Variation of Permission: When You Need One and How to Apply

Varying a Part 4A permission is one of the most common post-authorisation regulatory steps for growing FCA-regulated firms — and one of the most frequently misunderstood. Getting it right means understanding which activities actually require a VoP and submitting a well-prepared application.

A Variation of Permission (VoP) allows an FCA-authorised firm to modify its existing Part 4A permission — adding or removing regulated activities, changing the scope or conditions on existing activities, or removing limitations that were imposed at authorisation. VoPs are regulated under Section 55I of FSMA and are assessed by the FCA using the same threshold conditions framework as the original authorisation.

When Does a Firm Need a VoP?

A firm needs a VoP whenever it wishes to carry on a regulated activity not currently covered by its permission, or to remove a limitation or condition that is preventing it from operating as it wishes. Common triggers include: adding a new product or service that involves a regulated activity (for example, a payment firm adding consumer credit); expanding into a new regulated business area (for example, a wealth manager adding discretionary management to an advisory-only permission); removing the client or counterparty limitations that were imposed at the time of original authorisation; and upgrading from a limited to a full permission in areas such as consumer credit.

A common mistake is to assume that if an activity is within the general scope of the firm’s existing permission, no VoP is needed. In practice, FCA permissions are often more narrowly defined than firms realise — the regulated activity description, client categorisation limits and geographic limitations in the original permission may exclude activities the firm now wants to conduct. Firms should check their permission on the FCA Register against the proposed new activity before proceeding, and obtain legal advice if the position is unclear.

What the VoP Application Involves

The VoP application is submitted through FCA Connect and follows a similar structure to the original authorisation application — but scoped to the new or varied activities. The key components are: a description of the proposed new or varied activities and the regulated activity category they fall within; an updated or supplementary regulatory business plan addressing the new activities specifically; evidence of financial resources adequate to support the expanded activities; confirmation of the SMF holders who will be accountable for the new activities; and, where the new activities create new regulatory risks, an explanation of the controls the firm has in place to manage them.

Where the VoP involves adding a significantly different category of regulated activity — for example, a payment firm adding consumer credit, or an investment firm adding insurance distribution — the FCA will assess the new activities against the full threshold conditions framework. This means the VoP application for a materially new activity is almost as comprehensive as a fresh authorisation application for that activity in isolation.

VoP Timelines

The statutory framework for VoPs mirrors the authorisation framework: the FCA has six months from receipt of a complete application to determine it. In practice, straightforward VoPs — adding a related activity to an existing permission for a firm with a clean supervisory history — are typically determined in six to ten weeks. VoPs involving a new category of activity, a change in the firm’s business model, or submission by a firm currently under FCA supervisory attention take considerably longer and should be planned for on a three to five month timeline.

One underappreciated timing issue: the FCA cannot process a VoP application while the firm has an outstanding information request or is the subject of an ongoing supervisory action. Firms in active supervisory engagement should resolve that engagement before submitting a VoP, or should disclose the supervisory context in the application and discuss the timing with their FCA supervisory contact.

FCA-Imposed VoPs: The Other Direction

VoPs are not only firm-initiated. The FCA has the power under Section 55J to impose a variation of permission on its own initiative — restricting or removing regulated activities from the firm’s permission as a supervisory or enforcement measure. These own-initiative VoPs (OIREQs) are a less severe alternative to full cancellation, used where the FCA wants to constrain the firm’s activities without removing its authorisation entirely.

Firms subject to an own-initiative VoP receive a Warning Notice in the same way as firms subject to cancellation proceedings, and have the same rights to make representations and to refer to the Upper Tribunal. The same considerations on the Warning Notice stage apply: it is the most productive point at which to engage with the FCA’s concerns and, where possible, to agree a voluntary variation rather than waiting for the imposed one.

SMF Implications of a VoP

Where a VoP adds new regulated activities that fall within an existing SMF holder’s accountability, the firm must consider whether the SMF holder’s Statement of Responsibilities should be updated — and whether the FCA expects notification of that change. Where the new activities fall outside the existing SMF holders’ accountabilities and a new SMF appointment is required, the Form A application for the new SMF holder must be processed in parallel with the VoP. The FCA will not approve new regulated activities under a VoP while the required SMF approvals are outstanding.

The interaction between VoP timelines and SMF approval timelines is one of the most common planning failures in permission expansion projects. Firms that submit the VoP application before identifying the SMF holder responsible for the new activities — or that identify the holder but fail to submit the Form A simultaneously — create a dependency that extends the overall project timeline by the full duration of the Form A process.

Key References

• FSMA 2000, Section 55I — Variation of permission on application
• FCA — Varying your permission