Changes Of Control: A Recurring Gap In Fitness & Propriety Due Diligence

Change of control transactions involving Isle of Man regulated entities continue to expose a recurring (and avoidable) risk. Namely, a failure to carry out, and evidence, due diligence on incoming controllers.

This brief note explains the regulatory position and considers why some firms overlook this requirement, before suggesting certain simple practical steps for boards and heads of compliance.

The regulatory position

The Isle of Man Financial Services Authority’s (FSA) fitness and propriety guidance indicates that individuals who are controllers will generally need to meet the same fit and proper standards as individuals in other controlled functions. Controllers that are corporate entities also have to be fit and proper.

The guidance separately indicates that, although the FSA will undertake its own consideration of incoming controllers, including communication with other regulators where relevant, regulated entities must conduct their own due diligence on incoming controllers and be fully satisfied that they are fit and proper occupants of that role before a change of control takes place.

Regulatory focus and risk

The guidance indicates that the FSA does not typically require evidence of the due diligence that a regulated entity carries out on incoming controllers. However, the FSA has recently been more active in asking for such evidence. As well as delaying transaction execution, an inability to produce such evidence promptly upon request can create regulatory risk and heightened scrutiny of governance, as well as potential reputational or enforcement consequences.

Why this is being missed in practice

Corporate acquisitions are typically driven by the seller and buyer. Due diligence is often undertaken by the buyer, and once the deal has been signed there is often intense pressure to submit the regulatory applications (often due to timetables that are agreed to in the transaction documents, which the Isle of Man regulated entities typically have little or no input into).

In addition, unlike the fitness and propriety form for other controlled functions, the change of control forms do not require the regulated entity to declare that it has completed its own due diligence. This can lead to oversights or a mistaken assumption that the forms themselves are sufficient.

The FSA’s expectation

As soon as possible after learning of a change of control transaction, regulated entities should request detailed information to satisfy themselves that the incoming controllers meet the various components of the fitness and propriety test. It is not sufficient to rely on group-level diligence or to wait and see if the FSA asks to see evidence of the firm’s due diligence.

What firms should do

• Check procedures – make sure internal controls and processes will not allow this to be overlooked.
• Start early – start due diligence as soon as a potential change of control is identified.
• Own the assessment – local board or compliance function must perform an independent fitness and propriety review.
• Document the process – maintain a clear audit trail of information obtained and conclusions reached.
• Be ready to evidence – assume the FSA may request this information.

If a firm is unsure of the precise requirements, Appleby can explain these in detail.

Originally published 17th June 2026.