Fintech software company due diligence

Diligence on a fintech software company is verification work. By this stage the buyer may already have a price and a letter of intent, and has to confirm that the permission, the records, the code and the contracts behind that price are real. The software can be tested directly; the harder parts may sit with regulators, counterparties and records of ordinary days years ago. This guide organizes the work by what is being verified and ends with the findings that can end a deal and what each one means. It is a framework for the buyer’s advisors, not a substitute for them.

The regulatory file

Ask for the company’s registration confirmation, every piece of correspondence with FINTRAC, and a written description of each service the company provides, mapped to the registration that covers it. Test that map against the product itself: FINTRAC treats payment services for goods and services, invoice payment services and virtual currency exchange or transfer as money services. If the company uses agents or mandataries, ask for the eligibility verifications and criminal record checks FINTRAC’s guidance requires for them, with dates. Ask whether any filing is pending, since the guidance treats registering, updating registration information and renewing as separate steps. If the seller says nothing changes on a sale, ask for that in writing from the company’s counsel rather than accepting it as an assumption.

The compliance program and its evidence

FINTRAC lists the elements a compliance program must have: a compliance officer, policies and procedures, a risk assessment, a training program and an effectiveness review carried out at least every two years by an internal or external auditor. Request each element, then test whether the evidence matches. Read the latest review and whether its findings were closed. Sample customer files to confirm that identity verification and beneficial ownership information were obtained as the policies say, and ask how the company evidences the reports FINTRAC describes: suspicious transaction, listed person or entity property, large cash transaction, large virtual currency transaction and electronic funds transfer reports. What may be shown in a data room about those reports is a question for counsel to settle before anyone asks the seller to produce them. Missing records are the finding; policies on their own do not substitute.

Privacy and breach records

The Privacy Commissioner says PIPEDA requires organizations to report breaches of security safeguards that pose a real risk of significant harm, notify affected individuals and keep records of all breaches, and that the Commissioner can ask for those records. Ask for the breach log and compare it against incident tickets, security-vendor reports and customer complaints; an empty log in a company that handles financial data deserves a question. Ask who holds customer data, where, and under which sub-processor contracts. For Quebec customers, the Commission d’accès à l’information describes a privacy impact assessment before personal information goes outside Quebec, so ask for the assessments and the written agreements behind any such transfer. Our answer on liability for past security breaches covers how deal structure affects who carries the past.

Code, credits and who owns what

Ask for a list of everyone who has written part of the product, with the agreement under which each did so. The Copyright Act makes the author the first owner, gives an employer first ownership of work made in the course of employment under a contract of service absent an agreement to the contrary, and treats an assignment as valid only if in writing and signed by the owner or the owner’s duly authorized agent. A contractor with no signed assignment is a gap to close before completion, and the Canadian Intellectual Property Office notes that assignments can be registered. Ask for filed SR&ED claims, the technical support behind them and any CRA correspondence, since the CRA describes a review process for claims; do SR&ED credits survive a change of control? covers what a sale does to them.

Partner and customer contracts

Read the sponsor-bank, processor, network and large-client agreements for provisions on assignment, change of control, termination and review of the new owner, and for minimum volumes or exclusivities that bind the business. Establish who must consent and how long the counterparty takes to decide. A termination right triggered by a change of control is a fact that bears on price.

Five findings can end a deal or reshape it, and each means something different:

• A service outside the registration. The company may have performed a regulated activity without the cover it needed; counsel characterizes the history and the buyer decides whether it is a price issue or a reason to stop.
• No effectiveness review, or one whose findings were never closed. The program has not had the review FINTRAC requires, so the buyer may be paying for its first one.
• Gaps in identity or beneficial-ownership records. The company cannot prove compliance for those customers, and FINTRAC can issue administrative monetary penalties; in a share purchase that exposure would stay with the company the buyer now owns.
• No breach record, or one that contradicts incident reports. Either controls are weak or the record was reconstructed, and either may affect trust in the rest of the file.
• Core code with no signed assignment. Ownership is uncertain until the author signs, so the signature belongs among the conditions to closing.