The craft
Regulatory diligence
How to establish whether a company is permitted to do what it does — checking registers yourself, understanding borrowed permissions, and spotting a model that depends on a gap.
Realistic time Two to six hours
In a regulated sector, whether the company may lawfully operate comes before every commercial question. A business with excellent metrics and no authorisation has a problem that no growth rate fixes, and enforcement action arrives without regard to how well the product is doing.
The encouraging part is that this is one of the few areas where an individual investor can verify claims independently. Most regulators publish searchable registers of authorised firms and their permissions, and the site's four regional desks link to the relevant ones. Confirming an authorisation takes minutes.
The harder question is not whether the company is compliant today but whether the model depends on a regulatory position that is changing. Payments, consumer credit, crypto assets, short-term rentals, gig work and health data have all seen substantial tightening, and a business built in a gap has a deadline it did not choose.
01
Establish the actual position
Ask three precise questions: what regulated activities does the company perform, what authorisation permits each one, and in whose name is that authorisation held. Vagueness in the answer is itself informative — founders operating lawfully generally know this in detail because it governs their daily operations.
Then verify. Search the regulator's public register for the entity name and confirm the permissions match the activities. A firm listed with narrower permissions than its activities require is a substantive finding, not a technicality.
Where the company operates under an exemption, ask for the specific provision relied on and whether counsel has advised on it in writing. Exemptions are narrow and businesses grow out of them without noticing.
Check
- Which regulated activities does the company perform?
- What authorisation covers each, and in whose name?
- Verify on the regulator's public register directly.
- If relying on an exemption, which provision, and is there written advice?
- Which regulators have jurisdiction in each market it operates in?
02
Borrowed permissions
Operating as an agent of a licensed firm, under a sponsor bank, or through a partner's permissions is common, legitimate and a genuine dependency. The company can operate only for as long as the partner permits, and the partner is subject to its own regulatory pressures.
Read the agreement, or at least establish its key terms: notice period for termination, change-of-control provisions, the partner's right to impose new requirements, and whether an alternative partner has been identified. Partners have exited whole categories of client at short notice.
Ask when the arrangement was last reviewed by the partner and what came out of it. That question often produces the most useful answer in the entire regulatory conversation.
Check
- What are the termination terms of the partner agreement?
- Can the partner impose new requirements unilaterally?
- Is an alternative partner identified, and how long would migration take?
- When did the partner last review the relationship, and what happened?
- Has the partner ever restricted or repriced the arrangement?
03
Direction of travel
A model that works because a rule has not caught up with it is a model with a deadline. Ask what consultations, draft rules or enforcement trends affect the category, and whether the company has engaged with the regulator about its own position.
Companies that talk to their regulator early tend to fare better than those that avoid the conversation, and a founder who has had that meeting will describe it specifically. One who has not may not know what is coming.
Multi-market operations multiply this. A model that is permitted in one country may be prohibited in the next, and expansion plans that assume regulatory portability are a common source of unpleasant surprise.
Check
- What regulatory change is in consultation or draft in this category?
- Has the company engaged with its regulator directly?
- What would the model look like under the proposed rules?
- Does the model travel to the markets the company plans to enter?
- Any enforcement action against comparable firms recently?
04
Compliance as an operating function
Beyond authorisation, ask how compliance actually works: who is responsible, whether they have authority, whether processes are documented and tested, and what happened at the last audit or examination.
A company where compliance reports to the chief executive and has the ability to stop things is in a different position from one where it is a part-time responsibility of someone in operations. In regulated sectors this is a substantive risk factor rather than an administrative detail.
Check
- Who holds responsibility for compliance, and what authority do they have?
- Are policies documented, and when were they last tested?
- When was the last regulatory examination or audit, and what were the findings?
- Any past or current enforcement action, complaints or investigations?
- What is the budget for compliance relative to the size of the business?
Stop and think
Red flags
- A licence claim that cannot be confirmed on the regulator's public register.
- Permissions on the register that are narrower than the activities performed.
- Reliance on an exemption with no written legal advice behind it.
- A partner agreement terminable at short notice with no alternative identified.
- A business model that depends on a rule that is currently in consultation.
- No named person responsible for compliance.
- Undisclosed past enforcement action or regulatory findings.
Take these into the room
Questions to ask the founders
- What regulated activities do you perform, and what permits each one?
- In whose name is the authorisation held?
- What are the termination terms of your partner agreement?
- What regulatory change is coming that affects this model?
- Have you spoken to your regulator, and what did they say?
- When were you last examined, and what were the findings?
- Does this model work in the next market you plan to enter?
From the decoder