FCA Regulatory Licence Application Process
Introduction
The Financial Conduct Authority (“FCA”) is the body responsible for authorising and supervising the vast majority of firms who carry on regulated financial services business in the UK. This includes e-money institutions, credit brokers and firms carrying on payment services activities and all but the largest of investment management and advisory firms. (Banks, building societies, credit unions, insurers and the largest investment firms are jointly regulated by the FCA and the Prudential Regulation Authority.). And of course, the scope of FCA regulation is continually evolving in response to industry trends, bringing in firms such as those providing cryptoasset exchange services.
Any firm wishing to undertake activity in the UK that falls within the FCA’s “regulatory perimeter” will either need to obtain the necessary FCA permission(s) prior to undertaking that activity or, (if the activity in question is one permitted under such an arrangement), carry on activities under the authorisation of an existing regulated firm which already has the relevant permissions.
This article provides an overview of the considerations firms should have in mind when determining whether to apply for FCA authorisation, the process and timescales associated with such an application and the key things firms should focus on when preparing their application.
Initial considerations
Key points:
Take time to confirm you need to be FCA authorised and if so, that you are applying for the correct permissions
Consider obtaining external assistance to help determine the regulatory status of your proposed activities, and whether minor changes to your planned business model might impact this
Factor the time the application process and subsequent FCA consideration will take into your business plans
Ensure you can demonstrate that you meet (and will continue to meet) the minimum requirements for authorisation, including in respect of the fitness and propriety of owners and group companies
Be capable of demonstrating that you will be ready and organised by day 1 of authorisation, with the right policies, processes, systems and people in place to enable you to do business in a compliant manner.
Ensure you have sufficient budget available to undertake the work necessary both to submit your application and to prepare for being FCA authorised (many firms are likely to require some form of external support in this respect).
Do you need to be regulated and if so, what permissions do you require?
An obvious but extremely important first consideration is whether the nature of your business and the activities you propose to undertake are such as to require FCA authorisation.
The activities within the FCA’s regulatory perimeter derive primarily from four sources:
The Financial Services and Markets Act (“FSMA”) 2000 (Regulated Activities) Order 2001 (the “RAO”) covers activities including managing and advising on investments, arranging deals in investments, credit broking;
The Payment Services Regulations 2017 (“PSRs”) define the activities associated with payment services for which FCA authorisation is required;
The Electronic Money Regulations 2011 (“EMRs”) define electronic money and the activities associated with it for which FCA authorisation is required;
The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (“MLRs”) set out the requirement for businesses undertaking certain activities in relation to cryptoassets to be registered with the FCA.
In each case, the activities that fall within the regulatory perimeter are defined very precisely. Confirming that your planned activities meet the relevant definition(s) is important for a number of reasons:
The FCA will only grant permission where it is satisfied that this is necessary given the nature of the firm’s proposed activities; firms cannot obtain FCA authorisation as a “badge of honour” or on the basis that they might wish to undertake certain activities in future. Where the firm cannot demonstrate that its planned activities are such as to require authorisation, the FCA is likely to reject the application. And furthermore, the question of whether a particular activity falls within or outside the scope of regulation may not always be easily answered, given the number of exemptions and exclusions that are available. External advice in this respect can often be helpful;
Furthermore, the process of applying for authorisation is complex, time-consuming and costly (both in terms of man hours expended by senior personnel within the firm but also in terms of application fees and possible fees for outside support from consultants). Before committing to this process, firms should take time to confirm that FCA authorisation is absolutely necessary;
Finally, for those firms who obtain FCA authorisation, this brings a number of ongoing obligations and requirements in terms of their internal organisation and resources, systems and controls, policies and procedures and even financial/capital position. The specific obligations vary depending on the nature of the permissions held by the firm, providing another incentive to ensure that the firm does not have permissions beyond those it requires.
In many scenarios, determining whether your activities will fall within or outside the regulatory perimeter may be relatively straightforward. Where this is not the case or there is any doubt, we would recommend seeking external assistance to review your proposed business model and provide confirmation as to whether FCA authorisation will be required.
Are there any available exemptions?
The majority of activities inside the regulatory perimeter have one or more exemptions that remove the need for FCA authorisation. As with the definitions of the activities themselves, the exemptions are precisely worded such that they are only available in limited circumstances. As such it is important to consider these carefully, possibly with external support, in order to determine whether they might apply.
Are there alternatives to direct FCA authorisation?
Certain activities can be carried out by firms as a result of a contractual arrangement with another firm that has the necessary FCA permissions. For activities caught by the RAO, such firms are known as “appointed representatives”, whereas for activities under the PSRs and EMRs, these firms are known as “agents” or “distributors”.
Becoming an appointed representative or agent can provide a quicker alternative to obtaining FCA authorisation, but there are some disadvantages, notably that the activities the firm can undertake are limited to those for which the principal firm is authorised. The firm will also need to align with the risk appetite of its principal and be subject to its oversight and monitoring.
Timescales
Even in the most straightforward of cases, the process of obtaining authorisation is likely to take somewhere between nine and 12 months and can often take as long as 18 months to two years (this timescale is broken down below).
Whilst there are certain things you can do to help minimise the time this process will take – for instance, by responding promptly to follow up questions from the FCA – any savings in this respect are likely to be fairly minimal in the context of the process as a whole.
Firms cannot commence undertaking regulated activity whilst their application is pending (except where this is under an appointed representative or agent arrangement, as previously outlined), and as such it is important that you factor this into your business plans.
Minimum requirements for authorisation
In addition to detailed requirements relating to areas such as conduct of business, market conduct, consumer duty and internal systems and controls (summarised below), the FCA requires that each firm meet certain minimum standards both at the point it is authorised and throughout its lifetime as a regulated firm.
For firms seeking permission for activities under the RAO, these standards are known as the “threshold conditions”, whilst under the PSRs and EMRs they are referred to as “conditions for authorisation”. Whilst there is some variation in the specific requirements across the different regimes, they largely focus on similar points, including that the firm seeking authorisation must:
Be a body corporate with its head office in the UK;
Hold the necessary amount of regulatory capital (the specific amount required varies depending on the permissions held by the firm);
Be undertaking or planning to undertake business in the UK;
Be capable of being effectively supervised by the FCA, having regard to its business model, controllers, group companies etc;
Have its “mind and management” located (at least in part) within the UK – that is to say, at least a majority of the firm’s senior personnel should be UK based;
Be effectively organised with appropriate systems and controls, resources.
These requirements carry forward into many of the forms, supplements and supporting documents that the firm will be required to complete or attach as part of its application. Should the FCA not be satisfied that the firm will meet the relevant minimum requirements, it will refuse the application.
In practice, the areas here (if any) that are most likely to present a challenge are those focusing on systems, controls and resources as well as those relating to group structure, controllers and close links. The former can be addressed by providing comprehensive information within the application form. The latter will require you to ensure that your owners and those firms with whom you have a group relationship are all likely to meet the FCA’s requirements regarding fitness and propriety.
Preparing your application
Key points:
Register for Connect and ensure you assign appropriate permission levels to your registered users
Consider whether it may be appropriate to make use of the FCA’s regulatory sandbox
Ensure you have a full understanding of the information that is required within each section of the application forms, including any specific regulatory standards or rules that are applicable
Engage with the right individuals within the firm to obtain information pertinent to their areas of responsibility
Consider using a project manager or project management tools to help keep track of progress
Connect system
Authorisation applications need to be made via the FCA’s “Connect” system. Once you have determined that you will indeed need to apply for FCA authorisation, you will need to create an account on Connect and assign an individual as principal user. Firms can also assign additional users, giving them different permissions – read only, edit, submission etc – as necessary in order to facilitate the application process.
In practical terms, it is usually advisable for the principal user to be the firm’s compliance officer or another senior individual who will be responsible for the preparation and submission of the application. The number of additional users with “edit” permissions should be kept to a minimum; having a select group of individuals who can update sections of the application forms for which they are responsible can be beneficial, but having too many individuals with this ability can create issues in terms of version control.
FCA “regulatory sandbox”
For those firms who are looking to provide innovative products and services, the FCA’s “regulatory sandbox” can provide a useful way of engaging with the FCA as a precursor to or alongside commencing a formal authorisation application. The regulatory sandbox process involves regular engagement with the FCA, additional guidance and a tailored authorisation application process. In order to make use of the regulatory sandbox, you will need to be able to demonstrate that your proposed business model involves in scope activities, is genuinely innovative and provides a consumer benefit. You will also need to demonstrate that the firm is ready to commence the authorisation process but requires assistance in this respect. The FCA is also likely to require you to have submitted your application for authorisation as a pre-condition to commencing activity within the sandbox environment.
The application form(s) and supporting documents
The specific forms, supplements and supporting documents that a firm seeking authorisation will need to complete or provide vary depending on the regime the firm is applying under (that is, FSMA/the RAO – which covers, amongst other activities, those under MiFID, PSRs, EMRs or MLRs) and the permissions the firm is seeking. Detailed consideration of any specific forms is beyond the scope of this article, but there are common threads that are worth focusing on.
As noted above, the FCA expects firms to be able to demonstrate how their proposed activities fall within the regulatory perimeter and how they meet (and will be able to continue meeting) the minimum requirements for authorisation.
In addition, the FCA requires firms to provide information in areas such as:
How the firm will attract new customers, including its projections for growth over the first three years post-authorisation;
Financial forecasts for the first three years post-authorisation;
The controls the firm will have in place to counter the risk that it is used to facilitate money laundering or financial crime;
How the firm will ensure it meets its duty takes reasonable steps to deliver good outcomes for retail customers (the “consumer duty”);
The governance arrangements the firm will have in place how these are appropriate given the nature and complexity of the business and how they will ensure the firm is able to identify and manage risks and issues as they arise;
IT systems and information security, notably where the firm is providing payment services and as such may come into possession of sensitive payment data (customer credentials that, if leaked, may allow an unauthorised user to gain access to a customer's bank account);
How the firm will safeguard funds or segregate and protect client money;
Any outsource relationships the firm has and how these will be managed appropriately;
The steps the firm will take to ensure that its staff are appropriately skilled and competent; and
The means by which the firm will manage conflicts of interest.
It should be noted that the above is by no means an exhaustive list but merely provides an indication of the kind of topics covered by the application process and forms.
The amount of time required to complete an application ready for submission varies significantly depending on a number of factors including the nature of the activities the firm will be undertaking and the permissions it will be seeking, the extent to which it already has supporting documents that can be attached to the application and the availability of key individuals to provide input to the process where necessary. However as a guide, we would suggest you allow for a minimum of two to three months from commencing work to the point at which the application can be submitted.
Understanding the specific regulatory requirements that are applicable
In many of the areas covered by the application forms, there are underlying regulatory requirements that firms will be required to meet. These may be different or more prescriptive than the standards the firm is used to working with in an unregulated environment. Understanding those requirements is vital in order to demonstrate to the FCA that the firm will meet its regulatory obligations, and – particularly for those firms who do not have in house compliance expertise – external support is likely to be vital here.
Supporting documents
Certain areas within the application process require the firm to provide copies of supporting documents such as draft customer contracts or the firm’s compliance monitoring plan. Needless to say, it is important to ensure that these meet the required standards and take account of any specific requirements that are applicable.
In other areas of the application process, firms are merely asked to provide a summary or description of the policies, procedures, systems, controls etc they will have in place, or to confirm that a particular document exists. However the FCA can (and regularly does) ask firms for copies of additional documents as part of its follow up questions post-submission of the application, and as such you will need to ensure these are available if and when requested.
It can also be helpful to provide flow diagrams covering areas such as AML processes, the flow of money and the overall customer journey. As the old saying goes, a picture can tell a thousand words!
Input from appropriate individuals
The application process requires information on all aspects of a firm’s business. For all but the smallest firms, this is likely to require them to seek input from multiple individuals in order to ensure the information provided is accurate and complete.
Identifying and engaging with the individuals who will need to provide input early on in the process is likely to prove beneficial in terms of avoiding delays in submission.
Project management and tracking
It should be clear from the above description and the timescales described within this article that applying for FCA authorisation is a significant undertaking and one which is likely to involve the expenditure of significant time and resources. Given the number of areas covered by the application process and the likely need for input from multiple individuals within the business (and possibly even externally), we would recommend that firms apply robust project management methodologies to their application, including assigning a project manager or “owner” for the process.
Submission and beyond
Key points:
Ensure you have answered all questions as fully and comprehensively as possible and in a way the FCA is likely to understand (remember, they don’t know your business model)
Avoid electing to send documents at a later date wherever possible
Expect multiple rounds of follow up questions; when these are received, respond as promptly and fully as possible
Don’t be afraid to seek further clarification from the case officer where necessary
First impressions count (but won’t get you over the line alone)
As the old adage runs, “you only get one chance to make a first impression”; this is certainly true in respect of your FCA application, and it is vital to ensure that you have answered all questions fully and completely, uploading any necessary supporting documents as required. Whilst in certain areas the option exists to submit supporting documents at a later date, this is something we would advise against doing unless absolutely necessary; it is unlikely to generate any savings in terms of the overall time for the application, not least because although the FCA is bound by statute to consider applications within a certain timescale, the FCA does not regard the “clock” as ticking in this respect until the application is complete, including having received satisfactory answers to any follow up questions it raises post submission (see below). Furthermore, submission of an incomplete application risks creating a poor first impression.
However whilst the importance of taking care to submit a complete application cannot be overstated, it is important to recognise that the FCA is extremely unlikely to grant authorisation based purely on the content of the application forms and supporting documents. In practice, the FCA will engage with the firm seeking further information and/or clarification, with this process usually taking several months.
Feedback from the FCA suggests that many firms fail in their quest for authorisation not because of flaws in their business model per se, but rather because they fail to demonstrate that they have built the right compliance culture within the firm and/or understood the risks they are likely to face in regulatory and customer terms. Getting these points right from the outset is vital.
The FCA is willing to meet with firms pre-application and this can be helpful in establishing an initial relationship and building mutual understanding. However the firm must be able to demonstrate a good level of understanding of what being regulated entails and how they will ensure they do business in a compliant manner before even this initial meeting takes place.
Process and timescales after submission
Once submitted, the FCA will assign a case officer to work on your application. This process typically takes around four to six weeks, after which time he or she will contact you by way of introduction and to set out the next steps.
If there are any missing or incomplete elements of the application, the case officer will usually request that these be addressed before he or she commences a full review of the application. After commencing that review, the case officer is likely to revert with questions, typically around four to six weeks after initial contact (subject to any missing elements of the application having been addressed) and will usually give the firm around four weeks to respond to those questions. In our experience, two to three rounds of questions is common, but this can be more, depending on the nature of the application and the permissions being sought.
Once the case officer is satisfied that with the response to all his or her questions, the application will be referred to a manager within the authorisation department for their review. In our experience, this will typically result in at least one further round of questions, although again this can be more.
Once the FCA is satisfied that the firm has answered all its questions fully, meets (and will continue to meet) the minimum standards for authorisation and will have in place all necessary policies, procedures, systems and controls to fulfil its regulatory obligations, it will issue a “minded to approve” letter. This may include certain conditions – for instance, providing proof that the firm is holding the required amount of regulatory capital. Once the firm has met any conditions attached to the minded to approve letter, the FCA will grant its authorisation and update the FCA register accordingly. The firm is then free to commence regulated actjvities.
Responding to FCA follow up questions
When the FCA provides follow up questions, it is important that the firm reviews these promptly and carefully, seeking clarification where necessary. The FCA will always provide a deadline for responses – typically around four weeks. If the firm feels this is likely to be problematic, it is important to raise this as soon as possible.
Timeline at a glance
The table below provides an approximate indication of the timescales that are typically involved in obtaining FCA authorisation.
Initial consideration and determining which permissions are required: 1 month
Preparation of application and supporting documentation: 1 to 3 months
Assigning of a case officer: 4 to 6 weeks
Initial review and questions: 4 weeks
Response to initial questions: 4 weeks
Follow up questions (each round): 4 weeks
Response to follow up questions (each round): 4 weeks
Manager review: 4 to 6 weeks
Response to manager questions: 4 weeks
Manager review of responses: 4 weeks
Beyond authorisation – commencing regulated activity
The FCA requires firms to comply with all applicable regulatory requirements and obligations from the point at which it commences carrying out regulated activity; there is no transition period or similar permitted. This will involve ensuring that all relevant policies, procedures, systems and controls are in place and operational from day 1.
In practice, we recommend that firms use the time from submission of their application to the point at which their authorisation is granted to implement and embed the necessary arrangements such that they are able to “hit the ground running” at the point they become authorised.
Finnovation support
We have extensive experience of supporting clients through all stages of the FCA application process, from undertaking initial business model analysis to determine whether authorisation is required and if so, for which activities, to preparing application forms and supporting documents and managing subsequent interactions with FCA case officers and authorisations team management.
For more information please contact: claire.conby@finnovation.uk