A UK telecoms, payments or data-heavy target can need up to four separate clearances before completion. Ofcom has no change of control approval, so a share purchase of a telecoms target needs none from Ofcom. The clearances that can stop or delay completion are national security clearance under the National Security and Investment Act 2021 (NSIA), where the target falls within a mandatory description; the Financial Conduct Authority’s change in control assessment, where the target is an authorised or small payment institution or an electronic money institution; and merger control by the Competition and Markets Authority (CMA), if the parties choose to notify. Ofcom’s involvement turns on structure: a share purchase leaves licences and Code powers with the target, while an asset purchase needs Ofcom’s involvement to move spectrum and a buyer that holds, or applies to Ofcom for, its own Code powers. Who decides each clearance, the statutory clock and a practical lead time are set out in the table below.

Approval or issue	Who decides	Statutory clock	Practical lead time
National security clearance under the NSIA. Notification is mandatory where the target carries on a notifiable activity (for a public network or service provider, relevant UK turnover of at least £50 million: Schedule 5 to the Notifiable Acquisition Regulations 2021) and a person gains control in one of the cases in section 8(2), (5) or (6) (section 6(2)). An acquisition completed without approval is void (section 13(1)).	The Secretary of State, through the Investment Security Unit.	Review period of 30 working days beginning with the day the Secretary of State notifies acceptance of the notification (section 14(8) and (9)). Acceptance has no fixed period: it must follow as soon as reasonably practicable (section 14(5)). If the acquisition is called in, the assessment period is 30 working days, extendable by 45 working days and then by any period agreed in writing (section 23); days between an information or attendance notice and the notice confirming compliance do not count (section 24(4)).	Estimate: allow about eight weeks, being 11 working days to acceptance plus up to 30 working days of review. In the government’s NSIA annual report for 2025-26, the median time from receipt of a mandatory notification to acceptance was 11 working days. Where a deal was called in, the median time from call-in to a final notification clearing it was 24 statutory working days (47 calendar working days), and to a final order 69 statutory working days (97 calendar working days).
FCA change in control. A person who decides to acquire or increase control of an authorised or small payment institution (other than one on the regulation 153(1) transitional register) or of an electronic money institution must give notice first (section 178, applied to payment institutions by paragraph 5 of Schedule 6 to the Payment Services Regulations 2017 and to electronic money institutions by paragraph 4 of Schedule 3 to the Electronic Money Regulations 2011). Control means 10 per cent or more of the shares or voting power in the institution or a parent, or significant influence over its management (section 181); further notice must be given on reaching 20, 30 and 50 per cent (section 182). Completing before the assessment period ends, without approval, is an offence (section 191F(2)).	The FCA.	Assessment period of 60 working days beginning with the day the FCA acknowledges receipt of the notice (section 189(1)). The FCA may interrupt it once, by a written request for further information made no later than the 50th working day. The interruption lasts until the information arrives, for no more than 20 working days, or 30 working days where the notice-giver is situated or regulated outside the United Kingdom or Gibraltar or in certain other cases (section 190). If the period ends and the FCA has neither given notice of its decision nor said that the notice is incomplete, it is treated as having approved (section 189(6)).	Estimate: plan on the full 60 working days (about 12 weeks), and on up to 80 working days (about 16 weeks) if the FCA interrupts the period, or 90 working days (about 18 weeks) where the notice-giver is outside the United Kingdom or Gibraltar. Notice can be given as soon as the buyer has decided to acquire, so the clock can start before signing.
UK merger control, which is voluntary. The CMA has jurisdiction where the target’s UK turnover exceeds £100 million; or where the merger creates or increases a share of supply of at least one quarter and the UK turnover of the target or another party exceeds £10 million; or where one party has a 33 per cent share of supply and UK turnover above £350 million and another party has a UK nexus (section 23). The CMA may investigate before or after completion.	The CMA.	Phase 1 lasts 40 working days, beginning the first working day after the CMA tells the parties that it has enough information to begin its investigation, or after it accepts a merger notice (section 34ZA(3)). The CMA may extend it where a person has failed to comply with an information requirement, and by up to 20 working days where an intervention notice is in force (section 34ZB). A Phase 2 reference gives 24 weeks, extendable by up to 8 weeks for special reasons and by any period agreed with the parties (section 39(1), (2A) and (3)).	Estimate: the CMA’s pre-notification discussions come before the 40 working days and no statute fixes their length; allow several weeks for them. Phase 1 then takes about eight weeks at its longest without extension, and a Phase 2 reference adds 24 weeks (about five and a half months), or 32 weeks with the full extension for special reasons, and longer if the CMA and the parties agree an extension.
Transfer of spectrum rights (asset purchase). A transfer of rights under a wireless telegraphy licence is void unless it is made in accordance with the trading regulations or the licence (section 30(4) of the Wireless Telegraphy Act 2006). A share purchase does not transfer the licence, but a licence may require notice of a change of control, so each licence needs to be read.	Ofcom. For mobile bands Ofcom must consent to the transfer (regulation 6(f) of the Wireless Telegraphy (Mobile Spectrum Trading) Regulations 2011). For other tradable licences Ofcom gives effect to the transfer by accepting surrender of the licence and granting a new one to the buyer (regulation 9(3) of the Wireless Telegraphy (Spectrum Trading) Regulations 2012).	None. Neither the Act nor the trading regulations set a period within which Ofcom must decide.	Estimate: the three mobile spectrum trades Ofcom published between December 2024 and December 2025 took between 15 and 41 days from Ofcom’s notice of the application to its consent. Allow about two to six weeks.
Numbers on an asset purchase. On allocating numbers, Ofcom must specify whether an allocation may be transferred and may set conditions for transfer (section 56A(1) of the Communications Act 2003). In practice the seller hands the numbers back to Ofcom and the buyer makes a new application, so the allocation does not pass to the buyer. Ofcom has discretion whether to reallocate the numbers to the buyer, so the effect is similar to a consent. A share purchase leaves the allocation with the target.	Ofcom, which has discretion whether to reallocate the numbers to the buyer.	None.	Estimate: two to four weeks in practice.
Code powers (asset purchase). Code powers are conferred by an Ofcom direction under section 106 of the Communications Act 2003, which applies the Electronic Communications Code to a named person. They are personal to the company that holds them and there is no process for consent to their transfer. A share purchase leaves them with the target. On an asset purchase the buyer must already hold Code powers or apply to Ofcom for its own (section 107(1)).	Ofcom.	Ofcom must decide within 6 months of receiving the completed application (regulation 3 of the Electronic Communications and Wireless Telegraphy Regulations 2011).	Estimate: 6 to 9 months in practice. Apply as soon as the asset structure is settled.

What a share purchase and an asset purchase each need from the regulators

A share purchase moves no regulatory permission, and an asset purchase moves none automatically: spectrum moves only through Ofcom’s trading process, and the buyer must hold Code powers of its own. In a share deal, the target entity retains its regulatory status: General Conditions, SMP conditions, spectrum licences and Code Powers all remain with the company. The buyer does not take on those obligations itself; it owns a company that remains bound by them. Change of control provisions in spectrum licences or other regulatory instruments may be triggered, but the obligations themselves stay in place.

In an asset deal, regulatory assets do not transfer automatically. Code powers do not pass with the assets: a direction under section 106 of the Communications Act 2003 applies the Code to a named person, and there is no process for consent to its transfer. The buyer must already hold Code powers or apply to Ofcom for its own, which takes 6 to 9 months in practice. A Code agreement can then be assigned to the buyer as another operator: paragraph 16 of Schedule 3A makes void any term of an agreement under Part 2 of the Code that prevents or limits that assignment or makes it subject to conditions, save a term requiring the assignor to enter into a guarantee agreement (paragraph 16(2)). Paragraph 16 does not apply to an agreement that was already in force when the Code came into force on 28 December 2017 (paragraph 5 of Schedule 2 to the Digital Economy Act 2017). Spectrum licences may need to be varied or reissued. This distinction can drive deal structure: where the target holds material regulatory assets that cannot easily be replicated, a share deal may be the only practical option even if an asset deal would otherwise be preferred for tax or commercial reasons.

Ofcom sets General Conditions under section 45 of the Communications Act 2003 and may apply each one to every provider or to providers of a description it specifies (section 46(2)), so the first task is to establish which bind the target. Where a target is subject to SMP services conditions under sections 87 to 91, set following a market analysis, those obligations stay with the target in a share deal and constrain the buyer’s pricing, product bundling and network decisions. A buyer that plans to bring a target with cost orientation obligations into its own commercial model must do so within those obligations. Ofcom may set a price control only where its market analysis shows a relevant risk of adverse effects from price distortion and the other tests in section 88 are met, so an SMP finding does not of itself carry one. Where the target does carry one, it caps wholesale revenue and the buyer should model it. Ofcom set the conditions for the fixed telecoms markets for April 2026 to March 2031 in its Telecoms Access Review 2026-31.

Data protection due diligence often covers the target’s ICO enforcement history and privacy notices, but rarely its ongoing relationships: where the target is a controller, what data flows are required for integration, whether processor contracts with the buyer’s preferred vendors are feasible, and whether the seller’s international transfer mechanisms will work post-close. A buyer that integrates a target into its own business processes may become a joint controller with it, or may replace its processors. As a controller, the buyer must then meet the transparency duties in Articles 13 and 14 UK GDPR for the populations concerned, update the privacy information, put Article 28 processor terms in place, and complete a data protection impact assessment under Article 35 where the processing is likely to result in a high risk.

Where the target is an authorised or small payment institution, a buyer that decides to acquire or increase control must give the FCA notice first and may not complete until the FCA approves, or is treated as approving because the 60 working day assessment period has ended without a decision, under sections 178, 189 and 191F of the Financial Services and Markets Act 2000 (Part 12), as applied by Schedule 6, paragraph 5 to the PSRs 2017. Control means holding 10 per cent or more of the shares or voting power in the institution or in a parent undertaking, or being able to exercise significant influence over its management, and the buyer must give notice again on reaching 20, 30 and 50 per cent. In telecoms, Ofcom has no equivalent change of control regime. The CMA reviews telecoms mergers under the Enterprise Act 2002, and notification is voluntary. After a share purchase the target remains bound by its General Conditions and must continue to comply from day one.

The Telecommunications (Security) Act 2021 inserted section 105K into the Communications Act 2003 with effect from 1 October 2022. A provider of a public electronic communications network or service must inform Ofcom as soon as reasonably practicable of any security compromise that has a significant effect on the operation of the network or service, and of any compromise that puts a person in a position to bring about a further compromise of that kind. A target subject to these obligations remains subject to them after a share purchase. The buyer’s security protocols must be capable of meeting the reporting and compliance requirements from day one.

Where regulatory risk is mispriced in the sale agreement

Regulatory issues surface late in a regulated deal for structural reasons.

SPA risk allocation often misses the regulatory position. Warranties drafted in “material compliance” language do not capture the detail of telecoms regulation. A warranty that “the Target has complied in all material respects with applicable law” may be technically accurate while leaving an SMP price control on wholesale charges undisclosed. A price control limits wholesale revenue and feeds straight into the valuation model. It should be identified in the data room, disclosed explicitly, and quantified in the price adjustment mechanism. Where a specific regulatory risk is identified and disclosed, the appropriate tool is often a specific indemnity rather than a broad warranty.

Data protection due diligence scoped around the seller’s compliance history misses the buyer’s integration burden. A target with a clean ICO record passes due diligence. The buyer then discovers post-close that the target is a controller of customer personal data, the buyer’s standard processor contracts do not match existing vendor agreements, and the buyer’s integration plan moves personal data in ways the target’s international transfer safeguards do not cover. On a share deal the target remains the data exporter and its existing transfer safeguards stay in place; nothing transfers to the buyer. Since 5 February 2026 an exporter relying on a safeguard must, acting reasonably and proportionately, consider that the data protection test is met, so that the protection after transfer is not materially lower than under UK law (Article 46(1A) and (6) UK GDPR, inserted by Schedule 7 to the Data (Use and Access) Act 2025). The buyer needs new safeguards of its own where its group becomes a recipient or exporter of the data, or where contracts are novated on an asset deal. That negotiation involves the seller’s vendors and is a common source of delay to day-one data migration. A regulatory due diligence workstream running in parallel with the corporate DD catches this early.

The regulatory compliance workstream is under-resourced. General Condition compliance, Code Powers status and spectrum licence conditions are ongoing obligations that require interpretation and sometimes advance engagement with Ofcom or the CMA.

Common issue	Better approach
SPA warranties using generic material compliance language	Warranties reflecting specific SMP and spectrum obligations
Data protection DD limited to breach history	DD covering integration burden, Article 28 transitions and DPIA requirements
Regulatory compliance treated as a post-close workstream	Pre-signature DD identifying valuation-affecting regulatory obligations
CMA clearance timeline not reflected in conditions	Regulatory conditions with realistic long-stop dates and walk-away rights
Code powers left to integration	The buyer’s Code powers position and any spectrum transfer built into the deal timeline

Spectrum licences follow the structure of the deal. A change in the shareholders of a licence holder is not a transfer of the licence under section 30 of the Wireless Telegraphy Act 2006, so a share purchase needs no Ofcom consent unless the licence itself requires notice of a change of control, and each licence should be read for such a term. An asset purchase is a transfer. It is void unless made in accordance with the spectrum trading regulations or the licence. For mobile spectrum Ofcom must consent to it; for other tradable licences Ofcom gives effect to it by granting the buyer a new licence.

A buyer must analyse the National Security and Investment Act 2021 and UK merger control separately. Mandatory NSIA notification does not apply to every acquisition of a communications provider. Under Schedule 5 to the Notifiable Acquisition Regulations 2021, a PECN or PECS provider falls within the communications description where the turnover of its relevant UK business for the relevant period is at least £50 million; other specified communications activities are covered separately. The acquisition must also meet the statutory control conditions. UK merger control may apply under the £100 million target-turnover test, the share-of-supply route, including the additional £10 million turnover condition, or the separate 33% and £350 million test with a UK-nexus condition.

For payments M&A, the Payment Systems Regulator does not operate a formal pre-acquisition clearance regime. Its powers under section 58 of the Financial Services (Banking Reform) Act 2013 are remedial: with Treasury consent, it can require a person to dispose of an interest in the operator of a regulated payment system or an infrastructure provider, where it is satisfied that competition would otherwise be likely to be restricted or distorted. The Financial Services and Markets Bill would abolish the PSR and transfer its functions to the FCA; the Bill completed its Lords stages in September 2026 and is not yet law. A person who decides to acquire or increase control of an authorised or small payment institution must give the FCA notice first and may not complete until the FCA approves, or is treated as approving because the 60 working day assessment period has ended without a decision, under Part 12 of the Financial Services and Markets Act 2000 as applied by Schedule 6 to the Payment Services Regulations 2017. The same regime applies to an electronic money institution through Schedule 3 to the Electronic Money Regulations 2011. On a payments target the FCA period and, where the acquisition is notifiable, the NSIA period run in parallel and both must end before completion, so the longer of the two sets the earliest completion date. The buyer decides whether to notify the CMA. If it does not, the CMA may still investigate the merger before or after completion, and the buyer carries that risk unless the sale agreement allocates it.

How we divide the work

We take the regulatory questions before signature, at risk allocation and after completion.

Pre-signature due diligence identifies regulatory obligations that affect valuation: SMP conditions, spectrum conditions, Code Powers status and Ofcom licence history. We produce a regulatory report section for the data room that spells out each obligation in plain language and flags the impact on the buyer’s commercial model.

At risk allocation, we specify in the sale agreement which General Conditions must be met at completion and what spectrum licences must be in force. Where regulatory DD identifies a specific risk, we draft a specific indemnity for it. We map the FCA change in control notice if the target is a payment or electronic money institution, and NSIA mandatory notification if the target falls within a mandatory description. For data protection, we include a specific condition that the buyer must have updated processor agreements before day-one data migration.

Clearance under the National Security and Investment Act 2021 and FCA approval of the change in control are conditions to completion, and the parties must obtain them before completing. After completion come the notices to site providers on any Code agreements assigned to the buyer and the data protection controller transition.

How Bratby Law helps

On larger transactions we work behind the lead firm on the regulatory workstream and report to the lead partner. We deliver an early red flag note on the clearances above, with the trigger analysis for each and our view on which are conditions precedent, followed by the regulatory due diligence report. We then draft the regulatory conditions, warranties and indemnities for the sale agreement, run the FCA and NSIA processes where we are instructed to, and agree the Ofcom steps for any asset transfer. The corporate team keeps the sale agreement, the funds flow and the multi-jurisdictional coordination.

On smaller and mid-market telecoms M&A, we act as lead advisor through our Direct Legal Advice model, handling both the regulatory and transactional work as a single team.

In both models, we draw on operator-side experience from four current fractional General Counsel appointments at telecoms, data and payments operators. Before signature we map the regulatory perimeter and material obligations; we then draft regulatory conditions precedent, warranties and indemnities, integrate General Condition compliance, SMP obligations, spectrum constraints and TSA 2021 requirements into the transaction timeline, manage DPIA and processor agreement transitions, and structure the post-close regulatory workstreams.

Frequently asked questions about telecoms and payments M&A

Is there an Ofcom change of control regime for telecoms?

No. Ofcom has no formal change of control approval or notification regime for electronic communications providers. The CMA may review a telecoms merger under the Enterprise Act 2002, and notification to it is voluntary. After a share purchase the target remains bound by its General Condition and SMP obligations and must continue to comply with them. If your post-completion integration plan conflicts with those obligations, the conflict must be resolved before close.

How do I assess the value impact of SMP conditions?

SMP conditions can require network access, no undue discrimination and transparency (section 87 of the Communications Act 2003). Ofcom may add price controls and cost orientation rules only where the tests in section 88 are met. A price control limits what the target can charge for wholesale access, so the valuation model should reflect it.

What data protection issues arise in telecoms M&A?

The target is likely a controller of customer and operational personal data. Data migration may make you a joint controller with the target or lead you to replace its processors, which brings in Article 28 UK GDPR processor terms and, where the processing is likely to result in a high risk, an Article 35 DPIA. In a share deal the target remains the data exporter, so its existing international transfer agreements continue unchanged and nothing transfers to you. You review them for the integration plan, and put new agreements in place where data will move to a group company that is not already a party.

How long does regulatory due diligence take?

A focused regulatory due diligence report on a single-regime target typically takes two to three weeks from data room access. Allow three to four weeks for a target that is regulated under several regimes, such as telecoms and payments. We can give a red flag memo earlier where the deal timetable needs an interim view, and we agree a prioritised work plan at the outset.

What if the target is subject to Code Powers agreements?

Code powers are conferred by an Ofcom direction under section 106 of the Communications Act 2003, which applies the Electronic Communications Code in Schedule 3A to a named operator. Under the Code an operator can obtain code rights to install and keep apparatus on, under or over land, by agreement or by order. Code powers are personal to the company that holds them, and there is no process for consent to their assignment. In a share deal the target keeps its Code powers and its Code agreements. In an asset deal the buyer must already hold Code powers or apply to Ofcom for its own, which takes 6 to 9 months in practice, and only then can Code agreements be assigned to it under paragraph 16 of Schedule 3A. We check the target’s Code powers and agreements, and advise on the notices to site providers on assignment.

Do I need Ofcom consent to transfer a spectrum licence?

In an asset purchase, yes. A transfer of rights under a licence is void unless made in accordance with the spectrum trading regulations or the licence (Wireless Telegraphy Act 2006, section 30(4)), and Ofcom must either consent to it (mobile spectrum) or give effect to it by granting the buyer a new licence (other tradable licences). In a share purchase the licence stays with the target and needs no consent unless its terms require notice of a change of control.

When does NSIA mandatory notification apply to a telecoms or payments deal?

The National Security and Investment Act 2021 requires mandatory notification only where the target’s activities fall within a description in the Notifiable Acquisition Regulations 2021 and the acquisition meets the statutory control conditions. A target is not caught merely because it provides a PECN or PECS. For that part of the communications description, the turnover of the relevant UK business for the relevant period must be at least £50 million. Other communications activities, and the data infrastructure description in Schedule 9, have their own definitions. A notifiable acquisition completed without the Secretary of State’s approval is void under section 13(1), and the acquirer commits an offence under section 32, for which the maximum penalty is the higher of 5 per cent of worldwide turnover and £10 million (section 41).

What PSR clearance is needed for a payments acquisition?

The PSR does not operate a formal pre-acquisition clearance regime. Its powers under section 58 of the Financial Services (Banking Reform) Act 2013 are remedial: with Treasury consent, it can require a person to dispose of an interest in a payment system operator or infrastructure provider where competition would otherwise be likely to be restricted or distorted. The Financial Services and Markets Bill would abolish the PSR and transfer its functions to the FCA; the Bill completed its Lords stages in September 2026 and is not yet law. A person acquiring or increasing control of an authorised or small payment institution must give the FCA notice first and may not complete until the FCA approves, or is treated as approving because the 60 working day assessment period has ended without a decision, under Part 12 of the Financial Services and Markets Act 2000 as applied by Schedule 6 to the Payment Services Regulations 2017. That approval and, where the acquisition is notifiable, NSIA clearance must both be in hand before completion. Notification to the CMA is voluntary, so the buyer decides whether to file.

Related transactions pages

See also our other transactions pages:

• Private equity
• SaaS and Cloud Services
• Subsea cables
• MVNOs and MVNEs
• Interconnection, peering and access agreements
• Network sharing and co-location agreements
• Digital Infrastructure Projects
• Data Commercialisation and Licensing
• NSIA Clearances

Independent directory rankings

Our specialist expertise is recognised in major independent legal directories:

• Chambers & Partners: Rob Bratby is ranked as a Band 2 lawyer in the UK Guide 2026 in the “Telecommunications” category: Chambers
• Lexology: Rob Bratby is recognised in the Lexology Index as a Global Elite Thought Leader for telecoms and media, and as a Thought Leader for data privacy and protection: Lexology

See our Core Communication and TelXL case studies for examples of our work on corporate transactions.