Regulatory Due Diligence in 2026: Which Licenses Survive the Deal
Co-founder and CEO at Peony. I built the data room platform with a background in document security, file systems, and AI. Founded Peony in 2021 in San Francisco.
Last updated: October 2026
TL;DR: Regulatory due diligence is the buyer's check of every license, permit, registration and government approval the target needs, and of what happens to each one on closing. Whether an authorization survives depends on the deal structure more than on the sector. A stock purchase leaves the license holder in place, but a federal alcohol basic permit still terminates 30 days after a change in control unless a new application is filed. An asset purchase moves the business to a new entity, so a Medicare provider agreement goes through a change of ownership and a federal contract needs a novation. Map every license with the Permit Transfer-Trigger Matrix below before you fix the structure, the outside date or the SPA conditions. Then run the permit register, regulator correspondence and consent tracker in a data room that records who read what.
I'm Deqian Jia, co-founder of Peony, a data room company used by 8,000+ customers in 60+ countries. Regulated-sector deals tend to run late for the same reason. Diligence treats "regulatory" as a sub-bullet of legal review, so nobody asks which permits the chosen structure will kill until the SPA is nearly done. By then the 60-day clock at a bank regulator or the 60-day advance notice to the State Department is the longest pole in the deal. This guide is the map I wish every deal lead had in week one: what to request, which regulator owns each approval, and how each finding changes the purchase agreement. Every rule below is cited to the regulation, statute or regulator page as it stood in October 2026.
Key takeaways
- Structure decides survival. The same license can survive a stock deal, need notice in a merger and need a new application in an asset deal. Map each license against each structure you are still considering.
- "Stock deal, so nothing transfers" is wrong for control-based regimes. Banks (25% voting control, or 10% with a presumption), insurers (10% presumption), money transmitters (25%), FCC licensees, broker-dealers (25%) and federal alcohol permit holders all look through to whoever controls the entity.
- Clocks start on a complete filing, not on signing. The Fed's 60-day Change in Bank Control Act period runs from receipt of a complete notice (12 CFR 225.43); the CSBS money transmission model act runs 60 days from the completion date.
- HSR is back on the old form. The expanded form was vacated on February 12, 2026, and the FTC accepts the pre-February 2025 form (FTC). The 2026 threshold is $133.9 million.
- Findings become contract terms. An approval requirement becomes a closing condition and an efforts covenant. A known violation becomes a special indemnity, because rep and warranty insurance won't cover what the buyer knew.
- The data room is part of the evidence. A permit register, regulator correspondence by agency, a live consent tracker and a page-level record of what buyer counsel read make the disclosure schedule defensible later.
What is regulatory due diligence?
Regulatory due diligence is the review of every government authorization a target holds or needs, the conditions attached to each, the target's compliance and enforcement record with the issuing agencies, and the approvals the transaction itself triggers. It is the workstream that tells you whether the business you are buying can operate legally on the morning after closing, and how long it will take to get there.
It overlaps with two other workstreams, and the boundary matters because each is usually run by different people:
| Workstream | The question it answers | Typical output | Who runs it |
|---|---|---|---|
| Legal due diligence | Are the contracts, corporate records, litigation and IP sound? | Legal DD report, contract consent map, disclosure schedule markup | Buyer's M&A counsel |
| Compliance due diligence | Does the target follow the rules that apply to it today (AML, sanctions, anti-bribery, privacy)? | Compliance gap list, remediation plan | Compliance counsel, forensic accountants |
| Regulatory due diligence | Which licenses and approvals does the target hold, will they survive this deal structure, and which regulators must approve the deal? | Permit register, transfer-trigger map, regulatory approvals list, consent tracker | Sector regulatory counsel (healthcare, banking, FCC, export) plus environmental consultants |
Environmental permits sit in both regulatory and environmental due diligence: the environmental team prices contamination and compliance, while the regulatory team decides whether the Title V, NPDES or RCRA permit moves with the deal. Healthcare targets have their own deeper layer of billing, coding and Stark/AKS work, covered in healthcare due diligence.
In practice, regulatory due diligence asks four questions of every authorization:
- Inventory: what does the target hold, in which legal entity, issued by which agency, expiring when, on what conditions?
- Transferability: under the structure you are using, does it survive as-is, survive with notice, need prior consent, or need a new application?
- Standing: is it in good standing, or is there an open inspection, warning letter, plan of correction, consent decree or lapsed renewal?
- Approval path: which regulators must approve or be told about the deal itself, by when, and does the clock fit the outside date?
What is the Permit Transfer-Trigger Matrix?
The Permit Transfer-Trigger Matrix is a one-page grid that sorts every license the target holds by what the chosen deal structure does to it: it survives as-is, it survives with notice, it needs prior regulator consent, or it needs a new application. Rows are deal structures; columns are those four outcomes. You fill it once per structure you are still considering, and the structure with the fewest entries in the right-hand two columns is usually the one that closes fastest.
The reason it works is that almost every US licensing regime asks one of two questions. Holder-based regimes ask whether the license holder changed: a stock purchase leaves the holder in place, while an asset purchase or a forward merger creates a new one. Control-based regimes ask whether control of the holder changed, directly or indirectly: those regimes catch stock deals and parent-level deals too. Knowing which question a regime asks tells you which row it bites in.
| Deal structure | Survives as-is | Notice only | Prior regulator consent | New application |
|---|---|---|---|---|
| Stock purchase (licensed entity survives, owner changes) | Medicare provider agreement (stock transfer is not a change of ownership, 42 CFR 489.18); federal contracts (no novation, FAR 42.1204(b)); permits issued to the entity, subject to state notice rules | Medicare enrollment update within 30 days (42 CFR 424.516(e)); ITAR registration notice within 5 days (22 CFR 122.4(a)) | Bank change in control (12 CFR 225.41); insurer Form A (NAIC Model #440); money transmitter (MTMA §6.01); FCC transfer of control (47 CFR 1.948, 73.3540); CFIUS mandatory declarations | Federal alcohol basic permit after 30 days (27 CFR 1.44); Florida health-facility license at 51%+ (Fla. Stat. 408.803); home health or hospice inside 36 months (42 CFR 424.550(b)) |
| Asset purchase (new entity takes the business) | Rarely anything: licenses sit with the seller's entity | NPDES automatic transfer with 30 days' notice (40 CFR 122.61(b)); Title V administrative amendment (40 CFR 70.7(d)); NDA/ANDA ownership letters (21 CFR 314.72) | Medicare change of ownership filings before closing (42 CFR 424.550); federal contract novation (FAR 42.1204); FCC assignment; RCRA permit, revised application 90 days before (40 CFR 270.40); EAR licenses (15 CFR 750.10); DEA registration (21 CFR 1301.52) | Federal alcohol basic permit (no voluntary transfer); money transmitter license (not transferable, MTMA §5.01(c)); FDA food facility registration (21 CFR 1.234(b)); state facility licenses |
| Merger (target merges into another company, or vice versa) | Medicare agreement when another corporation merges into the provider (42 CFR 489.18(a)(3)) | ITAR: surviving entity lists the licenses it keeps; unlisted licenses are invalid (22 CFR 122.4(c)) | Forward merger of the provider corporation is a Medicare change of ownership; federal contracts moving by merger need novation; FCC and state financial regulators | Federal alcohol basic permit transferred by operation of law, apply within 30 days (27 CFR 1.44) |
| Parent-level change of control (indirect) | Licenses held by the operating company under holder-based regimes | Medicare enrollment update (30 days); ITAR, plus 60 days' advance notice if the buyer is foreign (22 CFR 122.4(b)) | Bank, insurer and money transmitter regimes all reach indirect control; FCC transfer of control; CFIUS | Federal alcohol basic permit, where control is acquired "directly or indirectly" (27 CFR 1.44) |
How to use it in a live deal:
- Build the register first. Every row in the matrix comes from the permit register: one line per authorization, with the holder entity, the issuing agency and the transfer clause. If the seller can't produce one, that alone tells you how long regulatory review will take.
- Fill one matrix per candidate structure. Buyers often prefer an asset deal for liability reasons. The matrix shows what that preference costs in new applications and consents, so it can be weighed against the indemnity you would otherwise need.
- Turn the two right-hand columns into the consent tracker. Every "prior consent" and "new application" entry becomes a filing with an owner, a complete-filing target date, a regulator clock and a matching closing condition.
Which US regulators must approve a change of ownership or control?
The answer is sector by sector, and the trigger, the regulator and the clock differ for each. The tables below list the regimes deal teams hit most often in $5M to $500M deals. Each row is checked against the current regulation or statute. Treat the clock as the regulator's legal deadline or filing lead time, not a forecast: real processing time is usually longer. The Federal Reserve's Inspector General found that processing times for merger, acquisition and change in bank control applications increased from 2021 to 2024 (March 2026 report).
Healthcare and life sciences
| License or registration | What triggers review | Regulator | Clock or lead time | Source |
|---|---|---|---|---|
| Medicare provider agreement (hospitals, SNFs and other Part A providers) | Asset sale, forward merger of the provider corporation, partner change, lease of the facility. A transfer of corporate stock is not a change of ownership | CMS, via the Medicare contractor and state survey agency | Both owners file enrollment applications before closing; if the new owner hasn't filed within 30 days, CMS may deactivate the billing number. The agreement is assigned automatically, with any existing plan of correction | 42 CFR 489.18; 42 CFR 424.550 |
| Medicare enrollment, any ownership or control change | Change of ownership or control, including stock deals | CMS (Medicare contractor) | Report within 30 days | 42 CFR 424.516(e) |
| Home health agency or hospice | Majority ownership change (asset sale, stock transfer, merger) within 36 months of initial enrollment or the last majority change | CMS | Agreement and billing privileges do not convey: new enrollment plus a state survey or accreditation, unless an exception applies (for example, two consecutive years of full cost reports) | 42 CFR 424.550(b) |
| State health-facility license (Florida example: home health agencies, hospitals, assisted living, nurse registries) | Asset sale shown by a new FEIN, or transfer of 51%+ of ownership, shares or controlling interest | Florida AHCA | Seller notifies and buyer's application must reach AHCA at least 60 days before the change; AHCA decides within 60 days of a complete application; the seller stays liable for lawful operation until the buyer is licensed | Fla. Stat. 408.803; 408.806; 408.807 |
| DEA controlled-substance registration | Any assignment or transfer | DEA | No transfer without DEA's written consent | 21 CFR 1301.52 |
| FDA drug establishment registration | Closing or selling an establishment | FDA | Update within 30 calendar days | 21 CFR 207.29 |
| FDA device establishment registration | Change to registration information | FDA | Update within 30 days | 21 CFR 807.22 |
| FDA food facility registration | New owner of the facility | FDA | Former owner cancels within 60 calendar days; new owner submits a new registration | 21 CFR 1.234(b) |
| NDA or ANDA (approved drug application) | Transfer of ownership of the application | FDA | Former owner's transfer letter and new owner's commitment letter at the time of transfer | 21 CFR 314.72 |
Two healthcare traps account for most of the late surprises. First, Medicare and state licensing disagree on what a change of ownership is. Medicare says a stock transfer is not one; Florida says a transfer of 51% or more of the shares is. The same stock deal can therefore be "no change of ownership" federally and a full change-of-ownership application at the state, with a 60-day lead time. Second, the 36-month rule for home health agencies and hospices covers stock transfers too, so the stock-deal workaround doesn't help there. If you are buying in that space, the home health accreditation data room guide and skilled nursing facility data room guide cover the survey and accreditation files buyers ask for.
Financial services and insurance
| License | Control trigger | Regulator | Clock | Source |
|---|---|---|---|---|
| Bank or savings association (individual or group acquirer) | Acquiring 25%+ of a class of voting securities, or 10%+ where the presumption applies (registered securities, or no larger holder) | Federal Reserve (state member banks and holding companies), OCC (national banks, federal savings associations), FDIC (state nonmember banks) | 60-day prior notice from a complete notice; the Fed may extend by 30 days, and in limited cases by two further 45-day periods | 12 U.S.C. 1817(j); 12 CFR 225.41 and 225.43; 12 CFR 5.50; 12 CFR 303.82 |
| Domestic insurer (Form A) | Acquiring control of the insurer or of any person controlling it; control is presumed at 10% of voting securities | Commissioner of the insurer's domiciliary state | Statement filed and approved before closing; under the NAIC model, a public hearing within 30 days of filing | NAIC Model #440, §§1 and 3 |
| Money transmitter | Acquiring control: power to vote 25%+ of voting interests of the licensee or a person in control of it | State banking regulators, usually through NMLS | Prior written approval; under the model act the regulator approves or denies within 60 days of a complete application, or it is deemed approved. Licenses are not transferable | CSBS MTMA §§2.01, 5.01, 6.01; 31 states had enacted it in whole or in part as of September 2026 |
| Broker-dealer | A change giving one person 25%+ of equity or partnership capital; mergers and certain asset transfers | FINRA | Continuing membership application at least 30 days before the change; the firm may close before FINRA decides, subject to interim restrictions | FINRA Rule 1017 |
The phrase that catches buyers is "or any person controlling." Bank, insurance and money transmitter regimes all look through holding companies. A sale of the parent of a licensed subsidiary therefore needs the same approval as a sale of the subsidiary. Money transmitters add a multi-state problem: a target licensed in 30 states needs approval from each one. The model act lets a state rely on a lead investigative state's review, but whether it does so is that state's choice.
Communications
| License | Trigger | Regulator | Clock | Source |
|---|---|---|---|---|
| Wireless radio licenses | Assignment or transfer of control | FCC (Form 603 in ULS) | Prior consent; non-substantial (pro forma) carrier transfers may notify within 30 days after closing; approved deals must close and be reported within 180 days of public notice of approval | 47 CFR 1.948 |
| Broadcast licenses | Assignment or transfer of control | FCC (Form 2100 Schedule 314 or 315; 316 for pro forma changes) | Prior consent; file at least 45 days before the planned effective date | 47 CFR 73.3540 |
| Domestic Section 214 authority (telecom carriers) | Transfer of control | FCC | Streamlined applications may close on the 31st day after public notice | 47 CFR 63.03 |
Alcohol, environmental and industrial permits
| Permit | Trigger | Regulator | Clock | Source |
|---|---|---|---|---|
| Federal alcohol basic permit (importers, distillers, wholesalers) | Voluntary transfer terminates the permit immediately; acquiring actual or legal control, "directly or indirectly whether by stock ownership or in any other manner", terminates it after 30 days | TTB | Permit continues while a new application filed within the 30 days is pending | 27 CFR 1.44 |
| State alcohol licenses | Varies by state | State ABC board | Varies by state; check each state's rules in week one | State law |
| Title V air operating permit | Change in ownership or operational control | State or local permitting authority (EPA-approved program) | Administrative amendment, if no other change is needed and a written agreement fixing the date of transfer of permit responsibility, coverage and liability is submitted | 40 CFR 70.7(d)(1)(iv) |
| NPDES water discharge permit | Transfer to a new owner or operator | EPA or authorized state | Automatic transfer if the current permittee notifies at least 30 days before, with a written transfer agreement, and the regulator does not object | 40 CFR 122.61(b) |
| RCRA hazardous waste permit | Change in ownership or operational control | EPA or authorized state | Class 1 modification with prior written approval; revised application at least 90 days before; new owner must show financial assurance within six months | 40 CFR 270.40(b) |
The environmental rows share a quiet requirement: a written agreement between seller and buyer fixing the date on which permit responsibility, coverage and liability transfer. That agreement is a regulatory document, not just a contract term. Draft it alongside the SPA, and make sure its date matches the closing mechanics.
Defense, export controls, government contracts and foreign investment
| Regime | Trigger | Regulator | Clock | Source |
|---|---|---|---|---|
| ITAR registration | Change in ownership or control, board, senior officers, or legal structure | State Department, Directorate of Defense Trade Controls (DDTC) | Signed notice within 5 days of the event | 22 CFR 122.4(a) |
| ITAR, foreign acquirer | Intended sale or transfer to a foreign person of ownership or control of the registrant "or any entity thereof" | DDTC | Notice by registered mail at least 60 days in advance | 22 CFR 122.4(b) |
| ITAR licenses and agreements after a merger or acquisition | New entity formed by the deal | DDTC | Must list licenses with unshipped balances to keep (any license not listed "will be considered invalid"); agreement amendments within 60 days | 22 CFR 122.4(c) |
| EAR export licenses | Transfer of a license to another party | Commerce, Bureau of Industry and Security | Prior written approval; BIS approves only one transfer of the same license | 15 CFR 750.10 |
| Federal government contracts | Transfer of all assets, or of the assets used to perform the contract, including by merger | Responsible contracting officer | Novation agreement; not needed for a stock purchase where the contracting entity and its control of the assets don't change. Several agencies, NASA among them, now apply Revolutionary FAR Overhaul class deviations to Part 42, so check the agency's current text | FAR 42.1204; 41 U.S.C. 6305 |
| CFIUS | Foreign investment in a US business; mandatory for certain critical-technology and foreign-government deals | Committee on Foreign Investment in the United States (Treasury chairs) | Mandatory declarations due 30 days before closing; 30-day assessment for declarations; notices get a 45-day review plus a 45-day investigation if needed | 31 CFR 800.401; CFIUS overview |
For a defense target, the ITAR rules and the CFIUS rules together decide the signing-to-closing gap. If any foreign person is acquiring control, the 60-day ITAR notice has to go out at least 60 days before closing, and you can't send it until you know who the buyer is. That makes ITAR a signing-day task. Our ITAR-compliant data room guide covers how to keep USML technical data away from non-US persons in the room while diligence runs.
Where does HSR stand in 2026 after the expanded form was vacated?
HSR filers are back on the pre-February 2025 form. On February 12, 2026 a federal district court vacated the expanded HSR form that took effect on February 10, 2025. On March 19, 2026 the Fifth Circuit denied the FTC's motion for a stay pending appeal. The FTC's Premerger Notification Office now says "the Agencies are now accepting HSR filings using the Form and Instructions that were in place before the February 10, 2025" effective date, and it will still accept the expanded form from filers who choose it (FTC). On May 26, 2026 the Fifth Circuit put the appeal in abeyance while the FTC considers revisions to its reporting requirements. Squire Patton Boggs reads the pre-2025 regime as "likely to remain in place through at least the remainder of 2026" (Squire Patton Boggs). The FTC and DOJ also asked for public comment on HSR reporting in March 2026, so expect a new proposal.
What that means for a $5M to $500M deal:
| HSR item, 2026 | Current figure | Source |
|---|---|---|
| Size-of-transaction threshold | $133.9 million (size-of-person test applies up to $535.5 million) | FTC current thresholds |
| Size-of-person thresholds | $26.8 million and $267.8 million | FTC current thresholds |
| Filing fee, deals under $189.6 million | $35,000 | FTC filing fees |
| Filing fee, $189.6 million to under $586.9 million | $110,000 | FTC filing fees |
| Effective date of 2026 thresholds and fees | February 17, 2026 | FTC |
| Waiting period | 30 days from filing (15 for cash tender offers), unless terminated early | 15 U.S.C. 18a(b) |
The practical change is preparation time. The expanded form added narrative sections, such as a transaction rationale and descriptions of overlaps and supply relationships; the older form asks for less, so most mid-market filings take less work again. The waiting period itself has not changed. Neither has gun-jumping exposure: the buyer still can't take beneficial ownership or operational control before the waiting period ends. Competitively sensitive data should still sit in a clean team data room until then.
What goes on a regulatory due diligence request list?
The buyer's regulatory request list asks for the register, the licenses, the record and the deal-specific approvals, in that order. The register comes first because everything else hangs off it. Here is the list I'd send, with the data room folder each item belongs in.
| # | Request | What the buyer is looking for | Room folder |
|---|---|---|---|
| 1 | Permit and license register: every license, permit, registration, certificate and accreditation, with holder entity, agency, number, issue and expiry dates | Completeness; licenses held in the wrong entity; anything expiring before the outside date | 4.1 Register |
| 2 | Copies of each authorization with all conditions, amendments and riders | Conditions that restrict operations or require consent on transfer | 4.2 Licenses |
| 3 | Renewal applications pending and their status | Lapses during the sign-to-close period | 4.2 Licenses |
| 4 | Map of states and countries where the target operates, sells or has customers vs where it is licensed | Unlicensed activity (money transmission, home health, telehealth, insurance producers) | 4.1 Register |
| 5 | Regulator correspondence for 3 to 5 years, by agency | Open questions, informal warnings, commitments made | 4.3 Correspondence |
| 6 | Inspection, survey and examination reports with responses (CMS surveys, FDA Form 483s, bank exams where shareable, environmental inspections) | Repeat findings; unanswered observations | 4.4 Inspections |
| 7 | Plans of correction and corrective action plans | Obligations that follow the license to the buyer | 4.4 Inspections |
| 8 | Enforcement history: warning letters, notices of violation, consent decrees, corporate integrity agreements, civil money penalties, settlements | Ongoing monitorships and obligations that survive closing | 4.5 Enforcement |
| 9 | Self-disclosures made to any agency, including voluntary disclosures to DDTC or OFAC | Known violations to carve out of the RWI policy and cover by special indemnity | 4.5 Enforcement |
| 10 | Ownership and control filings on record (Medicare enrollment, Form A, NMLS control persons, FCC ownership reports, ITAR statement of registration) | Whether the record matches the real cap table today | 4.6 Ownership filings |
| 11 | Organizational chart showing which entity holds each license | Structure planning: which entity must survive | 4.6 Ownership filings |
| 12 | Foreign ownership and foreign government interests in the cap table | CFIUS and ITAR exposure | 4.6 Ownership filings |
| 13 | Government contracts and subcontracts, with assignment and change-of-control terms | Novation needs; contracts that terminate on change of control | 4.8 Gov contracts |
| 14 | Export classification records (USML categories, ECCNs), licenses and agreements with unshipped balances | Which licenses must be listed after a merger | 4.8 Gov contracts |
| 15 | Environmental permits with transfer provisions and financial assurance instruments | Transfer agreements needed; RCRA financial assurance replacement | 4.2 Licenses |
| 16 | Compliance program documents: policies, training logs, internal audit reports | Program maturity behind the licenses | 4.7 Compliance |
| 17 | Licensed individuals (administrators, pharmacists in charge, qualified individuals, designated officers) and their status | Licenses that depend on a person who may leave | 4.7 Compliance |
| 18 | Draft regulatory approvals list and consent tracker (seller's view) | Seller's own read of the approval path | 4.9 Consent tracker |
Two items do most of the work. The register (1) turns into the Permit Transfer-Trigger Matrix. The consent tracker turns into the closing checklist. Build the tracker as a spreadsheet with one row per filing and these columns: regulator, filing type, trigger, filer, target date for a complete filing, regulator clock, expected decision, matching SPA condition and status. Keep it live in the room so both sides work from one version. The due diligence data room checklist covers the other nine folders of a full room.
How do regulatory findings change the purchase agreement?
Each regulatory finding becomes one of five contract mechanisms: a closing condition, a regulatory efforts covenant, an interim operating covenant, a special indemnity, or an interim services arrangement while consent is pending. The mapping is predictable once the matrix is filled:
| Finding | SPA mechanism | Timeline effect |
|---|---|---|
| Prior regulator consent needed (bank, insurer, money transmitter, FCC, CFIUS, HSR) | Closing condition naming each approval; regulatory efforts covenant setting how hard the buyer must work for it (filing deadlines, what remedies it must accept); outside date set beyond the longest clock | Sign-to-close is at least the longest clock measured from a complete filing, plus time to assemble the filing |
| New application needed (alcohol basic permit, state facility license, money transmitter license in an asset deal, FDA food facility registration) | Condition that the buyer holds the new license at closing, or a restructure into a stock deal | Lead times such as Florida's 60 days before the change of ownership go on the critical path |
| Notice-only item (NPDES 30 days before, ITAR 5 days after, Medicare enrollment within 30 days) | Covenant assigning who files and when; post-closing covenant for filings due after closing | Usually none, unless the notice is due before closing and forgotten |
| Known violation or open enforcement matter | Special indemnity outside the general cap and basket, often with an escrow; pre-closing covenant to cure; price adjustment | Can delay signing while the cure is negotiated |
| Pending inspection, survey or renewal | Interim operating covenants: run the business in the ordinary course, keep licenses in force, give the buyer copies of regulator contact, don't make commitments to a regulator without consent | Adds reporting work for the seller during the sign-to-close period |
Rep and warranty insurance won't absorb most of this. RWI covers unknown breaches, so anything regulatory diligence surfaces is typically excluded. That is why a known violation goes to a special indemnity, not the general reps (how RWI handles known issues).
When consent lags, what keeps the deal alive? Three structures do most of the work:
- Sign and defer closing. This is the default for bank, insurance, money transmitter and FCC deals, since closing before approval is the violation.
- Seller stays the licensee, buyer provides services. A transition services or interim management agreement lets the seller keep operating under its license while the buyer supports the business. Some rules expect this: Florida keeps the seller "responsible and liable for the lawful operation of the provider and the welfare of the clients served until the date the transferee is licensed" (Fla. Stat. 408.807(3)). The risk is that regulators look at substance. A management agreement that hands the buyer real control before consent can itself be the unapproved change of control the rule forbids. Have sector counsel scope what the buyer may decide during the interim.
- Use the built-in bridge where one exists. A federal alcohol basic permit stays in effect after a change in control if the new application is filed within 30 days and is still pending. FINRA lets a broker-dealer close before its continuing membership application is decided. These bridges are narrow and regime-specific. Don't assume one exists without a cite.
What are the red flags in regulatory due diligence?
The red flags that matter most are the ones that change structure, timing or price: a license that dies on the chosen structure, a compliance problem that follows the license to the buyer, and unlicensed activity the seller didn't map. The table lists them roughly in the order a buyer should check them.
| Red flag | Why it matters | What to do |
|---|---|---|
| Home health agency or hospice inside its 36-month window | Medicare billing privileges do not convey, even in a stock deal (42 CFR 424.550(b)) | Check enrollment and last majority-change dates on day one; test the exceptions; re-price or re-time |
| Expired, lapsed or soon-to-expire permits | The business may be operating unlawfully today, or may lose a license during the sign-to-close period | Pre-closing covenant to renew; closing condition; special indemnity for the lapse period |
| Open FDA warning letters, Form 483 observations, CMS survey deficiencies | An assigned Medicare agreement carries "any existing plan of correction" (42 CFR 489.18(d)) | Read the responses, not just the findings; tie the cure to a covenant and indemnity |
| Consent decrees, corporate integrity agreements, monitorships | Obligations that bind the entity after closing | Price the compliance cost; confirm how successor obligations work in the document itself |
| Operating in states or countries where the target is not licensed | Unlicensed money transmission or care delivery is an enforcement matter, and a license can't be acquired retroactively | Map operations against the register; budget new applications; special indemnity for the past |
| Conditional or restricted licenses | In Florida, any restriction or conditional license in force at a change of ownership "shall remain in effect" until the agency decides it is corrected (Fla. Stat. 408.807(4)) | Treat as a cost to cure, not a paperwork item |
| Foreign owners, directly or via funds, in the cap table | Pulls in CFIUS declarations and the ITAR 60-day advance notice | Run the ownership chain early; filing-date covenants |
| ITAR licenses with unshipped balances not listed after a merger | Unlisted licenses "will be considered invalid" (22 CFR 122.4(c)) | Make the license list a closing deliverable |
| RCRA financial assurance in the seller's name | The seller stays on the hook until the buyer shows compliance, which it must do within six months (40 CFR 270.40(b)) | Line up replacement instruments before closing |
| Licensed individuals who are leaving | Some licenses depend on a named qualified person or administrator | Retention agreements; a successor named before closing |
| A seller that can't produce a permit register | Signals that nobody owns regulatory compliance | Expect more findings, and slow the timeline accordingly |
For the non-regulatory red flags (financial, legal, commercial), see due diligence red flags.
What does regulatory due diligence cost, and how long does it take?
Regulatory due diligence costs whatever the regulator count times the license count takes in specialist counsel hours, plus fixed government fees. It takes as long as the longest approval clock measured from a complete filing. I have not found a published, sourced benchmark for regulatory due diligence fees on their own. Anyone quoting a single number is guessing. The honest way to budget is to build it up from parts.
| Cost component | What drives it | 2026 reference point |
|---|---|---|
| Sector regulatory counsel | Number of regulators and licenses; number of states; whether a consent filing must be prepared | Average partner billing rates rose 5.6% and associate rates 7.9% for work from January to July 2026, vs the same period in 2025 (LexisNexis CounselLink, September 2026) |
| HSR filing fee | Size of transaction | $35,000 under $189.6 million; $110,000 from $189.6 million to under $586.9 million (FTC) |
| CFIUS notice fee | Transaction value | No fee under $500,000; $750 from $500,000; $7,500 from $5 million; $75,000 from $50 million; $150,000 from $250 million; $300,000 from $750 million (31 CFR 800.1101) |
| State change-of-control and licensing fees | Number of states and license types | Set state by state; the CSBS model act leaves the money transmitter fee to each state |
| Environmental and technical consultants | Number of permitted sites | Scoped per site; see environmental due diligence |
| Data room | Admins on the deal team, not viewers | Peony Data Room plan, $52 per admin per month billed yearly; viewers free |
For context on the whole diligence budget, our due diligence cost breakdown puts legal review on multi-jurisdictional or heavily regulated targets in the mid to high five figures. Regulatory review is usually a separate line on top of that when a consent filing is needed. Two levers bring the number down. The first is a seller-prepared permit register, which cuts counsel's inventory time. The second is scoping counsel to the matrix's consent and new-application columns instead of a full compliance audit of every license.
Timeline. Read the regulatory clocks against the overall deal calendar. Across 733 M&A transactions from $1M to $500M on Peony, average time to close was about 7.9 months (State of M&A Data Rooms, Q3 2026 edition). Most regulatory clocks fit inside that, if the filings go in early and complete:
| Approval | Minimum lead time or clock |
|---|---|
| HSR | 30-day waiting period |
| Domestic Section 214 (streamlined) | 31st day after public notice |
| FINRA continuing membership application | File 30 days before; may close before decision |
| CFIUS declaration / notice | 30-day assessment / 45-day review plus 45-day investigation |
| Bank change in control | 60 days from a complete notice, plus possible 30- and 45-day extensions |
| Money transmitter (model act) | 60 days from a complete application, per state |
| ITAR, foreign acquirer | 60 days' advance notice |
| Florida health-facility change of ownership | Application 60 days before; decision within 60 days of a complete application |
| RCRA permit transfer | Revised application 90 days before |
| Home health or hospice inside 36 months | New enrollment plus survey or accreditation: the longest path, with no rule-based clock |
The word that matters in that table is "complete." The Fed's clock "begins on the date of receipt of a complete notice." The money transmitter model act's clock starts on the date the regulator says the application is complete. Background checks, fingerprints and biographical affidavits for every control person are what usually keep a filing incomplete. Start them the week the LOI is signed. The due diligence timeline shows where these filings sit on the critical path.
How should you set up the data room for regulatory due diligence?
Run regulatory due diligence in a data room that puts the permit register, regulator correspondence and consent tracker in their own numbered folders, limits regulator-sensitive files to named counsel groups, watermarks every page, gates entry behind a signed NDA, and records which pages each reviewer actually read. In Peony, that is the Data Room plan at $52 per admin per month billed yearly, with viewers free. The last point matters more here than in any other workstream. When a buyer later says it didn't know about a warning letter, the room's record of who opened which page, and when, settles it.
This is how I set it up in Peony. Peony is used by 8,000+ customers in 60+ countries and trusted by 250+ M&A advisors, including Jefferies and Bank of America.
| Regulatory DD job | How Peony handles it | Plan |
|---|---|---|
| Permit and license register, correspondence and consent tracker in their own folders | AI room generation drafts the folder structure; Index documents numbers every folder and file (4.1, 4.2...) so both sides can refer to a document by number | Data Room |
| Regulator-sensitive files (enforcement, self-disclosures, exam reports, export-controlled data) seen only by named counsel | Visitor groups with group permissions and file-level view, download or no-access settings | Data Room |
| Deterrence on every page | Dynamic watermarks stamped with each viewer's identity | Data Room |
| No access without a signed confidentiality agreement | Advanced NDA: viewers sign, both parties get the signed PDF, with an audit trail of timestamp, IP and identity | Data Room |
| Proof of what buyer's regulatory counsel actually read | Page-level analytics per viewer, per page | All plans |
| Audit trail behind the disclosure schedule | Audit trail of actions in the room; Upload new version replaces a file in place while keeping every earlier version one click away | Data Room |
| Regulator request waves and follow-ups | Basic Q&A on Data Room; the advanced Q&A module with assignments and deadlines on Deal Team | Data Room / Deal Team |
| Personal data in survey files, patient records or KYC files | Advanced redaction | Deal Team |
| Pulling access when a bidder drops out | Remote access revocation | Business and above |
| Closing binder | Data room archive download: freeze the room at a point in time into a verifiable archive | Deal Team |
Pricing is per admin, billed yearly. Business is $30 (3 rooms per admin, simple NDA, screenshot protection). Data Room is $52 (unlimited rooms and storage, signed NDA, dynamic watermarks, group permissions, audit trail, basic Q&A). Deal Team is $64 with a minimum of 4 admins (advanced Q&A, advanced redaction, archive download). Viewers are unlimited and free on every plan, which matters in regulatory diligence: buyer counsel, sector specialists, lenders' counsel and the R&W underwriter all need access. Peony staff can't open, move or edit the documents in your room. Peony is SOC 2 Type II-ready and ISO 27001-ready, with both audits underway.
Where Peony is not the right call. Deals above $500M, or deals where the counterparty or its bank mandates Datasite or Intralinks, should run in the room the other side requires. Two more limits apply here. Peony signs a HIPAA Business Associate Agreement on request on the Enterprise plan only, so a room holding PHI needs that plan or a de-identified file set. And Peony enforces your export-control access decisions but does not make them: who counts as a US person, and how an item is classified, are calls for your export counsel.
Start now with a 7-day Data Room trial you start yourself: no credit card, and it never auto-charges.
What changes outside the US?
Cross-border deals add foreign-investment and subsidy filings that work like US approvals: mandatory, suspensory, and on their own clocks. Two regimes come up most often for US buyers of UK or EU businesses:
- UK National Security and Investment Act. An acquisition of control of an entity active in any of 17 sensitive areas of the UK economy needs government approval before closing. Completing a notifiable acquisition without approval makes it void, and penalties reach "up to 5% of your organisation's global turnover or £10 million, whichever is greater". Review runs up to 30 working days, and a call-in assessment can be extended by a further 45 working days (GOV.UK guidance, updated July 15, 2026). On March 12, 2026 the government confirmed it will bring water companies into the mandatory regime and give critical minerals and semiconductors their own categories. "The current rules remain in force until secondary legislation" comes into force (GOV.UK).
- EU Foreign Subsidies Regulation. A concentration must be notified to the European Commission when the target, a merging party or the joint venture has EU turnover of at least €500 million and the parties received more than €50 million in foreign financial contributions over the last three years. "Pending the Commission's review, the concentration in question cannot be completed" (European Commission).
Most $5M to $500M targets fall below the FSR turnover threshold. The NSIA has no turnover floor, so a small UK defense, AI or data-infrastructure target can still trigger it. Our cross-border M&A guide covers the rest of the international layer.
FAQ
What is regulatory due diligence in M&A?
Regulatory due diligence is the buyer's review of every license, permit, registration and government approval a target needs to operate, plus its record with the agencies that issued them. It answers three deal questions: which authorizations survive the chosen deal structure, which need a regulator's consent or notice, and which must be applied for from scratch. Its output sets the closing conditions, the outside date and any special indemnities, which is why it runs alongside legal due diligence rather than inside it.
How is regulatory due diligence different from legal due diligence?
Legal due diligence reviews the target's contracts, corporate records, litigation and IP. Regulatory due diligence reviews its relationship with government: what it is licensed to do, whether it complies, and what each regulator must approve for the deal to close. Legal findings are mostly priced or negotiated with the seller. Regulatory findings run on the regulator's calendar, such as the 60-day Change in Bank Control Act notice period or the 30-day clock on a federal alcohol permit, so they set the timeline as well as the price.
Do business licenses and permits transfer when a company is acquired?
It depends on the deal structure and the regime. In a stock purchase the licensed entity survives, so many authorizations stay in place, but control-based regimes still apply: a federal alcohol basic permit terminates 30 days after someone acquires control unless a new application is filed (27 CFR 1.44), and banks, insurers and money transmitters need prior regulator approval. In an asset purchase most licenses stay with the seller, so the buyer needs consents, transfers or new applications, such as a novation for federal contracts or a new FDA food facility registration.
Is a stock purchase or an asset purchase better for keeping licenses and permits?
A stock purchase usually keeps more licenses in place, because the license holder does not change. Medicare does not treat a transfer of corporate stock as a change of ownership (42 CFR 489.18), and FAR 42.1204(b) says no novation is needed for a pure stock purchase. It is not a free pass: Florida's health-facility law treats a transfer of 51 percent or more of the shares as a change of ownership, and a home health agency or hospice loses its Medicare billing privileges on a majority stock sale within 36 months of enrollment or its last majority change. Run each license through the Permit Transfer-Trigger Matrix before choosing.
I'm buying a home health agency: does the Medicare provider agreement transfer, and what is the 36-month rule?
Usually the provider agreement is assigned automatically to the new owner on a change of ownership under 42 CFR 489.18, and a stock purchase is not a change of ownership at all. The exception is the 36-month rule in 42 CFR 424.550(b)(1): if majority ownership of a home health agency or hospice changes, including by stock transfer or merger, within 36 months of its initial enrollment or its last majority change, the provider agreement and billing privileges do not convey. The buyer must enroll as a new provider and obtain a state survey or accreditation, unless an exception applies, such as two consecutive years of full cost reports.
How long does change-of-control approval take for a bank, insurer or money transmitter?
The rule clocks are the floor, not the forecast. A Change in Bank Control Act notice gives the Federal Reserve 60 days from a complete notice, extendable by 30 days and, in limited cases, by two further 45-day periods (12 CFR 225.43). Under the NAIC model holding company act, the Form A public hearing is held within 30 days of filing, and states vary from there. Under the CSBS money transmission model act, enacted in whole or in part by 31 states as of September 2026, the regulator decides within 60 days of a complete application. Every clock starts only when the filing is complete, so start biographical affidavits and background checks in week one.
Which HSR form do I file in 2026 after the expanded form was vacated?
File the older, pre-February 2025 form. A federal court in Texas vacated the expanded HSR rule on February 12, 2026; the Fifth Circuit denied the FTC a stay on March 19, 2026; and the FTC now accepts filings on the form and instructions in place before February 10, 2025, while still accepting the expanded form from filers who choose it. The appeal was put in abeyance on May 26, 2026 while the FTC considers new rulemaking. The 2026 size-of-transaction threshold is $133.9 million and the filing fee starts at $35,000.
What should a regulatory due diligence checklist include?
At minimum: a register of every license, permit, registration and certificate with its holder entity, issuing agency, number, expiry and transfer terms; the conditions attached to each; three to five years of regulator correspondence, inspections, surveys and audits; enforcement actions, consent decrees, warning letters and plans of correction; ownership filings already on record; government contracts with their novation terms; and a map of where the target operates against where it is licensed. In Peony, Index documents numbers every folder and file, so buyer counsel can ask for 4.2 instead of hunting for the right permit.
What are the biggest red flags in regulatory due diligence?
The ones that change structure or timing: an operating license that lapses or terminates on the chosen structure; a home health agency or hospice inside its 36-month window; open FDA warning letters, Form 483 observations or survey deficiencies, because an assigned Medicare agreement carries any existing plan of correction; consent decrees or corporate integrity agreements; operating in states where the target is not licensed, common in money transmission and home health; foreign owners in the cap table that pull in CFIUS or ITAR notices; and conditional licenses, which in Florida stay in force through a change of ownership.
Can we close before the regulator approves the change of ownership?
Only where the regime allows it. FINRA lets a broker-dealer close before its continuing membership application is decided, subject to interim restrictions, and a federal alcohol basic permit stays in effect if the new application is filed within 30 days of the change in control. Banks, insurers, money transmitters and FCC licensees need approval first, and HSR and mandatory CFIUS filings bar closing until the waiting period ends. Where consent lags, deal teams sign and defer closing, or use an interim management or transition services agreement that regulatory counsel scopes so it does not hand over control early.
What does regulatory due diligence cost for a US acquisition?
There is no published benchmark for regulatory due diligence alone, so budget it from three parts. Counsel hours scale with the number of regulators and licenses, at rates that rose 5.6 percent for partners from January to July 2026, according to LexisNexis CounselLink. Government fees include the $35,000 HSR fee for deals from $133.9 million to under $189.6 million, and CFIUS notice fees from $750 to $300,000. Then the data room: Peony's Data Room plan, with signed NDAs, dynamic watermarks, group permissions and an audit trail, costs $52 per admin per month billed yearly, and viewers are free.
What data room should I use for regulatory due diligence on a $5M to $500M deal?
Use a room that can separate regulator-sensitive files by group, stamp every page, gate entry behind a signed NDA and log every view. Peony's Data Room plan, at $52 per admin per month billed yearly, covers group and file-level permissions, dynamic watermarks, a signed NDA with audit trail, page-level analytics and basic Q&A, with unlimited free viewers. Deal Team, at $64 with a minimum of 4 admins, adds advanced redaction and the advanced Q&A module. Peony is used by 8,000+ customers in 60+ countries. Above $500M, or where a counterparty mandates Datasite or Intralinks, use the enterprise room.
Related Resources
- Legal Due Diligence: the contract, corporate and litigation workstream that runs beside regulatory review
- Environmental Due Diligence: contamination, compliance and the permits that sit in both workstreams
- Healthcare Due Diligence: billing, coding and fraud-and-abuse review for healthcare targets
- Due Diligence Cost Breakdown: what each diligence workstream costs by deal size
- Due Diligence Timeline: the critical path from LOI to close, including HSR and consents
- Due Diligence Data Room Checklist: the full folder-by-folder document list
- M&A Due Diligence Process Guide: the six phases of diligence and who runs each
- ITAR-Compliant Data Room: keeping export-controlled data away from non-US persons during diligence
- Rep and Warranty Insurance: why known regulatory issues go to special indemnities
- State of M&A Data Rooms: our dataset of 733 M&A transactions from $1M to $500M
You might also like
Sep 3, 2026
What Is a Virtual Data Room? The Complete VDR Guide (2026)
Aug 18, 2026
Legal Due Diligence (2026): The Change-of-Control Consent Map + 9-Workstream Checklist
May 30, 2026
M&A Advisor Fees: What They Charge on $5M to $100M Deals (2026)