FCA Threshold Conditions: The Five Tests and Evidence

Your business plan is detailed, the policies are signed and the application folder looks ready. Yet a simple question can expose the weakness: who can demonstrate that the controls described in those documents really work?

Table of Contents

• What Threshold Conditions Are and Why They Matter
  • Proportionate doesn't mean informal
  • Separate the regulatory routes
• The Five Conditions at a Glance
  • Read the conditions as connected tests
  • Check that the framework fits the route
• Evidence and Suitability Tests Regulators Apply
  • Resources must support actual delivery
  • Distinguish plans from established arrangements
  • Make technical controls explainable
  • Suitability extends beyond background checks
  • Show how decisions will be made
• Why Applications Stall and How to Avoid It
  • Follow the evidence through the process
  • Diagnose the question before answering
• Keeping Conditions Met After Authorisation
  • Allocate recurring obligations
  • Maintain condition-level evidence
• Readiness Checklist and Next Steps
  • Work in dependency order
  • Buy challenge where it changes decisions

What Threshold Conditions Are and Why They Matter

Say a firm submits a polished application and obtains permission. Six months later, its compliance lead has left, an outsourced provider has changed and nobody can explain who signs off control exceptions. The original documents still exist, but management can no longer substantiate the operating arrangements they describe.

A threshold condition is like an occupancy certificate for a building. The certificate may be issued once, but the building must keep meeting the code every day.

The FCA threshold conditions are the statutory minimum standards for obtaining and retaining Part 4A permission: the FCA's COND guidance explains that section 55B(3) of the Financial Services and Markets Act 2000 requires the FCA, when granting or varying permission, imposing or varying a requirement, or giving consent, to ensure continuing satisfaction of the conditions for every regulated activity covered by the permission, interpreting Schedule 6 in the context of the firm's size, nature, scale and complexity.

Permission isn't evidence that your operating arrangements will remain adequate. Management must keep those arrangements credible as the business changes.

Proportionate doesn't mean informal

A straightforward investment business and a complex crypto-related operation won't need identical evidence. The latter may need more detailed explanations of custody dependencies, asset flows and outsourced technology. The former still needs identifiable decision-makers, workable controls and a business plan that management can defend.

The guidance is general and non-exhaustive. Treating its wording as a document checklist misses the statutory question: can this particular firm conduct its proposed activities responsibly?

Separate the regulatory routes

Don't assume that registration, AML compliance and permission to conduct regulated activities are interchangeable. Kons Law's explanation of registration and AML obligations is useful background when separating those workstreams, but your application must establish the route appropriate to your actual services.

The practical question isn't whether you can obtain permission alone. It's whether your people, resources and controls can support the permission you intend to keep.

The Five Conditions at a Glance

The framework applies differently to PRA-authorised firms. For firms without a PRA-regulated activity, the relevant appropriate-resources condition is paragraph 2D, addressed through the financial and operational evidence discussed below.

The five FCA threshold conditions, identified with their COND references in the FCA's international-firms guidance, provide the following working map. “All applicants” below means applicants within this FCA framework, not every regulatory registration or authorisation route.

Read the conditions as connected tests

Start with where management genuinely operates, not merely the registered address. Then consider whether group structures, information access or overseas dependencies could obstruct supervision.

Resources concern both funding and delivery capability. Suitability concerns the judgement and conduct of those directing the business, while the business-model assessment asks whether the proposed activities make regulatory and commercial sense together.

I would usually investigate appropriate resources early. A firm can budget for compliance without having anyone capable of delivering it, particularly where recruitment and supplier appointments remain unresolved.

Check that the framework fits the route

Payment firms should distinguish this framework from the requirements of their particular payment-services route; the authorised payment institution explainer helps frame that distinction. Don't import a Part 4A checklist without checking the applicable regime.

Crypto businesses moving from MLR registration to full FSMA authorisation must evidence the threshold tests, not just reproduce their existing AML registration controls. The operating model determines what persuasive evidence looks like.

Evidence and Suitability Tests Regulators Apply

The FCA reads the application as a whole. A credible policy won't repair a forecast that omits the staff needed to operate it, and an organisation chart won't establish accountability if the procedures allocate decisions elsewhere.

Use the following as a preparation matrix, not an official exhaustive document list.

Evidence to prepare for each threshold condition

Resources must support actual delivery

Under paragraph 2D of Schedule 6 to FSMA, applicable to firms without a PRA-regulated activity, the FCA's appropriate-resources guidance addresses resources proportionate to the activities, including management skills and experience and sufficient non-financial resources to enable compliance.

Capital is therefore only part of the assessment. Show who operates the systems, who reviews exceptions, what happens during absence and how management knows whether controls are effective.

Take a business plan that assumes rapid customer onboarding. The corresponding financial crime procedures require manual review of complex cases, but the staffing plan contains no investigator capacity. Each document may look reasonable in isolation; together, they describe an operation that can't deliver its own controls.

The remedy isn't automatically more hiring. You could narrow the initial customer population, constrain onboarding volumes or introduce appropriate automation, provided someone can explain its limitations and oversee exceptions.

Practical rule: If a control depends on a person, supplier or system, show the dependency, its readiness status and the fallback arrangement.

Distinguish plans from established arrangements

Applicants don't need to pretend that every launch arrangement is already operating. They do need to distinguish what exists from what remains conditional, and explain how outstanding work affects readiness.

For a proposed compliance appointment, record the role specification, recruitment status, approval dependencies and interim responsibilities. For a supplier, retain the due diligence, proposed contract, implementation milestones and evidence needed before relying on the service.

Use an evidence register with document identifiers, owners, approval status and supporting records. A controlled spreadsheet or SharePoint list can work; expensive workflow software won't compensate for unclear responsibilities.

• Established control: Retain the approved procedure, configuration evidence, test results and exception records.
• Planned control: Identify the accountable owner, delivery dependency, acceptance test and launch restriction.
• Known weakness: Record the risk, temporary mitigation, remediation decision and person authorised to accept the residual exposure.

Make technical controls explainable

Crypto-related applications need more than a list of screening and analytics vendors. Describe which transactions enter monitoring, how alerts are prioritised, who investigates them and what triggers restrictions or escalation.

BroLabel's explanation of transaction monitoring for crypto AML provides useful operational context for that workstream. The application still needs the firm's own risk assessment, coverage decisions and investigation procedures, rather than a supplier's product description.

The same discipline applies to outsourcing. A provider may perform a task, but management must understand the service, retain access to relevant information and have a workable response if the arrangement fails.

Suitability extends beyond background checks

The FCA's suitability guidance considers whether the firm is fit and proper, including its treatment of consumers, financial-system integrity, compliance with requirements and information requests, managers' skills and probity, and sound and prudent management.

A clean disciplinary history doesn't establish that the governance model works. Decision-making authority, challenge, competence and regulatory responsiveness all matter.

Consider a technically strong founder who designs the platform, approves customers, authorises exceptions and answers every regulatory query. There's no credible compliance function, and staff can't challenge the founder without asking the founder's permission.

That arrangement creates concentration and conflict risks. Adding a compliance title to the organisation chart won't fix them unless the role has authority, capacity and access to the board.

Show how decisions will be made

Prepare a decision-rights map that distinguishes proposing, reviewing, approving and escalating decisions. Identify who can stop onboarding, suspend a product, reject a high-risk customer or require corrective action.

Support it with a compliance resourcing plan that explains competence, workload, cover and access to specialist advice. Where individual approval requirements are relevant, the FCA approved-person explainer can help separate those requirements from the firm-level suitability assessment.

Maintain a regulator-correspondence log showing the request, responsible owner, agreed response date, supporting evidence and approval record. If there are past information requests, retain the actual responses and unresolved commitments.

Management should be able to explain these arrangements without reading policy language aloud. Ask responsible staff to walk through a difficult exception, identify the decision-maker and locate the evidence that would support the decision.

Why Applications Stall and How to Avoid It

An on-time determination rate doesn't establish application quality: the FCA's operating service metrics report 99.5% of applications across metric areas determined within statutory deadlines, alongside statutory determination periods of 6 months for complete applications and 12 months for incomplete applications.

That headline doesn't reveal how many files were initially incomplete or which omissions prompted clarification. It measures deadlines, not first-time readiness.

Follow the evidence through the process

File → assessment of completeness → clarification rounds → determination

An incomplete application isn't outside a statutory determination framework. Don't treat missing information as creating an unlimited waiting period or assume that completeness guarantees approval.

A file can address the legal headings yet remain operationally unpersuasive. Statements that the firm will appoint staff or implement controls leave the reviewer unable to assess readiness unless ownership, sequencing, testing and management information are clear.

Application pitfalls, causes and fixes

Diagnose the question before answering

For novel models, explain who contracts with whom, who controls assets, how transactions settle and where losses or failures could arise. Labels such as platform or technology provider don't resolve the regulatory analysis.

Distinguish a missing fact from a disputed interpretation. If the FCA asks who controls a wallet, provide the access and authority evidence; if the parties disagree about the resulting activity classification, record the competing analysis and obtain appropriate legal input.

Use the FCA application-process overview to organise procedural preparation, but manage substantive issues through a question log with named owners. Maintain a central assumptions log so a changed launch date, supplier or customer segment is reflected across every affected document.

Keeping Conditions Met After Authorisation

Authorisation starts a continuing evidence record rather than finishing an application file. Management needs records of what the firm does in practice, not just what it originally intended to do.

Recurring obligations that firms commonly overlook include regulatory returns, annual fees, Directory Persons and Firm Details Attestations, and the use-it-or-lose-it check, where a firm stops carrying on regulated activity connected with its permissions. None of these is difficult in isolation. They fail because nobody owns them after the application team disperses.

Allocate recurring obligations

The following is a management allocation model, not a substitute for checking the deadlines and requirements applicable to the firm.

Recurring post-authorisation obligations

Broad permissions aren't harmless optionality. Retaining unused scope creates exposure, but launching an activity merely to demonstrate use creates a different problem if controls aren't ready.

Keep permission scope aligned with a credible operating business, not with an aspirational product roadmap.

Maintain condition-level evidence

Assign responsibility for location-of-offices evidence to the person overseeing corporate arrangements. Keep management-location records and reconsider them when decision-makers relocate.

For effective supervision, retain group charts, reporting access and supplier-information rights. For resources, maintain funding forecasts, staffing capacity and control-testing results; escalate shortfalls with funded remediation actions.

Suitability records should capture appointments, conflicts, training and governance decisions. Business-model monitoring should compare actual customers, products and revenues with approved plans, showing where management has accepted, constrained or stopped a change.

A file that looks complete can still fail at this point. A firm can hold every policy and still lack the records showing those policies operated during the period under review. The test is evidence of operation: minutes where a drift from the approved business model was discussed, an attestation signed on time, a forecast refreshed after a key hire left. If the record starts when the FCA asks, the condition was unproven for everything before that date.

A variation of permission or a change in controllers or senior managers can require reassessment of the arrangements supporting the original approval. Assess regulatory approvals and notifications before implementing the change, rather than treating the paperwork as an administrative follow-up.

As a quarterly management discipline, ask: what evidence proves that each condition still holds as our business, owners, outsourcing and permissions change?

Readiness Checklist and Next Steps

Run these as pass-or-fail tests before filing or seeking a variation. An unanswered question is an open item, not a pass.

• Activity mapping: Every planned regulated activity points to the permission required.
• Accountability: Each threshold condition and key control function has an identified owner.
• Policy status: Established arrangements are clearly separated from those still to be established.
• Financial consistency: The business plan, organisation chart and capital plan agree on staffing, timing and costs.
• Third parties: The supplier register contains due diligence, service dependencies and credible exit arrangements.
• Financial crime: The framework explains risk assessment, screening, monitoring, investigation and escalation.
• Ongoing administration: A calendar assigns responsibility for applicable returns, attestations and fees.

Work in dependency order

1. Map activities to permissions. Establish what the firm will do before drafting around an assumed route.
2. Run a condition-by-condition gap review. Record missing evidence, unresolved decisions and dependencies separately.
3. Resolve document contradictions. Correct the underlying assumption, then update every affected document rather than patching individual answers.
4. Prepare responsible people. Test whether managers can explain controls, financial assumptions and escalation decisions using the supporting records.
5. Set the continuing calendar. Build ownership and evidence retention into ordinary operations before launch pressures compete for attention.

Use the FCA compliance-requirements guide to support the wider obligations inventory. Give each entry an owner, evidence location and escalation route, rather than keeping a list of rule names.

Buy challenge where it changes decisions

Outside help earns its cost when it reveals something management wouldn't otherwise identify. A focused gap review and interview rehearsal can be more useful than another polished rewrite of an already coherent business plan.

Ask a reviewer to trace a proposed activity from customer contract through operational delivery, control ownership and financial assumptions. Require tracked findings that distinguish missing facts, technical interpretation and management decisions.

In-house compliance teams, legal advisers and specialist consultants can divide that work under clear responsibilities. Glentorion, a regulatory authorisation consultancy, can scope the route, review application packages with tracked findings, prepare management for regulator interviews and submit under agreed mandates; start with a scoping conversation about the activities you plan to conduct.

---

A threshold-conditions review should connect permission scope, operational evidence and management accountability. Visit Glentorion to discuss your planned activities and agree a defined scope for application preparation, review or interview readiness.