Hidden regulatory risks in UK financial services acquisitions

In UK financial services M&A, regulatory due diligence is often described as a ‘must-have’. However, the scope of the reviews has narrowed in recent years. In some cases, they have even become little more than a box-ticking exercise – carried out late in the transaction process and limited to reviewing permissions and headline compliance issues.

The most damaging regulatory liabilities are rarely obvious at signing; they emerge after completion, when a new owner inherits historical conduct or governance weaknesses.

Governance is the regulator’s first post-deal focus

Hidden regulatory liability frequently sits in:

• Boards that historically did not challenge management

• SMF structures designed for a smaller firm and haven’t kept pace with growth

• Committees that existed on paper but weren’t effective in practice

These weaknesses may not breach rules in a way that looks obvious pre-deal, but they become highly visible once a regulated firm is under new ownership and heightened scrutiny.

Buyers often assume governance will naturally improve once a firm is brought into a larger group, but regulators don’t share this assumption.

In practice, the FCA’s early post-change-of-control focus is often on:

• Board effectiveness

• Senior management oversight

• Decision‑making frameworks

• Risk ownership and escalation

Where governance is fragile, the acquirer may face:

• Skilled person reviews,

• Remedial governance programmes,

• Ongoing supervisory engagement that absorbs senior management time and group resources.

Regulatory culture is inherited, not replaced

Culture is one of the hardest risks to diligence and one of the most underestimated.

Many firms can demonstrate policies, training records, and compliance monitoring plans.

Far fewer can demonstrate consistent accountability, effective challenge, and a track record of acting early on regulatory risk.

Regulatory cultural issues often reveal themselves through audit or review findings that repeat year after year, compliance recommendations that were deferred or diluted, or a pattern of “managing the regulator” rather than addressing root causes.

When a buyer acquires such a firm, it inherits not just cultural debt but regulatory credibility risk, particularly if the firm already sits within the FCA’s supervisory radar.

If you’re planning a transaction and need support, get in touch. Ocorian’s M&A team specialises in acquisition due diligence, change-in-control, and integration services, helping firms navigate regulatory requirements and providing both parties with the reassurance they need during these sensitive transactions.

About the author

James Marshall is a Principal Consultant at Ocorian. With over 30 years’ financial services experience, he advises clients across wealth, financial advice, mortgages, consumer credit and insurance on regulatory matters, including risk management frameworks, SMCR, remediation, suitability of advice, sales process design and complaints management.