FCA Authorisation Process for UK Financial Firms

The FCA authorisation process in the UK is the mandatory pathway through which financial firms obtain legal permission to operate regulated activities from the Financial Conduct Authority. It requires demonstrating threshold conditions—fitness, capability, financial resources—and submitting a detailed regulatory business plan; full authorisation typically takes 3–6 months after submission, though complex firms may require 12+ months.

Legal Foundation and Scope

FCA authorisation is required under the Financial Services and Markets Act 2000 (FSMA) and the Financial Services Act 2012. Any firm wishing to conduct regulated activities in the UK—whether mortgage lending, investment advisory, insurance distribution, or payment services—must obtain explicit FCA permission or operate under an exemption granted by the FCA itself.

The scope of authorisation is tightly defined. A firm is licensed only for the specific regulated activities listed in its authorisation letter. A mortgage lender cannot suddenly offer investment advice; a financial advisory firm cannot take deposits from the public. The FCA’s permissions regime is activity-based rather than entity-based, meaning each business line must be justified and documented within the application.

The firm must also nominate an SMCR-controlled function (a key individual responsible for senior management functions under the Senior Managers and Certification Regime), and it must declare whether it has dual regulation status (additional oversight by the Prudential Regulation Authority for banks and insurance firms).

Threshold Conditions Assessment

Before the FCA considers a firm’s business plan, it evaluates whether the applicant meets six threshold conditions set out in FSMA Schedule 6:

1. Authorisation threshold: The firm meets the legal definition of a firm eligible to apply.
2. Location threshold: The firm is incorporated or established in the UK (or in rare cases, the EEA or overseas with valid exemption).
3. Offence threshold: No director, controller, or senior manager has been convicted of fraud, market abuse, or dishonesty offences within a specified period.
4. Integrity threshold: The firm, its management, and controllers are fit and proper to conduct the activities proposed.
5. Capability threshold: The firm has adequate systems, controls, staffing, and training to manage regulated activities.
6. Financial resources threshold: The firm holds minimum own funds or capital determined by the activity—typically ranging from £20,000 for small advisory firms to £8–12 million for broker-dealers and lenders.

A firm that fails any threshold is rejected outright. The FCA publishes guidance on what “fit and proper” means: it covers honesty, competence, solvency, and regulatory compliance history.

Regulatory Business Plan Requirements

The regulatory business plan (RBP) is the centrepiece of the application. It must address the firm’s governance, risk management, financial projections, and regulatory controls across multiple sections:

Governance and management. The applicant must identify the Significant Influence Function holders (controllers, board members, senior managers) and demonstrate their fitness and propriety through CVs, criminal records checks, and references. The board structure and any outsourcing arrangements must be detailed, showing clear lines of accountability.

Systems and controls. The plan describes how the firm will comply with FCA rules on consumer protection, data security, anti-money laundering, conflicts of interest, and complaints handling. For consumer lending, this includes credit-assessment processes and affordability checks. For investment advisory, it covers suitability assessments and fees disclosure.

Financial projections and capital. The applicant must submit 3-year profit-and-loss forecasts and a balance sheet, detailing sources of funding, working capital, and the mechanism for holding minimum capital. The FCA stress-tests these projections and examines whether capital buffers are adequate if business performs worse than forecast.

Operational resilience. The firm must demonstrate how it will continue critical functions during disruption—IT systems, backup facilities, third-party dependencies, and incident response procedures.

Consumer protection. The plan must specify how the firm will handle customer disputes, segregate client money (if applicable), provide clear terms and conditions, and manage complaints. For sensitive activities (mortgage lending, financial advice), the firm must show how it meets conduct-of-business rules and why its target market is appropriate.

Timeline and Assessment Process

The FCA publishes a Service Level Agreement aiming to make decisions on most applications within 8 weeks of submission, but only if the application is complete and the firm is straightforward. In practice, the FCA often issues clarification requests (CRs) requiring the applicant to provide missing information, revise risk assessments, or expand on governance details.

Most firms experience at least one round of CRs. The clock pauses while the firm responds—often adding 2–8 weeks. Complex applications (e.g., new banks, hedge funds, payment institutions) routinely extend to 12–18 months as the FCA tests the business plan against stress scenarios, conducts background checks on all controllers, and negotiates the firm’s rulebook (fee structure, reporting requirements, governance arrangements).

Once the FCA’s case officer is satisfied, the application enters decision-making, at which point a manager reviews the file and recommends approval or refusal. The FCA then sends an approval letter specifying the regulated activities, any limitations, and conditions (e.g., “no leverage beyond 2:1” for investment firms).

Common Reasons for Delay or Refusal

Applications are delayed or rejected when:

• Incomplete governance. Applicants nominate managers without proper criminal clearance documentation or with unexplained regulatory history.
• Weak risk management. The business plan lacks detail on how the firm will detect fraud, comply with data protection rules, or handle conflicts of interest.
• Undercapitalized projections. Financial forecasts are unrealistic, or the firm’s capital buffer is too thin relative to projected volumes and stress scenarios.
• Suspicious funding. The FCA cannot verify the source of seed capital, or funding is traced to shell companies or high-risk jurisdictions.
• Inadequate compliance staffing. The applicant plans to manage compliance with one part-time person when regulation demands dedicated expertise.
• Poor outsourcing controls. The firm outsources critical functions (e.g., compliance, IT) but has not secured an equivalent level of oversight and audit rights.

Post-Authorisation Obligations

Once authorised, the firm enters the FCA’s reporting and supervision regime. This includes:

• Annual returns: Submission of financial statements, compliance certifications, and regulatory reports.
• Change notifications: The FCA must be informed of any material change in management, ownership (controllers exceeding 5%), business strategy, or systems infrastructure.
• Thematic examinations: The FCA conducts periodic reviews of how firms manage specific risks (e.g., financial crime, consumer credit).
• Breaches and incidents: Firms must notify the FCA of cyber-security incidents, significant complaints, or operational failures within prescribed timelines.
• Fee payments: Regulated firms pay annual fees based on their activity category and business revenue.

The FCA can vary (amend) a firm’s authorisation, impose conditions, or withdraw it if the firm breaches rules or ceases to meet threshold conditions.

See also