A target can show fast revenue growth, a recognised brand and an attractive licence portfolio, yet still be a poor acquisition. In regulated digital businesses, acquisition due diligence red flags rarely sit in one document. They tend to emerge in the gap between what the seller represents, what regulators permit, what banks and payment providers will support, and what the operating structure can actually sustain after completion.
For a buyer of a gaming operator, crypto business, payments company or international media asset, diligence is not a box-ticking exercise before signing. It is the process that determines whether the acquired business can keep trading, retain its licences, protect customer funds, move money efficiently and expand into the markets that underpin the investment case.
Why acquisition due diligence red flags carry greater weight in regulated sectors
In many transactions, an unresolved contractual dispute or incomplete HR file can be priced into the deal. In a regulated sector, the same approach can be dangerously simplistic. A change of control may require prior approval, notification or a fresh assessment of beneficial owners and senior management. A payment provider can reassess its risk appetite. A key licence may not cover the product, geography or marketing model that generated the target’s reported revenue.
The commercial question is therefore not simply whether a risk exists. It is whether it can be cured, how long the cure will take, who bears the cost, and whether the business can operate lawfully while it is being resolved. A discounted valuation is not protection if the issue causes a suspension, freezes settlement flows or prevents a planned launch.
Regulatory authority that does not match the operation
The most serious red flag is often an apparent licence that offers less protection than the buyer assumes. Sellers may describe their authorisation in broad commercial language, while the underlying permission is limited by activity, territory, entity, product type or customer class.
A gaming licence, for example, may belong to a different group entity than the one signing supplier contracts or collecting player funds. A CASP authorisation may not support every service promoted by the business. A payment arrangement may rely on an agent, programme manager or third-party principal whose agreement is terminable on change of control.
Review the licence itself, its conditions, the regulator’s correspondence, renewal history, inspection findings and all notifications made or still required. Confirm whether the intended acquisition structure triggers a change-of-control approval and whether the buyer’s shareholders, directors and source of wealth can satisfy the relevant fit-and-proper review. Timing matters. A deal that completes before approval may create a regulatory breach even if approval is later granted.
The difference between a licence and a licensing strategy
A licence is an asset only when it supports the target’s actual operating model. Buyers should test how customer onboarding, payments, marketing, outsourcing, record keeping and complaints handling work in practice. If revenue is US-facing, cross-border or generated through affiliates, this analysis becomes even more exacting.
The right answer may be to acquire the brand, technology or customer-facing assets while leaving a problematic entity outside the perimeter. In other cases, the licence and its operating history are central to the value. The transaction structure should follow that reality, not a generic share-purchase template.
Payment rails built on fragile relationships
Revenue on a management account is not the same as dependable cash access. Payment providers, acquiring banks, correspondent banks and crypto liquidity partners assess regulated and high-risk businesses continually. They may view new ownership, altered transaction volumes, new jurisdictions or adverse compliance findings as grounds for enhanced review or termination.
Ask who holds the merchant accounts, safeguarding accounts, wallets and settlement reserves. Establish which entity contracts with each provider, whether any reserve is rolling or fixed, and whether balances are subject to security interests, set-off rights or delayed release. A business can look profitable while a material part of its cash is inaccessible for months.
Particular care is needed where the target depends on a single acquirer, a personal relationship with a payment intermediary or payment flows that are not accurately reflected in its written policies. Obtain evidence of approval for the actual business model, including the products, markets and traffic sources involved. A provider that accepted the business during a limited pilot may not support post-acquisition scale.
Compliance policies that look better than the evidence
Well-written AML, safer gambling, sanctions, data protection and customer due diligence policies have little value if the operating evidence tells a different story. A common red flag is a compliance framework adopted for an application or audit, then applied inconsistently as commercial pressure increased.
Test a meaningful sample of customer files, transaction alerts, enhanced due diligence cases, suspicious activity reports, source-of-funds checks, self-exclusion records and complaints. Compare the timestamps and decisions with the policy requirements. Review exception logs and escalations, not only closed cases selected by management. Repeated manual overrides, late reviews or unexplained dormant alerts can indicate that the compliance function lacks independence, resources or authority.
Data protection deserves the same scrutiny. Confirm where personal data is hosted, who can access it, whether processing agreements exist and whether historic breaches were notified correctly. In a consumer business, weak data governance can damage both regulatory standing and the value of the customer database the buyer expected to acquire.
Group structures that obscure ownership, tax or control
International structures can be commercially sensible. A holding company, IP company, operating entity and regulated subsidiary may each have a legitimate role. The concern arises when the structure was built without clear substance, agreements or tax rationale, or when beneficial ownership and decision-making are difficult to establish.
Map every entity, director, shareholder, nominee, bank account, intercompany loan, IP assignment and material service agreement. Reconcile that map against corporate registers, regulatory filings, tax returns and financial statements. Gaps between the legal chart and the commercial reality deserve immediate attention.
Buyers should also identify undeclared permanent-establishment exposure, withholding tax leakage, transfer-pricing weaknesses and historic VAT liabilities. The cost is not limited to an eventual tax assessment. A disorderly structure can complicate licence applications, banking onboarding and post-completion dividend or financing plans.
Revenue quality, affiliates and unverifiable growth
High headline revenue may conceal customer concentration, bonus abuse, chargebacks, related-party traffic or marketing practices that a buyer cannot safely continue. This is especially relevant in online betting, casino, fintech and crypto businesses where affiliates and introducers can generate volume quickly but create substantial conduct and compliance exposure.
Analyse revenue by geography, product, payment method, customer cohort and affiliate. Then test whether each source is permitted under the relevant licences and payment-provider terms. Review affiliate agreements, sub-affiliate arrangements, tracking permissions and historic promotional materials. If the target cannot identify who generated traffic or what claims were made to customers, it may inherit regulatory and reputational risk alongside its revenue.
Forecasts should be rebuilt using retention, margin, acquisition cost, chargeback and regulatory assumptions that the buyer can verify. A lower but sustainable earnings figure is more useful than an ambitious multiple applied to revenue that disappears after a compliance clean-up.
Technology, IP and outsourced dependencies
A platform is not necessarily owned by the company that markets it. Critical code may sit with a founder, development contractor or related entity. The target may rely on a white-label supplier whose contract restricts assignment, imposes minimum volumes or permits termination after change of control.
Confirm ownership and assignment of source code, domains, trademarks, data, algorithms and content. Assess cyber-security controls, incident history, disaster recovery and access management. Where outsourcing is material, review service levels, audit rights, subcontracting, data location and exit assistance. The buyer needs more than a promise that the system works. It needs the legal right and operational capability to keep it working.
Turn findings into transaction protection
Not every red flag should end a deal. Some can be resolved through a pre-completion remediation plan, regulatory approval condition, specific indemnity, escrow, retention payment or revised purchase-price mechanism. The key is to match the protection to the risk. A general warranty is rarely sufficient for a known licensing gap, tax exposure or threatened payment relationship.
Bring regulatory, legal, tax, finance and operational specialists into one diligence workstream early. Their findings should shape the acquisition perimeter, completion timetable, governance model and post-completion plan together. This is where a strategic adviser can protect value: not by producing a longer issues list, but by helping the buyer acquire an operation that can remain compliant while it grows.
The strongest buyers treat diligence as the first stage of integration. When the structure, licences, payment rails and control environment are clear before completion, the acquired business has a far better chance of becoming the expansion platform the investment was meant to create.