FCA Authorisation for Firms: Application Guide
Published
FCA authorisation for firms isn't secured by completing the right forms, attaching a business plan and paying an application fee. The FCA is testing whether the proposed business can operate safely, whether its senior managers understand the model, and whether its controls work in practice. The application is a written case for authorisation, not an administrative exercise.
That distinction matters most for firms with complex operating models, overseas dependencies, digital assets, or plans to scale quickly. A credible submission connects activities, permissions, people, systems, financial assumptions and customer outcomes. A polished set of policies that doesn't match the operating model creates more risk than a shorter, candid application that clearly identifies what exists, what is being built and who is accountable.
Table of Contents
- The Reality of the FCA Application Process
- Decoding the Five Threshold Conditions
- Scoping Routes and Building the Application Package
- Navigating the 2026 Crypto Authorisation Gateway
- The Value of Integrated Regulatory and Systems Consulting
- Submission Timelines and Life on the Financial Services Register
The Reality of the FCA Application Process
Many founders approach FCA authorisation as a compliance formality. They assume that if the business describes its services clearly, pays the fee and answers every question, approval should follow. That approach fails because the FCA assesses the substance behind the application, not just the completeness of the paperwork.
The regulator's own asset-management data illustrates the point. Between April 2023 and April 2024, 18% of applications were withdrawn or rejected, including cases involving poor-quality information, while 73% were approved in under 8 months and 56% in less than 6 months, as set out in the FCA's asset-management application findings. Those figures aren't a prediction for every firm or sector. They are a useful warning that application quality and applicant readiness materially affect the experience.
Processing speed isn't the same as applicant readiness
The FCA tracks its own authorisation performance as a formal service metric. For complete applications, it usually aims to decide within 6 months for a FSMA firm and within 3 months for a payments or e-money firm. In its 2025/26 Q4 metrics, the FCA reported that 97.6% of applications across all metric areas were determined within the relevant deadlines, while 99.2% were determined within existing statutory deadlines alone, according to its authorisation application guidance.
Those measures tell boards how the regulator manages its process. They don't tell an applicant whether its submission will be accepted without challenge, how many clarification requests it will receive, or whether senior management can explain the proposed controls under questioning. A regulator can process an application on time and still require substantial additional evidence from the firm.
The practical consequence is uncomfortable but important:
A fast regulatory process doesn't compensate for a weak evidence base. It gives an unprepared applicant less room to discover its own contradictions.
Why applications lose credibility
The FCA identifies recurring weaknesses in asset-management submissions, including poor senior-management arrangements, inadequate evidence of competence and seniority, misunderstanding the Location of Offices threshold condition, and failure to identify and mitigate risks within the business model. These aren't isolated drafting errors. They show that the applicant hasn't translated its commercial proposition into an accountable control environment.
A board should therefore challenge the application team on questions such as:
- Who owns each activity? Every regulated activity should map to a responsible senior manager with the authority, competence and capacity to oversee it.
- What evidence supports the model? Customer journeys, reconciliations, safeguarding arrangements, outsourcing oversight and incident procedures should be more than policy statements.
- Where are the dependencies? The application should expose reliance on group entities, overseas staff, vendors, liquidity providers, technology platforms and key individuals.
- What happens when the plan fails? A credible business model addresses wind-down, service continuity, operational disruption, customer harm and financial stress.
The firms that struggle most often submit documents that sound reasonable individually but don't agree with each other. The business plan describes one customer journey, the financial model assumes another, and the policies describe controls that the proposed team can't yet operate. FCA authorisation for firms should be treated as an evidence-building exercise from the outset, with consistency tested before submission.
Decoding the Five Threshold Conditions
The FCA's threshold conditions provide the foundation for the assessment. For international firms, the FCA identifies five named tests: location of offices, effective supervision, appropriate resources, suitability and business model. The FCA also states that it applies the same standards to international firms as to UK firms and authorises the whole firm, including its UK and overseas offices, as explained in its guidance for international firms.
These conditions aren't five boxes to tick at the end of the drafting process. They should shape the application architecture from the beginning.
Location of offices
The FCA needs to understand where the firm is operating its UK business. An address on an application form isn't enough if the relevant decision-making, oversight and day-to-day activity occur elsewhere. The applicant should show how the UK office functions, which staff are based there, what responsibilities they hold and how the FCA can supervise the regulated business.
This becomes more difficult when the firm relies on an overseas group. The application must distinguish genuine group support from the UK firm's own accountability. Shared services may be workable, but the UK entity still needs effective governance, access to information and sufficient control over its regulated activities.
Effective supervision
Supervision depends on transparency. The FCA must be able to understand the firm's structure, activities, risks, customer base and material dependencies. Complex ownership chains, informal reporting lines or unclear outsourcing arrangements make that assessment harder.
For international groups, the applicant should set out which regulator supervises each relevant entity, how information flows between supervisors and how the UK firm manages conflicts between group priorities and UK regulatory obligations. A group chart alone won't answer those questions.
Appropriate resources
“Appropriate resources” extends beyond regulatory capital or cash. Under the FCA Handbook, the condition includes systems, controls, plans, policies and human resources, assessed against the nature and scale of the business, continuity risks and the regulated activities the firm carries on or seeks to carry on. The FCA Handbook threshold conditions makes that non-financial dimension explicit.
The right test is not whether the firm has written a policy. It is whether the people, technology and management information exist to operate the policy. A firm seeking permission for custody, payments, investment management or cryptoasset activity should be able to demonstrate how it will monitor risk, handle exceptions, protect customers and escalate problems.
Suitability and business model
Suitability covers the firm and the people responsible for it. The FCA will consider competence, integrity, governance and the quality of decision-making. A senior manager who can describe a commercial strategy but can't explain customer harm scenarios or control testing creates an avoidable weakness.
The business-model condition asks whether the firm's strategy is sound in relation to its regulated activities. That includes revenue assumptions, customer acquisition, product design, risk appetite and the consequences of growth. The strongest applications connect commercial decisions to controls. They don't present risk management as a detached compliance annex.
A useful board review asks whether every proposed permission has a clear owner, every material risk has a control, and every control has an operator, evidence source and escalation route. That is how the threshold conditions become operational rather than theoretical.
Scoping Routes and Building the Application Package
The application package should begin with a regulatory perimeter analysis, not a document list. Define what the firm will do, for whom, from which entity, in which jurisdiction and with what degree of discretion over customer assets, orders, money or investments. The answer may point towards a new authorisation, an extension or variation of permission, a different perimeter analysis, or a decision not to enter a particular activity.
That scoping exercise should also account for the target customer and delivery channel. A business that describes itself as a technology provider may still be carrying on a regulated activity if its interface enables customers to place orders or access a regulated service. Conversely, a firm may be able to separate a technology service from regulated execution if its operating arrangements clearly support that distinction. The analysis must reflect how the service works in reality.
Make the documents agree
A sound application package has a single factual spine. The business plan, financial projections, governance documents, policies, customer journeys, outsourcing register and application answers should all describe the same business.
A practical review can test the following relationships:
- Activities and permissions: Each service should map to the permission sought and to a defined customer journey.
- People and accountability: Each regulated activity should have a named accountable owner, supported by an organisation chart and reporting structure.
- Financial assumptions and operations: Revenue, costs, staffing and capital assumptions should match the operating model and growth plan.
- Controls and evidence: Each important control should identify its operator, frequency, output, escalation point and source of management information.
- Current and planned arrangements: The application should distinguish controls already in operation from those that will be implemented before launch.
The last distinction is critical. A firm shouldn't present an intended future control as if it already exists. It should explain the implementation milestone, accountable owner, testing approach and dependencies. Candour gives the regulator a clearer basis for assessing readiness.
Treat the fee as a governance decision
Application fees vary across 10 pricing categories, from £280 in category 1 to £225,170 in category 10. Category 6 is listed at £11,260, and the FCA states that the fee isn't refundable if the application is unsuccessful, as set out in its authorisation and registration fee schedule.
The fee shouldn't be the main cost consideration. Management time, specialist advice, remediation, control implementation and the opportunity cost of a delayed launch can be more significant. Before filing, the board should approve not only the fee but also the evidence plan and the resources required to respond to questions.
A tracked review is more useful than a general proofreading exercise. Record each finding, the affected documents, the person responsible, the decision required and the evidence needed to close it. This approach exposes contradictions early, particularly where a change to the business model affects financial projections, customer disclosures, governance or operational procedures.
Navigating the 2026 Crypto Authorisation Gateway
Crypto firms face a transition from a registration-led model to full FSMA authorisation. The FCA states that firms carrying out in-scope crypto activities must be authorised under FSMA, with the application window running from 30 September 2026 to 28 February 2027. Firms that don't apply must run off their UK crypto business before the regime commences, as described in the FCA's announcement on the regulated crypto gateway.
The central question for an existing business is not, “Have we registered for money-laundering purposes?” The more useful questions are:
- Does the firm's existing permission cover the proposed activity?
- Does the business need a new FSMA authorisation, a variation of permission, or both?
- Which entity carries on each activity?
- What can the firm continue doing while its application is assessed?
- Can the operating model satisfy the new expectations on consumer protection, safeguarding, market integrity and financial resilience?
Sequence the transition, don't just file
A payments or e-money firm may already have governance, safeguarding and operational controls, but that doesn't automatically establish that it can conduct in-scope crypto activities under the new regime. An existing UK crypto business may have customer relationships and systems, yet still need to demonstrate that its controls meet the wider prudential and conduct standard.
The right transition plan starts with an inventory of activities and permissions. Map each product, wallet function, interface, custody arrangement, execution flow and customer type to the relevant legal entity. Then identify which controls can be reused, which need strengthening and which must be created.
Continuity planning deserves separate board attention. The firm should model what happens if the application is incomplete, if the FCA requests further information, if a permission is narrower than expected, or if a critical vendor cannot support the proposed control framework. A firm shouldn't promise uninterrupted service unless its legal route and operating arrangements support that promise.
The gateway tests the whole proposition
The new regime changes the risk of treating compliance as a filing project. The FCA will be concerned with whether customers are protected, assets and money are safeguarded, markets operate with integrity and the firm has the financial and operational resilience to continue responsibly.
For a crypto firm, that means the application should connect blockchain or wallet architecture to governance and control evidence. Explain who can approve listings, how transactions are monitored, how suspicious activity is escalated, how customer assets are reconciled, how private-key or access risks are managed, and how incidents affect customers.
Overseas firms need to be especially careful. Serving UK customers from outside the UK doesn't remove the need to analyse the UK perimeter, the relevant entity and the practical ability of the FCA to supervise the business. The application should address the firm's full operating footprint rather than treating the UK presence as a nominal wrapper.
The Value of Integrated Regulatory and Systems Consulting
An FCA application is judged through the operating model behind the paperwork. Legal analysis establishes the relevant permission, interprets the rules and shapes policies. The firm must then demonstrate that its people, systems, data, workflows and management decisions can produce the outcomes those documents promise.
An integrated approach connects those elements. Regulatory judgement defines what the FCA needs to see. Systems thinking assigns each requirement to an owner, process, control, dependency and item of evidence. Engineering disciplines can test whether the resulting arrangements work together, remain maintainable and can support the business as it develops.
Evidence should have traceability
Treat the application as a connected evidence set. A change to the proposed customer journey, for example, may alter the permission analysis, financial model, Consumer Duty assessment, safeguarding procedure, outsourcing arrangements and risk register. If those effects are not tracked, inconsistencies can surface during review or interview.
A structured evidence matrix should record:
- The regulatory proposition: What activity the firm will undertake and why it fits the proposed route.
- The accountable person: Who owns the relevant decision, control or process.
- The supporting artefact: Which policy, procedure, system record, contract or management report demonstrates that the arrangement exists.
- The implementation state: Whether the control is live, under test or still to be established.
- The change impact: Which other answers and documents require review if the proposition changes.
This structure gives the board a clearer view of readiness. It also lets the application team trace an FCA question back to the underlying process and identify every affected document.
Software can assist with cross-document consistency checks, source tracking, issue registers and next-action management. AI tools may help classify material, compare drafts and prepare working text. Human review remains necessary because automated comparison cannot determine whether a control is proportionate, whether a senior manager has genuine authority or whether the business model is credible.
Prepare people, not just papers
Interviews reveal weaknesses that polished documents can hide. Senior managers should explain the firm's customers, revenue model, key risks, control ownership, outsourcing dependencies, escalation routes and assumptions without relying on prepared wording.
Preparation should use the actual application and test whether management gives consistent answers about:
- how the firm identifies and manages customer harm;
- how incidents reach the board;
- how management information is produced and challenged;
- what happens if a critical supplier fails;
- how the firm would wind down or protect customers under stress;
- which controls are already live and which depend on future implementation.
Legal advice and integrated regulatory systems consulting serve different functions. Legal advisers may lead perimeter analysis, documentation or specialist interpretation. A systems-led team may focus on operating arrangements, evidence architecture, workflows and interview readiness. The board should set those responsibilities clearly and retain ownership of the final proposition.
For firms assessing this model, Glentorion combines regulatory consultants with software, systems and AI engineers to prepare and review applications, coordinate evidence and ready management teams for regulator interviews. The value lies in connecting those activities while accountable management and specialist legal advice remain in place.
Submission Timelines and Life on the Financial Services Register
Submission is the start of the regulatory assessment, not the end of the project. Once the application is filed, the firm must preserve a controlled version of the facts, respond to requests accurately and ensure that changes in people, services, ownership, financial assumptions or controls are assessed for their effect on the submission.
The FCA's usual decision period is 6 months for a complete FSMA application and 3 months for a complete payments or e-money application, subject to the relevant route and the quality of the submission. The applicant's job during that period isn't to wait passively. It should maintain a response team, an evidence log and a decision process for questions that require management or board approval.
A realistic post-submission routine
A regulator's information request often reveals where the application is difficult to follow. The wrong response is to send an isolated document that answers one sentence but conflicts with the rest of the package. The right response explains the answer, identifies any consequential changes and updates affected materials through controlled document management.
A disciplined team should:
- Log each request: Record the question, owner, deadline, source document and required approval.
- Test the answer: Check the response against the business plan, financial model, policies and operating arrangements.
- Escalate material changes: Bring changes in scope, ownership, risk or implementation status to the appropriate senior manager and board forum.
- Prepare the people involved: Ensure responsible managers can explain the answer and its practical operation.
- Preserve the record: Retain the submitted version, correspondence, evidence and final decisions.
Interview preparation should follow the same approach. Managers don't need rehearsed slogans. They need a clear understanding of their responsibilities and the evidence that supports their answers. If a control isn't live, they should say so and explain how, when and by whom it will be implemented.
Authorisation creates an ongoing public record
The FCA's Financial Services Register is the public record for firms and individuals that are, or have been, authorised by the FCA or PRA. It records authorisation status and permissions, and now includes Directory Persons data for firms regulated solely by the FCA and for firms regulated by both the FCA and PRA.
That makes the Register more than a launch announcement. Customers, counterparties, advisers and internal teams can use it to check the firm's status and permissions. A firm that changes its business but fails to keep its permissions, governance information or regulatory disclosures aligned creates avoidable credibility and conduct risk.
Authorisation also brings a continuing management obligation. The board must monitor whether the firm still meets the threshold conditions, whether its resources remain appropriate, whether new products alter the regulatory perimeter, and whether regulatory change affects policies, systems or accountable individuals. For digital-asset businesses, that includes treating new products as governance decisions rather than only technical releases.
The strongest applicants therefore plan beyond the Register entry. They build a compliance operating model that can absorb new permissions, staff changes, outsourcing decisions, incidents and regulatory developments without losing the factual discipline that made the original application credible.
Glentorion helps financial and crypto businesses scope the correct FCA route, build coherent application packs, review evidence with tracked findings and prepare management for regulator interviews. Visit Glentorion to discuss an authorisation project grounded in your activities, permissions, operating model and readiness needs.
- fca authorisation for firms
- fca application process
- crypto regulation uk
- threshold conditions
- regulatory consultancy
