where persons agree to exercise rights together. FG24/5 paragraph 2.15 states: “We view persons as acting in concert when each decides to exercise rights linked to shares under an explicit or implicit agreement.”
- Indirect Control (section 422(5) FSMA): Deemed voting power, such as via trusts or fund chains may create controller status.
- Private Equity / LP Structures: Limited Partner investors with no control are not generally considered controllers; the General Partner or investment manager usually is.
Assessment criteria
Under section 186 FSMA, the regulators assess proposed changes in control using several criteria, including:
- Reputation of the proposed controller.
- Reputation, knowledge and skills of proposed management.
- Financial soundness.
- Whether the target will be able to comply with its prudential requirements.
- The impact of joining a group on the target.
- Risk of money laundering or terrorist financing.
According to FCA in FG24/5 (paragraph 4.1):
“Our assessment focuses on the controller’s suitability, financial strength and the ongoing ability of the firm to satisfy threshold conditions.”
FCA/PRA guidance
On 1 November 2024, the FCA and PRA provided new guidance on various aspects of the change in control regime, including:
- Multiple controllers in same group: The FCA/PRA may decide to accept one controller notification form covering multiple controllers where they are part of the same group or controlled by the same legal or natural person. In this respect the FCA has said that groups making several acquisitions over a 12-month period are encouraged to discuss information requirements with it prior to formal submission.
- Intragroup transaction form: Introduction of a new FCA “intragroup transactions form” which contains reduced information requirements.
- Enhanced assessment guidance: Additional guidance on how the FCA and PRA assess proposed acquisitions.
- Controller determination examples: More granular examples from the FCA and PRA illustrating the determination of which persons or entities are considered controllers.
- Acting in concert guidance: Further guidance from the FCA and PRA on the application of acting in concert to controller analysis.
The Change in Control Application Form
Key parts of the change in control application form include:
- About the notification – Description of the change in control, whether prior approval was obtained, dates of acquisition, reasons for notification, and awareness of related applications or regulatory actions.
- About the target firm(s) – Names and FCA/PRA reference numbers of firms affected, details of current and proposed controllers, percentages of control before and after, and a description of how control is held.
- Corporate controller’s details – Legal status, registration number, country of incorporation, registered and head office addresses, financial solvency, overview of business activities, relationships with other shareholders or directors, and details of any prior regulatory assessments.
- Group information – Whether the controller is part of a group, details of the group’s structure and activities, and information on other regulated entities in the group (including those entities’ regulators and contact details).
- The corporate controller’s directors – Full names, dates of birth, positions held, and confirmation that CVs are attached for those directors not currently FCA/PRA-approved.
- The persons who effectively run the business – Names, dates of birth, positions, details of the controllers of the controller (with percentage ownership and description of how control is held), any shareholder agreements, credit ratings, and DBS or other background checks.
- Disclosures – Information on any criminal, civil, regulatory, business, employment, or disciplinary matters relating to the proposed controller or anyone with a position of influence over (or who effectively runs) the business of the controller.
- About the transaction – Whether the target firm is aware of the proposed change, market sensitivity considerations, rationale for the acquisition and strategic fit, intended changes to governance or operations, financial arrangements (including cost and source of funds with supporting evidence), and any conflicts of interest or shareholders’ agreements.
- Details of proposed control – Whether the acquirer will become a parent undertaking, how long control is expected to last, whether control will be actively exercised, the controller’s ability and willingness to support the target financially, and medium-term intentions for the target.
However, please note that the precise form that will need to be used depends on the status of the target firm and the type of proposed controller.
Supporting documents
In addition to the form, various supporting documents may need to be submitted, including:
- Financial Statements – For the proposed controller, covering the last three financial periods.
- Assessment by another supervisory authority – Evidence of any assessment conducted by another authority and its outcome.
- CVs – For each director, partner, member, or individual who effectively runs the business, if not currently FCA/PRA-approved (to be provided unless such person is already approved).
- Control structure charts – Diagrams showing the ownership structure before and after the change in control.
- Funding documentation – Documents supporting the information provided about funding the acquisition, including:
- Loan agreements
- Bank statements
- Sale and Purchase Agreement or key terms and conditions of the sale
- Business plan – Required if the proposed controller will become a parent undertaking. The business plan must include:
- Strategic developmental plan
- Consumer duty compliance plan
- Due diligence or board pack (highlighting identified risks and proposed mitigations)
- Three-year financial forecasts (on both a solo and consolidated basis)
- Plans addressing capital adequacy, governance, integration, systems and controls, and data security
- Supporting evidence for regulatory or legal matters – Any documents referenced in section 6.6 of the application (regarding criminal, civil, regulatory, or disciplinary proceedings) or additional sheets providing relevant details, if applicable.
Change in control timing
Key steps in the change in control process include:
- Pre-notification engagement: The FCA and PRA generally encourage early engagement before formal notification, especially for complex or high-risk transactions. Early discussion can help identify additional information requirements and improve the chances that the notification will be deemed complete on submission.
- Assessment duration: Once a complete notification is accepted and a case officer is assigned, the regulator has 60 working days for its assessment. In practice, the FCA/PRA often does not deem applications “complete” immediately, meaning the statutory clock may not start right away. (Notably, FCA statistics for Q1 2025/26 show a median of 40 days and an upper quartile of 70 days for change in control approvals.)
- Interruption (“Stopping the Clock”): The regulator can interrupt the assessment period once, for up to 30 working days, to request further necessary information (FSMA section 189(2)). This interruption must occur within the first 50 working days of the assessment period (FSMA section190(1)).
- Post-approval: Once approval is granted and the transaction completes, the new controller must notify the FCA/PRA that the change in control has taken place (notification upon completion of the transaction).
Conditional approvals
Under section 185(3) FSMA, the FCA/PRA may approve an acquisition subject to conditions. Typical conditions include capital support, governance restrictions, enhanced reporting, and restrictions on regulated activities.
Notifications by authorised firms
In addition to requirements for proposed controllers, there are various requirements that apply to FCA/PRA authorised firms in relation to changes in control:
- Firms must monitor the identity of controllers: FCA/PRA authorised firms are expected to monitor the identity and status of their controllers on an ongoing basis.
- Pre-notification discussions: FCA guidance advises that authorised firms should inform the FCA at the earliest opportunity about any prospective material changes in a controller’s (or proposed controller’s) shareholdings or voting power. At a minimum, firms should engage in such discussions before a person:
- enters into any formal agreement to purchase shares or undertake an acquisition/merger that would result in a change in control (even if the agreement is conditional on regulatory approval); or
- purchases any share options, warrants, or other financial instruments that, upon exercise, would result in that person acquiring control or otherwise triggering a change in control.
In practice, the PRA is likely to have a similar expectation for PRA authorised firms.
- Notification of acquisition/disposal/increase/decrease in control: Authorised firms must notify the FCA/PRA of acquisitions, disposals, increases, and decreases of control. Notification should be made:
- as soon as the firm becomes aware that a person, whether alone or acting in concert, has decided to acquire, increase, reduce, or cease control; or
- if the change in control occurs without the firm’s knowledge, within 14 days of the firm becoming aware of the change.
- False or misleading information (or changes in information): If, between submitting a change in control notification and the completion of the change, an authorised firm becomes aware (or has information which reasonably suggests) that the notice-giver has provided information that was or may have been false, misleading, incomplete or inaccurate, or that information has changed in a material way, the firm must notify the regulator immediately. (While this duty is explicitly stated for PRA authorised firms, the FCA is likely to expect the same of FCA authorised firms.)
- Notification of completion of change in control: After a change in control has occurred, an authorised firm must notify the FCA/PRA that the change in control has taken place, within 14 days of the event.
Key takeaways
Key takeaways on the FCA/PRA:
- Regulatory approval must precede completion of the transaction.
- Control thresholds apply to both shareholding and voting power.
- Consider whether significant influence applies.
- Determine whether any parties are “acting in concert,” as their holdings may need to be aggregated.
- Align the Sale and Purchase Agreement (SPA), regulatory approval, and completion timelines.
- Coordinate any parallel filings (e.g. Senior Managers & Certification Regime approvals, competition authority clearances).
- Engage advisers and regulators early in the process.
- The quality and completeness of the application can significantly influence the speed of the decision.
- Maintain ongoing awareness – subsequent changes in control (even post-completion) must be notified.
Appointment of new directors or senior managers
The appointment of new directors or senior managers is not part of the change in control process itself, but such appointments often occur upon closing of a transaction and therefore need to be considered. Regulatory approvals for new appointments are likely to be needed (for example, securing FCA/PRA approval for individuals under the Senior Managers & Certification Regime).
Get in touch
Our regulatory team is experienced in guiding clients through the FCA/PRA change in control process.
