Business Plan SWOT Analysis: How to Build One That Works

The FCA recorded 139 withdrawals and 35 approvals among cryptoasset registration applications received across 2020 to 2022, according to its registration application figures. Those figures concern a particular registration route, not every authorisation process. But they make a useful point for founders: regulatory readiness deserves more than a reassuring sentence in a business plan.

A business plan SWOT analysis should help management distinguish what the firm can demonstrate from what it hopes to achieve. For a regulated business, each item needs an owner, a source document, a financial effect and an application consequence. Otherwise, the familiar grid can conceal the gaps it's supposed to reveal.

Table of Contents

• The Four SWOT Quadrants in a Business Plan
  • Separate the condition from your response
• How to Build a SWOT From Your Business Plan
• Turning Each SWOT Item Into an Application Action
  • Apply the consequence to the operating model
  • Review the package, not isolated files
• Stress-Testing Forecasts and Scoring Each Risk
  • Score the exposure and the control separately
• Regulatory Dates to Build Into Opportunities and Threats
  • Sort controls by implementation dependency
• Common SWOT Mistakes in Regulated Plans
  • Replace broad assertions with bounded claims
  • Give opportunities and threats decision consequences
• Presenting and Confirming the SWOT Before Submission
  • Put the summary in the plan and the detail in an annex
  • Resolve scope before polishing the wording

The Four SWOT Quadrants in a Business Plan

Start with a grid you can fill in using your existing documents. Keep internal capabilities and gaps separate from external conditions, then ask what evidence would persuade someone who doesn't already know your business.

SWOT quadrants for a regulated business plan

Strengths are capabilities backed by documents and named people. Weaknesses are internal gaps a reviewer could identify, even if management already intends to fix them. Opportunities are external developments the firm could capture, while threats are external risks management can't control.

The stakes extend beyond regulatory approval: the Office for National Statistics business-demography bulletin records approximately 2.9 million active UK businesses in 2024, around 317,000 births and approximately 280,000 deaths, while only 38.4% of businesses born in 2019 survived into 2024.

Separate the condition from your response

An authorisation delay is an external threat. Insufficient cash to withstand that delay is an internal weakness. Keeping them separate helps management choose the right response: it can't dictate the regulator's timetable, but it can revise expenditure, funding and launch assumptions.

Likewise, demand for custody infrastructure is a potential opportunity, not proof of sales. Your team still needs evidence that customers want the proposed service and that the firm can deliver it within its regulatory scope.

Practical rule: A SWOT line is useful only if someone can check it against a document, a person or a number.

How to Build a SWOT From Your Business Plan

Build the SWOT from the operating model rather than a blank template. A spreadsheet works well because you can filter claims by owner, evidence status and affected application document.

1. Describe the business and activity. Record the services the client intends to provide, its customers and how the business will operate, then map each activity to the relevant regulatory route. The common slip is copying a broad description such as crypto platform, which doesn't explain who performs each service or handles customer assets.
2. Gather the working documents. Bring the business plan, financial information, policies, organisation chart and application answers together, review them, resolve findings and revisit affected material when facts change. This prevents the common mistake of assessing a polished business plan while ignoring contradictory assumptions elsewhere; the Smart Classic Business Hub plan outline can help organise the underlying narrative before the evidence review.
3. Write a short set of testable claims. Aim for four to six claims per quadrant, each expressed in a sentence containing a name, number or date. For example, replace experienced management with a statement identifying the managers, their roles and relevant regulated-firm experience, rather than relying on adjectives nobody can verify.
4. Trace every claim to its source. Record the document title, version and relevant passage or model assumption, and flag anything unsupported. A business analysis process model helps connect activities to documents and decisions; the common slip is linking to a folder without identifying what proves the claim.
5. Distinguish current from planned arrangements. Label each item as operational, under development or dependent on a decision, so readers can understand the firm's actual starting position. Don't describe an unsigned supplier arrangement or untested control as if it already operates.
6. Assign review responsibility. Give every weakness and threat an owner, review date and event that requires reassessment. The common slip is setting a calendar reminder but ignoring material changes, such as a different service model or a revised regulatory milestone.

The finished register should be short, dated, sourced and consistent with the financial model. It should also make unresolved questions visible, rather than forcing the reader to infer them from draft documents.

Turning Each SWOT Item Into an Application Action

A SWOT item matters when it changes an application answer, control or management decision. The FCA's regulatory business-plan guidance expects a detailed explanation of the business model, regulated and non-regulated activities, the reason authorisation is needed, customer impact, long-term strategy and whether client money will be held.

That makes traceability more useful than persuasive wording. A reviewer should be able to follow the strategic claim into the relevant responsibilities, procedures and financial assumptions.

From SWOT item to application action

Apply the consequence to the operating model

Take the compliance lead and tested onboarding process. If management also claims combined regulatory and engineering capability, identify the senior manager responsible for translating policy into system behaviour. Hold the relevant experience records, approved onboarding procedure and test results, then identify the application sections that rely on them.

For incomplete operating procedures, assign the missing safeguarding responsibility to a named person and set a target date for approval. State whether the gap will close before submission or remains a planned arrangement. We distinguish arrangements already in place from those the business still needs to establish when preparing policies and operating arrangements.

An infrastructure opportunity involving UK customers with overseas operations needs a separate feasibility decision. Experience across FCA, MAS and DFSA frameworks doesn't make permissions interchangeable. Test the proposed service against each jurisdiction's obligations, staffing and systems, and exclude expansion revenue where the delivery conditions can't be met.

For changing cryptoasset rules, identify the assumption that could become invalid. The risk owner should maintain a change register showing which permissions analysis, policy, forecast and application answer needs reconsideration.

Review the package, not isolated files

When a responsible manager changes, updating the organisation chart isn't enough. Revisit every document that assigns that person a duty, including governance descriptions, procedures and application answers, and record the correction.

We check consistency across application documents, address findings and prepare the identified package for internal and client approval. The benchmark is a complete package explaining how activities align with requested permissions, not merely a well-written SWOT. An unevidenced claim should be identified as unconfirmed or planned, never presented as an established fact.

Stress-Testing Forecasts and Scoring Each Risk

Some UK authorisation routes require at least three years of forecasts, potentially including balance-sheet, profit-and-loss and cash-flow statements under stressed assumptions; the FCA's consumer-investment authorisation guidance also expects relevant applicants to explain how minimum capital requirements will be maintained. Check the applicable route before choosing your forecast format.

A threat needs a measurable consequence. Translate it into a change in revenue, expenditure, capital headroom, delivery capacity or recovery capability, rather than leaving it as a risk label.

The stress levels below are illustrative modelling choices, not regulatory thresholds or predictions.

Sensitivities to test against the forecast

A delayed launch should postpone revenue without automatically postponing every expense. Lower conversion should flow through receipts and capital, not just the sales chart. Removing the largest referral partner should also prompt a decision about whether planned recruitment remains justified.

Higher consultant costs and additional AI development should include the work needed to complete, test and oversee delivery. For provider failure, estimate recovery expenditure and staff effort alongside lost revenue. AmbitionCFO's explanation of using scenarios to protect cash flow provides useful context for comparing those alternative outcomes.

Score the exposure and the control separately

Assess each weakness and threat against likelihood, financial impact, control maturity, recovery time and evidence status. Use defined descriptive ratings so colleagues apply the same meaning to high impact or weak controls.

A low-likelihood event can still require urgent work if the firm couldn't fund or manage the consequences.

Prioritise high-impact items with immature controls before submission. Accept a claimed strength only where documented processes, qualified personnel, tested tooling and accountable governance support it.

The Bank of England's operational-resilience framing covers preventing, adapting to, responding to, recovering from and learning from disruption. Apply that lifecycle to cyberattacks, outages and supplier failure, rather than treating continuity as a backup document.

We bring financial and regulatory input together so the figures and written account can be reviewed together. That handover should connect financial risk assessments to management decisions, including who will act when a forecast trigger is breached.

Regulatory Dates to Build Into Opportunities and Threats

Consider a firm preparing a UK cryptoasset launch. Its team needs to distinguish policy direction, enacted provisions, expected application arrangements and controls that must operate when the relevant requirements apply.

The historical milestones below are recorded in HM Treasury's cryptoasset regime publication, from the October 2023 proposals through the legislation laid on 15 December 2025. The Payments Forward Plan identifies an FCA gateway expected in Q3 2026, while the commencement provision schedules full commencement for 25 October 2027, with specified preparatory provisions starting earlier.

UK cryptoasset regime dates and their SWOT effect

The proposals gave management a direction for product design. Government confirmation reduced uncertainty about that direction, but didn't eliminate implementation risk. Draft provisions then allowed the compliance team to challenge its permissions map against a more concrete framework.

Laying final legislation gave the team a firmer basis for readiness work. It didn't mean every detailed obligation was immediately operational or that subsequent FCA rules could be ignored. An expected gateway should therefore remain a monitored dependency, not a guaranteed launch commitment.

Sort controls by implementation dependency

Preparatory powers allow the FCA to develop rules and guidance before full commencement. The firm's compliance lead should monitor that work because it can affect application drafting, governance, safeguarding design and management-interview preparation.

Tag each control as needed at launch, eligible for justified phasing, or dependent on final rules. Don't use the last category to defer work whose purpose and ownership are already clear.

For a projected launch around full commencement, schedule applicable controls to be operational by the commencement milestone, subject to the firm's actual route and any applicable transitional arrangements. Keep a change-impact register identifying the policy, owner and forecast to revisit if a dependency changes.

Common SWOT Mistakes in Regulated Plans

A confident description isn't necessarily an accurate one. These mistakes are especially damaging because they can make an incomplete operating model appear ready for review.

Replace broad assertions with bounded claims

Describing a generic crypto platform. Wrong: the platform needs a crypto licence. Better: the business model identifies which entity issues stablecoins, safeguards assets, operates a trading platform, deals, arranges or provides staking. The Cryptoassets Regulations 2026 identify these distinct activities within the forthcoming Part 4A FSMA authorisation framework. Fix: create an activity-by-entity permissions matrix using the actual customer and asset flows.

Treating AML registration as general authorisation. Wrong: FCA registration permits every planned crypto service. Better: the legislation's explanatory material distinguishes AML supervision applying to in-scope cryptoasset businesses since January 2020 from the future authorisation framework, and records cryptoasset financial-promotion requirements effective from October 2023. Fix: separate current AML registration, financial-promotion obligations and future permissions in the obligations matrix.

Calling the team experienced without evidence. Wrong: management has extensive expertise. Better: identify the people, their relevant responsibilities and the records supporting their suitability. Fix: replace the adjective with named roles cross-referenced to CVs and governance responsibilities, using the FCA threshold conditions as a prompt for a wider readiness review.

Give opportunities and threats decision consequences

Listing an opportunity without delivery resources. Wrong: international expansion offers significant growth. Better: the proposed market has a defined service, regulatory route, staffing requirement and systems budget. Fix: attach a costed feasibility entry before including the opportunity in the base forecast.

Recording a threat without a trigger. Wrong: third-party technology failure could affect operations. Better: management will invoke a defined response when provider unavailability threatens an approved service tolerance. Fix: assign a risk owner to document the escalation event and response decision.

Review test: Read the SWOT beside the financial model and permissions matrix. Challenge any claim those documents can't support.

Run that comparison as a working meeting with finance, compliance and the relevant operational manager. Resolve discrepancies through recorded decisions, not by making each document's wording less specific. A candid gap with an accountable action is more useful than an unsupported assurance.

Presenting and Confirming the SWOT Before Submission

Use a pre-submission review to test whether someone outside the preparation team can follow the reasoning. Don't ask only whether the SWOT sounds convincing. Ask whether its conclusions remain defensible when the reviewer opens the supporting files.

• Claim records: Every material item has a source document, accountable owner and review date.
• Response decisions: Every weakness and threat has a remediation action, escalation trigger or explicit acceptance decision.
• Opportunity feasibility: Permissions, staffing, systems and jurisdiction-specific obligations have been tested.
• Financial alignment: The base forecast and stress tests reflect the same operating assumptions as the narrative.
• Regulatory dependencies: Each milestone is connected to the policies, controls and forecasts it could affect.
• Implementation status: Current arrangements remain clearly distinguishable from planned arrangements.

Put the summary in the plan and the detail in an annex

Present the business plan SWOT analysis as a short management summary of the most material items. Alongside each item, identify the owner, evidence reference and relevant date, with cross-references to the financial model, permissions matrix and controls.

Keep the full working register in an annex. Include document versions, open decisions, remediation status and change triggers there, so readers can inspect the detail without overloading the business-plan narrative.

The distinction between a source document and proof matters. A draft policy shows that someone has written a proposed process; it doesn't establish that staff can operate it. This explanation of application evidence can help teams assess what each document demonstrates.

Resolve scope before polishing the wording

If the checklist fails in several places, examine the scope before rewriting. The team may not yet have agreed which entity performs the activity, who owns an important control or whether the proposed launch assumptions are feasible. Those are management decisions, not editorial defects.

Our Discovery Call covers the activity and market the client wants to enter, its current stage and available material, the questions holding preparation back and the professional help needed. Scope, fees, responsibilities and service commitments are set out in a written engagement agreement before consultancy work begins.

Use the final review to confirm decisions with the people who must implement them. A SWOT is ready when a reviewer can follow each material line to a person, a document and a number, and management can explain what happens if the underlying assumption changes.

---

Glentorion helps financial and crypto businesses prepare coherent authorisation applications by connecting business plans, financial assumptions, policies and supporting evidence. Visit Glentorion to discuss your planned activities, existing materials and the work needed to turn your SWOT into an accountable application-readiness register.