FCA Compliance Requirements Checklist

The most popular advice on FCA compliance requirements is to start with the application forms. That advice is incomplete. The harder question is whether your business can prove that its proposed controls exist, have named owners, produce reliable evidence and work consistently across the operating model.

The FCA treats authorisation as an evidence-based gateway, not a purely administrative filing. A credible application therefore connects the business model to permissions, governance, financial resources, technology, financial-crime controls and management accountability. Policies matter, but a policy that describes a capability the firm hasn't implemented can create more risk than a policy that candidly identifies a controlled implementation plan.

Table of Contents

• Redefining FCA Compliance as an Evidence Problem
  • What the FCA needs to understand
• Core Threshold Conditions and Principles for Businesses
  • Translate the route into evidence
  • Fit, capability and operational readiness
• Governance Structures and Management Accountability
  • Build accountability into the evidence matrix
  • Make management interview-ready
• Operational Systems and Financial Crime Controls
  • Design the control chain
• Navigating Cryptoasset Registration and Future Authorisation
  • Compare permission with transition planning
• Financial Promotion Rules for Digital Assets
  • Treat Article 73ZA as a narrow route
• Application Packaging and Interview Readiness
  • Package the application in controlled layers
  • Rehearse the regulator's questions
• Post-Authorisation Obligations and Enforcement Realities
  • Convert policies into operating routines
• Quick Reference Checklist for Ongoing Compliance
  • Six control questions for the board
  • Keep change inside the control system
• Scoping Your Regulatory Route and Next Steps
  • Assemble the decision set

Redefining FCA Compliance as an Evidence Problem

Public guidance says that firms carrying on regulated financial activities generally need FCA authorisation and must meet conditions appropriate to their business. It doesn't, by itself, explain sufficiently how an applicant should demonstrate that controls are operational, owned by named people and consistent across the business plan, financial forecasts, policies and governance materials. The practical gap is where many applications weaken. The UK Government's FCA registration guidance is a starting point for identifying the regulatory gateway, not a substitute for an evidence architecture.

A board should ask a more demanding question than, “Have we completed every form?” Ask instead, “What would a reviewer see if they tested this control tomorrow?” That question changes the work. Customer due diligence becomes a workflow with records, exception handling and oversight. Outsourcing becomes a documented allocation of responsibility. A financial forecast becomes an explanation of how capital, staffing and control investment support the proposed permissions.

What the FCA needs to understand

The application should make five things clear:

• What the firm will do: Describe each regulated activity, customer type, product and distribution channel precisely.
• Who controls it: Identify the accountable senior manager, operational owner and escalation route.
• How it operates: Show the procedure, system, approval point and exception process.
• What proves operation: Link the control to records, testing, management information or other evidence.
• What remains to be completed: Separate live arrangements from pre-launch commitments and assign implementation dates.

The FCA's authorisations performance data shows that 99.3% of applications across all reported metric areas were determined within the relevant statutory deadline during October to December 2024, compared with 98.5% during July to September 2024. Those figures describe processing timeliness, not an applicant's probability of approval, as explained in the FCA's governing legislative framework. They also shouldn't be mistaken for evidence that an application is quick or routine.

Practical rule: Never present a planned control as operational. Label its status, owner, dependency, test evidence and target implementation date.

A complete submission gives the regulator a coherent account of the business. Contradictions between the business plan, forecasts and policies invite questions. Missing ownership makes otherwise sensible controls difficult to supervise. Evidence-led preparation is therefore not an administrative extra. It is the mechanism through which the FCA can assess whether the proposed firm is ready to operate within its permission route.

Core Threshold Conditions and Principles for Businesses

The baseline is not merely a well-written business plan. An applicant must demonstrate that it can comply with the FCA Principles for Businesses, relevant Handbook rules and, where applicable, the FSMA threshold conditions, as set out in the FCA's application guidance. The exact analysis depends on the permissions sought, the firm's activities, its structure and the risks created by its customers and products.

The regulator will expect the application to explain why the business model is compatible with the proposed permissions. That means defining the revenue model, customer journey, product boundaries and distribution arrangements without leaving material assumptions implicit. A business that seeks permission for one activity but describes adjacent services as though they're already covered creates perimeter uncertainty from the outset.

Translate the route into evidence

Build the application around an evidence matrix rather than a document list. Each row should connect a regulated activity to:

1. Permission analysis, including why the activity falls within the proposed route.
2. Business model evidence, including customers, counterparties, revenue and operational dependencies.
3. Financial assumptions, including projected income, expenditure, liquidity needs and resources.
4. Governance ownership, including the relevant senior manager and committee oversight.
5. Control documentation, including procedures, systems and escalation arrangements.
6. Testing or implementation evidence, showing whether the control is live or still being built.

Financial information must be complete and internally consistent. Forecast assumptions should align with staffing plans, outsourcing costs, technology expenditure, customer volumes and the control environment. If the business plan assumes a mature compliance team but the recruitment plan shows those roles won't exist until after launch, the discrepancy needs a documented explanation and a credible mitigation.

Fit, capability and operational readiness

Key role holders need appropriate qualifications, experience and capacity for their responsibilities. The question isn't whether a person has an impressive CV in isolation. It is whether that person understands the proposed business, has sufficient authority, can challenge commercial decisions and can evidence the control environment they're responsible for.

Technology should be treated in the same way. A vendor's capability statement doesn't prove that your firm has configured access controls, retained records, monitored alerts or established resilience arrangements. The application should explain how management will oversee outsourced providers and how the firm will obtain evidence that the service is operating as intended.

Governance Structures and Management Accountability

Weak applications often use collective language. “The compliance team will monitor risk” sounds reassuring until the reviewer asks who performs the review, which system produces the information, who approves an exception and who reports the result to the board. FCA compliance requirements become tangible only when responsibility is allocated to identifiable people.

Start with a responsibility map covering the proposed permissions, key functions, committees and outsourced arrangements. For each material control, record the accountable senior manager, day-to-day owner, reviewer, escalation point and evidence location. This map should agree with the business plan, governance chart, statements of responsibilities and application forms.

Build accountability into the evidence matrix

A useful matrix includes these fields:

• Activity and risk: What regulated activity is being performed and what can go wrong?
• Responsible manager: Which person is accountable for the outcome?
• Operating procedure: What does the firm do, and when?
• System or record: Where is the activity performed and what evidence is retained?
• Review cadence: Who checks quality, exceptions and overdue actions?
• Testing result: What testing has occurred, and what remediation followed?
• Implementation status: Is the arrangement live, in build, or dependent on another decision?

This approach prevents a common failure mode: a policy assigns responsibility to a role that hasn't been filled, while the application presents the role as fully operational. If a function will be outsourced initially, document the provider, contract scope, oversight method, service information, exit considerations and internal accountability. Outsourcing may transfer performance of a task, but it doesn't remove the firm's responsibility for controlling the risk.

Controllers also need to obtain a recent criminal-record check, normally no more than six months old at submission. Treat that check as one item in a broader due-diligence file, not as a substitute for assessing competence, integrity, conflicts and capacity.

Make management interview-ready

Senior managers should be able to explain their responsibilities without reading a policy. They should know the principal risks, key controls, management information, open issues and decisions awaiting board approval. They should also be able to distinguish between a control that has operated and one that exists only in a project plan.

The strongest interview answer connects responsibility, action, evidence and escalation in that order.

Run structured rehearsals using the firm's own artefacts. Ask who approved a sample customer, how an alert was escalated, what happens when a vendor fails, where a breach is recorded and how the board learns about unresolved risk. If the answer depends on a future hire, future system or future policy approval, say so and explain the interim control.

Operational Systems and Financial Crime Controls

Risk-based requirements aren't a licence for informal controls. A firm must take reasonable care to establish and maintain effective systems and controls for regulatory compliance and to counter the risk that it may be used to facilitate financial crime. The framework needs to be complete and proportionate to the nature, scale and complexity of the business.

For UK cryptoasset businesses, the business-wide risk assessment is foundational. The FCA expects it to exist before registration or authorisation, remain current and be reviewed after material changes, as described in its anti-money laundering webinar materials. It should drive the customer-risk methodology, due-diligence requirements, monitoring scenarios and management information. A document that sits separately from the operating model has limited value.

Design the control chain

A workable framework should show how risk moves from assessment to action:

• Risk taxonomy: Define threats by customer, product, geography, channel, transaction and delivery model.
• Customer-risk methodology: Explain risk factors, scoring logic, review triggers and enhanced-due-diligence conditions.
• Onboarding controls: Set identity, beneficial-owner, source-of-funds and approval requirements.
• Monitoring scenarios: Match scenarios to the firm's products, transaction flows and known typologies.
• Escalation process: Specify alert ownership, investigation standards, suspicious-activity decisions and management reporting.
• Sanctions controls: Cover screening, matching logic, disposition of alerts and restricted activity.
• Travel Rule handling: Document how relevant originator and beneficiary information is collected, transmitted, received and retained.
• Independent testing: Set out the testing scope, findings, remediation ownership and board reporting.

Technology choices must follow the risk assessment. Automated monitoring can improve consistency, but it doesn't remove the need for scenario governance, tuning, access controls, alert review and management oversight. AI-assisted workflows need clear human accountability, data governance, exception handling and records that allow the firm to explain how an outcome was reached.

A board should also test whether the framework survives operational stress. Consider a sanctions hit during a busy onboarding period, a data outage affecting transaction monitoring, a missing Travel Rule field, an outsourced provider that stops responding, or a material change to the business model. The answer should identify the decision-maker, fallback procedure, record created and escalation route.

Navigating Cryptoasset Registration and Future Authorisation

Cryptoasset businesses often use “FCA compliance” to describe two different regulatory questions. Registration under the existing anti-money-laundering regime addresses the relevant registration route and financial-crime controls. It isn't the same as permission to conduct every activity in a broader future FSMA authorisation framework.

The historical application outcomes show why route selection and readiness deserve separate analysis. Since January 2020, 391 cryptoasset applications had been determined, with 68 registered, 46 rejected, 14 refused and 263 withdrawn, according to the FCA's cryptoasset registration information.

The 67% withdrawal figure is especially relevant to applicants planning their operating model. It doesn't establish why each application was withdrawn, so it shouldn't be treated as a direct measure of a particular failure. It does, however, underline the practical importance of resolving ownership, business-model, governance, financial-resource and control questions before submission rather than relying on the process to discover them.

Compare permission with transition planning

Registration should be mapped against the activities the business intends to perform. Identify what the current route permits, what it doesn't permit, which promotions require a separate legal route and which future permissions could affect custody, trading, dealing, safeguarding or other services. This analysis should sit alongside a transition plan, not in a separate legal memo that operational teams never use.

The UK government has announced work on a proposed provisional-licences authorisation regime for early-stage firms. That proposal is a policy development, not a current permission, and it wouldn't remove the need for credible governance, financial resilience, systems, financial-crime controls and responsible management. A firm that designs only for today's registration route may later face expensive redesign.

Use a route register with three columns: permitted now, proposed later and not covered. For every proposed service, record the legal analysis, control dependency, responsible owner and change impact. That makes the business model easier to explain and reduces the risk that commercial teams market a service before the regulatory route supports it.

Financial Promotion Rules for Digital Assets

From 8 October 2023, qualifying cryptoassets became subject to the UK financial-promotion regime under section 21 of FSMA, including where the firm marketing to UK consumers is based outside the UK. The relevant issue is whether the communication can have an effect in the UK, rather than just where the business is incorporated or where the technology operates. The FCA's guidance consultation on cryptoasset promotions sets out the framework.

A promotion can be communicated lawfully through four routes:

1. An FSMA-authorised person communicates it.
2. An unauthorised person communicates it, but an appropriately authorised firm approves it.
3. An FCA-registered cryptoasset business communicates it, or it is communicated on its behalf under the Article 73ZA exemption.
4. Another applicable exemption applies.

Each campaign needs a route analysis before publication. Record the asset, audience, channel, communicator, approving entity, content owner, jurisdictional assumptions and evidence supporting the chosen route. “The group is registered” isn't enough. The route may depend on who prepared the content, who communicated it and whether the approver's permission covers the relevant activity.

Treat Article 73ZA as a narrow route

Article 73ZA isn't a general permission to market cryptoassets in the UK. It applies to a promotion relating only to one or more qualifying cryptoassets when communicated by an FCA-registered person, or on behalf of that person where the promotion is non-real-time and the registered person prepared the content. Firms should retain evidence showing who prepared the promotion, which registered person controls it and why the communication satisfies the exemption.

The FCA Handbook states that, from 25 October 2027, Article 73ZA will be available only to a person within the scope of regulation 53 of the Cryptoassets Regulations, as set out in PERG 8. That is a future transition point, so businesses should monitor the final legal position rather than treating the date as an invitation to assume eligibility.

Authorised approvers face their own controls. From 7 February 2024, an authorised person approving an unauthorised person's promotion could do so only within a specific FCA permission or relevant exemption. For qualifying cryptoasset promotions, the approver must notify the FCA within seven days where the notification mechanics apply, as explained in FCA Finalised Guidance FG23/3. Build that deadline into the approval workflow, preserve the approval record and verify the approver's scope before publication.

Application Packaging and Interview Readiness

A complete application is a single operating narrative, not a bundle of individually polished documents. The business plan, financial model, governance materials, policies and application answers should describe the same customers, products, staffing, controls and implementation status. The FCA's statutory framework supports treating authorisation as an evidence-based gateway rather than a filing exercise, as described in the Financial Services and Markets Act 2000.

Start the final review with a contradiction log. Compare every material answer against the source document that supports it, then record the owner and correction deadline for each inconsistency. Firms often find here that a forecast assumes a system not mentioned in the technology plan, or that a policy assigns a role to a manager whose controlled function isn't completed.

Package the application in controlled layers

Use a staged review rather than one final proofread:

• Scope review: Confirm that every proposed activity has a permissions analysis and isn't described beyond the route.
• Narrative review: Test that the business plan, customer journey and revenue model agree.
• Control review: Trace each material risk to a procedure, system, owner and evidence record.
• Financial review: Reconcile assumptions, resources, staffing and outsourced expenditure.
• Submission review: Check signatures, passwords, controlled functions, attachments and required due diligence.

Mark each control as implemented, partially implemented, scheduled before launch or not yet designed. For scheduled controls, include the implementation owner, dependency, testing method and decision required. This is more credible than presenting a fully mature framework that staff and suppliers can't demonstrate.

Rehearse the regulator's questions

Interview preparation should use the actual application and evidence matrix. Ask responsible managers to explain how they would handle a failed screening result, a material incident, a customer complaint, an outsourcing failure and a monitoring alert. Then test whether their answers match the written procedures and available records.

Incomplete forms, missing signatures, unavailable passwords and unfilled controlled functions can delay assessment. A submission gate should therefore require sign-off from the accountable manager, compliance, finance, technology and the board before filing. The aim isn't to eliminate every future change. It is to show that the firm knows what is live, what isn't and who will close the gap.

Post-Authorisation Obligations and Enforcement Realities

Authorisation doesn't convert compliance into a finished project. It creates an ongoing supervisory relationship in which the firm must maintain governance, controls, records, reporting and conduct arrangements as the business changes. The operating model that supported approval must continue to produce evidence after launch.

The financial consequences are substantial. In 2024/25, the FCA imposed total financial penalties of more than £186 million, comprising £179,096,835 against firms and £7,315,673 against individuals, according to the FCA's enforcement data. The figures don't predict the outcome of any particular case, but they demonstrate why boards should treat control ownership and remediation as active management responsibilities.

Convert policies into operating routines

A post-authorisation control calendar should cover:

• Regulatory reporting: Identify each return, source system, reviewer, approval point and submission evidence.
• Governance attestations: Require managers to confirm the operation of their controls and disclose material gaps.
• Incident management: Record events, decisions, root causes, customer impact and remediation ownership.
• Change control: Assess how new products, jurisdictions, vendors or systems affect permissions and controls.
• Testing: Schedule compliance monitoring, financial-crime testing, access reviews and independent assurance.
• Board reporting: Present meaningful trends, overdue actions, breaches, complaints, incidents and risk acceptances.

A policy review date isn't evidence that the policy remains effective. Management should ask whether staff follow it, whether the system produces the required records and whether exceptions reach the correct decision-maker. Where an issue is found, the firm should preserve the investigation trail and show how remediation was validated.

The FCA also cancelled the authorisation of 1,456 firms and used formal intervention tools to deliver 135 outcomes in 2024/25, based on the same enforcement data. Those figures reinforce a practical point: permission is conditional on continuing to meet the firm's obligations. A board that reviews controls only when a filing is due is managing paperwork, not regulatory risk.

Compliance evidence should answer three questions every month: what happened, who reviewed it and what changed as a result?

Quick Reference Checklist for Ongoing Compliance

A useful checklist is short enough to use and detailed enough to expose ownership gaps. It should cross-reference the relevant FCA Handbook requirements, internal procedures, system records and board decisions. Don't treat it as a static annual exercise. Use it after a product change, new outsourcing arrangement, material incident or change in senior management.

Six control questions for the board

Use the checklist to trace evidence, not merely to tick completion. A “yes” answer without a record, owner or review date should be treated as unresolved. The same applies to capital and prudential analysis. The firm should know which requirements apply to its route, how it monitors them and who escalates a breach or deterioration.

Keep change inside the control system

Regulatory change should enter through a controlled process. Record the source, rule status, affected activity, accountable owner, required decision, implementation date and evidence needed to demonstrate completion. This avoids the common situation where a team updates a policy but fails to amend training, system configuration, customer disclosures or management information.

The checklist should also support management challenge. Ask what has changed since the previous review, which controls failed, whether a risk assessment remains current and whether any commercial activity has moved beyond the permissions analysis. A mature checklist creates a trail from regulatory expectation to operating action and board oversight.

Scoping Your Regulatory Route and Next Steps

Start with the activity, not the form. Write down what the business intends to provide, to whom, through which channels, in which jurisdictions and with what reliance on banks, payment firms, custodians, technology providers or group entities. Separate current services from planned services. This initial fact pattern determines which regulatory routes need detailed analysis.

Assemble the decision set

The board should make or approve decisions on:

• Regulatory perimeter: Which activities require authorisation, registration, approval or a different legal analysis?
• Operating model: Which functions are internal, outsourced, automated or dependent on third parties?
• Risk appetite: Which customers, jurisdictions, products and transaction types will the firm accept?
• Governance: Who will hold key responsibilities, and do they have the time and authority to perform them?
• Implementation: Which controls are live, which are scheduled and which dependencies could delay launch?
• Evidence ownership: Where will the firm retain records, testing results, approvals and management information?

Create a starting-materials pack containing the group structure, ownership information, product descriptions, customer journey, financial assumptions, technology architecture, vendor arrangements and existing policies. Then build the evidence matrix before drafting prose. This sequence exposes missing facts early and prevents the business plan from becoming a polished description of an operating model that hasn't been built.

For a multi-jurisdictional crypto or digital-asset business, map the UK route against other regimes without assuming that one approval solves another jurisdiction's requirements. Identify where customer onboarding, sanctions controls, data flows, custody, financial promotions and outsourcing arrangements diverge. The design objective is not identical documentation everywhere. It is controlled interoperability with clear local accountability.

Use specialist support where the internal team lacks regulatory, legal, financial, technology or operational depth. A regulatory authorisation consultancy such as Glentorion combines regulatory consultants with software, systems and AI engineers to prepare and review application packages, coordinate evidence, support submission work and prepare management teams for regulator interviews.

The most effective work plan ends each review with named next actions, unresolved questions and a decision owner. That discipline helps the board distinguish a genuine readiness gap from a drafting issue, and it gives management a defensible basis for deciding when the application is ready to submit.

---

Glentorion helps financial and crypto businesses scope their regulatory route, align business plans with operational evidence, prepare submission-ready application packages and ready management teams for regulator interviews. Visit Glentorion to discuss an evidence-led approach to FCA authorisation and ongoing compliance.