Buying a ready-made licensed company is a deal where the most valuable things are below the surface. The license can be valid while the relationship with the regulator is strained; the balance sheet can be clean while the AML history is not. That is why you need full due diligence before signing. Below is the checklist we use with buyers.
In short: check six blocks — corporate, regulatory, finance and tax, AML and clients, contracts and partners, IT and security. Any red flag is a reason to revisit the price, restructure the deal or walk away.
1. Corporate
- Constitutional documents, register of shareholders and beneficial owners, change history.
- Directors' powers, board resolutions, powers of attorney.
- Encumbrances on shares, options, third-party rights.
2. Regulatory
- Exact license scope: which services, which countries, whether it is passported.
- Correspondence with the regulator, orders, inspections, fines.
- Timely regulatory reporting and compliance with capital requirements.
- Key people (MLRO, compliance officer) and whether they will stay for a transition period.
3. Finance and tax
- Audited financial statements for recent years and management accounts.
- Debts, guarantees, contingent liabilities.
- Tax returns, disputes with tax authorities, transfer pricing.
4. AML and clients
- AML policies and how they are actually applied: sample review of client files.
- Suspicious activity reports and law enforcement requests.
- Client base structure: countries, industries, share of high-risk clients.
5. Contracts and partners
- Banks, payment partners, IT vendors: termination rights on change of control.
- Office lease, employment contracts, outsourcing agreements.
- Litigation and client complaints.
6. IT and security
- Rights to software and data, third-party licenses.
- Security incidents, penetration test reports, continuity plans.
- Compliance with data protection rules.
Deal red flags
| Signal | What it may mean |
|---|---|
| The seller rushes and withholds documents | Hidden issues with the regulator or clients |
| The company has been dormant | The regulator may review the license |
| Frequent changes of directors and MLRO | Internal conflict or tension with the regulator |
| Banks have closed accounts | A problematic AML history |
Frequently asked questions
How long does due diligence take?
Usually 3–8 weeks depending on the size of the company and how quickly the seller provides documents.
Who carries out the review?
A team of lawyers, finance and compliance specialists and IT auditors. We coordinate the work and compile a final report with risks and recommendations on deal structure.
What if risks are found?
Options: lower the price, add seller warranties and indemnities, split payment into stages, fix issues before closing or walk away.
Need a specific company checked? Send a request on the ready-made companies page and we will organise due diligence and support the deal through regulator approval. Closing documents are prepared under our corporate documents service.
This article is for information only and is not legal advice.