How to Become FCA Authorised: A Step-by-Step Guide

From Initial Concept to Authorisation Approval — The Complete UK Roadmap

FCA authorisation is the gateway to operating in UK financial services. Section 19 of the Financial Services and Markets Act 2000 establishes the “general prohibition” — no person may carry on a regulated activity in the UK unless they are authorised or exempt. For firms intending to provide regulated activities, the path from concept to operation passes through FCA authorisation: identifying the regulated activities, structuring the firm appropriately, preparing a comprehensive application, navigating the FCA’s review process, and ultimately receiving the formal Part 4A permission that allows the firm to operate. The timeline typically runs 9-15 months from initial scoping to authorisation grant; the cost runs from low five-figures for simple firms to seven figures for complex firms.

This guide explains how the authorisation journey actually works in practice — the regulated activities framework, how to determine what permissions you need, the firm structure and substance requirements, the application preparation, and the FCA review process. It also covers the recruitment dimension — the senior team that needs to be in place before authorisation, and the realistic timeline for sourcing those individuals.

What’s missing from most online explanations of authorisation is the operational reality. The framework is well-described; what’s harder to find is what good actually looks like — the substance the FCA expects to see, the recurring reasons applications stall, and the realistic timeline that firms should plan for. That’s the gap this guide fills.

When You Need FCA Authorisation

FCA authorisation is required if your firm intends to carry on regulated activities in the UK. The regulated activities are defined in the Regulated Activities Order (Financial Services and Markets Act 2000 (Regulated Activities) Order 2001, as amended) and include broad categories such as:

• Accepting deposits — banks, building societies, deposit-taking institutions
• Issuing electronic money — e-money institutions
• Providing payment services — payment institutions under the Payment Services Regulations
• Effecting and carrying out contracts of insurance — insurance underwriters
• Insurance distribution — insurance intermediaries
• Dealing in investments — as principal or agent
• Arranging deals in investments
• Managing investments — discretionary managers, fund managers
• Advising on investments — investment advisers
• Operating a collective investment scheme — fund operators
• Lending and consumer credit — under the Consumer Credit Act framework
• Mortgage lending and broking
• Cryptoasset activities — registration under MLR 2017 plus emerging full authorisation requirements
• Various ancillary activities — including custody, safeguarding, certain trading activities

The Perimeter Guidance (PERG) section of the FCA Handbook provides authoritative interpretation of which activities are regulated. For complex or novel business models, perimeter analysis is itself substantive work — frequently requiring legal advice.

The Authorisation Journey — Timeline Overview

For a typical FCA authorisation, the timeline runs as follows:

Total realistic timeline from initial concept to authorisation: 9-15 months for typical firms; 12-24 months for complex firms (including authorisation of dual-regulated firms, novel business models, or firms in sectors with intensified FCA scrutiny).

Phase 1: Scoping — Determining What You Need

The first phase establishes what the firm is going to do and what permissions it therefore requires. Key decisions include:

Which regulated activities will the firm carry on?

This requires substantive analysis of the planned business model against the Regulated Activities Order. Many business models touch multiple regulated activities — and the specific activities determine the permissions required, the prudential framework applicable, and the SMF requirements.

Will the firm be solo-regulated or dual-regulated?

Solo-regulated firms are supervised by the FCA only. Dual-regulated firms (banks, building societies, insurance underwriters, larger investment firms) are supervised jointly by the FCA and PRA. The application process and ongoing supervisory framework differ substantially.

What firm tier under SM&CR will apply?

Limited Scope, Core, or Enhanced. The tier affects the SMF requirements, the prescribed responsibilities allocation, and the operational governance burden. See our SMCR Guide.

What sector-specific frameworks apply?

Investment firms operate under MIFIDPRU. Payments firms operate under PSR/EMR. Consumer credit firms operate under CONC. Each sector has its own additional rules, capital requirements, and operational expectations.

What about appointed representatives?

Some firms choose to operate through the Appointed Representative regime under another firm’s authorisation rather than seeking direct authorisation. See our Appointed Representative Guide. This can be appropriate for smaller firms but the recent reforms have substantially tightened the regime.

Phase 2: Pre-Application Preparation — Building the Firm

The most demanding phase of the authorisation journey is pre-application preparation. The FCA expects to see a substantively-built firm at the point of application — not a concept that will be built after authorisation. Key components include:

Senior team

SMF candidates need to be identified and ideally engaged. The application includes individual approvals for each SMF, with each candidate’s Fit & Proper assessment included. For a Core-tier firm, this typically means at least:

• SMF1 (CEO) or equivalent
• SMF3 (Executive Director) for each executive director
• SMF16 (Compliance Oversight) — see our SMF16 Guide
• SMF17 (MLRO) — see our SMF17 Guide
• SMF9 (Chair of Governing Body) for firms with a board
• Other SMFs depending on firm structure and tier

For Enhanced firms, additional SMFs apply including SMF2 (CFO), SMF4 (CRO), SMF24 (Chief Operations) — see our individual SMF guides.

Governance framework

Documented governance arrangements including:

• Board structure and committee terms of reference
• Statement of Responsibilities for each SMF (see our SoR & MRM Guide)
• Management Responsibilities Map (for Enhanced firms)
• Reporting lines and decision-making authority
• Risk and compliance committee structures

Capital and prudential framework

Documented evidence that the firm has sufficient capital to commence operation, with capital projection over the early years. The capital amount required depends on the regulated activities and the prudential framework. For investment firms under MIFIDPRU, ICARA documentation is required.

Policies and procedures

A comprehensive set of policies covering:

• Risk management framework
• Compliance monitoring
• AML/CFT framework (see our MLR 2017 Guide)
• Customer onboarding and CDD
• Conflicts of interest
• Conduct of business (where applicable)
• Operational resilience
• Business continuity
• Outsourcing arrangements
• Complaints handling
• Record-keeping
• Financial promotions
• Market abuse and personal account dealing

Systems and infrastructure

Operational systems and technology platforms ready (or substantively progressed) at the point of application. This includes financial systems, customer management systems, regulatory reporting infrastructure, transaction monitoring, sanctions screening, and similar.

Business plan and financial forecast

Substantive business plan with three-year financial forecast, including stress scenarios. The forecast must demonstrate sustainable economic viability.

Phase 3: Pre-Application Engagement

The FCA offers pre-application engagement for firms preparing complex authorisations. This typically involves discussion with FCA Authorisations division before formal submission to:

• Confirm the regulated activities the firm proposes to carry on
• Discuss the firm’s proposed structure
• Identify any specific concerns the FCA has with the proposed business model
• Understand documentation expectations

Pre-application engagement is not mandatory but is strongly recommended for complex applications. It substantially reduces the risk of the application stalling on issues that could have been addressed beforehand. The FCA charges fees for pre-application engagement.

Phase 4-5: Submission and Initial Review

The formal application is submitted via the FCA’s Connect system. The application includes:

• The application form for the firm itself (typically Form A or sector-specific equivalent)
• SMF Form A applications for each Senior Manager
• The full documentation pack (governance, capital, policies, business plan, etc.)
• Application fee payment (see our FCA Application Process & Costs Guide)

After submission, the FCA assigns a case officer who manages the review. Initial review typically takes 2-8 weeks. The case officer may request additional information, clarify aspects of the application, or identify gaps that need to be addressed.

Phase 6: Substantive Review

The substantive review is where the FCA examines the application in detail. This phase typically involves:

• Detailed questions on specific aspects of the application
• Requests for additional supporting documentation
• Interviews with key SMF candidates (particularly first-time SMFs or where there are concerns)
• Independent verification of key assertions in the application
• Coordination with other regulators where relevant (PRA for dual-regulated firms, international regulators where the firm has international elements)
• Senior FCA management review of complex applications

The substantive review can last 3-9 months. Application quality at submission directly affects review duration — well-prepared applications with comprehensive documentation tend to move through review faster than weaker applications.

Phase 7: Determination

The FCA’s determination options are:

Grant of authorisation

The firm is granted Part 4A permission for the specified regulated activities. The permission specifies which activities are authorised and any limitations or requirements attached.

Grant with limitations or requirements

The FCA may attach specific limitations (e.g., on customer types, transaction volumes, geographic scope) or requirements (e.g., specific monitoring arrangements, capital requirements above standard, reporting obligations) to the permission.

Refusal

The FCA may refuse the application if the firm does not meet the threshold conditions or if the FCA has concerns that cannot be addressed through limitations. See our Threshold Conditions Guide.

Voluntary withdrawal

Firms sometimes withdraw applications during the review process — typically where the review has identified issues that the firm cannot or chooses not to address.

The statutory timeline is 6 months for complete applications, extending to 12 months for complex applications. In practice, complex applications frequently extend beyond the 12-month statutory period through agreed extensions.

Common Reasons Applications Stall

Drawing on FD Capital’s experience supporting firms through authorisation, the most common reasons applications stall include:

Inadequate firm substance. Concept-stage applications without substantive build-out.

Senior team gaps. Critical SMF roles unfilled or filled with inadequate candidates. See our SMCR Guide for the SMF requirements.

Capital weakness. Insufficient capital to support the proposed operation, including stress scenarios.

Business model concerns. Where the FCA has substantive concerns about the proposed business model — typical in sectors under intensified FCA scrutiny like cryptoassets, certain consumer credit models, and complex investment products.

Governance weakness. Inadequate governance documentation or substantive concerns about the proposed governance framework.

Compliance and AML framework gaps. Inadequate compliance monitoring, MLRO designation, AML risk assessment, or related documentation.

Operational systems not ready. Where the firm has not built operational infrastructure (financial systems, regulatory reporting, customer onboarding) sufficient to support post-authorisation operation.

Connected party concerns. Where the firm’s controllers, directors, or senior managers have history that creates Fit & Proper concerns.

Sector-specific regulatory concerns. Particularly for sectors with intensified FCA focus.

Recruitment Implications — Building the Authorisation Team

Authorisation requires substantial senior team in place before submission. The recruitment timeline implications are significant:

SMF candidate sourcing timeline

Senior SMF candidates typically have notice periods of 3-6 months. From decision to recruit to candidate starting realistically takes 4-7 months for permanent appointments — and that’s before the FCA approval process for the SMF appointment itself.

Authorisation-period appointments

For firms in the authorisation phase, several patterns emerge:

• Permanent appointments contingent on authorisation — candidates engaged contingent on the firm’s authorisation, with start dates aligned to authorisation grant
• Interim/fractional appointments during authorisation — covering critical roles during the authorisation process, with permanent appointments planned post-authorisation
• Outsourced or shared MLRO arrangements — for smaller firms during authorisation

The fractional CFO and fractional MLRO markets have grown specifically to serve firms during authorisation. See our FCA Authorisation CFO Recruitment page for the fractional CFO model in this context.

SMF approval timing

SMF approvals are typically processed alongside the firm’s authorisation application. The FCA approves the firm and the named SMFs together at the point of authorisation grant — meaning SMF approvals don’t add additional timeline beyond firm authorisation.

Sector-Specific Authorisation Considerations

Investment firms (MIFIDPRU)

Investment firm authorisation requires substantive ICARA documentation, K-factor capital calculation, MIFIDPRU returns infrastructure, and demonstration of the firm’s investment proposition. Wealth managers, asset managers, brokers and similar firms fall in this category.

Payments firms (PSR)

Payment institution authorisation requires demonstrated safeguarding arrangements (different from CASS), payment processing infrastructure, and the specific governance for the regime. Payments firm authorisation has been heavily scrutinised since 2022 reflecting FCA concerns about the sector.

E-money institutions (EMR)

E-money authorisation requires safeguarding, the specific prudential framework for EMIs, and the conduct framework for the sector.

Consumer credit firms

Consumer credit authorisation operates under CONC and requires demonstrated affordability assessment frameworks, complaints handling, and vulnerable customer support. The FCA has been particularly active in supervising consumer credit since the regime moved from OFT to FCA.

Cryptoasset firms

Cryptoasset MLR 2017 registration is currently the principal regime. Full FCA authorisation for broader cryptoasset activities is being developed and is expected to substantially intensify the regulatory framework.

Insurance intermediaries

Insurance distribution authorisation operates under the IDD framework with specific requirements around suitability, fair value, and customer outcomes.

Further Reading and Authoritative Sources

For the FCA’s authorisation process pages, see the FCA’s authorisation pages. For the regulated activities framework, see the Regulated Activities Order. For the Perimeter Guidance, see PERG.

Related Guides: Authorisation and Recruitment

Part of FD Capital’s series of practical guides for FCA-regulated firms: The FCA Application Process & Costs | FCA Threshold Conditions | The Appointed Representative Regime | The FCA Fit & Proper Test | Regulatory References Under SMCR | SMCR — Pillar Guide | SMF16 — Compliance Oversight | SMF17 — MLRO Function | MLR 2017 Compliance Guide