Commercial banking business modelGuide to applications and ongoing compliance

Primarily engaged in corporate deposits, corporate lending and trade finance; investment, payment, financial promotion and anti-money laundering responsibilities must be assessed separately according to the products.

Commercial banking is a banking business model focused on deposits, lending and proposed trade finance for corporate and small and medium-sized enterprise (SME) customers, not a separate statutory licence. Applications must follow the bank Part 4A authorisation granted by PRA with the consent of FCA and the applicable capital rules, demonstrating sustainable operations through actual customers, credit portfolios and funding sources. Corporate customer labels cannot replace permission checks or automatically exclude deposit protection or conduct regulation. This entry is compiled from existing official verification materials as at 2026-11-07 and does not guarantee approval, pricing or that an applicant already has physical office premises.[1] [6] [7]

This model serves businesses and SME and may propose corporate transaction or savings accounts, working capital loans and other corporate financing. Trade finance is included only where it is actually proposed and the activity and permission checks have been completed. Applications should distinguish clients' legal status, such as companies, partnerships and sole traders, and describe business size, sectors, regions, connected groups and service channels, rather than treating all 'business customers' as institutional clients with identical risks. Whether deposits in business accounts are regulated deposits must be assessed against the contracts, repayment obligations, use of funds and statutory exclusions.[2] [6]

Formal operating rights derive from the approved Part 4A permission and its customer scope and restrictions. Deposit-taking is authorised by PRA with the consent of FCA, with prudential and conduct regulation applying separately after approval. A bank name does not automatically cover investment services, all credit products or direct access to payment systems. This page primarily addresses applications for a newly established UK-incorporated commercial bank; UK subsidiaries or branches of overseas banks must separately check their legal structure and international banking regulatory route. Serving businesses likewise does not justify applying all the entity capital and documentation requirements on this page.[1] [6] [11]

Select the minimum sufficient combination of permissions that lawfully supports the actual business, client scope and financial responsibilities, rather than treating the broadest permissions or fastest approval as the sole objective.

• Within authorised activities and restrictions, a bank may use corporate deposits to support asset business such as lending, and arrange account and financing services for the same corporate customer. This capability derives from the business actually approved, not from all financial services being bundled with a ‘commercial banking licence’; the activity boundaries for trade finance, other credit or investment-related services must first be checked individually.[2] [6]

• The same model may target different business customer segments, but applicants must use market research and financial evidence to explain why they can attract the chosen segment. Specialising in a particular SME industry may help build lending expertise but also increases sector concentration risk. This is a commercial choice and risk trade-off, not regulatory recognition of profitability or a reduction in capital requirements.[7]

• Eligible corporate deposits should also be classified under the applicable deposit protection rules, rather than making blanket claims that corporate deposits are unprotected or fully protected. The general FSCS limit is £120,000 per eligible depositor, per PRA-authorised institution, not separately per account or brand. This does not replace liquidity management for large corporate deposit outflows.[5]

• Common banking threshold conditions still apply: legal form, the UK legal entity's head office and registered office, appropriate resources, prudent conduct and effective supervision must all be addressed. First explain why becoming a deposit-taking bank is necessary, rather than merely lending to businesses. Map each account, financing contract and flow of funds to the activities applied for; company registration or the name ‘Commercial Bank’ cannot replace authorisation.[3] [6]

• The regulatory business plan RBP must organise market evidence by corporate and SME customer segments, explaining how customers are acquired, open accounts, obtain credit and repay financing. Loan balances, loan income, corporate deposit costs, staffing and system expenditure, and expected credit losses should be linked to the same set of financial projections to demonstrate a path to profitability, rather than merely reporting prospective customer numbers or financing intentions.[6] [7]

• Credit risk evidence should explain repayment sources, credit assessment, lending authorities, post-lending monitoring and problem loan handling for the proposed loan types. Concentration measures and stress scenarios may be designed around customer sectors, connected groups and guarantee or collateral arrangements. For trade finance, further explain verification of transaction parties, documents, goods flows and use of funds, and exception escalation. These are directions for materials implementing a model-specific risk framework, not a requirement for all commercial banks to offer identical products or apply a uniform collateral ratio.[6] [7]

• A UK-incorporated entity must produce ICAAP and ILAAP consistent with RBP. For commercial banks, capital and cash needs should be tested simultaneously against corporate loan defaults or delayed repayments, significant corporate deposit outflows and concentrated drawdowns on committed credit facilities. One set of loan growth assumptions must not be used in capital forecasts and another set of funding assumptions in liquidity forecasts. Executable contingency funding and management measures should be explained; deposits or credit facilities awaiting approval must not be treated as shareholders’ regulatory capital.[6] [7]

• Governance and systems must support the actual complexity of the business. Customer relationships and business development must not bypass credit approval or independent risk oversight, and material credit exceptions should be traceable. Core account, credit, treasury and regulatory data must be reconcilable. Where corporate payments or trade finance services are provided, the corresponding processes and important external dependencies should be tested. A supplier’s system presentation alone cannot demonstrate readiness to commence business.[6] [7]

• Business account opening requires arrangements for customer and beneficial owner identification, authorised signatory verification and risk classification, with financial crime controls based on the proposed transactions. The applicability of conduct rules such as the Consumer Duty and eligibility for FSCS must also be determined for each product and customer. SME, micro-enterprises and sole traders cannot be excluded merely by labelling them 'business customers'. Even where a business activity falls outside the Consumer Duty, applicable conduct responsibilities and potential customer harm must be explained in RBP.[5] [6] [7]

Shareholders and controllers must disclose ownership chains, ultimate owners, sources of funds and group relationships. Where an investor is also a major corporate borrower, depositor or business introducer, clarify its commercial relationships and influence and design approval, recusal and oversight arrangements for connected lending and conflicts of interest. Shareholder commitments or business volumes from their companies cannot replace evidence of actual capital availability and controller fitness.[6] [7]

The experience of the board and senior management must cover the proposed corporate and SME lending, treasury and liquidity management, risk governance and operational controls. Applicants proposing trade finance should explain how the team understands the relevant contractual and transaction risks, rather than providing only retail customer acquisition experience or banking job titles. Collective capabilities may be demonstrated through skills matrices, experience of actual responsibilities, recruitment assessments and training plans addressing gaps. All applicable SMF applications, statements of responsibilities and fitness and propriety materials should be prepared alongside the bank application, with regulatory interviews where necessary.[7] [8]

Common governance requirements for new banks must still be implemented according to the authorisation stage. Staffing maturity differs between entry into mobilisation and full launch; it must not be claimed that a uniform number of directors or employees is sufficient. The business model should also clearly allocate responsibilities and cover for relationship management, credit decisions, independent risk oversight, treasury, compliance and anti-money laundering, audit and systems operations. Committee structures or outsourcing arrangements must be proportionate to scale; this list of functions must not be misrepresented as a fixed headcount or uniform SMF combination.[6] [7]

Commercial banks do not have a separate set of ‘corporate banking minimum capital’ requirements. Under the common rules for ordinary UK-incorporated banks, the base capital resources floor is €5,000,000; it must not be restated as £5,000,000, nor is it the total start-up budget or the purchase price of a licence. Only institutions meeting the PRA definition of a small specialist bank may apply the currency-equivalent floor of the higher of €1,000,000 and £1,000,000. Serving SME does not itself establish eligibility, and a small specialist bank is not the same as the SDDT simplified prudential regime.[13] [14]

Actual requirements must cover applicable Pillar 1, Pillar 2A, buffers and, where applicable, MREL in addition to base capital, and account for establishment and operating losses. Commercial bank ICAAP should measure credit risk against the actual corporate loan portfolio and assess sector or connected-group concentrations, guarantees and collateral, credit commitments, interest rate risk and operational risk as appropriate. Trade finance or foreign-currency business should be included only where present in the proposed portfolio; a nominal limit for one product must not replace bank-wide risk capital calculations.[6] [7]

When commencing full operations directly or exiting mobilisation, it must be demonstrated that planned operations can maintain the relevant capital requirements for at least the first twelve months; applicable requirements must also be met continuously during the restricted stage. A new bank’s PRA buffer is generally calibrated to six months of projected day-to-day operating expenses. The mature-bank stress-testing approach generally applies after five years of full operations or one complete consecutive profitable operating year, whichever comes first. This is not six months of loan interest income, nor does it permit minimum capital to be consumed to pay development costs.[6] [7]

Corporate deposits, settlement funding and shareholder capital are distinct resources. ILAAP must demonstrate funding arrangements for loan drawdowns and corporate deposit outflows. Shareholder capital injection plans must also specify timing and credible fallback measures. As at 2026-11-07, distinguish current rules from the announced 2027 reforms: the main Basel 3.1 rules and the SDDT simplified capital phase take effect on 2027-01-01, while the market risk internal models approach takes effect on 2028-01-01. Future regimes must not be treated as automatic eligibility for capital reductions for current commercial banks.[7] [14] [16]

A newly established UK-incorporated commercial bank must locate its head office and registered office in the UK and demonstrate that its actual decision-making, systems and records can be effectively supervised by PRA and FCA. Explain where corporate lending, treasury management and risk oversight take place, who has ultimate decision-making authority and how UK management obtains customer, loan and account information. A correspondence address or nominee directors alone cannot demonstrate that these controls exist. This page does not confirm that any applicant already has an office.[3] [6] [7]

Relationship managers may serve businesses through different channels, but remote teams, outsourced loan servicing or shared group systems require clear documentation of access, regulatory contact, business continuity and responsibility interfaces. The need for branches or particular office arrangements should be demonstrated against actual customer service and control capabilities; this model does not imply any uniform requirement for London office space, staff numbers or premises rent.[6] [7]

• The application form, list of proposed activities and restrictions, and applicable application fee information should be consistent. Explain customer identities, contractual arrangements and fund flows for each corporate account, SME loan and trade finance product actually proposed. Investment services or other activities outside the plan must not be described as automatically authorised. Verify regulatory fees against the current official PRA and FCA rules at submission; they are not a project quotation.[6]

• A corporate bank’s RBP must include market evidence tailored to its customers’ industries and size, customer acquisition channels and pricing explanations. Financial projections must reconcile the loan portfolio, credit losses, corporate deposit costs, fee income, and development and control expenditure. Board challenge and approval records and an index of responses to pre-application feedback should also be included, explaining how the plan would be revised if deposit or lending growth falls below expectations.[6] [7]

• Credit and post-lending policies should explain customer financial analysis, repayment sources, approval and exception authorities, limits, guarantee and collateral management, arrears monitoring and problem loan handling. Illustrative credit cases consistent with the proposed products, portfolio concentration analysis and stress calculations may be provided to demonstrate that processes are workable. For trade finance, also include transaction verification, document handling and exception escalation procedures. This list is a way of organising risk evidence for this model, not a standard fixed list of attachments published by the regulator.[6] [7]

• Submit the UK legal entity’s final ICAAP and ILAAP, together with evidence of capital instrument eligibility and capital actually in place. Under the official instructions, an auditor may confirm that capital is in place and available, or a combination of capital injection bank statements, SH01 and board records of issued share capital may be provided; corporate deposit intentions, loan collateral or unapproved financing facilities are not evidence of capital injection. Capital and liquidity documents must use loan growth, impairment and corporate deposit outflow assumptions consistent with RBP.[6] [7] [13]

• Controller information must include ownership and group structures, ultimate owners, sources of funds and suitability evidence, and explain investors' relationships with major borrowers or customers. Senior management information should include experience, statements of responsibilities, suitability assessments, a collective skills matrix and plans to address knowledge gaps, enabling those responsible for corporate credit, treasury and operations to explain the core application documents personally.[6] [7] [8]

• Customer journey materials should cover corporate onboarding and beneficial owner identification, authorised signatories or operating permissions, fee communications, loan applications and decisions, customer support, complaints and handling account restrictions. Record the conduct rules, Consumer Duty assessment and FSCS eligibility applicable to each customer and product, and provide evidence of preparation of the corresponding deposit disclosures, Single Customer View and exclusions files. A single set of large-corporate standard terms cannot cover all SME.[5] [6] [7]

• Systems and operational materials should explain the integration and reconciliation of core account, credit, loan servicing, treasury and regulatory reporting data, with implementation and test results, material outsourcing contracts, oversight and replacement arrangements. Test credit drawdowns, corporate payment authorisations, reconciliations and service disruptions against the proposed business. Before full launch or exit from mobilisation, submit the applicable operational resilience self-assessment and materials on important business services, impact tolerances and scenario testing.[6] [7]

• Recovery, applicable resolution and solvent exit materials must reflect the commercial bank's corporate deposit concentration, constraints on loan realisation or collection at maturity, and undrawn commitments or trade finance obligations. Where applicable, prepare a board-approved solvent exit analysis SEA. If mobilisation is selected, also attach a build-out plan for staffing, capital, systems and customer service, together with exit evidence; the deposit limit must not be treated as an exit or liquidity budget.[6] [7] [9]

This is provided as a reference for organising the project; it cannot replace current official application forms or case-specific requests for additional materials. Please do not send identity documents or customer records through website forms.

• First decide whether to use a UK-incorporated bank, an international group subsidiary bank or an overseas branch structure, then define the corporate and SME customer, product and activity boundaries. The new bank steps below primarily apply to newly established UK legal entities. A business model label cannot replace the choice of structure, nor can purchasing an existing loan portfolio be treated as having obtained permission to accept deposits.[1] [6] [11]

• Initial, feedback and technical challenge discussions with the New Bank Start-up Unit are available at the pre-application stage. Commercial banks should first explain why bank status is needed and the demand for business accounts and financing, then use RBP to address questions on the market, profitability, credit and corporate deposit funding sources. Although this stage is strongly recommended officially, completing meetings does not constitute an invitation to apply or a commitment to approval.[6] [7]

• Once RBP is sufficiently developed, refine ICAAP, ILAAP and risk governance materials. Management should be able to explain combined stress from corporate loan losses and deposit outflows, and the management actions. The board must provide independent challenge and ensure consistency across the three core documents; responses to feedback must not update only the business plan while omitting lending and funding assumptions.[6] [7]

• Submit the formal application form, supporting materials and applicable fee under the PRA new bank procedure. The current official procedure specifies electronic submission to NewFirmAuthorisation@bankofengland.co.uk; prepare controller and SMF information in parallel. PRA and FCA separately assess completeness and their respective thresholds, and may request further information or interviews. PRA communicates individual capital and liquidity requirements before authorisation, and applicants must provide the corresponding evidence of capital; PRA may grant authorisation only after obtaining FCA consent.[6] [8]

• Those choosing to launch fully from the outset must demonstrate that business account opening, lending, treasury management and key systems are operationally ready; those choosing mobilisation must already meet the threshold conditions and comply with the restrictions in the approval notice. The typical £50,000 restriction applies to total bank-wide deposits, not to each business or account. Restricted authorisation must not be used to take on a full business deposit programme ahead of time.[6] [7]

• Where mobilisation is used, complete the team, systems and operational testing under the approved business plan, and prepare the applicable VoP application and evidence of capital, liquidity and readiness to open. Business deposits and related activities may be expanded within the effective permission only after removal of restrictions has been approved. Material product or team changes during build-out should be explained promptly; switching to a commercial banking model cannot automatically bypass the original review.[6]

The commercial banking model has no separate or shorter authorisation timeline. Under the common banking rules, a decision is made within six months of an application being deemed complete, or within twelve months of submission for an incomplete application. The decision may be approval or refusal, not a guaranteed licence date. Insufficient corporate lending, funding-source or shareholder-structure documentation also affects completeness; the complete-application period cannot be calculated solely from the application form submission date.[6]

There is no uniform completion deadline for pre-application preparation. Progress under this model depends on whether business and SME market evidence, credit and concentration models, corporate deposit and capital sources, the management team and system testing form a consistent body of evidence. Customer letters of intent, credit indications or outsourcing contracts cannot individually establish readiness to launch within a fixed number of months. Alternatives and delay implications for pending capital or key services should be set out in the project plan.[6] [7]

Mobilisation normally lasts no more than twelve months, and exit VoP materials should be prepared and submitted at least three months before the expected end to allow time for assessment. VoP also has statutory decision rules of six months for complete applications and twelve months for incomplete applications. This allowance does not mean approval is guaranteed within three months, nor may the mobilisation build-out period and formal application period be added together to promise a fixed two-year launch timetable.[6]

After approval, expansion from a single SME sector to other corporate customer groups, adding trade finance or foreign-currency financing, or changing the main source of deposits should first be assessed for material business plan changes and discussed with regulators in advance, with credit capabilities, capital, liquidity, financial crime and operational risks reassessed. If this exceeds the original permission or restrictions, approval must be obtained through the applicable variation-of-permission process before proceeding; a change in business model does not create another banking licence.[6] [7] [300]

Changes in ownership or control arrangements should be handled under the common change-of-control rules for UK-incorporated banks. Acquiring or increasing control generally requires prior notification under Section 178 and approval from PRA. The 10%, 20%, 30% and 50% control bands must also be assessed in conjunction with indirect control, acting in concert and significant influence; inserting a holding company may require prior approval even if the ultimate owners remain unchanged. Commercial banks should also examine relationships between new controllers and major corporate borrowers and conflicts concerning connected lending, rather than merely recording shareholding changes.[10] [19]

When replacing heads of credit, treasury or other key functions, first determine whether this involves SMF requiring approval, and update responsibilities and fitness records. Changes to core credit systems, outsourced loan servicing or material payment dependencies should be assessed for customer service continuity, data integrity and regulatory notification obligations; appointing suppliers or group personnel does not automatically transfer board responsibility. Material changes during mobilisation may affect the original basis of authorisation and exit conditions and must not be treated unilaterally as an approved new plan.[6] [7] [8]

Common ongoing prudential requirements still apply. UK legal entities must continuously maintain capital and liquidity and submit prudential, financial and fee information under their own applicable regime and reporting calendar. Commercial banks must not be described as having a uniform monthly reporting requirement, nor all institutions as submitting the same set of COREP and FINREP. ICAAP and ILAAP should at least be updated regularly in line with official expectations, with more timely adjustments following material changes. After operations begin, forecasts should be tested against actual lending and deposit data, and records of board challenge retained.[7]

Post-lending management under the business model should continually review borrowers’ repayment capacity, credit terms and the status of guarantees and collateral, identifying arrears, problem loans and sector or connected-group concentrations. Board risk information should link credit losses, lending exceptions, deposit outflows and capital consumption, and explain the triggers for lending restrictions, capital injections or recovery measures. Where growth exceeds risk or system capacity, controls should be repaired first, rather than using new business volumes to offset risk.[7]

Corporate deposits cannot continue to be treated as long-term funding merely because they were stable when the account was opened. Use actual data to monitor concentrations among large or connected corporate customers, withdrawals and maturity arrangements, and, where applicable, consider the impact of simultaneous financing drawdowns and deposit outflows by the same customer. Contingency funding measures must be executable. Arrangements such as central bank reserve accounts require separate applications; funding plans must not assume that bank authorisation automatically provides access.[7]

Ongoing customer and financial crime controls should cover changes in beneficial owners and authorised operators, consistency between transaction activity and the business, and escalation of anomalies; where trade finance is involved, maintain corresponding transaction verification and document controls. Monitor customer outcomes relating to fee communications, account restrictions, financing services and complaints as applicable, and keep FSCS disclosures, SCV and exclusion documents accurate. Bank deposits are repayment obligations of the bank and should not universally be described as segregated in trust under CASS; only where separate customer investment or asset services are provided should the corresponding CASS scope be checked item by item.[5] [6] [7] [22]

Technology and outsourcing oversight must continuously check consistency across account, credit and funding data, testing of important services and remediation of issues; the bank’s responsibilities must not be omitted merely because suppliers are operating normally. Recovery and applicable solvent exit arrangements should test whether obligations can still be met during outflows of corporate deposits, and how loan recoveries, asset sales and undrawn commitments would constrain exit. Those covered by the regime for non-systemic UK banks must maintain SEA; this specific regime must not automatically be applied to overseas branches.[7] [9]

Before acquiring a UK-incorporated commercial bank, check the legal entity, deposit-taking and other permissions, customer scope and all restrictions on the Financial Services Register, and review actual regulatory notices and correspondence. If it remains in mobilisation, verify outstanding corporate account, lending or treasury system development, the remaining period and capital consumption. Buying shares does not remove deposit restrictions or restart the mobilisation period, nor does it constitute purchasing a standalone “commercial banking licence”.[6] [10]

Asset due diligence for this model should reconstruct the corporate and SME loan portfolios and examine borrower cash flows, sector and connected-group concentrations, arrears and impairment, guarantees and collateral arrangements, credit exceptions and undrawn commitments. Where trade finance is present, transaction documents, outstanding obligations and problem transactions should also be checked; comparing loan book balances and interest income alone is insufficient. Capital and stress calculations should be rerun using the due diligence findings, and the buyer's funds must be confirmed as actually available for capital injections rather than merely paying the equity purchase price.[7] [13]

Liability and operational due diligence should identify large corporate depositors and their interconnections, deposit maturities or withdrawal behaviour, FSCS eligibility and SCV data quality, assessing whether deposits are likely to remain following changes in controllers or customer relationships. Also check corporate account mandates, credit documentation and account data migration, outsourcing and critical service contracts, and outstanding account restrictions, complaints and financial crime remediation issues; systems integration plans must align with funding and capital plans.[5] [6] [7]

Completion of a control transaction involving a UK-incorporated bank should be conditional on prior approval under Section 178 and other necessary conditions. A complete control notification generally has a sixty-working-day assessment period, excluding statutory pauses for further information; approval immediately after signing cannot be promised. Post-acquisition changes to customer segments or products also require separate assessment of material changes to plans and permission variations. Buying loan assets alone or transferring deposit business differs from acquiring shares in a legal entity: legal and regulatory procedures must be checked separately against the actual structure, and this page must not be taken to imply that permissions automatically transfer with assets.[10] [20] [300]

The following are specific permissions, organisational models or statutory categories covered by this topic. They do not necessarily each constitute a separate financial licence.

Primarily based on FCA, PRA / Bank of England, GOV.UK and current legislation. Older third-party guides supplied by users are used to organise business material and do not override the latest official requirements.

Information compiled by: RenGang Yongsheng (Hong Kong) Limited

Tang Shangyong (Mr Tang / Drew) · Business Manager
Global financial licence application, transaction and ongoing compliance services

Contact the author and enquire about projects