Change of control in a UK or Swiss regulated target: the approvals that set the deal timetable

The clock that governs the deal

In an unregulated acquisition the parties control the timetable. In a regulated one they do not. The regulatory filing is the critical path, and it should not be treated as a workstream to be started once the documents are agreed. It has a statutory duration, it can be paused by the regulator, it can produce conditions the buyer had not modelled, and until it completes the buyer cannot take the shares.

That matters for pricing as much as for planning. A long conditional period is a risk allocation problem: who bears the target's performance in the interim, what the seller may and may not do, what happens if the regulator imposes a capital or governance condition, and what the walk-away right looks like if the clock runs past the drop-dead date. None of those questions can be answered until the length and shape of the regulatory process is known, which is why the perimeter analysis belongs before the term sheet.

The United Kingdom: control at 10 per cent for directive firms, and a 60 working day clock

Part 12 of the Financial Services and Markets Act 2000 governs the acquisition of control over a UK authorised person. Under section 181, a person acquires control if it holds 10 per cent or more of the shares in the authorised firm or in a parent undertaking of it, or 10 per cent or more of the voting power in either, or shares or voting power as a result of which it is able to exercise significant influence over the management of the firm. Increases in control above that level are dealt with separately, and a buyer whose stake will move through further bands should check the current text and not assume that a single filing covers every band.

The 10 per cent trigger applies to directive-scope firms, that is banks, MiFID investment firms, insurers, reinsurers and UCITS management companies, and to the payments, e-money and cryptoasset regimes as Part 12 is applied to them. For non-directive firms, which include non-MiFID investment firms, insurance intermediaries, full-permission consumer credit firms and alternative investment fund managers, the Financial Services and Markets Act 2000 (Controllers) (Exemption) Order 2009 (SI 2009/774) exempts acquisitions below a single 20 per cent threshold, and for firms whose only regulated activities are certain consumer credit activities the threshold is 33 per cent (article 6A). The significant influence limb applies at every tier.

Two features of that test need attention. The first is how low it sits: 10 per cent captures minority investors, co-investors and funds taking a board seat as well as buyers of the whole company. The second is that the significant influence limb is not numerical at all, so governance rights negotiated in a shareholders' agreement, veto rights, board appointment rights, reserved matters, can create control for regulatory purposes at a shareholding well below any threshold. A term sheet that gives a minority investor real governance can create a notification obligation that was not planned for.

The process runs on a statutory clock. Under section 189, the appropriate regulator must act within 60 working days beginning with the day it acknowledges receipt of the section 178 notice. That period may be interrupted once, and the regulator must tell the notice-giver the duration of the assessment period, its expiry date and any change to it. At the end the regulator either approves unconditionally, or gives a warning notice proposing approval subject to conditions, which then take effect as interim conditions, or proposes to object. A decision to approve conditionally or to object comes by decision notice, and the notice-giver may refer it to the Upper Tribunal. There is a deemed approval: if the regulator has neither given the section 189(4) notice nor told the notice-giver that the notice is incomplete by the expiry of the assessment period, it is treated as having approved the acquisition (unless section 190A, which applies where a bank is in resolution, displaces the ordinary procedure).

The regulator assesses the notice against the section 186 criteria: the acquirer's reputation and financial soundness, the reputation, knowledge, skills and experience of anyone who will direct the business, the target's continued ability to meet its prudential requirements, whether the resulting group structure allows effective supervision and information exchange, and whether there are reasonable grounds to suspect money laundering or terrorist financing in connection with the acquisition.

Getting the sequence wrong is a criminal matter: under section 191F it is an offence to acquire without notifying, to complete before the assessment period expires without approval, to breach a condition, to complete in contravention of an objection (punishable by up to two years' imprisonment), or to provide materially false information. The seller has a duty too: under section 191D a person who decides to reduce or cease to have control must notify the regulator in writing before the disposition, with concert parties aggregated.

Three practical consequences follow. Sixty working days is roughly three calendar months before any interruption, and the clock starts on acknowledgement, and submission alone does not start it, so an incomplete filing costs weeks before the period even begins. The single permitted interruption is usually triggered by a request for further information, which means the quality of the initial pack is the main lever the buyer controls. And because conditions can be imposed, the buyer needs a position, agreed with the seller in the documents, on which conditions it will accept and which entitle it to walk away.

The regime reaches further than banks, and the crypto test changed in June 2026

Part 12 is usually discussed as bank and investment firm law. It is applied, with modifications, well beyond that. It has long been applied to electronic money institutions under the Electronic Money Regulations 2011 and to payment institutions under the Payment Services Regulations 2017. It is also applied, with modifications, to cryptoasset businesses registered under the money laundering rules, through Schedule 6B to the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017. That Schedule was replaced by the Money Laundering and Terrorist Financing (Amendment) Regulations 2026, and regulation 1(5) commenced the replacement in two stages: paragraphs 1, 2 and 5 of the new Schedule took effect on 30 June 2026, and the Schedule takes effect for all other purposes on 25 October 2027.

The change matters to anyone buying into the UK crypto sector. What is new is that, for a registered cryptoasset business to which Part 12 would not otherwise apply (a target that is itself an authorised person is assessed under ordinary Part 12), the test now depends on when the target was registered. For a business on the FCA's register before 25 October 2027, paragraph 2 of the Schedule rewrites sections 181 to 183: control is acquired where the buyer would become a beneficial owner of the target or its parent within the meaning of regulation 5 or 6 of the money laundering rules, and only if that does not apply do the familiar tests of 10 per cent of shares, 10 per cent of voting power or significant influence over management come into play, with increases measured at 20, 30 and 50 per cent. For a business registered on or after 25 October 2027, paragraph 4 leaves sections 181 to 183 untouched, so the ordinary Part 12 tests govern. The same transaction can therefore be assessed against a different definition of control depending on the date the target came onto the register.

Two consequences of the rewrite follow. Where the notice-giver comes in through the beneficial ownership route, paragraph 2 reduces the assessment to a single criterion, namely whether that person is fit and proper within the meaning of regulation 58A, and it removes the financial soundness of the acquisition from section 185(2)(a) altogether. And a new subsection inserted into section 191B allows the FCA, in a restriction notice, to direct that no influence over the management or activities of the business be exercisable by a beneficial owner. That is a restriction on influence, and it does not depend on a shareholding at all.

All of this arrives while the same firms are preparing for the FSMA authorisation gateway, whose application window runs from 30 September 2026 to 28 February 2027 ahead of the regime going live on 25 October 2027, and while a further money laundering obligation is pending: from 1 February 2027, under a new regulation 34A, a cryptoasset exchange provider or custodian wallet provider that has or proposes a correspondent relationship with a third-country respondent must apply specified enhanced due diligence to that respondent, in addition to its existing regulation 33 obligations, and must not enter into or continue a correspondent relationship with a shell bank (regulation 34A(2)); regulation 1(4) of SI 2026/621 commences the provision after what HM Treasury's Explanatory Memorandum describes as a nine-month implementation period. A buyer negotiating a crypto acquisition is therefore running more than one regulatory process at once: a change in control assessment on the existing registration, an authorisation project on the incoming regime, and a correspondent due diligence duty that starts in February 2027. The sequencing has to be worked out for each target.

For completeness: EU-authorised targets have their own qualifying holding regimes, and a target authorised under the EU banking, investment firm or crypto-asset frameworks needs a separate analysis under the applicable instrument. That is outside this note.

Switzerland: qualified participations, and the filing that comes first

Swiss law approaches the same question with different vocabulary and a different sequence. FINMA's guidance on qualified participations states the test: under the Banking Act and the Financial Institutions Act, a qualified participation exists where a person directly or indirectly holds at least 10 per cent of the capital or voting rights of a licensed institution, or can otherwise influence its business activities in a significant manner. The familiar structure is there, a numerical trigger plus an influence limb, but the mechanics differ in three ways that matter on a transaction.

First, the reporting obligation runs before the acquisition. FINMA states that any person must report to it before directly or indirectly buying or selling a qualified participation in a bank, securities firm or branch of a foreign bank or securities firm. The statutory yardstick sits in article 3(2)(c^bis) of the Banking Act: anyone holding, directly or indirectly, at least 10 per cent of the capital or votes, or otherwise able to exert a significant influence on the business, must ensure that this influence does not work to the detriment of prudent and sound business conduct, which is the standard FINMA tests a new qualified participant against.

Second, the obligation is repeated at further thresholds: changes must be reported when a holding rises above or falls below 10, 20, 33 and 50 per cent. The 33 per cent step has no counterpart in the UK's directive-firm bands of 10, 20, 30 and 50 per cent (the UK's own 33 per cent figure is a single entry threshold for consumer-credit-only firms), and a buyer building a stake needs to plan for a series of filings. Third, the licensed institution itself carries a reporting duty as soon as it becomes aware of a party buying or selling a qualified participation, so the target has its own obligation running alongside the buyer's.

The distinction between reporting and authorisation, however, has the larger effect on deal structure. FINMA states that changes concerning qualified participations in foreign-controlled institutions require authorisation, as does the transfer of a Swiss-controlled institution to foreign control. A foreign acquisition of a Swiss-controlled licensed institution is a consent process, and the transaction documents have to treat it as a condition precedent with a realistic timetable; it cannot be left as a post-closing formality. Because the requirements and their statutory bases differ by licence type, across the Banking Act, the Financial Institutions Act and the Insurance Supervision Act, the position has to be confirmed for the specific institution and cannot be assumed from the sector.

The other two gates: national security screening, merger control and consents

Financial regulation is rarely the only approval. National security and investment screening runs on its own logic and its own timetable. The United Kingdom operates a mandatory notification regime under the National Security and Investment Act 2021 for acquisitions in specified sensitive sectors, and the consequences of closing a notifiable acquisition without clearance are severe. Both the sector definitions and the trigger thresholds are technical and have been refined since the Act came into force, so they need checking against the current regulations for the specific target.

Switzerland is building an equivalent regime, and it is not yet operative. SECO's own page records that the Federal Council adopted the dispatch on an Investment Screening Act on 15 December 2023 and that screening will focus on state-controlled investors and domestic companies operating in particularly critical sectors. Parliament adopted the Investment Screening Act on 19 December 2025, the referendum period expired on 17 April 2026, and on 12 June 2026 the Federal Council opened consultation on the implementing ordinance, running until 5 October 2026. SECO states that entry into force is expected in 2027, and the Federal Council decided in November 2025 that commencement should be designed to keep the burden on business low. A buyer planning a Swiss transaction that would complete in 2027 or later should confirm the current position with SECO directly, and should build optionality into the timetable if the target sits in a critical sector and the buyer is state-controlled or state-backed.

Merger control and the target's own contractual consents form the third gate. Change of control clauses in funding documents, key client contracts, IT and outsourcing arrangements and licences are a frequent cause of delay, because they are discovered in diligence late and each counterparty has its own timetable. On a regulated target they matter more than usual, since outsourcing and material contracts are themselves a supervisory concern.

What a defensible timetable looks like

Bringing this together, the deal plan for a regulated target should do five things. Run the control analysis on the governance package as a whole, beyond the percentage, so the significant influence limb is tested against the shareholders' agreement as drafted. Identify every filing and consent, on both sides of any border, and mark, for each, whether it requires prior clearance, imposes a standstill and allows the authority to object, since a filing called a notification can do all three: the UK section 178 notice is one. Build the conditional period around the longest gate, and set the drop-dead date with the single permitted interruption of the UK clock built in. Agree in the documents how regulatory conditions are allocated, including a materiality threshold above which the buyer may walk, and what the parties must do to satisfy conditions. And keep the target's own filing obligations in view, since in Switzerland the institution reports as well as the buyer, and a mismatch between the two filings is an avoidable supervisory question.

A regulated acquisition where the buyer has modelled the clock, prepared a complete filing and pre-agreed the treatment of conditions closes months earlier than one where the filing is assembled after signing. On a competitive process, deliverability at a known date is part of the price.

What this means for you

• Test the governance package as well as the percentage. For directive firms, UK control is acquired at 10 per cent of shares or voting power, or at significant influence over management (20 or 33 per cent for the non-directive tiers), so veto rights and board appointment rights can create a filing obligation well below any threshold.
• Start the UK clock properly. The 60 working day period runs from the regulator's acknowledgement, may be interrupted once, and produces a deemed approval only if, by its expiry, the regulator has neither given the section 189(4) notice (unconditional approval, or a warning notice proposing conditions or objection) nor told you the notice is incomplete. The quality of the initial pack is the main lever you hold.
• In Switzerland, file before the participation changes hands. The statutory duty is to report to FINMA before acquiring or disposing of a qualified participation, so the report must precede completion; whether it must also precede signing of a conditional agreement depends on what rights the buyer takes at signing and on FINMA's practice, and should be settled with FINMA early. Further reports arise at 20, 33 and 50 per cent, and the target has its own duty to report.
• Know whether you need consent or only give notice. Changes in qualified participations in foreign-controlled Swiss institutions, and the passing of a Swiss-controlled institution into foreign control, require authorisation. Treat it as a condition precedent in the documents.
• Crypto targets: check the target's regulatory status, then the registration date. Ordinary Part 12 governs a target that is itself an authorised person; for a registered cryptoasset business outside Part 12, the control test since 30 June 2026 turns on whether it was on the register before 25 October 2027. Run those checks first, then sequence the change in control assessment against the authorisation gateway deliberately.

Isak Legal advises acquirers, investors and regulated targets on the regulatory path through a transaction, including control analysis, filing strategy and the conditionality that belongs in the documents. See our Corporate and Financial Regulation pages, or get in touch.

This client update is provided for general information only, reflects the position as at 26 September 2026 and does not constitute legal advice or create a lawyer-client relationship. The UK control test and assessment procedure are taken from sections 181 and 189 of the Financial Services and Markets Act 2000 in the consolidated text on legislation.gov.uk, which also records the application of Part 12, with modifications, to electronic money institutions, payment institutions and registered cryptoasset businesses. The cryptoasset position is taken from Schedule 6B to the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 as replaced by regulation 37 of the Money Laundering and Terrorist Financing (Amendment) Regulations 2026 (SI 2026/621), and from regulation 1 of those Regulations; the account of the previous regime is HM Treasury's, in the Explanatory Memorandum. The Swiss position is taken from FINMA's published guidance on qualified participations, and the statutory bases differ by licence type. The National Security and Investment Act sector definitions and thresholds, and the current status of Swiss investment screening, must be confirmed against the current regulations and SECO's own publications before reliance. Merger control, tax and the target's contractual consents are outside the scope of this note. For advice on a specific matter, please contact us.