FCA Authorisation Process: A Step-by-Step Guide for 2026

The advice that circulates most often is simple: file early, then wait for the statutory clock to do the work. That advice wastes months. The FCA authorisation process does not start when someone uploads a half-finished pack. It starts when the Financial Conduct Authority can treat the submission as complete. Until then, queries, missing signatures and unpaid fees sit outside the formal timetable, and the firm is the one losing control.

A second habit is just as costly. Founders treat a determination as if it were permission to trade. It is not. The regulator can approve, refuse or see the application withdrawn, and the published service figures measure how often a decision lands inside the legal window, not how often a firm is authorised.

What works is treating the file as a controlled evidence system. Permissions, people, capital, policies and forecasts have to agree before Connect ever sees them. What does not work is describing an intended business and hoping clarification rounds will finish the design.

Table of Contents

• How the FCA Authorisation Process Unfolds Stage by Stage
  • Who drives which stage
• Choose the Right Permission Route Before You File
  • The crypto handover
• Build the Evidence Pack and File Through Connect
  • A custodian that fails its own matrix
  • Filing through Connect
• Answer Regulator Queries and Prepare for Interviews
  • A log that actually gets used
  • Interviews test the gap
• Common Deficiencies and How to Fix Them
• Budget the Application and Decide on Specialist Help

How the FCA Authorisation Process Unfolds Stage by Stage

Most delays start with a misread clock. For a complete application for Part 4A permission, the published framework gives the FCA a six-month decision period. Where the application is incomplete, the statutory period is generally 12 months, as set out in the FCA authorisations operating service metrics for 2024/25 Q4.

Those same Q4 metrics, covering January to March 2025, recorded 348 new-firm authorisation applications. The FCA determined 97.4% of complete or incomplete new-firm applications within the applicable statutory deadline, with category figures ranging from 96.0% to 97.5%. Across all authorisation metric areas, 99.1% of applications were determined within the statutory deadline. The same quarter saw 280 variation-of-permission applications determined, at 99.3% against the service standard.

Throughput is not a probability of approval. The statutory clock governs when the regulator aims to reach a decision. The FCA also publishes lower-quartile, median and upper-quartile calendar-day timings, which are better planning inputs than the legal maximum.

Who drives which stage

You own pre-application clarification, the quality of the Connect filing, the speed of answers and the credibility of what senior staff say in interview. The FCA owns allocation, the assessment against minimum standards, checks with UK or overseas regulators, and the determination itself.

Practical rule: Do not budget to the legal maximum. Read the quartile timings, then add time for the work you still control before the file can be called complete.

After a decision, supervision and the annual periodic fee replace the application clock. If the outcome is a withdrawal or a refusal, the next filing is a new evidence exercise, not a short edit of the old one.

Choose the Right Permission Route Before You File

The route you choose sets the evidence the FCA will assess, the fee category and, in some cases, the clock that applies. A money-laundering registration is not full authorisation. It covers a narrower purpose, while prudential resources, governance, conduct, safeguarding, outsourcing, technology and senior-management arrangements may require a separate regulatory assessment.

Set the perimeter before opening an application. Start with the services the firm will actually provide, not the label used in a pitch deck.

1. List the activities. Record every UK service, including functions that appear to be part of the product. A feature can change the regulatory perimeter even if the firm does not sell it as a separate service.
2. Map activities to permissions. Match each service to its likely permission route. Where activities fall under different regimes, keep their requirements distinct rather than forcing them into one account of the business.
3. Identify the customers. Retail and professional clients can require different conduct controls and evidence. A wholesale desk and a consumer app need control arrangements that reflect how each serves its customers.
4. Distinguish AML registration from FSMA permission. Firms offering in-scope crypto services, such as fiat-to-crypto exchange or custodial wallets, must register under the money-laundering regulations. That registration does not grant Part 4A permission.
5. Confirm the fee category before filing. The category follows the activities. Resolve it during route selection, since submitting first does not settle the fee question.

The crypto handover

For firms planning to enter the broader cryptoasset regime, the FCA's published timetable sets out pre-application support from July 2026, an application window opening on 30 September 2026, and a closing date of 28 February 2027. These are scheduled steps in a future authorisation process. Existing AML registration does not, by itself, cover permissions under that broader regime. The FCA's cryptoassets information for firms sets out the relevant route information.

The AML registration clock has its own start condition. The assessment period begins only after the FCA has received all required information, and the fee must be paid before it can consider the application. The three-month period therefore does not run from the first upload. Track outstanding information and payment status together: either can delay the start of substantive assessment.

A firm operating a fiat-to-crypto exchange may already hold AML registration and still need a separate FSMA case if its activities expand to custody. Check how custody, outsourcing or safeguarding changes the operating model before selecting the route. Any interim provider arrangement needs supporting contracts and an exit plan, rather than a general statement that a provider will be appointed.

Payment firms face a separate route choice. An authorised payment institution follows requirements that differ from those for crypto or investment permissions, so confirm the applicable category and scope before filing.

The decision to settle is which activities the firm will carry on from day one. Apply for that scope with evidence. If later services are not ready, identify them clearly as future plans or leave them out of the initial application.

Build the Evidence Pack and File Through Connect

Preparation is an evidence-and-consistency exercise, not a form-filling task. The FCA will not review draft documents. Every paper in the pack has to be final, internally approved and appropriately signed before it goes through Connect, which is the standard described in the FCA's guidance on how to apply for authorisation.

Build the pack in this order. Each gate has to close before the next one starts, because later documents copy earlier ones.

1. Permission-to-evidence matrix. Link each permission to the policies, systems, people and forecasts that prove it. If a cell is empty, you do not have a file yet.
2. Threshold-condition map. Take the business model, customer types, governance, controllers, responsible individuals, capital, outsourcing and systems, and show how each meets the minimum standards the firm must keep meeting after launch.
3. Regulatory business plan. Write the proposition you will run. A pitch that describes a larger future firm creates queries you cannot answer with today's controls.
4. Three-year forecasts. Where forecasts apply, reconcile them to the plan and to capital assumptions. A revenue line with no matching cost for the control that produces it will not survive a read-across.
5. Assumptions register and ownership table. Every name, date and figure needs one source. When two documents disagree, the case officer does not pick the kinder version.
6. Management sign-off. Approve and sign final versions only. A board paper that predates the risk appetite it relies on is a day-one query.

A custodian that fails its own matrix

Take a custody applicant whose wallet-key policy describes controls the firm will perform, while the operating model assigns those keys to an outsourced provider that has not been contracted. The forecast still shows no vendor cost. Align the policy, the outsourcing description and the cost line before filing. Otherwise the three documents accuse each other.

Financial crime controls need the same treatment. A generic policy will not stand in for a financial crime risk assessment that matches the customers, corridors and products in the plan.

Filing through Connect

1. Confirm access. Check Connect logins and name the firm contacts who will receive questions. A shared inbox with no owner is how a two-week query becomes six.
2. Complete the forms from signed sources. Copy figures from the approved pack. Do not retype "about" numbers into the form.
3. Pay at submission. Identify the fee category and pay by credit or debit card. Payment is required before an application can be submitted.
4. Run the age check. Blank mandatory fields, mismatched dates and individual-controller criminal checks older than six months all fail this gate. Re-run checks against the filing date, not against the date you first ordered them.
5. Submit and save the confirmation. That confirmation fixes the date the process is measured from, but only once the FCA can treat the submission as complete.
6. Log the case officer. Record the name and reference as soon as allocation lands. Every later answer should cite that reference and the evidence, not a fresh explanation.

A payments applicant that uploads a board paper dated before the final risk appetite was approved will usually see a query immediately. The paper is not wrong because it is old. It is wrong because it disagrees with the document the board later signed.

If a control is not built, say so and date the implementation plan. Silence reads as a claim that the control already operates.

The case officer then tests whether the firm meets, and will continue to meet, minimum standards, and may check information held by UK or overseas regulators. Your job at that point is to answer from the pack you have already reconciled, not to redesign the firm in the reply.

Answer Regulator Queries and Prepare for Interviews

A regulator decision within the statutory timetable is not the same as authorisation. The application runs on two clocks: the firm's response deadlines and the FCA's assessment period. Under the statutory framework discussed earlier, the six-month period applies to a complete application, while an incomplete one can take up to twelve months. The clock depends on whether the file is complete, so treat each response as part of the evidence record, not as an informal email exchange.

FCA material on the banking authorisation process describes delay drivers for banking applications. These include incomplete or poor-quality submissions, weak cooperation, delays implementing systems and controls or securing sufficient capital, and slow replies to information requests. These examples concern banking authorisations; they should not be read as a breakdown of delays across every FCA permission route.

The filing team can address the first issue before submission. For the others, show which controls and capital arrangements operate now, which remain in development, and who owns each dated commitment. Delayed answers can extend the assessment and expose gaps between the application and the firm's actual readiness.

A log that actually gets used

Keep one live question-and-response log with five fields: question, owner, due date, evidence reference and status. Review it at least twice a week, and assign an accountable executive to each commitment, including administrative tasks.

• Cite the document. Refer to the relevant policy, forecast line or contract. General assurances do not answer an evidence request.
• Label the control. State whether it is operational, in development or planned. Give a date for controls that are not yet live.
• Close the loop. Update the same log entry when the case officer follows up. A reply that overlooks the earlier answer can create a contradiction in the record.

Interviews test the gap

Identify the senior managers and responsible individuals who may attend, then map each person to the controls they own. Interview questions often test the difference between arrangements operating today and those promised for launch. Practise concise answers grounded in the submitted evidence. If a control is still being built, say so and explain its status plainly.

Preparation for an FCA approved person can help individuals explain their responsibilities, even when the firm's formal permission route differs. They should be able to describe the control in their own words, rather than recite policy language.

Use a practical measure of readiness: mandatory fields answered, financial assumptions reconciled, evidence identified for each material control, and queries answered promptly.

Your metric is first-pass completeness: no unanswered mandatory fields, reconciled financial assumptions, evidence for every material control, and a prompt response to every query.

Slow replies can do more than delay a decision. They may also raise questions about whether the firm can operate the control framework it has described.

Common Deficiencies and How to Fix Them

A decision within the statutory timetable does not mean an application has succeeded. Between 1 April 2023 and 1 April 2024, the FCA determined 310 applications from firms seeking to operate in the UK asset-management sector: 253 were approved, 3 were rejected and 54 were withdrawn. The FCA's note reports that 18% were withdrawn or rejected, and identifies concerns such as poor-quality information among the issues it discusses. It does not mean that every withdrawal or rejection had the same cause. See the FCA's asset management applications and what to consider.

The timing figures use different outcomes and should not be compared as if they measured the same thing. The FCA reported that 73% of applications were approved in under eight months. Separately, 56% were determined in less than six months. Approval is a positive outcome; determination means the FCA reached a decision, which can also be a rejection. Track completeness and outcome separately when assessing your own timetable.

Treat the application as a controlled evidence system. Each claim should match the underlying document, have an accountable owner and reflect the firm's actual readiness. Read the file as an examiner unfamiliar with the team. Check every figure against the forecasts, and make sure the responsible person can explain how each control works. Remove claims about arrangements that are not in place. If a change will take time, state its status and expected date clearly rather than leaving the FCA to infer it.

The statutory six- or twelve-month framework is not a promise that a weak file will be resolved within that period. The clock depends on the application meeting the relevant completeness requirements; clarification requests and unresolved gaps can affect how the case progresses. A refusal or withdrawal is a different outcome from rework. Prevent avoidable delays by checking the evidence, owners and document versions before filing, then respond accurately when the FCA identifies a gap.

Budget the Application and Decide on Specialist Help

The application fee is only one part of the filing cost, and it should be confirmed against the FCA's current fee information before submission. The FCA requires payment through Connect by credit or debit card when the application is submitted. Treat the fee as a separate budget line from the annual periodic fee that may apply after authorisation. The FCA's guidance on what firms need to do under the new cryptoasset regime is specific to that regime, so do not use it as the source for general application-fee amounts. Classify the fee while scoping the activities. Connect will not accept an invoice to follow.

Budget for the fee, the internal time needed to assemble and reconcile the evidence, and any external advice. Keep rework and delay as separate lines. If a deficiency pushes the filing back, revenue may also be deferred while running costs continue.

Specialist help is most useful when the filing crosses several activities or jurisdictions, evidence is split across teams, or a material fact changes late. It also helps when no one internally can explain how the proposed controls work, or the launch date leaves little room to withdraw and improve the application. Those are practical triggers, not a reason to outsource by default.

A firm can prepare internally and commission a pre-filing review, or ask an adviser to own defined deliverables from the outset. Regulatory compliance consultants and in-house teams can divide the work when responsibilities and sign-off are clear. Glentorion is one firm that scopes work to the route and agreed deliverables, reviews packs with tracked findings, coordinates evidence, and prepares staff for interviews. It can also submit under a mandate after internal approval and client sign-off. Law firms and other consultancies may cover overlapping tasks. Choose a scope your team can oversee and verify.

---

Glentorion helps financial and crypto firms assess the FCA route, assemble a consistent evidence pack and prepare senior managers for case-officer questions and interviews. For a new permission, a variation or a crypto transition case, a scoped review can clarify the activities, existing documents and ownership of each filing task. Discuss the route and proposed deliverables with Glentorion.