Private equity investment in regulated sectors requires specialist regulatory due diligence from day one. Telecoms and payments assets carry regulatory conditions that constrain valuation, growth plans and exit strategies. Generic regulated-sector DD frameworks applied to these sectors risk underestimating the impact of Ofcom and FCA oversight on returns.

Why PE regulatory due diligence matters now

Two regulators set conditions that reach directly into a target’s revenue line. Ofcom identifies and analyses markets under section 79 of the Communications Act 2003, reviews those determinations under section 84, and where it determines that a provider has significant market power must set SMP conditions under section 87, subject to the constraints in sections 88 and 91A; those conditions constrain wholesale pricing, access and product terms. Ofcom published its Telecoms Access Review 2026-31 statement on 17 March 2026, fixing the wholesale fixed access framework for the five years from 1 April 2026, so a buyer of a fixed network is acquiring into a settled set of conditions with the next review due in 2031. The FCA’s operational resilience rules in SYSC 15A reach payment institutions and electronic money institutions under SYSC 15A.1.1R(3), and carry a continuing compliance cost that sits in the target’s cost base. The critical third parties regime in Chapter 3C of Part 18 of the Financial Services and Markets Act 2000, inserted by section 18 of the Financial Services and Markets Act 2023 and in force from 29 August 2023, works differently: the Treasury designates the third party, and the obligations fall on it rather than on the payments firms it serves. For a buyer it is a supplier-side dependency to map, not a direct obligation on the target. The provider of a public electronic communications network or service is subject to the duty in section 105K of the Communications Act 2003 to inform Ofcom of a security compromise that has a significant effect on the operation of the network or service, and Ofcom carries compliance and assessment functions in relation to those duties under sections 105M to 105O.

PE fund models assume scalability, margin expansion and debt capacity. Regulated sectors constrain all three. A consolidation plan in a telecoms market may be prohibited or made subject to remedies on a CMA merger review, with Ofcom providing input on competition and spectrum issues. Notification is voluntary: section 96 of the Enterprise Act 2002 allows a merger notice to be given, and the CMA may open an investigation on its own initiative whether or not one is given, including after completion. The National Security and Investment Act 2021 works the other way round: notification is mandatory in the specified sectors, the test turns on the sector and the level of control acquired rather than on the acquirer’s nationality, and section 13(1) makes a notifiable acquisition completed without the Secretary of State’s approval void. A plan to migrate customer data may trigger a DPIA and require new processor agreements. A plan to reduce capex by deferring network investment may conflict with General Condition obligations or spectrum licence coverage requirements.

The three regulatory questions that move valuation

Three questions do most of the work on a telecoms or payments deal: what the target’s regulatory perimeter actually is, what the regulatory conditions cost across the hold period, and which approvals a change in ownership needs.

First, the perimeter. A licence-compliance and enforcement-history review does not reach the telecoms-specific points. Under section 46(2) of the Communications Act 2003 a general condition may be applied to every provider of an electronic communications network or service, or only to providers of a description specified in the condition, so the first task is establishing which General Conditions bind this target. Then spectrum licence conditions, which determine coverage obligations and service scope; numbering allocation constraints; Code Powers status; and, where Ofcom has made a market power determination under section 79 following its market analysis, the SMP conditions set under sections 87 to 91A that constrain wholesale pricing and access terms. Not every telecoms acquisition involves SMP, but where it does the effect on valuation is material.

Second, the cost of the conditions. Section 87(9) of the Communications Act 2003 authorises Ofcom to impose price controls on a dominant provider and to make rules about the recovery of costs and cost orientation; where the target carries them, the upside from wholesale margin expansion is capped with them. General Condition compliance, spectrum coverage obligations and the security duties in sections 105A to 105K carry a continuing cost. For payments targets, regulation 23 of the Payment Services Regulations 2017 requires an authorised payment institution to safeguard relevant funds, and regulation 23(3) offers a choice of method: segregate them and either place them in a separate account with an authorised credit institution or the Bank of England or invest them in assets the FCA has approved as secure and liquid and place those assets in a separate account with an authorised custodian, or cover them with an insurance policy or a comparable guarantee. Relevant funds are sums received from, or for the benefit of, payment service users, so they are not the firm’s own cash and a model that treats the safeguarded balance as available liquidity overstates the position by that amount. The FCA’s supplementary safeguarding rules in CASS 10A, CASS 15, SUP 3A and SUP 16.14A, made by the Payments and Electronic Money (Safeguarding) Instrument 2025 (FCA 2025/38) following PS25/12, came into force on 7 May 2026 and add a monthly safeguarding return under SUP 16.14A.3R, due within 15 business days of each month end, and a safeguarding report from the institution’s external auditor to the FCA under SUP 3A.9.1R, delivered within four months of the end of the period it covers. SUP 3A.1.1R(2) exempts an institution that has not been required to safeguard more than £100,000 of relevant funds at any time for at least 53 weeks.

Third, the reserved matters. Standard SHA reserved matters cover board appointments, new debt, major capex and M&A. Two further points arise in a regulated business. The first is that an acquisition of control can need clearance before it completes. Part 12 of the Financial Services and Markets Act 2000 governs change in control, applied to payment institutions by paragraph 5 of Schedule 6 to the Payment Services Regulations 2017 and to electronic money institutions by paragraph 4 of Part 1 of Schedule 3 to the Electronic Money Regulations 2011. Section 13(1) of the National Security and Investment Act 2021 makes a notifiable acquisition completed without the Secretary of State’s approval void. A CMA merger review under the Enterprise Act 2002 may follow where the thresholds are met, and notification there is voluntary. Those approvals sit in the transfer, drag and tag provisions as conditions rather than in the list of matters the board may decide. The second is that the company’s own regulatory duties apply to it whatever the shareholders have agreed. Where Ofcom, the FCA or the Secretary of State requires the company to act, an investor veto does not displace the duty; it leaves the company in breach. So the reserved matters carve out action taken to comply with a regulatory requirement, and the management warranties address regulatory compliance and authorisation scope at signature.

Diligence question	What the review covers
Which telecoms-specific obligations bind this target?	Regulatory perimeter analysis covering General Conditions, spectrum and Code Powers
What do the regulatory conditions cost across the hold period?	Scenario analysis modelling cost orientation caps and safeguarding capital lock-up
Which changes in ownership or control need regulatory approval?	Reserved matters and transfer conditions reflecting regulatory approval thresholds
What does the target warrant about its regulatory status?	Warranties addressing General Condition compliance and authorisation scope
Does the FCA authorisation scope match what the target does?	Safeguarding assessment and authorisation scope review completed pre-offer

What our regulatory due diligence covers

We bring three things together on a private equity deal: detailed regulatory analysis, operator-side experience, and transaction structuring.

We conduct a regulatory perimeter analysis identifying all material obligations affecting the investment thesis: Ofcom General Conditions, spectrum assignments and coverage conditions, Code Powers status, numbering constraints, TSA 2021 compliance and, where applicable, SMP conditions and their market review schedule. We produce a regulatory report mapping each obligation to the acquisition model and identifying valuation impact.

For payments targets, we audit FCA authorisation scope, safeguarding requirements, working capital lock-up impact, and operational resilience requirements. We assess the working capital impact and timeline for any outstanding FCA notifications.

We produce regulatory scenario analysis assessing upside and downside assumptions to feed into the fund’s financial modelling: base case assuming current regulatory conditions; upside if conditions are relaxed in the next Ofcom market review; downside if conditions are tightened or new obligations imposed. For payments targets, we assess FCA safeguarding and operational resilience cost assumptions.

We draft SHA reserved matters reflecting regulatory approval thresholds and management warranties confirming regulatory compliance status at signature.

How Bratby Law helps

PE transactions in telecoms and payments are typically led by a City or US corporate firm acting for the sponsor. We work as Specialist Co-counsel alongside the corporate lead, responsible for the regulatory due diligence workstream and regulatory input into deal structuring. The corporate team retains control of the SPA, financial modelling and fund documentation. We provide the regulatory depth: perimeter analysis, scenario assessment, SHA reserved matters drafting on regulatory thresholds, NSIA notification assessment, and post-acquisition integration planning that accounts for Ofcom and FCA constraints.

For smaller PE acquisitions where the sponsor does not require a full corporate team, we act as lead Advisor through our Direct Legal Advice model.

The distinction that matters is between generic regulated-sector risk and the sector-specific constraints that reach fund returns directly. We settle the perimeter before the offer goes in, so the investment committee sees the regulatory position as part of the decision rather than after it.

Frequently asked questions about private equity in regulated sectors

How does SMP regulation affect acquisition upside?

Where Ofcom has set them, SMP conditions can include price controls and rules about the recovery of costs and cost orientation, which section 87(9) of the Communications Act 2003 authorises. Section 88 allows such a condition only where the market analysis shows a relevant risk of adverse effects arising from price distortion and the condition is appropriate for the purposes that section sets out, so an SMP determination does not carry one as a matter of course. Where the target does carry one, it constrains the wholesale price the target can charge. An acquisition plan assuming aggressive wholesale margin expansion will be constrained. We assess the impact on EBITDA and identify when the next Ofcom market review offers the opportunity to have conditions removed.

What is the timeline for an FCA change in control notification?

Acquiring control of an authorised payment institution requires prior notice to the FCA. Paragraph 5 of Schedule 6 to the Payment Services Regulations 2017 applies Part 12 of the Financial Services and Markets Act 2000 to payment institutions, and paragraph 4 of Part 1 of Schedule 3 to the Electronic Money Regulations 2011 does the same for electronic money institutions. Under section 189 the FCA has an assessment period of 60 working days from its acknowledgement of the notice. Section 190 lets the FCA interrupt that period once to request further information: the clock stops rather than runs, the interruption may not exceed 20 working days, and it may reach 30 only where the notice-giver is situated or regulated outside the United Kingdom or Gibraltar. Where the acquirer is not itself authorised, a fresh authorisation application may be needed, and regulation 9 of the PSRs 2017 gives the FCA three months to determine a complete application and up to 12 months for an incomplete one. We open the FCA dialogue early and build the approval into conditions precedent.

How does FCA safeguarding affect a payments target’s working capital?

Regulation 23 of the Payment Services Regulations 2017 requires an authorised payment institution to safeguard relevant funds, and regulation 23(3) offers a choice of method. The institution may segregate the funds and either place them in a separate account with an authorised credit institution or the Bank of England or invest them in assets the FCA has approved as secure and liquid, held in a separate account with an authorised custodian. It may instead cover the funds with an insurance policy or a comparable guarantee. Relevant funds are sums received from, or for the benefit of, payment service users, so they were never the firm’s own cash: on an insolvency event regulation 23(14) pays payment service users from the asset pool ahead of all other creditors, except in a payment institution special administration under the Payment and Electronic Money Institution Insolvency Regulations 2021, which that paragraph does not cover. On a business carrying an average safeguarded balance of £30m, a working capital model that counts that £30m as available liquidity overstates it by the whole amount. From 7 May 2026 CASS 15 adds rules on safeguarding arrangements, allocation and records, SUP 16.14A.3R adds a monthly safeguarding return within 15 business days of each month end, and SUP 3A.9.1R requires the external auditor to deliver a safeguarding report to the FCA. SUP 3A.1.1R(2) exempts an institution that has not been required to safeguard more than £100,000 of relevant funds at any time for at least 53 weeks.

What compliance burden does the TSA 2021 impose?

The duties apply to every provider of a public electronic communications network or service, not only to the largest operators. They include the duty under section 105A of the Communications Act 2003 to take such measures as are appropriate and proportionate for identifying and reducing the risks of security compromises occurring and for preparing for their occurrence, and the duty under section 105K to inform Ofcom, as soon as reasonably practicable, of a security compromise that has a significant effect on the operation of the network or service. There is no certification of compliance. The burden is a continuing one, in measures, records and reporting, and it extends to co-operating with an Ofcom assessment under section 105N and paying Ofcom’s reasonable costs of it. Its scale follows the size and complexity of the network or service, and we size it against the target rather than assuming a figure.

How long does regulatory DD on a telecoms acquisition take?

Regulatory due diligence runs alongside financial due diligence rather than after it. The critical path is the General Conditions and authorisation review, the SMP analysis where Ofcom has determined that the target has significant market power, and the spectrum, numbering and Code Powers audit; a payments target adds the FCA authorisation scope and safeguarding review. We scope and timetable it against the target and the deal timetable at the outset rather than working to a standard duration.

Related transactions pages

See also our other transactions pages:

• Mergers and Acquisitions (M&A)
• SaaS and Cloud Services
• Subsea cables
• MVNOs and MVNEs
• Interconnection, peering and access agreements
• Network sharing and co-location agreements
• Digital Infrastructure Projects
• Data Commercialisation and Licensing
• NSIA Clearances

Independent directory rankings

Our specialist expertise is recognised in major independent legal directories:

• Chambers & Partners: Rob Bratby is ranked as a Band 2 lawyer in the UK Guide 2026 in the “Telecommunications” category: Chambers
• The Legal 500: Rob Bratby is listed as a Leading Partner for Telecoms in London (TMT: IT and Telecoms). The Legal 500
• Lexology: Rob Bratby is recognised in the Lexology Index as a Global Elite Thought Leader for telecoms and media, and as a Thought Leader for data privacy and protection: Lexology