Variation of Permission: A Practical Guide
A variation of permission is how an authorised firm changes what it is allowed to do. It is a routine application that firms routinely underestimate, usually by treating it as a form rather than as a fresh assessment of whether the firm meets the threshold conditions for the business it is proposing.
This guide covers when a variation is needed, what the FCA is actually assessing, how long it takes, and the hiring consequences that catch firms out.
When You Need One
A variation is required whenever the firm wants to do something outside its current permissions. That includes adding a regulated activity, adding a client type — retail where the firm currently serves professionals only — removing a limitation or requirement imposed on the permission, or changing the investment types the permission covers.
It is also used in the other direction, to remove permissions the firm no longer uses. Firms often leave unused permissions in place on the basis that they cost nothing, which is not quite true: permissions carry obligations, and a firm holding a permission it does not exercise still has to be able to demonstrate it could meet the standards attached to it.
The judgement that catches firms out is the one where a commercial change looks like a product tweak and is in fact a different regulated activity. Where there is doubt, resolving it before launch is considerably cheaper than afterwards.
What Is Actually Being Assessed
A variation is not an administrative amendment to an existing authorisation. It is an assessment of whether the firm satisfies the threshold conditions for the business it proposes to carry on.
That means the regulator will look at the business model and whether it is viable and understood, at resources — financial and non-financial, including people and systems — at the suitability of the firm and those running it, and at whether the firm can be effectively supervised.
The practical consequence is that a firm whose current arrangements are adequate for its current business may not satisfy the conditions for the business it wants to add. A variation application is where that gap becomes visible.
The Resources Question Is Usually About People
Financial resources attract attention, and firms generally prepare for that. Non-financial resources — whether the firm has the people, skills and systems to run the new activity properly — are where applications more often stall.
If a firm currently serving professional clients applies to serve retail customers, the questions that follow are about consumer-facing capability: complaints handling, Consumer Duty arrangements, training and competence for staff who will advise retail clients, and whether the compliance function has retail experience.
A compliance officer whose entire background is institutional is a real gap in that scenario, and the regulator will see it. Firms that recognise this early and address it in the application are in a far better position than firms that are asked about it and have no answer.
The Regulatory Business Plan
Most variations of substance require a business plan covering the proposed activity, and the quality of this document does more to determine the timetable than anything else in the pack.
What works is specific: what the firm will do, for whom, through what distribution, with what volumes and revenue assumptions, with which risks identified and which controls addressing them, and who is accountable for each. What does not work is a marketing narrative with a compliance paragraph attached.
Our guide to the regulatory business plan covers the structure in more detail. The single most common weakness is financial projections that do not reconcile with the activity described.
Timing
Statutory determination periods apply, and they run from when the application is complete rather than from when it was submitted. That distinction accounts for most of the difference between firms’ expectations and their experience.
An application with gaps generates questions, and the clock effectively restarts around the information that was missing. Firms that submit early with an incomplete pack, hoping to start the clock, generally find they have started a correspondence instead.
Our guide to the FCA authorisation timeline covers what drives the variance, and much of it applies equally here.
What the Application Pack Contains
The exact requirements vary with what is being added, but the shape is consistent and worth assembling before anyone opens the form.
Expect to provide the business plan, financial projections covering a realistic horizon, an updated organisational structure showing who does what, compliance arrangements specific to the new activity rather than generic, and the relevant senior manager documentation. Where client money or custody is involved, expect substantially more.
Two items are routinely weaker than the rest. Compliance arrangements are frequently described in the abstract — a monitoring programme “will be developed” — where the regulator is looking for something that exists. And organisational charts often show the firm as it is rather than as it will need to be once the new activity is running, which prompts the obvious question about who is going to do the work.
Handling Questions Well
Most applications of substance generate a round of questions, and how a firm responds affects the timetable more than the questions themselves do.
Responses that work address the concern behind the question rather than its literal wording. Where the regulator asks how the firm will monitor a particular risk, an answer describing a control that does not yet exist, with a date for building it, is weaker than an answer describing one that does. Where something genuinely is not in place, saying so with a plan is better than implying otherwise.
Speed matters less than completeness. A thorough response a week later generally shortens the process more than a partial one by return, because a partial answer produces another question.
Senior Manager Consequences
This is the part firms most often miss until late.
A new activity may bring new senior management functions, or may change what existing holders are responsible for. Statements of responsibilities need updating to reflect the new business, and where a new function is required the individual needs approval — which is a separate application with its own timetable.
Where the firm will move into a different SMCR category as a result of the change, the consequences are larger still, bringing additional functions and prescribed responsibilities. Running the variation and the senior manager applications in parallel, rather than sequentially, is usually the difference between launching on time and not.
Our guide to SMF appointments during authorisation covers how the processes interact.
Removing Permissions
Applications to remove permissions are simpler but not automatic. Where the firm has conducted the activity, the regulator will want to understand what happens to existing customers, whether there are outstanding liabilities, and how any run-off is managed.
A firm that stops an activity without varying its permission remains authorised for it, with the attendant obligations. Firms carrying permissions they have not used for years should review them deliberately rather than leaving them in place by default.
Preparing Properly
The firms that get through quickly tend to do four things before submitting.
They establish precisely which permissions are needed, rather than approximating. They identify the resource gaps honestly and address them in the application rather than waiting to be asked. They prepare the business plan as a regulatory document rather than repurposing an investor deck. And they work out the senior manager consequences at the start.
The alternative — submit and see — reliably costs more time than the preparation would have.
Frequently Asked Questions
Is a variation quicker than a new authorisation?
Often, because the firm and its people are known. It is not a formality, and a material change in business model can attract similar scrutiny to a fresh application.
Can we start the new activity once we have applied?
No. The firm may only carry on activities covered by its current permission until the variation takes effect.
Will our existing compliance arrangements be enough?
Only if they are adequate for the new activity. Moving into retail business, client money or a different customer type frequently requires capability the firm does not currently have.
Do we need to remove permissions we no longer use?
There is no obligation to, but holding them carries obligations. Reviewing them periodically and removing the redundant ones is good practice.
Hiring for compliance?
We place the people who own this function
Compliance Oversight holders on a permanent, part-time, fractional and interim basis. Tell us what the firm does and we will give you an honest view on what the role actually needs.
Related guides and services
Practice area
Authorisation
Practice area
Wider compliance
About the author
Adrian Lawrence FCA
Adrian is the founder and Managing Director of FD Capital. A Chartered Accountant and ICAEW Fellow, he became a finance director at 28 and has spent more than 25 years at C-suite level, including as finance director of a listed company and of a private equity backed management buy-out. Every search is run by our specialist team, with Adrian overseeing each mandate.
Start a search
Tell us about your finance hire
Share a few details about your business and the role. A member of our team will review your brief and come back to you to talk it through.
- Reply within one working day, from a consultant who places finance leaders every day
- Confidential from the first conversation, with no obligation to go ahead
- Shortlists typically within three to seven days, faster for urgent interim cover
Your details are used only to respond to your enquiry.
Accredited Member of GBC 
Accredited Member of LWF 
Carbon Offset via TreeNation