Buying a ready-made licensed VASP company is marketed on a promise of speed: "don't wait for a licence — buy a company that has one." The story on this page is different and more precise: a licence belongs to the legal entity, so a share deal does indeed buy the company with its licence — but in every serious regime the change of ownership control is itself a regulated transaction. It requires the regulator's prior consent or a notification, and the buyer is screened with the same logic applied to a fresh applicant. The M&A route saves time only when it is built as a regulatory process from day one.
That is exactly what our M&A service is: simultaneous management of all three rings — due diligence, regulatory consents and the transaction contract — so that the deal does not collapse at the stage where it most often collapses: the consent. Below: facts confirmed per regime, the due-diligence checklist and the Georgian layer.
A Change of Control Is a Regulated Transaction
In the MiCA space this frame is written into the regulation itself: the authorisation application (Article 62) requires checks on the management body and on qualifying shareholders — ten percent or more (Article 3(1)(36)) — and an acquisition comprising a qualifying holding re-runs those checks on the new owner. CySEC's fee schedule prices this process in euros: a proposed acquisition of a CASP — EUR 8 000 per proposed acquisition (Article 83), and a change of the management body — EUR 2 000 per change (Article 69). In the Czech Republic, since August 2025 only legal entities may provide MiCA services — so the buyer's legal form is itself a precondition of the decision.
Non-EU regimes follow the same logic. In Serbia the NBS issues consents for the appointment of management members and directors and for acquirers of a qualifying holding — with AML screening of the origin of funds and flags for offshore or high-risk exposure. In Armenia the central bank's (CBA) prior consent is required for the acquisition of a qualifying holding, and the decision must be taken within one month (Article 28). So wherever a "fast entry without the regulator" is being sold, what you actually have is a deal that cannot close without consent — and a deal closed without consent is itself a breach of the rules.
What a Shelf Company Saves — and What It Does Not
What it saves: the company already exists — with its status, its history, sometimes its banking relationships and internal processes; and the statutory clock of a fresh authorisation (in the MiCA space, a 25-working-day completeness check and a 40-working-day decision) is distributed differently on the consent track (in the Armenian example, one month on a qualifying holding). What it does not save: screening of the buyer. Documentation of sources, the reputation filter and transparency of structure still apply — and that is precisely the block that delays consents. We therefore run the shelf route so that the buyer's file and the transaction terms are prepared in parallel, not after the deal.
Due Diligence: What We Check Before the Deal
First, the status in the regulator's public list: the register of authorised or licensed persons (CySEC's, the NBS's or the competent body's) and any conditions attached to the licence. Second, the capital picture: for CASPs the own-funds rule (Article 67 — the higher of the Annex IV class minimum or one quarter of the preceding year's fixed overheads) keeps applying after the acquisition. Third, the risk of deletion from the register: in Montenegro's regime, for example, an entry is deleted for false documentation, lost reputation or not actually providing the service (Article 40d) — a "slow" company can fall out of a clean register right after you buy it. Fourth, the AML history: inspections, incidents, the legal inheritance of the client base. And finally, the reality of the entry door: where new applications are suspended (SVG's FSA, from 1 September 2026), acquiring an existing registrant is formally the only door — but its annual and periodic obligations pass to the buyer, and that load must be priced into the deal.
The Georgian Layer: Buying a Shelf VASP from a Georgian Group
On the Georgian side, the mechanics of a share deal are set by the company-law rules of the Law on Entrepreneurs — shareholder agreements, warranties and the transfer procedure; every clause is written to the specific transaction, so here we emphasise structure rather than numbers. Separately, the Georgian Tax Code (No 1043717) characterises crypto-assets only in the VAT context — a cryptographic currency is neither goods (Article 160) nor a service (Article 160-1) — and the tax details of a deal require separate analysis per structure. And if the buyer is eyeing the Georgian Virtual Zone as a tax base, remember: the exemption (Article 99(ž), definitions in Article 8) is drafted around IT activity resulting in software products — VASP operations do not automatically fit that frame.
And the main Georgian rule: a foreign licence does not open the Georgian market. The organic law on the National Bank of Georgia (No 101044): Article 52-5(2) — a VASP registers with the National Bank; Article 52-5(3) — providing services while unregistered is impermissible; Article 52-5(4) — a provider carries on only that activity and auxiliary activity; Article 39-1 — payments in virtual assets are prohibited; Article 48 — supervision belongs to the National Bank. The AML law (No 4690334): Article 3(1) — a VASP is an accountable person; Article 4 — AML supervision belongs to the National Bank; Article 11(1) — the KYC trigger at USD 1 000 / EUR 1 000 / GEL 3 000; Article 17¹ — the Travel Rule. An acquired licence does not change this layer.
Frequently Asked Questions
Can a licence be bought without the regulator's involvement?
No. In the MiCA space the acquisition of qualifying shareholders (ten percent or more) triggers suitability checks; in Serbia and Armenia it requires the regulator's consent. A deal closed without consent is a breach of the rules.
What does the consent stage cost at CySEC?
CySEC's published charges: a proposed acquisition of a CASP — EUR 8 000 per proposed acquisition (Article 83); a change of the management body — EUR 2 000 per change (Article 69).
What does a shelf company save compared with a new application?
The company's existence, its history and sometimes its banking relationships; the fresh-authorisation clock (25 and 40 working days) is distributed differently on the consent track. What no route saves is the screening of the buyer — the file must still be ready.
What can be a fast door for a Georgian group?
Markets where the consent deadline is fixed in the law itself — for example, Armenia's CBA must decide on a qualifying holding within one month. But "fast" means well prepared, never outside the regulator.
Does an acquired licence change Georgian requirements?
No. Services directed at Georgia still require registration with the National Bank under Article 52-5(2), and the KYC trigger and the Travel Rule remain part of the Georgian AML layer.
How We Help on Legal.ge
Legal.ge builds the M&A route with three rings: due diligence — status in the register, licence conditions, capital under the Article 67 rule, AML history and the risks of falling out of the register; the regulatory track — consents and notifications with the competent body (CySEC, the NBS, the CBA or another), with a buyer's file that accounts for source documentation from day one; and the contract — under the company-law mechanics of the Law on Entrepreneurs, with price structure and warranties. In parallel we build the Georgian ring — National Bank registration and AML compliance. Contact us — let us start the acquisition assessment with your target jurisdiction and budget.