Compliance Due Diligence on a Regulated Target

When a finance leader runs diligence on an acquisition, the financial information gets taken apart. Revenue is tested for quality, working capital is normalised, the pipeline is challenged, and every material contract is read.

If the target is FCA-regulated, the compliance function usually gets a paragraph in the legal report confirming the firm holds the permissions it claims to hold, and that is the end of it.

That is a considerable gap, because the compliance monitoring file is arguably the single most revealing document in the data room. It is the only place in a regulated business where somebody has systematically written down what is not working, and whether anybody fixed it. This is a guide for the CFO, finance director or deal lead on what to ask for and how to read it.

Why a regulated target is a different proposition

Three things make this unlike an ordinary acquisition.

You need the regulator’s permission to buy it. Acquiring control of an FCA-authorised firm requires prior approval under the change in control provisions of FSMA 2000, with notification thresholds that bite well below outright ownership. The statutory assessment clock runs for weeks after a complete notice, and it does not start until the notice is complete. That timetable sits on the critical path of the deal, and a target with a visibly weak control environment makes the approval conversation harder.

Liabilities you cannot see are often the largest ones. A past-business review, a redress programme or a remediation exercise can exceed the purchase price of a small firm. None of it appears on the balance sheet until somebody has quantified it, and the monitoring file is frequently where the first evidence of it sits.

The firm’s permission depends on people and arrangements, not just capital. Threshold conditions require adequate resources and appropriate non-financial resources on an ongoing basis. If the senior managers leave on completion, the thing you bought may not continue to satisfy the conditions of its own authorisation.

What to ask for

A compliance diligence request list that actually earns its place is short. These are the items that reward reading.

• The compliance monitoring plan for the current and previous two years, and the completed reports against each.
• The open actions log, with original dates, owners and current status.
• Board and committee papers where compliance was reported, for the same period.
• All correspondence with the FCA, including supervisory correspondence, information requests and any attestations given.
• Any skilled person report commissioned under section 166, and the remediation plan that followed.
• The breach register and the record of notifications made to the regulator.
• Complaints data and root cause analysis, with any redress paid.
• The firm-wide financial crime risk assessment and the most recent annual MLRO report.
• Statements of Responsibilities for every senior manager and, where the firm is Enhanced, the management responsibilities map.

If the seller cannot produce the first two items, that is itself the finding, and a significant one. A firm with no documented monitoring over three years has not been testing its controls, which means nobody — including the seller — knows what condition they are in. SMF Capital’s guide to compliance monitoring sets out what a functioning programme should have produced, and is a useful benchmark to read the target’s file against.

How to read the monitoring file

Coverage: what was planned and what was done

Compare the plan with the completed reviews, year by year. Consistent under-delivery indicates a function without the capacity to meet its own commitments. Look at which reviews were dropped: the areas that get deferred are rarely the low-risk ones, because low-risk reviews are quick and get done to show progress.

Closure: what happened to the findings

Take the open actions log and sort by original date. A long tail of actions raised two or three years ago and still open tells you more about the firm’s culture than any management presentation will.

Then test how closure happens. Where an action was marked complete, was there evidence, and did anyone retest? “Confirmed closed by the business” is not validation, and a file full of self-certified closures is a file that will not withstand supervisory examination.

Repetition: the same finding under new wording

Read three years of reports together and look for the issue that keeps coming back. Where the same problem resurfaces annually, whatever remedy was applied did not reach the cause, and that issue is your best available predictor of what will go wrong after completion. It is also, typically, the one the board was told had been dealt with.

Candour: what the ratings tell you about the culture

A monitoring file with no serious findings across three years is not evidence of a well-run firm. Far more often it means the testing never went deep enough to surface anything, or that whoever performed it understood which conclusions were unwelcome. Either way you are buying an unmeasured control environment, which is a worse position than buying a measured one with known problems.

Cross-check the monitoring file against the complaints data and the breach register. If complaints show a pattern that monitoring never detected, the programme was not looking where the harm was.

Key person risk in the SMF roles

This is the diligence finding most often missed, and the one most likely to cause a problem in the first quarter after completion.

Map the senior management functions against the individuals holding them. At a smaller target you will frequently find one person holding both the SMF16 Compliance Oversight and SMF17 Money Laundering Reporting functions, sometimes alongside an operational role. Establish three things about that person: whether they intend to stay, what their notice period is, and whether anything about the transaction gives them a reason to leave.

If they go, the firm loses two required functions at once. The statutory financial crime obligations do not pause while a successor is recruited and approved, and a buyer who has just taken control of a regulated business with no compliance leadership is in an uncomfortable position with a supervisor who is already watching the change of control. Our guide to temporary SMF cover and the 12-week rule explains the mechanism available, and SMF Capital’s urgent SMF replacement page covers how firms move when it happens without warning.

The practical mitigations are retention arrangements for the SMF holders through integration, an agreed handover specification if they are leaving, and a successor identified before completion rather than after. Our post on senior manager handovers sets out what the handover pack should contain.

Turning findings into deal terms

Compliance diligence findings rarely kill a deal. They should change its shape.

Quantify the remediation. Open actions, unaddressed repeat findings and gaps in monitoring coverage all represent work the buyer will have to fund. Price it as a cost rather than treating it as a risk to be noted.

Use specific indemnities where the exposure is identified but unquantified. A known past-business issue with an undetermined redress population is the textbook case for an indemnity rather than a price adjustment.

Build the resourcing into the plan. If the target’s compliance function was under-resourced for the business as it stood, it will be more so under an owner with growth plans. That cost belongs in the model from day one, not in year two when a supervisor raises it.

Decide who owns compliance on day one. Not in month three. The first board meeting after completion should receive a monitoring report, and somebody has to have produced it.

The question worth asking the seller

If you ask one thing in management meetings, make it this: what has your compliance monitoring found in the last two years that you were genuinely uncomfortable about, and what did you do? A seller who can answer specifically has a functioning programme. A seller who cannot think of anything has either an unusually well-run firm or a monitoring function that was never really looking — and the file will tell you which.

References and further reading

• Financial Services and Markets Act 2000 — the change in control provisions governing acquisitions of authorised firms.
• FCA: Senior Managers and Certification Regime — the accountability framework behind the SMF roles you are acquiring.
• ICAEW — the professional body for chartered accountants in England and Wales.
• SMF Capital: Compliance Monitoring Explained — the benchmark to read a target’s monitoring file against.