Compliance-First M&A: How Regulated Industries Do Discovery Differently

In a normal M&A integration, discovery answers the question: what are we inheriting?

In a regulated industry integration, discovery also answers: what are we allowed to do with it, and in what sequence?

The sequencing matters. You can’t migrate EU personal data to a non-EU data centre before you’ve completed a transfer impact assessment. You can’t consolidate two FCA-regulated entities onto the same trading platform before you’ve reviewed the information barrier implications. You can’t move a regulated workload to shared infrastructure before you’ve confirmed the regulatory classification permits it.

Discovery in regulated M&A isn’t just about completeness. It’s about constraint identification. Here’s how it works.

The Regulatory Discovery Baseline

What every regulated acquisition needs to find

1. Personal data inventory

For every system that touches personal data:

• What categories of personal data does this system hold? (names, financial data, health data, special category data)
• Where does the data live geographically? (which datacenter, which cloud region)
• Who has access to this data? (role-based, individual, emergency access)
• What is the legal basis for processing? (contract, legitimate interest, consent)
• What are the retention requirements? (how long must this data be kept, and by whom)

2. Cross-border data transfer mechanisms

If personal data moves between jurisdictions:

• What is the destination jurisdiction?
• Is the destination jurisdiction deemed adequate by the source regulator?
• If not adequate: what transfer mechanism is in place? (SCCs, BCRs, binding corporate rules)
• Has the transfer impact assessment been completed?

3. Regulatory permissions and licenses

• What regulated activities does the target hold licenses for?
• Which regulators oversee those activities?
• What are the license conditions that affect IT integration? ( segregation requirements, reporting obligations, audit requirements)
• What happens to those licenses if the integration changes the regulated entity’s structure?

4. Information barrier and Chinese wall requirements

• Are there information barriers between business units within the target?
• Are there regulatory requirements that prevent certain data from being consolidated?
• Do any M&A activities (due diligence, integration planning) require specific clean team protocols?

GDPR in M&A: The Specific Requirements

Article 28 Processor Requirements

If the target uses data processors (SaaS vendors, cloud providers, managed service providers), each processor relationship needs to be documented. Post-acquisition, those processor agreements may need to be reassigned, renegotiated, or terminated.

Discovery question: For every processor that handles personal data, what is the current agreement status, and what is the notice and consent mechanism?

Article 30 Records of Processing

The target must maintain records of processing activities. Post-acquisition, those records need to be integrated into the acquirer’s records. If the target doesn’t have Article 30 records, that’s a compliance gap that predates the acquisition.

Discovery question: Do Article 30 records exist? Are they current? Do they reflect the actual processing, or are they aspirational documentation?

Transfer Impact Assessment

Post-Schrems II, every transfer of EU personal data to a non-EU country requires a transfer impact assessment (TIA). In M&A, this applies both to the due diligence process (are you transferring data during diligence?) and to the integration (where will personal data live post-merger?).

Discovery questions:

• Does the target have TIAs completed for all cross-border transfers?
• Do those TIAs reflect the actual data flows, or are they based on assumptions?
• Are the Standard Contractual Clauses in place still valid under current EU-US data sharing frameworks?

Data Subject Rights During Integration

Data subjects (employees, customers) have rights that don’t pause during M&A integration. DSARs must still be responded to within 30 days. Subject access requests can’t be delayed because your IT team is busy with migration.

Discovery question: What is the current DSAR backlog and response rate? If personal data is moved during integration, can you still locate and respond to DSARs for that data?

FCA-Regulated Entities: Specific Considerations

SYSC (Senior Management Arrangements, Systems and Controls)

FCA-regulated firms must maintain adequate systems and controls. A poorly executed IT integration can create control failures — particularly around:

• Access management (who has access to what, and is it still appropriate post-merger?)
• Audit trails (do your logs still capture what’s required post-consolidation?)
• Business continuity (do your DR and backup arrangements still meet requirements if infrastructure changes?)

COBS (Client Assets) Sourcebook

If the target holds client assets (money or investments), there are specific requirements around segregation, record-keeping, and reporting. Your IT systems for client asset custody need to maintain COBS compliance throughout the integration.

Regulatory Reporting Continuity

FCA-regulated entities must maintain regulatory reporting throughout the integration. If your reporting systems are disrupted by migration, you still have to file. This means migration windows for regulatory reporting systems need FCA-approved fallbacks.

SEC and US Regulatory Considerations

SOX Compliance Continuity

Acquisitions of US public companies trigger Sarbanes-Oxley requirements for the integrated entity. IT controls that affect financial reporting must remain effective throughout the integration.

Key controls that migration can break:

• Access controls to financial systems
• Segregation of duties in ERP and treasury systems
• Audit log integrity for systems that feed financial reports
• Change management controls for financial reporting infrastructure

Export Controls and Trade Sanctions

If the target has international operations, exports of certain technologies (encryption, advanced computing, aerospace components) may require export licenses. Changes to corporate structure — including mergers — can affect license validity.

Discovery question: Does the target hold any export-controlled technology? Do any acquisitions of IP or technology require export license reviews?

Discovery Sequencing for Regulated Integrations

In a regulated integration, discovery isn’t a single phase — it’s a sequenced program.

Phase 1: Regulatory discovery sprint (pre-signing)

Objective: Identify the hard constraints that will shape the integration plan.

Deliverables:

• Personal data inventory and data flow map
• Cross-border transfer mechanism audit
• Regulatory license and permission inventory
• Information barrier assessment
• Current DSAR and compliance reporting status

This phase is pre-signing because discovering these constraints after signing is too late to affect deal terms.

Phase 2: Integration constraint mapping (T+0 to T+30 days)

Objective: Map every integration decision against its regulatory implications.

For each planned integration activity:

• Does this activity require regulatory notification?
• Does this activity require a new license or authorization?
• Does this activity change the regulated entity’s obligations?
• What is the compliance risk if this activity isn’t sequenced correctly?

Phase 3: Phased integration with compliance gates

Each migration wave includes compliance verification:

• Personal data in scope for this wave — is the transfer mechanism documented?
• Regulatory reporting systems — are fallbacks confirmed?
• Access controls — are they tested before users are moved?

Phase 4: Post-integration compliance validation

Objective: Confirm that the integrated entity meets all regulatory requirements.

Deliverables:

• Updated Article 30 records for the combined entity
• Updated data processing agreements for all processors
• Updated TIA documentation for all cross-border transfers
• Regulatory notification of integration completion (where required)

The Compliance-First Integration Advantage

Teams that run compliance-first discovery consistently outperform teams that treat compliance as a post-integration cleanup task.

Why:

• Regulatory constraints identified pre-signing inform deal terms
• Sequencing errors caught in discovery are cheap to fix; sequencing errors caught in execution are expensive
• Regulators are more likely to view a well-documented integration favourably when issues do arise
• Data subject rights remain protected throughout, reducing legal exposure

ACQI’s discovery modules identify personal data, cross-border transfers, and regulatory dependencies across Azure, M365, and on-premises infrastructure. Request a demo →