Before acquiring a business in a regulated sector, you need to identify the regulatory risks that could affect the value, structure or completion timetable of the deal. Regulatory due diligence for a telecoms, data or payments business goes beyond standard legal DD. It covers the target’s authorisation status, compliance history, pending or potential enforcement action, regulatory capital requirements, data protection obligations, and any change of control approvals needed to complete the transaction. We conduct regulatory DD as a standalone workstream, reporting directly to the deal team and the board on risks that a generalist DD exercise would miss.

Who this is for

If you are acquiring or investing in a telecoms, data or payments business, we identify in regulatory due diligence the licence conditions, compliance gaps, enforcement history and pending regulatory change that affect valuation, deal structure and post-completion integration.

Sector	Key licences and registrations	Compliance areas to check	Common red flags
Telecoms	Ofcom General Conditions compliance; spectrum licences; code powers; numbering allocations	TSA 2021 security duties; lawful intercept obligations; universal service; switching compliance	Undisclosed Ofcom investigations; spectrum licence conditions not met; code powers disputes with landowners
Payments	FCA authorisation or registration (PI/EMI); passporting status; agent network registrations	Safeguarding arrangements; Consumer Duty compliance; AML/KYC framework; scheme membership terms	Safeguarding shortfalls; unresolved FCA supervisory actions; consumer complaints trends
Data-intensive / AI	Data protection charge paid to the Information Commission; DPIA portfolio; international transfer mechanisms (UK SCCs, adequacy)	Lawful basis documentation; data retention policies; automated decision-making compliance; AI governance	Incomplete DPIAs; reliance on consent without valid mechanism; no AI impact assessments

Typical triggers

• A PE fund is considering acquiring a payments firm and needs to understand the FCA change of control approval process
• A telecoms acquisition involves spectrum licences that need to be transferred with Ofcom’s consent
• The target operates across both telecoms and payments, requiring multi-regime regulatory due diligence

What we deliver

• Regulatory due diligence report: covering authorisation status, condition compliance, enforcement history, contractual regulatory obligations and upcoming regulatory changes affecting the target
• Red flag memo: a summary of material regulatory risks for the investment committee or board
• Deal structure advice: where regulatory status has implications for completion mechanics, change of control notifications or condition transfers
• Remediation plan: where issues are identified pre- or post-completion, a plan to resolve them
• Condition precedent checklist: a schedule of regulatory consents, notifications or approvals required before or after completion, with indicative timescales for each
• Post-completion integration note: where the target operates under different regulatory conditions from the acquirer, a summary of the steps needed to align regulatory compliance after the deal closes

If you are considering a telecoms, payments or data acquisition and need regulatory due diligence, we can scope the work within days of receiving the data room. See all our direct legal advice services or get in touch.

Related direct legal advice pages

See also our other direct legal advice pages:
Direct Legal Advice
Do I need regulatory authorisation before offering my product in the UK?
What should I do if a regulator is investigating my business?
Need advice before launching or changing a payments product?
Need a contract that works in a regulated sector?
How do I make sure my product is data protection compliant?
Need advice before launching or changing a telecoms product?
How do I structure and negotiate a deal in a regulated sector?
What legal documents does my digital platform need?

Representative experience

Recent and representative matters include:

• Conducted full regulatory due diligence on a UK MVNO target for a PE acquirer, covering General Conditions compliance and spectrum licence transferability, identifying a material compliance gap that informed price adjustment.
• Advised on Electronic Communications Code powers, section 106 certification, wayleaves and the funds-for-liabilities position supporting fibre network deployment.
• Conducted a privileged assessment of the UK telecoms regulatory framework for an international operator evaluating market entry.
• For national security screening on qualifying acquisitions, see NSIA Clearances.

Frequently asked questions

How long does a regulatory DD report take?

A focused regulatory due diligence report on a single-regime target typically takes 2 to 3 weeks from data room access. Multi-regime targets covering telecoms, payments and data protection take longer. We agree a scope and timeline at the outset, aligned to your deal timetable, and can prioritise where signing deadlines are tight.

What does telecoms regulatory DD cover?

The scope depends on the target’s regulated activities. For telecoms targets, we review Ofcom obligations, General Conditions compliance, spectrum holdings and interconnection arrangements. For payments targets, we assess FCA authorisation status, safeguarding compliance and scheme memberships. We tailor the scope to the deal rationale and the buyer’s risk appetite.

What does payments regulatory DD cover?

For payments targets, we review the target’s FCA authorisation or registration status (PI or EMI), passporting arrangements, safeguarding compliance, Consumer Duty compliance and AML/KYC framework, and the terms of its scheme memberships. We also check for unresolved FCA supervisory action and complaint trends that could signal a safeguarding or conduct shortfall. The scope reflects the buyer’s risk appetite and the specific payments activities the target carries out.

Can you work alongside our transaction lawyers?

Yes. We work as specialist regulatory co-counsel alongside your existing transaction lawyers, delivering the regulatory due diligence workstream to your deal timetable and coordinating directly with your transaction counsel so the regulatory findings feed into the wider process without duplicating effort.

How does this differ from the Transactions practice area page?

We explain the types of deal we work on, and the regulatory context for each, on the Transactions page. Use this page for a live deal where you need a regulatory diligence report. We work to your deal timetable and coordinate with your transaction counsel to ensure the regulatory workstream does not hold up signing or completion.

We are acquiring a target that holds spectrum licences. Does that need separate regulatory due diligence?

Yes. Spectrum licences are granted by Ofcom and carry specific conditions, including use-it-or-lose-it obligations and coverage requirements. Whether the deal needs Ofcom’s involvement depends on how it is structured, and a share purchase and an asset purchase are not treated the same way. On Code powers, a share purchase leaves the target’s powers in place. In an asset purchase there is no process for consent to the assignment of Code powers, because they are personal to the company that holds them: the buyer must already hold Code powers or must apply to Ofcom for its own, which Ofcom must decide within 6 months of receiving the completed application, although preparing a complete application and answering Ofcom’s questions on it can add to that in practice. Number allocations stay with the target in a share purchase. In an asset purchase they do not pass to the buyer: the seller hands the numbers back to Ofcom and the buyer makes a new application, which Ofcom has discretion to grant and which takes 2 to 4 weeks in practice (a practical estimate). In our telecoms regulatory due diligence we review spectrum licensing, Code powers and numbering, and identify any conditions that could affect the deal structure or post-completion obligations.

The investor needs regulatory DD before signing heads of terms. Can you deliver to that timeline?

We work to transaction timescales. For a single-regime target, we can typically deliver within two to three weeks of receiving data room access. For multi-regime targets (telecoms and payments, or telecoms and data protection), allow three to four weeks. We can provide a red flag memo earlier if the deal timeline requires an interim view before the full report.

Do you cover data protection compliance as part of regulatory due diligence?

Yes. Data protection due diligence is relevant for most acquisitions in the telecoms and payments sectors given the volume of personal data these businesses process. We review the target’s UK GDPR compliance, data processing agreements, international transfer mechanisms and any correspondence with the Information Commission (or, before 30 September 2026, the Information Commissioner). We include this in our regulatory due diligence report alongside sector-specific regulatory analysis.

What happens if the due diligence reveals material regulatory issues?

We set out the issues, quantify the risk where possible and advise on the options. Material issues may lead to price adjustments, specific indemnities in the SPA, conditions precedent requiring remediation before completion, or in some cases a decision not to proceed. We send a red flag memo early, so that the deal team learns of regulatory issues before they can stop the transaction at a late stage.

What is the difference between regulatory due diligence and standard legal due diligence?

Standard legal DD covers corporate, commercial and employment matters. Regulatory DD is a specialist workstream that examines the target’s position under sector-specific regulation: its authorisation status, compliance record, pending enforcement action, regulatory reporting obligations, and any conditions attached to its licence or authorisation. For a telecoms business, this means examining compliance with Ofcom’s General Conditions. For a payments firm, it means reviewing the FCA authorisation, safeguarding arrangements and capital adequacy. These risks are typically outside the scope of a generalist DD exercise.

---

Independent directory rankings

Our specialist expertise is recognised in major independent legal directories:

• Chambers & Partners: Rob Bratby is ranked as a Band 2 lawyer in the UK Guide 2026 in the “Telecommunications” category: Chambers
• Lexology: Rob Bratby is recognised in the Lexology Index as a Global Elite Thought Leader for telecoms and media, and as a Thought Leader for data privacy and protection: Lexology