Buying an EU CASP with control approval and licence continuity

Start with the legal entity and the rights being acquired. In a share purchase, the Irish company continues as the same legal person. Its customer obligations, tax liabilities and contractual exposure remain with it. The purchaser acquires economic exposure through its shares; it does not automatically become personally liable for every company debt. (Companies Act 2014, section 25(2).)

The buyer’s investment committee should choose among three routes:

1. Acquire shares where the target’s permissions, people, systems and customer relationships justify retaining the company and its liabilities.
2. Acquire selected assets where the receiving entity has the necessary permissions before providing services. Identify the contracts, customer relationships, data and assets requiring lawful transfer. The seller’s authorisation does not pass with the assets, and an asset deal does not establish that all liabilities stay behind.
3. Use an authorised provider where that provider will contract for and perform the regulated services. The buyer can supply agreed technology or support within a lawful allocation of responsibilities. Outsourcing must preserve the provider’s obligations, authorisation conditions and effective supervision. (MiCA, Articles 59(1), 73.)

MiCA excludes services supplied exclusively within the specified parent-subsidiary relationships. Serving external customers through a group structure does not itself satisfy that exclusion. (MiCA, Article 2(2)(a).)

For a share purchase, transaction counsel should prepare ownership charts before and after each proposed step. A qualifying holding means at least 10% of capital or voting rights, or a holding permitting significant influence over management. A smaller stake can therefore qualify. Further notification is required when an increase reaches or exceeds 20%, 30% or 50%, or makes the CASP a subsidiary. The seller has separate notification duties for disposal and specified reductions. (MiCA, Articles 3(1)(36), 83(1)–(2).)

Examine upstream purchases, nominees, options, board appointment rights, shareholder agreements and voting arrangements. An unchanged direct shareholder does not exclude a change of indirect ownership. The supervisory methodology applies control first, then multiplication where appropriate. It also tests persons acting in concert and significant influence. Ordinary protective rights or shareholder cooperation do not automatically establish concerted control; their content and use matter. (Joint EBA and ESMA Guidelines, EBA/GL/2024/09 and ESMA75-453128700-10, qualifying-holdings paragraphs 14–15; JC/GL/2016/01, sections 4–7.)

Map staged purchases as a complete sequence. A first minority acquisition does not establish clearance for a later takeover. Identify each threshold and confirm which steps the notification and supervisory outcome cover. Review interim vetoes and management mandates before signing so they do not confer the influence awaiting assessment. (MiCA, Article 83(1).)

The regulatory team should reconcile the target’s legal identity with its authorisation decision, conditions, service schedule and current supervisory correspondence. Compare those records with the national and ESMA registers. Record restrictions, withdrawals and the countries and services covered by cross-border notifications. Licentium’s crypto partner licence and permission checks explains the initial entity-and-service verification. (MiCA, Articles 59(4), 59(6), 65, 109.)

Product counsel must then map the buyer’s proposed customer journey to the actual services. Custody, operating a trading platform, dealing against the firm’s own capital and transmitting orders are separate categories. A custody permission cannot support a trading platform without the required extension. Tokens qualifying as financial instruments need their own securities-law analysis. Payment services connected with crypto services require the CASP or relevant third party to hold the applicable payment-services authorisation. Lending and staking arrangements need a separate activity assessment; their commercial labels do not settle the permissions. (MiCA, Articles 2(4)(a), 3(1)(16)–(26), 59(8), 70(4), recital 94; European Commission answer in ESMA Q&A 2067.)

Test current permission and historical legality separately. Ireland’s VASP transition ended on 30 December 2025; the EU maximum expired on 1 July 2026. An old registration cannot support current operation through that transition. Earlier customer activity must be assessed under the rules applicable to its date and location. Dormancy also matters: MiCA provides for withdrawal where an authorisation remains unused for 12 months or services cease for nine consecutive months. Obtain the operating evidence before valuing a dormant company’s permission. (S.I. No. 607/2024, regulation 20; Central Bank of Ireland, Markets in Crypto-Assets Regulation (MiCAR), “Transitional period for CASPs”; MiCA, Articles 64(1)(a), 64(1)(c), 143(3).)

The purchaser’s diligence request should require:

• The complete permission history, regulatory submissions, inspection findings, remediation commitments and correspondence about restrictions or withdrawal.
• Customer and country breakdowns, historical terms, onboarding files, monitoring backlogs, sanctions controls and independent AML reviews. Request evidence of suspicious-activity handling through a lawful disclosure process. Transfer records should demonstrate compliance with the applicable crypto Travel Rule. (MiCA, Articles 64, 68(8); Regulation (EU) 2023/1113, Articles 14–18.)
• Client-ledger, wallet and bank reconciliations; ownership and key-control records; shortfall reports; custody agreements; subcustodian permissions; and asset-return procedures. Establish legal and operational segregation, rather than relying on an on-chain balance alone. (MiCA, Articles 70, 75(1)–(9).)
• Complaints, litigation, compensation, incident and loss registers, with supporting files and unresolved customer claims. Quantify the potential cost and identify recurring operational causes. (MiCA, Articles 68, 71, 75(8).)
• Tax returns, payments, enquiries, payroll and VAT records, transfer-pricing arrangements and claimed losses or reliefs. Tax counsel should assess historic exposure and the acquisition’s effect on future reliefs before those benefits enter the valuation.
• Bank, custody, cloud, software and group-service contracts, including change-of-control clauses, termination rights, audit access, exit arrangements and any seller services needed after closing. (MiCA, Article 73; Regulation (EU) 2022/2554, Articles 28, 30.)

Review the token inventory separately. ESMA’s 8 October 2026 opinion treats services involving non-MiCA-compliant asset-referenced and e-money tokens as presumptively incompatible with Article 66(1). That supervisory position covers custody and transfers as well as trading. It contemplates national authorities allowing narrowly supervised residual services for existing holdings where necessary for an orderly wind-down and to avoid client detriment, and calls for legacy remediation within three months of publication. The buyer should obtain the target’s affected-token assessment and remediation plan before attributing value to continuing revenues. The opinion does not classify every service as an offer or admission to trading. (ESMA Opinion ESMA75-113276571-1742, paragraphs 7, 12–14, 21–27.)

Translate each finding into a transaction decision. A known customer-asset shortfall requires immediate corrective action by the CASP and a defined remedy before the buyer proceeds. A price reduction, retention or seller indemnity can allocate financial loss between the parties. Those contractual protections do not replenish customer assets or discharge the company’s obligations. If essential records cannot be produced, price the uncertainty or decline the acquisition; an empty data room does not establish clean history. (MiCA, Articles 70, 75; Companies Act 2014, section 25(2).)

The proposed acquirer files with the target’s competent authority. For the Irish target, that is the Central Bank of Ireland. Confirm its current submission arrangements with the supervisory team and coordinate the seller’s disposal notice. (MiCA, Article 83; S.I. No. 607/2024, regulation 3.)

The authority assesses five matters: the acquirer’s reputation; the incoming management’s reputation and competence; the acquirer’s financial soundness; the CASP’s ability to remain compliant; and acquisition-related money-laundering or terrorist-financing concerns. The buyer must address the intended business, including planned changes. Opposition requires reasonable grounds under those criteria, or incomplete or false information. (MiCA, Article 84(1)–(2).)

Delegated Regulation 2025/414 specifies the supporting information. Assemble identities and ownership chains, relevant investigations and enforcement history, proposed managers, transaction documents, group supervision arrangements and the funding trail. Trace acquisition money to its economic source, including borrowing, assets sold and relevant crypto transactions. A bank balance or wallet screenshot alone does not explain how the funds were generated or how acquisition debt will be repaid. (Delegated Regulation 2025/414, Articles 1–8.)

For more than 50% ownership, or where the target becomes a subsidiary, the filing requires a three-year business plan. Its forecasts, management arrangements, systems and outsourcing must support the intended product. Assess the resources left in the CASP after acquisition financing, integration costs and planned distributions. The purchase price paid to the seller does not itself fund the target’s continuing prudential safeguards. (Delegated Regulation 2025/414, Article 11; MiCA, Articles 67, 84(1)(c)–(d).)

Keep a written assessment-clock record. Article 83 requires acknowledgement within two working days and assessment within 60 working days of the relevant written acknowledgement. Confirm that the authority has accepted the required filing and obtain its stated expiry date. Preparation and incomplete submissions should not be treated as elapsed assessment time. (MiCA, Article 83(3)–(4); EBA/GL/2024/09, qualifying-holdings paragraph 30; JC/GL/2016/01, paragraphs 9.1–9.3.)

The authority can request necessary additional information no later than working day 50. The suspension ordinarily cannot exceed 20 working days. For an acquirer outside the Union, or regulated under third-country law, Article 83(6) permits extension of that suspension by up to 30 working days. Further requests do not create another suspension. Non-opposition by the correctly calculated expiry results in deemed approval; the authority can also set a deadline for completing the acquisition. Draft the long-stop date around those rules and the separate closing procedures. (MiCA, Article 83(6)–(9).)

The buyer’s board should approve the investment and financing within its constitution and delegated powers. UK incorporation alone does not trigger a UK change-of-control application for an Irish-only authorised target: section 178 concerns a UK authorised person. Additional UK permissions, crypto registrations, subsidiaries or regulated-buyer obligations require separate assessment. Screen the parties, controllers, financing and payment route against applicable sanctions before funds move. (Companies Act 2006, sections 171–172; Financial Services and Markets Act 2000, section 178; S.I. 2017/692, regulation 60B and Schedule 6B; OFSI, UK Financial Sanctions General Guidance, section 1.4.)

The share purchase agreement should make completion conditional on a documented list of outcomes:

1. The buyer’s regulatory team establishes MiCA non-opposition or valid deemed approval, with closing inside any supervisory completion period.
2. Investment-screening and competition counsel record the filing analysis and obtain the required outcomes for every applicable jurisdiction.
3. The target evidences continuing authorisation and any permissions essential to the agreed business at completion. Services dependent on later extensions remain outside the launch scope.
4. The target secures required management approvals and maintains capable incumbents until replacements can lawfully act.
5. The seller and target deliver essential contractual consents, continued banking and custody access, and any agreed transition services.
6. The target completes specified customer-protection repairs. The parties settle the evidence for remediation, the revised price and any secured indemnity or retention.

These are proposed contractual protections tied to the identified risks. The agreement should allocate filing work, information deadlines, remediation costs and consequences of refusal or delay. Interim covenants should preserve lawful operation and records without giving the buyer premature operating control. Do not describe every early transfer as automatically void under MiCA; the legislation provides an assessment process and supervisory remedies with their own conditions. (MiCA, Articles 68(3), 83–84; S.I. No. 607/2024, regulations 5–6.)

For Ireland, investment screening needs a distinct analysis. The UK buyer’s third-country status is only one element. Section 9 also requires control or a crossing above 25% or 50% of shares or votes, and value of at least €2 million including relevant transactions in the preceding twelve months. There must be no common controller of all parties, and the transaction must relate to a specified sensitive-sector matter. Current guidance identifies CASPs operating trading platforms as potentially relevant financial infrastructure; CASP status alone does not establish mandatory filing. The Minister can also review certain non-notifiable transactions on security or public-order grounds. (Screening of Third Country Transactions Act 2023, sections 2, 9, 12(1)(b); Department of Enterprise guidance, May 2026, section 3.5.1.)

Where notification is required, the parties must file at least ten days before completion. A screening notice triggers the statutory restriction on completing or furthering the transaction. The assessment period ordinarily runs for 90 days from that notice, can extend to 135 days and can be suspended for information. Make the necessary screening outcome a closing condition; the ten-day filing minimum is not a decision deadline. (2023 Act, sections 10–11, 16–17, 20.)

Competition counsel must assess EU and national jurisdiction using group turnover and the transaction’s structure. Ireland’s current national thresholds are at least €60 million combined Irish turnover and at least €10 million each for two undertakings. The higher thresholds introduced in July 2026 lapsed on 30 September 2026. Check the applicable thresholds again before closing, alongside any call-in power and EU merger jurisdiction. Required clearance is separate from MiCA assessment. (Competition Act 2002, sections 18–19; S.I. No. 388/2018; CCPC notice, 13 October 2026; Regulation (EC) No 139/2004, Articles 1, 4, 7.)

The buyer should also screen EU foreign-subsidy notification using the target’s EU turnover and the parties’ foreign financial contributions. Where that regime applies, its notification and standstill requirements create another closing dependency. (Regulation (EU) 2022/2560, Articles 20–24.)

At completion, the parties should finish the share-transfer and register formalities, deliver the agreed notices and activate only the appointments that can lawfully take effect. The target’s board must retain the people, powers and resources needed to run the regulated business. MiCA requires effective management in the Union, at least one EU-resident director, and a registered office in a Member State where some crypto services are performed. Group ownership does not relax those requirements. (Companies Act 2014, section 94; MiCA, Articles 59(2), 68.)

Management changes must be notified without delay and before new members exercise their activities. Irish appointments to pre-approval controlled functions also require the applicable Central Bank approval. This includes the CASP Head of Safeguarding role introduced from 10 February 2026. Schedule that process separately from ownership clearance. (MiCA, Article 69; Central Bank Reform Act 2010, section 23; S.I. No. 20/2026, regulations 3–4 and Schedule.)

Additional services require an authorisation extension before launch. For services in another Member State, the CASP submits the Article 65 information. It may start when notified that the home authority has communicated that information, or at the latest on the fifteenth calendar day after submission of the required information. That timetable does not authorise an unapproved service. A share purchase alone need not restart unchanged cross-border arrangements, but every proposed expansion needs checking. (MiCA, Articles 59(8), 65.)

For group technology and outsourcing, the target must retain oversight, information access and exit capability. DORA requires timely notification of planned ICT arrangements supporting critical or important functions and appropriate contractual provisions. Outsourced custody must use a provider authorised under Article 59, with disclosure to clients. An overseas group custodian does not qualify merely through common ownership. Update the customer documents, asset controls and migration plan before changing how services operate. (MiCA, Articles 73, 75(9); Regulation (EU) 2022/2554, Articles 28(3), 30.)

Data counsel should document lawful access to customer information before the buyer or a new supplier receives it. Processing terms and any international-transfer route need their own assessment; ownership does not supply that legal basis. (Regulation (EU) 2016/679, Articles 5–6, 28, 44–46.)

The EU permission also leaves UK-facing activities to be assessed separately. UK business activity can trigger money-laundering registration, while qualifying crypto promotions into the UK require a lawful promotion route. The enacted UK crypto regime has full commencement on 25 October 2027; an operating plan extending into that period must address its authorisation requirements. Ownership of the Irish subsidiary supplies no UK permission. (S.I. 2017/692, regulations 8, 14A, 56; Financial Services and Markets Act 2000, section 21; S.I. 2005/1529, article 4 and Schedule 1, paragraph 26F, as amended; S.I. 2026/102, regulation 1.)

If the target cannot support the required product without unacceptable repair costs or inherited exposure, the buyer should reconsider the acquisition. A new MiCA authorisation or a properly structured provider arrangement may better match the intended business. The investment decision should follow the verified permissions, liabilities and implementation costs.