There are two ways to end up owning a regulated payments business. Apply for a new authorisation, or buy a company that already holds one. Both end with you as the principal of a licensed firm. What differs is how long it takes, what you inherit, and where the risk sits.

The same choice exists in broking and investment management, and the logic is similar. The details are not, because payments firms carry two things a securities firm does not: a live float of customer money and a set of banking and scheme relationships that may or may not survive the change of owner.

What an acquisition actually buys you

A new application is a project with an uncertain end date. An acquisition of an authorised EMI or payment institution replaces most of that uncertainty with a change-of-control approval, which is a narrower assessment against a permission that already exists.

You may also acquire things that are genuinely hard to build: an existing safeguarding account at a bank that has already onboarded the firm, scheme memberships, a live customer base, and a compliance function that has been through supervision at least once. In a market where banking access is the binding constraint, an entity a bank already knows can be worth more than the licence itself.

What you also inherit

Everything the company has ever done. That is the part buyers underweight.

Supervisory history. Past correspondence, undertakings, remediation programmes, and any restrictions on the permission. A firm operating under an agreed remediation plan is not the same asset as a clean one, and the plan does not disappear at completion.

The back book. Customers onboarded under earlier standards, with earlier documentation. If the file quality does not meet current expectations, remediating it becomes your obligation and your cost, and until it is done your firm carries the risk of every account in it.

Safeguarding position. Whether the float has been correctly segregated and reconciled throughout, and whether there is any shortfall. This is the diligence item that most often kills a payments deal, and it should be checked early rather than last.

Historic AML exposure. Suspicious activity that was never reported, sanctions screening gaps, corridors the firm served that you would not have chosen. Liability for historic conduct sits with the entity, and you are buying the entity.

Dormancy. A licence that has not been used in a meaningful way is a warning rather than a bargain. Regulators can and do question whether a permission still reflects a real business, and reactivating a dormant firm can attract as much scrutiny as a fresh application.

The change-of-control process

Acquiring a qualifying holding in a regulated payments firm requires prior regulatory approval. The authority assesses the proposed acquirer on much the same basis as a new applicant: fitness and propriety, financial soundness, source of the acquisition funds, and the intended strategy for the firm.

Two things follow. First, a buyer who would not have been authorised in their own right will not be approved to buy one either. Second, if you intend to change the business model materially after completion, say so in the notification. Approval granted on one basis and a different business run afterwards is a supervisory problem you create for yourself on day one.

Deals also stall when the seller's file is incomplete, because the regulator's questions are answered from records the seller may not have kept well.

When each route is right

Apply when the timeline is not the binding constraint, when your model is unusual enough that a clean permission scoped precisely to it is worth the wait, or when you want no inherited history at all. A firm built to your own standards from the start is the cleanest asset you can hold.

Acquire when speed is the point, when a specific entity carries banking or scheme access you cannot readily obtain, or when the target's business is genuinely close to what you intend to run. Then buy on the strength of diligence, not on the strength of the licence certificate.

The failure mode is buying a permission and discovering you bought a remediation programme. It is avoidable, and it is avoided by diligence in three places: safeguarding, the customer back book, and the full supervisory correspondence file.

Either way, the substance question follows you

Neither route excuses you from running a real business in the country that licensed it. An acquired firm with a departing management team and no local replacement is a substance problem wearing a licence, and supervisors notice quickly.

BrokLicense runs both routes: new EMI and payment institution applications, and the diligence and change-of-control approvals when clients acquire instead. Which one fits depends on your timeline and your appetite for inherited history, so tell us which of the two is tighter.