Regulatory Disclosures in Fintech M&A: What to Know

When acquiring or merging with a fintech company, regulatory disclosures are a critical step. They ensure compliance with federal and state laws, covering areas like antitrust, consumer protection, and licensing. Missing these can delay or even derail deals. Here's what you need to know:

• Federal Oversight: Agencies like the FTC, DOJ, CFPB, and CFIUS require detailed filings, including ownership details, business plans, and compliance records. Recent updates to the HSR Act now demand more extensive documentation, increasing preparation time.
• State Licensing: State-level requirements, such as money transmitter licenses, add complexity. Licenses aren't transferable, so deals must often be structured as equity transactions. Ownership changes typically trigger advance notifications, with timelines ranging from 30 to 90 days.
• Due Diligence: Buyers must review compliance histories, regulatory filings, and potential risks (e.g., cybersecurity or fair lending violations). Early preparation is key to avoiding surprises.
• Risk Management: Use representations, warranties, indemnities, and escrow funds to address potential liabilities. Post-closing covenants can ensure smooth integration and ongoing compliance.

Platforms like MyReadyMade can simplify these processes by offering pre-vetted listings and expert advisory services. Early planning and thorough due diligence are essential to navigating these regulatory hurdles effectively.

Compliance Tip of the Day: M&A-Pre-Acquisition: Final Lessons

sbb-itb-ba142f6

Federal Disclosure Requirements for Fintech M&A

When it comes to Fintech mergers and acquisitions (M&A), federal oversight is handled by three key agencies: the Federal Trade Commission (FTC) and Department of Justice (DOJ) for antitrust issues, the Consumer Financial Protection Bureau (CFPB) for consumer protection, and the Committee on Foreign Investment in the United States (CFIUS) for national security concerns. Each agency's requirements can significantly impact how deals are structured and their timelines, setting the stage for additional challenges at the state level.

SEC and HSR Act Filings

Under the Hart-Scott-Rodino (HSR) Act, large transactions must go through a premerger notification process, which includes a mandatory waiting period - typically 30 days, or 15 days for cash tender offers or acquisitions tied to bankruptcy cases [4]. Starting February 10, 2025, updated HSR rules have introduced more extensive filing requirements, adding between 68 and 121 extra hours of preparation per filing [8].

These new rules demand detailed disclosures such as transaction rationales, descriptions of business lines (even for products still in development), and documentation from key deal team leaders who oversee strategic assessments, even if they aren't high-ranking executives [5][8]. For Fintech companies, particular attention is given to vertical supply relationships and "roll-up" strategies, which involve serial acquisitions [5][6]. Additionally, parties are required to list their top 10 customers in overlapping areas, enabling the FTC or DOJ to contact these customers early in the review process [5][6].

"The statutory timelines laid out in the HSR Act have not kept pace with the surge in volume and complexity of transactions." - Lina M. Khan, Chair, FTC [8]

If a deeper investigation is necessary, agencies issue a "Second Request", which extends the waiting period until 30 days after all requested documents and data are submitted [4][7]. While HSR-reportable filings made up just 16.5% of annual U.S. deal activity between FY 2018 and 2022, FY 2021 saw a surge with 3,520 transactions reviewed - more than double the previous year's numbers [7]. On a positive note, as of February 2025, the FTC and DOJ have resumed granting "early termination" of the waiting period for deals deemed non-problematic, a practice that had been suspended since February 2021 [8].

CFPB and Consumer Protection Obligations

The CFPB plays a vital role in overseeing Fintech M&A, particularly for companies handling consumer financial data or providing services like lending, payment processing, or credit. Unlike the HSR Act, the CFPB doesn’t require a formal premerger notification process. However, it does mandate ongoing compliance with consumer protection laws, such as the Truth in Lending Act, Fair Credit Reporting Act, and Electronic Fund Transfer Act.

During M&A due diligence, acquiring companies must verify that the target has maintained proper practices in areas like consumer complaint handling, data privacy, and fair lending. The CFPB may review filings during the transaction process, and any past enforcement actions or compliance issues become critical disclosure items. Buyers should secure copies of CFPB examination reports, consumer complaint logs, and correspondence regarding any potential violations. Failure to disclose these issues can lead to post-closing liabilities, including civil penalties and mandatory remediation efforts. This makes thorough regulatory due diligence a must for Fintech deals.

CFIUS and National Security Concerns

National security considerations add another layer of complexity to Fintech M&A. CFIUS examines cross-border transactions to address potential risks, particularly in industries involving critical technology or sensitive personal data. Starting February 2026, the Department of War (DoW) has implemented a policy requiring HSR filings for transactions involving "Critical Technologies", such as Applied AI and Quantum information dominance [9].

New rules also mandate disclosures about foreign subsidies received from "governments of concern" within the two years prior to filing [8][10]. Additionally, companies must report contracts with the Department of Defense (DoD) or Intelligence Community (IC) valued at $100 million or more. Private equity and investment funds now face stricter requirements to disclose limited partners, including sovereign wealth funds, that may influence operations post-transaction [10].

The DoW reported roughly 400 defense-related M&A deals in 2017 but had the capacity to review only 40 deals annually between 2018 and 2022 [9]. Under the 2026 policy, the DoW must respond within one business day with secure submission instructions [9]. These tight deadlines are especially challenging for Fintech firms involved in sensitive technologies or intellectual property tied to areas like biomanufacturing, hypersonics, or contested logistics. The FTC estimates that the new HSR filing rules, including national security disclosures, will increase preparation time from an average of 37 hours to about 158 hours for deals involving overlaps or supply relationships [10].

State Licensing and Regulatory Disclosure Requirements

In addition to federal requirements, state licensing adds another layer of complexity that acquirers must navigate in Fintech M&A. While federal agencies set the groundwork for oversight, state-specific licensing frameworks introduce unique challenges that can be both time-consuming and costly. For instance, 49 states (Montana being the only exception) mandate separate money transmitter licenses for businesses that handle, transmit, or store money or monetary value [11]. Each state has its own set of rules, covering everything from net worth thresholds to surety bonds and permissible investments. These differences make disclosure requirements even more critical in the context of Fintech acquisitions.

The financial impact of state licensing is no small matter. Securing licenses in all 49 states can run anywhere from $1 million to $3 million. This includes application fees (ranging from $250 to $10,000), surety bonds (from $10,000 to $1,000,000), and legal expenses (between $500,000 and $1,000,000) [13][15]. On top of the costs, processing times vary significantly - from 3–6 months in states like Texas to as long as 12–24 months for New York's BitLicense. Although 31 states have adopted portions of the Money Transmission Modernization Act (MTMA) as of 2025 to standardize some requirements, substantial differences remain across jurisdictions [15].

Money Transmitter Licensing (MTL)

Money transmitter licenses come with a notable limitation: they are non-transferable. This restriction means that Fintech M&A deals are often structured as stock or membership interest purchases rather than asset sales. Any change in control or ownership triggers regulatory notifications or, in some cases, a completely new license application. Regulators will typically scrutinize new officers, directors, and owners - often defined as individuals with at least 10% equity ownership, though this threshold can range from 5% to 25%, depending on the state [3][12].

While the Nationwide Multistate Licensing System & Registry (NMLS) streamlines initial filings, states often require additional documentation. These may include detailed flow-of-funds analyses and proof of permissible investments, ensuring liquid assets cover 100% of outstanding transmission obligations to protect consumer funds [11]. Buyers should carefully examine the target company's NMLS records for any deficiencies or compliance issues. If a target lacks licenses in specific states, implementing geofencing technology to block users in those areas can help mitigate immediate risks [13]. However, these licensing requirements vary widely, adding to the overall complexity.

State-by-State Compliance Challenges

State regulations differ significantly in their scope, interpretation, and enforcement. For example, Nevada requires businesses to obtain foreign qualification and a state business license before applying for a money transmitter license [11]. Maine enforces a strict rule that permissible investments must equal 100% of outstanding transmission liabilities, coupled with a flat $100,000 surety bond requirement [11]. On the other hand, Massachusetts primarily licenses international transmissions, often exempting domestic peer-to-peer payment applications [11].

Starting in July 2025, states like Washington and Colorado will require Hart-Scott-Rodino (HSR) filers with net annual sales of $25.3 million or more to submit filings to the state Attorney General. Noncompliance could result in penalties of up to $10,000 per day. Similar measures are being considered in states like California, Hawaii, Nevada, and West Virginia [16][17].

State	Key M&A Licensing Nuance	Bond Requirement
Nevada	Requires foreign qualification and state business license	$10,000–$250,000
Maine	100% permissible investment rule for liabilities	$100,000
Massachusetts	Licenses only international transmissions; domestic P2P may be exempt	$50,000
Colorado	Among the highest fixed bond requirements in the U.S.	$1,000,000
California	DFAL licensing required by July 1, 2026; volume-based bond scrutiny	$250,000–$7,000,000

Operating a money transmitting business without the proper licenses is a federal crime under 18 U.S.C. § 1960 [14]. During due diligence, buyers should conduct thorough flow-of-funds analyses to identify which state licenses are necessary. In some cases, even small adjustments to fund settlement processes can eliminate the need for certain licenses [14]. A strategic approach is to focus on "Tier 1" states, such as California, Texas, Florida, New York, and Illinois, which collectively account for over 40% of the U.S. population [13].

Conducting Regulatory Due Diligence in Fintech M&A

Regulatory due diligence in fintech mergers and acquisitions (M&A) demands a deep dive into the target company's compliance history. Buyers should review at least five years’ worth of compliance reports (both internal and external), key correspondence with regulators, board meeting minutes, and any documents tied to investigations or enforcement actions [19]. It's a good idea to start regulatory, privacy, and cybersecurity reviews as early as the NDA stage to identify potential hurdles [2]. This early analysis lays the groundwork for a more detailed examination of compliance records and contractual obligations.

The review process should cover several key areas. First, confirm the target's presence on official registers like the Financial Services Register, and verify all necessary federal and state licenses, such as Money Transmitter Licenses or state-specific banking and insurance licenses. Additionally, check for any breaches or patterns in complaint registers that might point to systemic issues [19]. Vendor, cloud, and platform agreements should also be scrutinized for clauses related to assignability, data residency, and business continuity, as regulators increasingly focus on third-party risk management [20]. Lastly, examine the target's information security practices, including incident history and remediation efforts, ensuring they comply with laws like the CCPA, GLBA, and GDPR [20]. Together, these steps address not only past compliance but also potential challenges that could arise under new ownership.

Reviewing Past Examinations and Enforcement Actions

Looking into the target’s regulatory examinations and enforcement actions offers insight into its approach to compliance. Reports from state or federal regulators can uncover non-public findings and recurring compliance gaps. Similarly, analyzing consumer complaints can reveal underlying issues that traditional audits might not detect [23].

"Regulatory compliance remains the cornerstone issue in any transaction involving a financial technology company."

• Michael Edwards [22]

Recent enforcement actions highlight the importance of this due diligence. For instance, in early 2024, the FDIC issued consent orders to Lineage Bank, Sutton Bank, and Piermont Bank for shortcomings in third-party risk management and compliance with AML and consumer protection laws related to their fintech partnerships. Meanwhile, the SEC settled charges with Delphia (USA) Inc. and Global Predictions Inc. over misrepresentations regarding AI usage, and FINRA fined M1 Finance LLC $850,000 for inadequate oversight of social media promotions [21].

Background checks on executives, directors, and major shareholders are equally critical. Regulatory applications often require detailed personal financial statements, criminal records, and financial histories. A history of bankruptcy or prior enforcement actions can complicate the approval process [18]. Beyond these checks, understanding how changes in ownership might draw regulatory attention adds another layer to the due diligence process.

Change-of-Control Notifications and Equity Thresholds

Ownership changes in fintech transactions often trigger regulatory notifications. These thresholds can range from as low as 5% - especially if it includes the right to appoint a director - to 20%, 25%, or even 33%, depending on the state or type of authorization involved [19][24][3]. It's also important to consider the combined holdings of affiliated investors [24].

Regulatory notifications generally fall into five categories: prior approval before closing, advance notice without approval, advance notice with discretionary approval, post-closing notice, and post-closing notice with discretionary approval [3]. Since many licenses require prior approval, deals are frequently structured with a sign-and-delayed-close arrangement, making regulatory approval a condition for closing [3]. For example, most U.S. state licenses require a 30-day advance filing before closing, while New York mandates a 90-day notice for changes involving a mortgage banker license [3].

Even when equity thresholds aren’t met, regulatory consent may still be required if the buyer gains significant influence, such as the ability to appoint board members or veto key decisions [24]. In the UK, the process for securing change-of-control approval typically takes six to eight weeks after submitting the application, with transactions needing to close within three months of receiving approval [19].

Mitigating Regulatory Risks Through Contractual Protections

Once due diligence identifies potential regulatory concerns, the purchase agreement becomes the key tool for managing and allocating risk between the buyer and seller. Through representations and warranties (R&Ws), the seller confirms specific facts about the target company's compliance history, while indemnities and covenants provide financial safeguards and operational guidelines during the transition. These measures help address risks tied to federal and state disclosure requirements.

"In acquisitions and other transactions, representations and warranties (R&Ws) serve as the critical foundation for confirming due diligence efforts and allocating risk between the parties."

• Nina L. Flax, Julian M. Dibbell, and Nitya Sunil, Mayer Brown [26]

Specific Representations and Warranties

Buyers should negotiate detailed R&Ws that address the unique regulatory landscape of fintech businesses. These should confirm that all required licenses - such as state-level Money Transmitter Licenses, FCA authorizations, or PRA approvals - are valid, up-to-date, and in good standing [22][3]. Additionally, the seller must verify compliance with Anti-Money Laundering (AML) and Know Your Customer (KYC) requirements, as well as sanctions screening protocols [22][25].

Privacy and cybersecurity are critical areas. Representations should confirm adherence to major privacy laws like GDPR, CCPA, and GLBA, the ability to transfer personal data under new ownership, and the absence of prior data breaches requiring regulatory disclosure [26][22]. Intellectual property (IP) protections are equally important, especially since IP-related claims make up about 5.2% of post-closing M&A disputes [26]. Buyers should ensure the seller has sole ownership of proprietary software and that all contractors and employees have formally assigned their IP rights to the company.

For AI governance, buyers need assurances regarding the quality and origin of training data, algorithm accountability (including bias audits and explainability), and defenses against adversarial attacks [26][2]. Consumer-facing fintechs must also confirm compliance with fair lending practices, anti-discrimination laws, and transparency rules, with no history of "mis-selling" financial products like Buy-Now-Pay-Later (BNPL) or payday loans [2][22].

Indemnities and Covenants

While R&Ws establish the baseline facts, indemnities provide financial remedies if those representations later prove inaccurate. Buyers often negotiate special indemnities to address known regulatory risks uncovered during diligence, such as pending enforcement actions, historical AML violations, or unresolved consumer protection claims [2][26][22]. These indemnities usually extend beyond the general R&W period and are often excluded from financial caps or liability limits [26].

To safeguard against potential fines or remediation costs, buyers typically allocate 10%–15% of the purchase price to escrow for 12–24 months [2][26]. For larger transactions, buyers may also consider Warranty and Indemnity (W&I) insurance, though it often excludes coverage for known regulatory breaches or high-risk areas like AML compliance [22].

Pre-closing covenants are another layer of protection, requiring the seller to maintain business operations as usual, preserve all state licenses, meet financial obligations (e.g., net worth thresholds, surety bonds), and submit necessary change-of-control filings. Meanwhile, the buyer must provide required personal and financial details for background checks [27][3]. Post-closing covenants focus on integration and ongoing compliance, such as migrating customer data to secure systems within 90 days, aligning AML policies, or completing remediation identified during diligence [25].

"Use tailored deal structures - such as earnouts, escrows, and special indemnities - to bridge valuation gaps, address diligence findings, and ensure both parties are protected against unforeseen issues post-closing."

• Reed Smith [2]

When regulatory uncertainties affect valuation, earn-outs can be a practical solution. These arrangements tie a portion of the purchase price to achieving specific regulatory milestones, such as securing an SEC no-action letter or successfully launching a regulated crypto-asset product [27].

Leveraging MyReadyMade for Streamlined Regulatory Disclosures

Fintech M&A deals often face delays due to license change-of-control approvals. Mike Whalen, Partner at Goodwin, explains:

"License change of control approvals by state regulators... is the long pole to closing and can cause delays" [3].

To address this, MyReadyMade offers a specialized marketplace tailored for regulated industries, equipped with tools to handle disclosure and licensing challenges effectively.

The platform features verified business listings that have undergone a preliminary regulatory review. This includes assessments of registration status, AML program compliance, and consumer complaint history [28][23]. These pre-vetted listings help reduce the risk of uncovering unresolved regulatory issues later in the diligence process. Buyers also benefit from early access to confidential, NDA-protected communications, enabling regulatory and compliance workstreams to begin sooner. By identifying potential issues early, significant resources can be allocated more effectively [2]. This approach integrates seamlessly into the broader regulatory due diligence process.

Verified Listings and Expert M&A Advisory

MyReadyMade goes a step further with expert advisory services that help both buyers and sellers prepare thorough evidence packs covering governance, AML controls, and outsourcing [29]. These evidence packs are treated more like regulated audit files than marketing materials, ensuring the deal progresses smoothly and avoiding price reductions caused by disclosure delays. By focusing on comprehensive documentation from the outset, the platform minimizes regulatory disclosure risks.

Additionally, MyReadyMade’s controls-first evaluation ensures that license scopes align with the buyer’s operational goals. This prevents the common issue of "licensing optimism", where acquired licenses fail to support the buyer’s intended business model [29].

For sellers, MyReadyMade handles the often-complex state-by-state approval process. Standard change-of-control filings typically take 30 to 60 days, though some jurisdictions - such as New York - require at least 90 days’ prior notice for specific license types [3]. This timeline management is especially critical in fintech deals, which often use a "sign and delayed close" structure, making the closing dependent on securing all required regulatory approvals [3].

License Transfer Support Across Jurisdictions

State licenses cannot be transferred through asset purchases, so deals must be structured as securities or interest transfers to maintain license continuity [3]. MyReadyMade supports these transactions across more than 50 jurisdictions, accommodating control thresholds ranging from 5% to 25% [3]. The platform also addresses jurisdiction-specific timing requirements. For instance, Texas requires change-of-control notices to be submitted at least 45 days before the transaction is finalized [28].

To further simplify regulatory processes, MyReadyMade offers a curated selection of pre-vetted "off-the-shelf" regulated entities. These include Money Service Businesses (MSBs), Payment Institutions (PIs), Electronic Money Institutions (EMIs), and Crypto Asset Service Providers (CASPs) across jurisdictions such as Canada, Estonia, Lithuania, Australia, and the European Union [29]. This licensing-by-acquisition approach bypasses the lengthy timelines associated with new license applications while maintaining regulatory compliance through proper change-of-control procedures.

Conclusion: Key Takeaways for Regulatory Disclosures in Fintech M&A

Navigating fintech M&A transactions means dealing with a maze of federal and state regulatory requirements. At the federal level, HSR Act filings now demand detailed narrative descriptions of competitive overlaps and supply chain disclosures, as well as transparency around foreign government subsidies or any strategic threat-related support [30][1]. On the state level, licensing requirements add another layer of complexity, with control triggers and approval timelines ranging from 30 to 90 days [3].

Since state licenses are non-transferable, buyers must structure acquisitions as securities or interest deals to ensure business continuity. As Mike Whalen, Partner at Goodwin, explains:

"Licenses can't be transferred. They can't be acquired in an asset purchase. As a result, licensee acquisitions have to be structured as securities/interests deals" [3].

This requirement often calls for sign-and-delayed-close structures, where buyers maintain a comprehensive 50-state chart to analyze how ownership changes affect each license [3]. Aligning these ownership changes with regulatory demands is crucial to avoid disruptions.

Early due diligence is critical to tackling these challenges. Starting as early as the NDA stage allows companies to identify potential regulatory hurdles. This includes reviewing prior examinations, enforcement actions, and ensuring intellectual property has a clear chain of title [2]. Buyers can also mitigate risks tied to legacy liabilities by including specific representations, warranties, and indemnities in the deal terms.

To simplify this intricate process, platforms like MyReadyMade provide valuable support. MyReadyMade offers verified business listings, expert M&A advisory, and cross-jurisdictional assistance for license transfers in over 50 regions. These tools help buyers navigate the challenges posed by non-transferable licenses and streamline the disclosure process.

Given that regulatory approvals can often delay closing, early preparation and expert guidance are essential [3].

FAQs

How do the 2025 HSR rule changes affect deal timelines?

The 2025 HSR rule changes are set to make deal timelines longer, thanks to stricter filing requirements. Businesses will need to submit more detailed documentation, which could add as much as 121 hours to the preparation process. This added workload is likely to slow down regulatory reviews, creating delays.

These updates could have a notable effect on mergers and acquisitions, particularly in heavily regulated sectors like Fintech. With increased complexity and extended timelines, navigating the process will require more time and effort from all parties involved.

Why do money transmitter licenses favor stock deals over asset deals?

When it comes to money transmitter licenses, stock deals are often the preferred choice. Why? Because stock acquisitions generally sidestep the need for numerous regulatory approvals, like change of control filings. On the other hand, asset deals can be more complicated. They involve transferring individual licenses and assets, which typically demands multiple regulatory approvals, adding layers of complexity and extending the timeline.

What compliance issues most often derail fintech M&A after closing?

Regulatory compliance can throw a wrench into fintech M&A deals after closing, thanks to risks like noncompliance, shifting licensing requirements, or the need to transfer licenses. Some of the most frequent hurdles include securing approvals for license changes due to control shifts and staying aligned with the relevant laws and regulations. Tackling these issues early on is essential to sidestepping delays or unexpected complications.