Acquiring a payments business in Iraq is often motivated by the licence. Obtaining a Central Bank of Iraq authorisation can take time, and buying a company that already holds one appears to offer a shortcut into a growing market. But a licence is only as valuable as the business behind it. A payments company may hold a valid licence while carrying unreconciled customer balances, weak anti-money laundering controls, fragile partner relationships or technology that cannot scale. Some of these issues can be fixed after completion; others may lead to regulatory action, losses or the suspension of the licence the buyer was paying for.
Due diligence on an Iraqi payments business should therefore look beyond the licence certificate to the substance of the operation. The buyer needs to know whether the business is operating within its licence, whether customer funds are fully protected, whether its partners will continue to work with it under new ownership and whether the Central Bank will approve the change of control.
The Central Bank of Iraq Law No. 56 of 2004 and the Electronic Payment Services for Funds Regulation No. 2 of 2024, which replaced Regulation No. 3 of 2014, govern licensing and supervision of payment service providers, including approval of changes in ownership. Central Bank instructions address safeguarding, information security, outsourcing and reporting. The Anti-Money Laundering and Counter-Terrorism Financing Law No. 39 of 2015 imposes compliance obligations whose historic breach may lead to sanctions. The Companies Law No. 21 of 1997, as amended, governs the share transfer, and the Competition and Antitrust Law No. 14 of 2010 may apply to larger transactions.
Verifying the licence and its scope
The starting point is still the licence, but the review should go deeper than confirming its existence. The buyer should examine the exact activities authorised, any conditions or limits imposed, the licence term and renewal requirements and correspondence with the Central Bank about compliance with conditions. The buyer should compare the activities actually conducted with those authorised. A business offering services beyond its licence, even informally, carries regulatory risk that may crystallise after completion.
Safeguarding and reconciliation of customer funds
For any business holding customer balances, the single most important diligence question in acquiring a payments business in Iraq is whether customer funds are fully protected. The buyer should review:
- Safeguarding accounts. Where customer funds are held, in whose name and under what terms.
- Reconciliation history. Daily reconciliations over a meaningful period, unresolved differences and how breaks were resolved.
- Shortfalls. Any instance where safeguarded funds fell below customer balances, and how the gap was funded.
- Use of funds. Whether customer funds were ever used for operating expenses or investments.
A shortfall in safeguarded funds is effectively a liability of the business and may also be a serious regulatory breach.
Settlement exposures and partner contracts
Payments businesses depend on settlement banks, schemes, billers, merchants and agents. The buyer should review each material contract for change of control provisions, termination rights, exclusivity, liability caps and pending disputes. Settlement exposures, such as amounts owed to merchants or funds held by partner banks, should be reconciled. A key bank partner that is entitled to terminate on change of control, or that is unhappy with the business’s compliance record, can undermine the value of the acquisition. Commercial contract advice in Iraq can identify contractual consents and renegotiation points.
Anti-money laundering and compliance history
Compliance diligence should examine the AML framework, customer due diligence files, transaction monitoring systems, alert backlogs, suspicious transaction reporting history, sanctions screening and regulatory inspection findings. Sample testing of customer files often reveals more than policy documents. The buyer should also review complaints data, fraud losses and any correspondence with authorities about specific transactions or customers.
Technology, security and data
The technology platform is often the core asset of a payments business. Diligence should cover ownership of software and intellectual property, licences for third-party components, hosting arrangements, security assessments, penetration test results, incident history and scalability. Where the platform is licensed from a group company or a vendor, the buyer must confirm that the licence survives the acquisition on acceptable terms. Data protection practices and data location should be reviewed against regulatory expectations.
Agents and distribution networks
Where the business relies on agents for cash-in and cash-out, the buyer should review agent contracts, onboarding and training records, monitoring of agent activity, cash management and incidents of fraud. Weak agent controls can expose the business to money laundering risk and customer harm.
Financial position and capital adequacy
The buyer should confirm that the business meets any capital or financial guarantee requirements and assess its funding needs. Payments businesses often operate at a loss during growth; the buyer should understand the cash required to maintain compliance and expand. Tax compliance should be reviewed, including treatment of fee income and payments to foreign technology providers. Tax advisory services in Iraq can assess tax exposures.
Change of control approval
The acquisition will typically require Central Bank approval of the new owner. The buyer should prepare information about itself, its ultimate beneficial owners, its financial capacity and its plans for the business. The share purchase agreement should make completion conditional on approval and include interim covenants preventing the seller from changing the business, entering new partnerships or altering safeguarding arrangements without consent. Corporate transaction advice in Iraq can help structure conditions and interim protections.
Translating findings into deal protection
Findings should be reflected in the price, conditions, specific indemnities and post-completion plans. A safeguarding shortfall may require the seller to fund the gap before completion. AML weaknesses may justify a remediation plan agreed with the regulator and a retention of part of the price. Partner consents may be conditions precedent. Warranties should address licence compliance, safeguarding, data security and regulatory correspondence specifically.
Illustrative example. A regional payments group agrees in principle to acquire an Iraqi wallet provider for its licence and customer base. Diligence reveals that reconciliations were performed weekly, that safeguarded funds fell short of customer balances on several occasions, that the main settlement bank may terminate on change of control and that thousands of customer files lack verified identification. The buyer restructures the deal: the seller funds the safeguarding gap before completion, the settlement bank’s consent becomes a condition, part of the price is retained pending a customer file remediation programme, and the buyer presents a remediation plan as part of its change of control application.
Key takeaways
- Acquiring a payments business in Iraq requires diligence on the operation behind the licence, not only the licence itself.
- Safeguarding and reconciliation of customer funds are the most critical diligence areas.
- Partner contracts and AML compliance history can determine whether the business remains viable after completion.
- Central Bank approval of the change of control must be built into the transaction timetable and documents.
How Etihad Can Help
When acquiring a payments business in Iraq, the licence opens the door but the operation determines the value. Thorough diligence on funds, partners, compliance and technology allows buyers to price risk accurately and plan for regulatory approval.
Etihad Law Firm advises buyers, sellers and investors on payments and fintech transactions in Iraq, including regulatory diligence, Central Bank approvals and transaction documentation. We help clients acquire businesses that can operate compliantly from the first day of new ownership.