Buying a fintech software company in Canada

A buyer of a fintech software company can agree a price and then learn that the buyer is not permitted to run what was bought. Registration duties, partner approvals and privacy obligations may attach to who operates the business, so the evaluation starts with the buyer as much as the target. This guide sets out how to tell a sound acquisition from a fragile one, what a seller may not raise unprompted and what a buyer has to qualify for personally. It is a way of framing the decision, not a view on any particular purchase, and a lawyer who handles financial-services regulation should read the specifics.

Qualify the buyer before the business

FINTRAC says a money services business must register before it begins to operate, and that a provincial licence does not substitute. Whether the target needs that registration at all depends on what the product does, which what a fintech software company is worth walks through. If it does, ask how your structure interacts with it. In a share purchase the company stays the registered business while its ownership changes, so ask the seller and counsel what FINTRAC expects to be updated and when; FINTRAC’s guidance treats registering, updating registration information and renewing as separate steps. In an asset purchase your own entity is the one that will operate, so it has to be registered before it does. FINTRAC also says certain persons or entities are not eligible to register, so read its guidance on who is not eligible and apply it to the buying entity and the people behind it. A buyer that already holds a registration and a working compliance function is in a different position from a first-time buyer building both.

Foreign buyers face another layer

The government says the Investment Canada Act applies to non-Canadians who acquire control of an existing Canadian business or who wish to establish a new one, and that they must submit either a notification or an application for review of the investment unless a specific exemption applies; it also says the Act allows it to review foreign investments of any size on national security grounds. Its stated concern includes foreign actors gaining ownership or control of sensitive Canadian technology or personal data for purposes that could be injurious to national security, and a fintech company may hold both. A buyer from outside Canada should ask counsel early which route applies.

A sound company and a fragile one

The difference can show in whose name things are held and what happens if one person leaves. Signs of a sound business:

• Registration, bank relationships and key contracts held in the company’s name, with more than one person able to explain them.
• Revenue spread across several institutional clients and more than one payments or banking partner, so one counterparty’s decision cannot end the business.
• A compliance function with a named officer, written policies and a completed effectiveness review, rather than a founder’s memory.
• A product whose features match the activities the company is registered for, with no recent additions that touch payments or virtual currency.
• Code that employees wrote under employment terms or contractors assigned in writing.

What the seller may not volunteer

Ask directly for correspondence with FINTRAC, including any request for clarification, examination findings or penalties, since FINTRAC has the authority to issue administrative monetary penalties. Ask when each product feature was added and whether the registration and compliance program were updated to match, because payment services and virtual currency transfers are among the activities FINTRAC treats as money services. Ask for the record of every privacy breach, which PIPEDA requires organizations to keep whether or not a breach had to be reported. Ask which customers are in Quebec, because the Commission d’accès à l’information describes duties there that include publishing the title and contact details of the person responsible for personal information and notifying the Commission and affected individuals of confidentiality incidents that present a risk of serious harm. And ask how much of the product depends on one sponsor bank or processor.

Privacy duties arrive with the customer files

PIPEDA’s provision for a completed business transaction lets the parties use and disclose the personal information disclosed during the deal without the individual’s knowledge or consent, if conditions are met. They must have an agreement requiring each to use and disclose it solely for the purposes for which it was collected, permitted to be used or disclosed before the transaction was completed, to protect it by security safeguards appropriate to its sensitivity, and to give effect to any withdrawal of consent. The information must be necessary for carrying on the business or activity that was the object of the transaction, and one of the parties must notify the individuals, within a reasonable time after the transaction is completed, that it has been completed and their information disclosed. A buyer should plan that notice before closing. Am I liable for past security breaches when buying a tech company? explains how the structure of the deal affects who carries past exposure.