FCA Application Process: Step-by-Step Guide for 2026
Published
The most popular advice about the FCA application process is to start with a document checklist. That's useful for organising work, but it's a poor test of readiness. A business plan, financial model and policy library can each look convincing while describing different businesses.
Start instead with the connections between them. Your customer assumptions should explain your transaction volumes; those volumes should justify your staffing and controls; and the people named in your governance map should understand the responsibilities your policies give them. The practical objective is one coherent operating model, supported by evidence, rather than a folder of plausible documents.
Table of Contents
- FCA Application Routes and Timelines at a Glance
- How to Map Each Activity to the Right Route
- Documents Reviewers Test Together
- How to Submit, Pay and Respond to Follow-Up Questions
- What Happens in a Regulator Interview and How to Prepare
- Pitfalls That Stretch the Timeline and How to Fix Them
- Gap-Check Your Route Before You File
FCA Application Routes and Timelines at a Glance
Statutory timelines and fees by FCA route
| Route | Complete application | Incomplete application | Fee and notes |
|---|---|---|---|
| New FSMA Part 4A permission | 6 months, under the FCA's new-firm authorisation metrics | 12 months under the same statutory framework | Fee must be paid in full before the application counts as made |
| Payment services or e-money under the PSRs and EMRs | 3 months, as described in the FCA's authorisations service reporting | Up to 12 months under that reporting framework | Fee paid through Connect at submission |
| Cryptoasset registration under the MLRs | Three-month assessment after required information is provided and relevant questions are answered | Unconfirmed here; check current FCA guidance for this route | One-off application fee, then annual periodic fee; Category 6 |
The cryptoasset assessment period isn't a promise that the FCA will decide an initial submission within that period. Its starting condition matters: the required information must be available and the relevant questions addressed.
Completeness, not submission speed, determines the applicable timetable. A polished application with an unexplained funding assumption or an unresolved outsourcing arrangement may still leave the regulator unable to assess the business. Filing early doesn't remove that uncertainty.
Plan beyond the legal maximum
The FCA also publishes lower-quartile, median and upper-quartile determination times measured in calendar days. Use that distribution to inform your launch planning rather than treating the legal maximum as a delivery date.
Keep hiring, contractual commitments and customer-launch assumptions flexible until the regulatory position supports them. A deadline for determination doesn't guarantee a favourable decision.
For a payments proposition, establish whether you're providing payment services or issuing electronic money before choosing forms. The distinction behind an electronic money licence affects the application package, not just its label.
Planning rule: Find the right route before setting a launch date. The statutory clock is the outer framework for a decision, not a promise of authorisation.
How to Map Each Activity to the Right Route
A business description such as digital finance platform is too broad to establish permissions. The useful starting point is what the firm does in practice, for whom, where and with whose money or assets.
Build an activity-level decision record
- List every planned activity. Include lending, custody, introducing business and handling client money, even where they seem ancillary to the main product. Describe the actions rather than relying on marketing terms, because a supporting service can create a separate regulatory question.
- Test each activity against the regulatory perimeter. Identify the relevant regulated activity and assess whether a specific permission, registration, appointed representative arrangement or exemption is available. Record the conditions behind any alternative to direct authorisation, because a route that works only under restrictions may not support your intended business model.
- Separate cryptoasset registration from FSMA permissions. Don't assume that an AML registration resolves every regulatory question associated with a cryptoasset proposition. Under Regulation 21(3), the FCA's cryptoasset application guidance requires an MLRO, also called the Nominated Officer, and its application form requires projected cryptoasset-business revenue covering the first 12 months from registration.
- Confirm the jurisdictional position. Record where the firm operates, where customers are based and how services reach them, then assess whether UK requirements apply. An overseas group company or technology provider doesn't answer the jurisdiction question on the applicant's behalf.
- Mark what operates and what remains planned. Separate live customer journeys, appointed staff and functioning systems from proposed arrangements. This prevents the application from presenting a future capability as an existing control.
- Record the conclusion and challenge it. Keep the chosen route, supporting reasoning and unresolved decisions in a shared note, then have another qualified person review it. Resolve material disagreements before drafting, because changing the route later can invalidate substantial preparation work.
Check the commercial consequences
For payments, assess what an authorised payment institution would in fact do in the proposed customer journey. Who receives funds, who instructs a transfer and who contracts with the customer should be explicit.
For cryptoasset registration, confirm that the nominated officer can describe the AML framework in operational terms. Naming someone isn't a substitute for defining their authority, access to information and escalation responsibilities.
The common mistake is choosing a route from the business brochure. Choose it from the activity list, then make the brochure, contracts and application consistent with that decision.
Documents Reviewers Test Together
Reviewers don't read the business plan in isolation and then forget it when opening the financial model. They compare customer descriptions, responsibility allocations and operational claims across the file. Your internal review should do the same.
The FCA's authorisation application guidance describes an assessment of whether applicants meet, and will continue to meet, minimum standards. That requires more than having a document bearing each expected title.
What the documents must prove
What reviewers test in each application document
| Document | What reviewers test | Gap that appears most often |
|---|---|---|
| Business plan | Whether the model, customers, products and growth form one coherent story | Target customers and volumes don't match the controls |
| Financial projections and assumptions | Whether each assumption is sourced and ties to the business plan | Unsupported cost and revenue assumptions |
| Governance map and senior manager responsibilities | Named individuals with allocated, realistic responsibilities | Responsibilities listed but not allocated to a person |
| Systems and controls description | Controls with owners, evidence and operating status | Planned controls written as if already operating |
| Policies and procedures | Consistency with the business plan and governance map | Separate policies name different owners or escalation routes |
| Outsourcing and safeguarding arrangements | Oversight, contractual control and handling of client money | Vague outsourcing model or unclear safeguarding |
| Application form answers | Whether every answer matches the rest of the pack | Narrative drift between answers and policies |
Treat these gaps as review prompts, not a statistical ranking. The most serious issue in your file is whichever prevents the regulator from understanding or testing a material arrangement.
Say the business plan anticipates customers from higher-risk jurisdictions, but the AML policy describes a domestic-only customer base. Correcting the customer description alone isn't enough: the risk assessment, screening arrangements, staffing assumptions and financial projections may all need attention.
Build a requirements-to-evidence matrix
Use a controlled spreadsheet or shared database, not a collection of comments scattered across Word files. Each row should connect a requirement to an authoritative fact and identify everyone who must act when that fact changes.
| Requirement | Source fact | Document owner | Affected application answer | Approval status | Regulator-response deadline |
|---|---|---|---|---|---|
| Explain outsourced monitoring oversight | Provider scope, draft contract and oversight procedure | Financial-crime lead | Systems and controls response | Awaiting contract review | Record when requested |
| Explain operating funding | Funding evidence and approved financial model | Finance lead | Financial resources response | Management approval pending | Record when requested |
Source documents need to prove the proposition being made. BankStatementWizard's guide to choosing bank documents for loan applications provides a useful adjacent example of matching financial evidence to its purpose; it isn't an FCA evidence standard or a substitute for the application requirements.
Run targeted checks against the matrix:
- Customers and volumes: Match the proposed customer mix and activity levels to monitoring capacity, staffing costs and projected revenue.
- Responsibilities and escalation: Compare policy owners, deputies and approval routes with the governance map and senior-manager evidence.
- Present operating status: Test form answers against what exists today, including contracts, appointments and system configuration.
Make controls inspectable
For cryptoasset registration, build a process inventory covering onboarding, risk scoring, enhanced due diligence, sanctions and PEP screening, transaction monitoring, suspicious-activity escalation, record retention, training, governance and outsourcing. Record the accountable person, system, alert thresholds where relevant, review frequency, management information and test evidence for each control.
A vendor description isn't enough. Show who configures the system, investigates alerts, approves changes and checks whether the arrangement works.
Use applicable FCA compliance requirements to define what must be demonstrated, then attach evidence to the specific requirement rather than uploading an undifferentiated policy library.
Maintain a single change log for amendments. Record what changed, why it changed and which answers, models or procedures were updated as a result.
How to Submit, Pay and Respond to Follow-Up Questions
Submission is a controlled release of an approved application, not the moment drafting happens to stop. Assign a filing owner who can confirm the document versions, payment status and correspondence arrangements.
Control the filing sequence
- Approve the final package. Obtain formal management sign-off and identify the versions approved for submission. Approval should cover unresolved dependencies and implementation commitments, not merely the wording of the business plan.
- Complete the fee control. The FCA's application-fee guidance states that an application without the appropriate fee isn't treated as properly made and won't be considered until payment is complete. Pay through Connect, generally by credit or debit card at submission, and retain confirmation; cryptoasset registration is identified as Category 6, with payment due on or before applying.
- Reconcile the upload against the matrix. Check required attachments, entity names, declarations and approved versions. Open the uploaded files where possible, because an attachment name doesn't prove that the correct document was attached.
- Record the filing result. Save the submission date, reference, receipt and payment evidence in the controlled application folder. Don't assume that uploading documents establishes completeness or starts the timetable you expected.
Manage the assessment actively
- Prepare for case-officer scrutiny. Expect assessment of the business and its continuing ability to meet minimum standards, including checks involving UK or overseas regulators. Keep knowledgeable owners available rather than routing every technical question through someone unfamiliar with the arrangements.
- Log each follow-up request. Allocate an owner, deadline, evidence source and reviewer to each item. Expect further documents, calls or meetings, and check whether a response changes facts elsewhere in the application.
- Escalate unanswered requests. Missing responses are a substantive application risk, and FCA reporting records refusals where firms didn't respond. If a deadline is at risk, raise the issue promptly and propose a realistic response plan instead of allowing silence.
The first post-filing check should be the fee confirmation. After that, maintain a response log that distinguishes answered, awaiting evidence and awaiting approval, so management can see precisely what prevents the next response from being sent.
What Happens in a Regulator Interview and How to Prepare
A regulator interview tests whether the people named in the application understand their responsibilities and can explain how the business will operate. It's not a presentation contest, and polished answers won't compensate for unclear accountability.
Directors should be ready to explain the business model, funding and governance. For cryptoasset or AML-heavy models, the MLRO or financial-crime lead needs command of risk decisions and escalation; the person accountable for outsourcing should understand provider oversight and the consequences of service failure.
Rehearse decisions rather than speeches
Ask questions that require the responsible person to explain an action:
- Escalation: Why does this issue go to you, and what authority do you have to resolve it?
- Outsourcing: What information do you receive from the provider, and how would you identify deteriorating performance?
- Growth: What changes when customer activity exceeds current operational capacity?
- Readiness: Which arrangements operate now, and what must be completed before launch?
The distinction between a title and a responsibility matters. Where an FCA-approved person assessment is relevant, preparation should address the individual's actual role and competence rather than treating the application as a biography exercise.
Assemble a practical preparation pack
Prepare a one-page responsibility map showing decision owners, deputies and escalation routes. Pair it with a register of to-be-established arrangements, each with an owner, target date, dependency and completion evidence.
Run two mock sessions as an internal preparation exercise. In the first, have a colleague test explanations against the documents; in the second, challenge exceptions, provider failures and decisions that cross functional boundaries.
Use the FCA's discussion of application quality as a reminder that cryptoasset registration needs demonstrable operating controls, not generic financial-crime language. Managers should be able to explain what staff do in practice when an alert requires investigation.
If someone doesn't know an answer, establish who owns it and verify the facts afterwards. Don't encourage improvisation about a control that hasn't been implemented.
A confident answer that contradicts a policy does more damage than an accurate explanation that an arrangement isn't live yet.
Pitfalls That Stretch the Timeline and How to Fix Them
Kroll reported in December 2024 that 45% of approximately 1,500 firms applying to the FCA for authorisation for the first time between September 2023 and August 2024 were unsuccessful. That challenges the idea that submitting the form and supporting documents is the main hurdle, although the figure doesn't identify which stage failed.
A separate FCA review of asset-management authorisation applications found that 14% of 292 applications received between September 2024 and September 2025 were withdrawn or rejected because of poor-quality or incomplete information submitted initially. The useful lesson is about substantive quality, not document volume.
Diagnose the weakness before adding paperwork
Application pitfalls, causes and fixes
| Pitfall | Why it stalls the case | Fix before filing |
|---|---|---|
| Application fee not paid in full | Application isn't treated as made until the fee is paid | Reconcile the Connect payment confirmation against the filing record |
| Unsupported financial assumptions | Triggers follow-up questions and weakens credibility | Source each assumption and tie it to the business plan |
| Unclear outsourcing or safeguarding | Reviewers can't test oversight or client money handling | Name the provider, contract terms and oversight owner |
| Business plan and policies disagree | Contradictions suggest the model isn't operating as described | Run consistency checks in the evidence matrix |
| To-be-established arrangements without dates | Reviewers can't tell what will be live at launch | Label each item operating or planned, with a date and owner |
| Slow or missing responses to information requests | Refusals are recorded where firms didn't respond | Use a response log with a named owner and deadline |
| Weak cryptoasset registration evidence | The FCA flags cryptoasset registration as a particular concern | Build a process inventory with accountable person, system, thresholds and test evidence |
These are practical failure modes to test, not a ranked explanation of Kroll's unsuccessful applications. Don't infer a firm-specific approval probability from a broad historical figure.
Fix decisions before fixing prose
When the funding model is unsupported, another paragraph about financial resilience won't help. Obtain the missing evidence, revise the assumption or change the operating plan, then update the affected documents.
The same applies to outsourcing. If management hasn't decided who reviews provider performance, a polished oversight policy merely conceals an unresolved decision.
Before filing: Ask whether the proposed correction changes the business or only its description. If the underlying arrangement remains unclear, the drafting task isn't finished.
More documentation can make a weak application harder to repair by multiplying inconsistent statements. The earliest reliable opportunity to catch these issues is the evidence-matrix consistency review, before filing, rather than waiting for an interview to expose them.
Gap-Check Your Route Before You File
The final decision isn't whether the application looks finished. It's whether management can support its material claims and deliver the arrangements on which the application depends.
Use a go or no-go review with people who own the business decisions, not only the drafting team. An unresolved commercial dependency belongs in that discussion even if every mandatory form field contains text.
Apply the filing gate
- Is the route confirmed? Check the full activity inventory against the route table, including ancillary services. Where an activity requires another permission or a separate assessment, record that explicitly rather than forcing it into the main route.
- Is the payment path ready? Confirm access to Connect, authority to make payment and the person responsible for retaining the receipt. Resolve practical payment constraints before the submission meeting.
- Can every material risk be traced to a control? Require a documented owner, procedure, evidence source and management-information output. Where a control is planned, confirm the implementation dependency and how completion will be demonstrated.
- Do the documents agree? Test owners, customers and volumes across the approved package. Ask the relevant decision-maker to resolve discrepancies rather than allowing different authors to choose different answers.
- Can the named people explain the arrangements? Use the mock interview to identify misunderstandings about operating responsibilities. Correct the underlying allocation or procedure before rehearsing a smoother answer.
Decide what must stop filing
If a material answer is no, fix the gap first. A short internal delay can be less disruptive than regulatory assessment built around facts management later needs to retract or replace.
Distinguish missing substance from presentation improvements. An unclear control owner, unsupported funding assumption or unconfirmed route should stop filing; a cosmetic preference shouldn't keep an otherwise sound application in endless revision.
Your first action this week is to list every planned activity, including lending, custody, introducing business and handling client money, and map each to the appropriate route. Give every unresolved item an owner and a decision needed, so the list becomes a working control rather than another planning document.
Glentorion offers route scoping, application preparation and cross-document review for financial and crypto businesses, alongside management preparation for regulator interviews. If you need support identifying gaps or coordinating an approved FCA submission under an agreed mandate, visit Glentorion to discuss the activities, deliverables and responsibilities involved.
- FCA application process
- FSMA Part 4A
- FCA authorisation
- crypto registration
- regulatory application
