FCA Variation of Permission: A Step-by-Step UK Guide

Your payments firm has agreed a new service, the product team has a launch plan, and compliance has spotted a gap in the permissions. The immediate question is whether you can amend the existing authorisation or need a new licence. The harder question is whether the firm can evidence the business it intends to operate.

An FCA variation of permission can be the right route, but filing a small application isn't necessarily the quickest option. If the proposed service also changes capital needs, outsourcing, customer disclosures or management responsibilities, leaving those connections out can create more work than addressing them together.

Table of Contents

• What an FCA Variation of Permission Is
  • Completeness determines the planning clock
• Choosing Between a Variation and a New Application
  • Check the edge cases
• The Three Types of Variation and Their Fees
  • Adding an activity
  • Removing an activity
  • Changing a limitation
• Evidence and Documents the FCA Expects to See
  • Establish the business and its accountability
  • Show how the controls will work
  • Maintain a cross-document change register
• Step-by-Step Procedure and Realistic Timelines
  • Prepare and submit
  • Build a timetable around decision gates
• Common Pitfalls and What Regulators Expect
  • The narrow-filing trap
  • Budget for the work, not just the fee
• Sector Checklists for Payment, Investment and Crypto Firms
  • Payment and e-money firms
  • Investment firms adding custody or safeguarding
  • Crypto firms
  • Banks and diversified firms
• Confirm Your Route Before You File
  • Define the support you actually need

What an FCA Variation of Permission Is

Say an FCA-authorised payments business wants to add an investment activity. Before choosing an application, management needs to establish which legal entity holds which permissions. Payment-services authorisation alone shouldn't be treated as proof that the entity holds a Part 4A permission.

Think of planning permission: approval for the existing building doesn't automatically cover an extension. The decision concerns the proposed use and whether the supporting arrangements are suitable.

For an existing Part 4A-authorised firm, a variation of permission (VoP) changes the regulated activities, scope or limitations of its permission. It doesn't create a new authorised entity.

Completeness determines the planning clock

The FCA's authorisations operating metrics distinguish a six-month statutory period for complete applications from 12 months from receipt for incomplete applications; for Q2 2025/26, they report 316 VoP cases, with 98.9% completed within the relevant complete-application timeframe and 99.7% within the comparable incomplete-application timeframe.

Performance varies by reporting window and measure. Those results aren't a promise about your application.

The complete-application clock starts when the FCA determines that the submission is complete, not necessarily when you first file it. A submission receipt therefore isn't a reliable starting point for a committed launch date.

Planning principle: Treat a VoP as an assessment of the future business, not an administrative amendment.

Management must connect the route, change type, fee, evidence and implementation plan. The FCA needs a coherent explanation of what the firm will do and how it will control it.

Choosing Between a Variation and a New Application

Variation versus initial authorisation

The route test is straightforward: if the entity already holds Part 4A permission and the change concerns its permitted activities, a VoP is usually the starting point. A new entity, a different statutory regime or a change unrelated to permission requires a separate route assessment.

The FCA's payment and e-money variation guidance requires firms to obtain the relevant variation before providing new services and to apply through Connect. Don't let a product launch outrun the permission.

Check the edge cases

MLR registration isn't equivalent to full FSMA authorisation. A crypto business moving between those regimes must confirm the applicable authorisation and transitional arrangements using current FCA perimeter and pre-application guidance.

Approved-person and senior management function changes also need separate consideration. A VoP doesn't automatically resolve them.

Choose the legal route before pricing the filing or commissioning the application documents. Otherwise, the team may prepare persuasive evidence for the wrong regulatory question.

The Three Types of Variation and Their Fees

The fee depends on what the variation changes: the regulated activities, the fee block, or a limitation on an existing permission. A narrow wording change can still require a fee if it widens the firm's scope. Assess the proposed permission against the operating model before costing the filing.

Variation types and fee positions

Under section 55H of the Financial Services and Markets Act 2000, reflected in SUP 6, an authorised firm can add or remove activities, or change an activity description, including its limitations. The application must identify the requested variation and the regulated activities proposed after approval.

A product's commercial label does not settle the permissions question. It may require another activity, a limitation change, both, or neither.

Adding an activity

An investment firm proposing crypto custody should first establish the asset classification, service, legal entity and applicable regulatory regime. Adding “custody” to a business plan is not enough to determine the permission required.

Map the custody chain: who controls keys, who authorises transfers, what happens after a security incident, and which provider performs each function. That analysis informs both the permission sought and the controls the firm must evidence.

A commercially modest change can introduce another fee block. Price the resulting permission scope, not the length of the application narrative.

Removing an activity

A firm leaving payment services should distinguish stopping new business from completing existing obligations. Customer balances, unresolved complaints, records and outsourced arrangements may remain after sales stop.

A scope-reducing application can carry no application fee under the guidance, but operational closure still has a cost. Confirm the fee treatment and budget for the work needed to close the activity properly.

Changing a limitation

If an investment firm wants to serve a client category excluded by its current limitation, management should explain how distribution arrangements, staff competence, disclosures and oversight will support that category.

The permission wording may change only slightly. The operating model may change substantially.

A shorter requested variation doesn't necessarily mean a smaller regulatory assessment.

For each proposed change, map the customer journey to the permission rationale, accountable manager, financial assumptions and controls. This exposes connected amendments before the firm settles its scope and fee position.

Avoid filing too narrowly or too broadly. A narrow application may leave the firm unable to deliver its intended service. A broad one brings evidence and implementation obligations for activities management may not be ready to operate.

Evidence and Documents the FCA Expects to See

Build the application around documents management can explain and operations can use. A polished policy library won't compensate for an unclear service or an unowned control.

Establish the business and its accountability

• Business model and customer journeys: Document onboarding, execution, movement of money or assets, servicing and exit. Include exceptions such as failed transactions, complaints and provider outages.
• Permissions rationale: Match each activity to the permission sought. Explain exclusions and limitations rather than leaving reviewers to infer them from marketing language.
• Governance and resources: Provide an organisation chart, responsibility allocation, committee arrangements and staffing plan. Identify who approves the activity, operates its controls and challenges performance.
• Financial resources and projections: Align revenue assumptions, operating expenditure, capital calculations and downside scenarios. Include implementation costs and the effect of delayed revenue.

Use the FCA threshold conditions as a readiness lens across the business. The new activity shouldn't rely on resources already fully committed to existing operations.

Show how the controls will work

• Policies and procedures: Supply operating instructions, escalation routes and control records. Clearly distinguish current arrangements from those still to be built, hired or contracted.
• Outsourcing and third parties: Identify providers, responsibilities, due diligence, service dependencies and exit arrangements. Explain how the firm retains oversight rather than naming a reputable supplier.
• Risk assessments and monitoring: Connect conduct, prudential, financial-crime and operational risks to controls, owners, testing and remediation.
• Customer disclosures: Check that terms, fees, risk warnings and complaints information match the actual service. Remove promises the operating model can't support.
• Regulatory history: Record relevant FCA interactions, outstanding commitments and remediation. Explain how unresolved matters affect the expansion.

These documents should describe the same business. If a forecast assumes immediate launch but the staffing plan leaves critical roles unfilled, the inconsistency needs resolving before submission.

Maintain a cross-document change register

Use a controlled Excel workbook, SharePoint list or equivalent record to track each material fact across affected documents. Useful fields include the decision owner, supporting evidence, impacted files, version, approval status and unresolved questions.

For example, changing the custodian can affect the customer journey, outsourcing assessment, contract description, financial model and contingency arrangements. Update the whole chain, not just the application answer mentioning the provider.

Missing material evidence can prevent a completeness determination. An internal reviewer should test whether another person could understand and challenge the proposal without relying on unwritten explanations.

Step-by-Step Procedure and Realistic Timelines

A filing date is not a launch date. Keep the application work and product launch on coordinated schedules, and make commercial commitments conditional on the permission being granted.

Prepare and submit

1. Map the change. List each proposed activity, customer journey and affected legal entity. Include changes to existing services so the application explains how the new activity fits into the business.
2. Check the perimeter. Identify the regulated activity and appropriate application route. Record any unresolved classification questions for legal or specialist review.
3. Classify the fee. Compare the current and proposed fee blocks, then retain the calculation and approval record. An incorrect classification can complicate budgeting and delay a ready-to-file package.
4. Gather and challenge the evidence. Review connected documents and assign each gap to an owner. Check operational readiness as well as drafting quality: a well-written policy cannot establish that a process is in place.
5. Pay the applicable fee. Confirm the amount and payment arrangements before filing. The FCA's variation-of-permission guidance sets the fee at 50% of the relevant authorisation application fee for an additional fee block or Category 2 within the same block, and at the higher relevant fee for multiple new blocks. Maintaining or decreasing scope attracts no application fee. Payable fees are non-refundable and must be paid before processing begins.
6. Submit through Connect. State the variation and post-variation activities clearly. Save the submitted package, attachments, approvals and filing confirmation.
7. Manage completeness and follow-up questions. Keep a question log with an owner, response date and affected documents for each request. Answer directly, then update connected materials so the record remains consistent.
8. Implement the decision. Check the written approval and permission wording before enabling the activity. Translate any limitations into system settings, procedures and management reporting.

Build a timetable around decision gates

Variation timeline by stage

The FCA application process is best managed as a sequence of evidence and approval gates, not a countdown from uploading a form. Distinguish statutory periods from service expectations: payment and e-money guidance refers to usual decision expectations and operational targets as well as statutory deadlines. Check the current route-specific wording before relying on those expectations in a board-approved timetable.

A narrow filing can take longer than a broader, well-evidenced one if its scope leaves related activities or evidence unresolved. Board challenge: ask which dependencies could prevent a complete submission, not only when compliance expects to press submit.

An incomplete application does not automatically reset every statutory clock. The practical issue is that the firm may not yet have reached the complete-application milestone, while further evidence and responses postpone a reliable decision and launch plan.

Common Pitfalls and What Regulators Expect

For April 2024 to March 2025, the FCA's published VoP case outcomes recorded 1,199 cases, including 247 rejected, withdrawn or refused, a 20.6% rate; the October 2024 to March 2025 measure was 20.3%.

That doesn't mean every affected firm failed a suitability assessment. Withdrawals can reflect strategy changes, preparation gaps or plans to resubmit, but management shouldn't assume approval is routine.

The narrow-filing trap

A founder may prefer the smallest possible variation because it appears cheaper and easier. That works only if the proposed scope covers the service and its dependencies.

Common mistakes include:

• Premature launch: Commercial teams activate services before the permission is effective.
• Disconnected scope: The application adds an activity but ignores related capital, outsourcing or policy changes.
• Incomplete evidence: Key arrangements remain promises without credible implementation plans.
• Contradictory documents: Policies, forecasts and governance records describe different operating models.
• Fee misclassification: Finance budgets against the existing business rather than the proposed permission scope.
• Unprepared management: Responsible people can repeat policy wording but can't explain decisions, exceptions or escalation.

Budget for the work, not just the fee

The FCA fee rules make payment a submission-stage obligation, but the filing charge is only part of the budget. Include evidence production, policy redesign, forecasts, technology changes, remediation, management preparation and follow-up responses.

A broader, well-evidenced application can reduce repeated drafting and inconsistent disclosures. That isn't an argument for speculative permissions: include connected changes the firm intends and can support.

Low enforcement counts are a poor proxy for application quality. Enforcement and authorisation assessment answer different questions.

Regulators expect accountable people who can explain how the proposed business will operate, what could go wrong and which controls will be ready when the permission takes effect.

Sector Checklists for Payment, Investment and Crypto Firms

Start with the risk introduced by the activity, not the sector label. A familiar product name can conceal a different custody chain, settlement exposure or customer relationship.

Payment and e-money firms

• Trace customer funds: Map receipt, safeguarding, reconciliation, settlement and refunds. Identify balances held during failed or delayed transactions.
• Rework the payment flow: Show where the added service changes counterparties, settlement timing, liquidity needs or responsibility for losses.
• Extend fraud controls: Test onboarding, transaction monitoring, sanctions screening and escalation against the new service's risks.

An authorised payment institution should distinguish its payment permissions from any separate investment or other authorisation needs.

Readiness test: Can operations reconcile the new flow and resolve an exception without inventing a procedure after launch?

Investment firms adding custody or safeguarding

• Establish the applicable client-asset treatment: Identify the asset, legal ownership, account structure and relevant custody or client-money obligations.
• Test segregation and reconciliation: Explain records, breaks, escalation and oversight of third-party custodians.
• Review the client journey: Update suitability or appropriateness arrangements where relevant, disclosures, staff competence and complaints handling.

Don't treat a signed custody contract as proof that the firm can oversee the service. Management needs access to records and a practical response to provider failure.

Readiness test: Can the firm establish what belongs to each customer and act on a discrepancy?

Crypto firms

• Classify the service and asset: Distinguish cryptoassets, tokenised securities, stablecoins, tokenised deposits and electronic money before selecting a route.
• Document custody and execution: Explain key control, transfer approvals, recovery, trading dependencies and customer entitlements.
• Address conduct and crime risks: Check financial promotions arrangements, disclosures, AML monitoring and, where trading is involved, market-integrity and market-abuse controls.

Readiness test: Can management explain both the legal perimeter and the operational consequences of losing access to a provider or key?

Banks and diversified firms

• Assess prudential implications: Examine capital, liquidity, balance-sheet exposures and the proposed activity's treatment.
• Map dependencies: Review outsourcing contracts, operational-resilience arrangements, recovery and exit options.
• Allocate accountability: Identify senior-manager responsibility and obtain informed approval through the relevant governance process.

Distinguish experimentation from production. A successful technical demonstration doesn't establish readiness to hold assets, serve customers or manage losses.

Readiness test: Are the people, controls and resources ready for the approved activity, rather than merely for the pilot?

Confirm Your Route Before You File

Before commissioning another policy draft, make the decisions that determine the application.

1. Confirm the route. Identify the applying entity, existing permissions and intended activities. Decide whether the change requires a VoP, initial authorisation or a regime-specific transition; use a current assessment of cryptoasset regulation where digital assets are involved.
2. Run a completeness test. Match each activity to its permission rationale, evidence, fee treatment and controls. Record gaps, owners and decisions, and challenge any assertion that a critical arrangement will be ready later.
3. Set a dependency-based timetable. Start with evidence preparation, then allow for completeness review and follow-up questions. Fix the launch commitment only when the permission and operational dependencies support it.

Define the support you actually need

An effective advisory scope starts with planned activities, target jurisdiction and available materials. It should distinguish business-model assessment, document preparation, financial projections, specialist inputs, consistency reviews and management interview preparation.

Agree who supplies facts, who approves assumptions, who owns unresolved issues and who is authorised to submit. Treat ongoing correspondence as a defined responsibility rather than an implied extension of drafting work.

The useful output isn't a completed form alone. It's a decision-ready package that explains the intended business, identifies its dependencies and gives management a credible basis for implementation.

---

Glentorion supports FCA variation-of-permission scoping, application preparation, financial projections, cross-document change tracking and management interview readiness. Visit Glentorion to arrange a scoping conversation around your proposed activities, starting materials and timetable.