Digital banks and new banking modelsGuide to applications and ongoing compliance

Operating banking services through online or mobile systems still requires the applicable deposit-taking authorisation. Digital models require particular attention to technology outsourcing, operational resilience, cybersecurity and customer account continuity; they do not enjoy an automatic lower-capital exemption.

Digital bank or Challenger Bank describes a business model delivering banking services online, through mobile channels or through new distribution methods, not a separate low-entry-threshold UK licence. If deposits are actually accepted, Part 4A permission granted by PRA with FCA consent is still required. Differences in application and ongoing operations centre on remote onboarding and fraud prevention, technology and cloud outsourcing, digital distribution funding risks, operational resilience and customer account continuity during failures or exit. Ordinary prudential entry requirements, UK entity head office requirements and effective governance standards are not reduced.[1] [3] [6] [7]

This entry primarily describes UK-incorporated banks providing deposit and account services through apps, websites or third-party digital channels. Digital / Challenger Bank is not a separate statutory authorisation category: actual rights derive from permitted activities such as accepting deposits, the customer scope and restrictions in the permission. Lending, mortgages, investment, custody and other financial services must still be checked individually against permissions; an institution providing only electronic money or payment services cannot be classified as a deposit-taking bank merely because its interface resembles a bank's.[1] [2] [6]

Digital models can overlap with retail, commercial or private banking models. Applicable Consumer Duty and deposit protection obligations for retail customers do not disappear because a bank has no branches or acquires customers through platforms; serving only institutions does not remove applicable banking authorisation and prudential requirements either. An overseas group establishing a UK subsidiary bank must also explain group dependencies and UK standalone controls. Overseas branches require separate analysis based on their legal entity and home-state supervision; the UK entity capital and address arrangements here must not be mechanically applied to branches.[3] [6] [7]

Select the minimum sufficient combination of permissions that lawfully supports the actual business, client scope and financial responsibilities, rather than treating the broadest permissions or fastest approval as the sole objective.

• Within the approved scope, deposit and banking services may be provided to target customers through online accounts and mobile channels, organising account opening, payments and customer support into a consistent customer journey. Digital channels are a delivery method, not a passport to all business permissions, and firms must not advertise that every customer can open an account remotely or will necessarily be accepted.[2] [6]

• New UK banks may apply directly for authorisation without mobilisation restrictions when fully operationally ready, or use a regulator-accepted mobilisation plan to complete their final preparations. Digital banks may include systems integration, recruitment and finalising supplier arrangements in that plan, but it is not a grace period for developing an app from scratch, nor a guarantee of fast approval.[6]

• Eligible bank deposits qualify for FSCS protection, with a general limit of £120,000 per depositor, per PRA-authorised institution, rather than separately for each app, account or partner brand. Banks should clearly identify the actual legal entity providing the deposit and the applicable protection on their own and third-party channels. A technology platform’s reputation or certification cannot replace an assessment of deposit eligibility.[5] [6]

• Ordinary bank threshold conditions apply continuously. UK-incorporated applicants must demonstrate an appropriate legal form, UK head office and registered office, adequate financial and non-financial resources, and accessibility for effective supervision. Remote teams, overseas founders or purchases of cloud services cannot replace the bank's own governance and controls.[3] [6]

• The regulatory business plan RBP must connect digital channels, target customers, products, pricing and the path to profitability. It should explain the basis for customer acquisition and assumptions for active customers and deposit growth, include the costs of technology maintenance, fraud prevention, customer service and control functions, and test the impact of insufficient customer acquisition, rising costs or failed financing. The board should retain records of challenge, ensuring that RBP is consistent with ICAAP, ILAAP and recovery and exit plans, rather than merely presenting download figures or investor promotional material.[6] [7]

• Remote account opening must establish an executable process covering application, identity and beneficial ownership verification, risk classification and ongoing transaction monitoring. The business-wide financial crime risk assessment should cover non-face-to-face customer acquisition and proposed products; for risks such as impersonation, account takeover or money mules, verification, escalation for review and investigation arrangements should be explained according to the business risks. Specific technologies may be selected on a risk basis, but selfies, a particular biometric method or supplier scores must not be presented as a uniform statutory solution for all banks, nor may automated verification directly replace the bank’s responsibility for controls.[6] [7]

• Anti-fraud and anti-money laundering controls must be designed alongside the customer journey, with clear responsibility for handling account-opening anomalies, suspicious transactions and account restrictions. Automated screening or blocking should be followed by appropriate review, customer support and complaints channels, with monitoring of foreseeable harm from erroneous blocking or prolonged freezes. Fully online channels do not justify providing only chatbot responses or denying necessary support to customers unable to use the App.[6] [7]

• The technical solution must demonstrate that core accounting, onboarding identity services, payment connections, customer support and regulatory data can work together. Prepare implementation, integration, capacity and recovery testing for the proposed business, and assess risks including cyberattacks, data corruption and rapid technological change. Testing should focus on whether customers can complete critical services, rather than merely proving that an app is live or a single system produces no errors.[6] [7]

• Cloud and other outsourcing should be incorporated into the bank’s outsourcing strategy and governance. Applicants should identify the suppliers, group shared services and associated downstream dependencies on which important services rely, explain the risks of cross-border cloud arrangements, supplier capacity and concentrated dependencies, and demonstrate the bank’s continuing ability to obtain necessary information, oversee services and respond to service termination. Cloud services can improve resilience but also create new risks; outsourcing must not be presented as a transfer of regulatory responsibility.[6] [7]

• Important business services and impact tolerances must be identified and set during authorisation, with the board responsible for approval and oversight. Before direct authorisation without mobilisation restrictions or exit from mobilisation, submit the applicable operational resilience self-assessment covering dependency mapping, severe but plausible scenario testing, recovery arrangements and remediation of gaps. For digital accounts, consider actual services such as payments, deposits and withdrawals, or essential account access; do not classify every IT component as an important business service without analysis.[7]

• ICAAP and ILAAP must reflect the assets, liabilities and operational risks of the digital model. Digital distribution and intermediary channels may affect funding concentration and deposit outflows. Funding pressures caused by customer acquisition through the same platform, pricing changes or service incidents should be analysed, and viable liquidity contingency arrangements explained. Retail products must also implement Consumer Duty, FSCS disclosures and SCV data requirements. Recovery, resolution and solvent exit requirements apply according to the actual scope of the regime.[5] [6] [7] [9]

Controllers must disclose the complete ownership chain, ultimate owners, group relationships and sources of funds. Digital start-up teams and overseas technology investors have no automatic exemption. Explain decision-making and service relationships between the technology parent, brand company and bank, to prevent connected transactions or founders' growth targets from overriding the bank's risk controls.[6] [7] [10]

The board and executive team must have collective capabilities proportionate to the banking business and its technology dependencies, enabling challenge on capital, liquidity, customer outcomes and operational risks. Current new bank application guidance requires at least CEO, a board chair and another executive SMR holder; the team and board should be fully operational at full launch. These are ordinary new bank stage requirements, not a fixed headcount concession for digital banks or a rule requiring every director to live in London. Relevant SMF fitness and propriety, responsibilities and approval materials should be submitted in parallel.[6] [7] [8]

Banks should define responsibilities, resources and cover arrangements for risk, compliance, anti-money laundering, fraud prevention, information security, technology operations and customer support, and assess SMF and other personnel rules against the functions actually performed. Where there is a SMF24, operational resilience responsibilities should be assigned in accordance with applicable duties; not every CTO can be assumed to be the same SMF. Suppliers may perform services, but the bank must retain people who understand its systems and information, challenge suppliers and decide how to respond to incidents. The board must also maintain oversight of outsourced audit and other control functions.[6] [7]

Using an app, cloud architecture or a branchless model does not create a separate lower capital tier. The current basic capital resources floor for an ordinary UK-incorporated bank is the currency equivalent of €5,000,000, not £5,000,000, and is not a complete project budget. A small specialist bank must independently meet the definition in the capital rules, while SDDT must satisfy the eligibility conditions of its prudential regime; a digital model label alone proves neither qualification.[13] [14]

Actual capital also depends on applicable Pillar 1, Pillar 2A, buffers and, where necessary, MREL. The application should identify credit, operational and other material risks through ICAAP and demonstrate, at authorisation without mobilisation restrictions or on exiting mobilisation, the ability to maintain the relevant requirements for at least the first twelve months of operation. Digital-model forecasts should include items relevant to the actual business, such as systems implementation and ongoing maintenance, customer service, fraud losses and remediation costs; capital adequacy cannot be inferred solely from reduced physical branch expenditure.[6] [7]

The new bank PRA buffer is generally calibrated to six months of projected routine operating expenses, not a uniform percentage of app revenue or user numbers. Stage-specific mobilisation requirements are set case by case for the restricted business and must be met at all times after authorisation; funds maintaining minimum regulatory capital cannot be spent on development so as to fall below the threshold. Liquidity and preparation funding must still be planned separately; an intention to raise further funding is not capital already available.[6] [7]

The information is current as at 2026-11-07. The Basel 3.1 and SDDT capital phases are mainly implemented on 2027-01-01, with the internal models approach for market risk implemented separately on 2028-01-01. Assessment must follow actual effective dates and eligibility; future reforms must not be used to promote current capital concessions for digital banks. This statement does not promise approval or a funding budget.[14] [16]

A UK-incorporated bank must have its head office and registered office in the UK; digital operations do not remove this requirement. It must explain actual decision-making, business management and regulatory liaison arrangements and demonstrate that PRA and FCA can effectively access responsible personnel, records and systems. Merely purchasing a mailbox, correspondence address or nominee directors cannot demonstrate that the bank’s actual management is in the UK.[3] [6]

Remote working and overseas cloud services should align with UK governance, explaining how management controls dispersed personnel and service dependencies, obtains information and maintains contact and fulfils its duties during incidents. The UK head office requirement does not mean that all servers must be in the UK, and this provision offers no universally applicable promise regarding London office size or a fixed number of on-site personnel. The applicant must demonstrate the genuine availability of any proposed address and actual working arrangements; this provision does not establish that a bank office already exists at any location.[6] [7]

• Bank application forms, a list of proposed activities and restrictions, application fee information and responses to pre-application feedback. Clarify the relationship between the legal entity providing banking services, the app and partner brands, and whether the route is direct full launch or mobilisation. Check application fees against the PRA and FCA fee schedules applicable at submission; service providers’ quotations must not be treated as regulatory fees or capital requirements.[6] [17] [18]

• Board-reviewed RBP and records of related challenge. Specify products, digital and intermediary delivery channels, target markets, and the basis for profitability and financial projections. Link investment in technology, control functions, fraud prevention and customer service, and business adjustments under stress, to ICAAP and ILAAP.[6] [7]

• Final versions of ICAAP and ILAAP, capital instrument terms and applicable classification approval applications, and evidence that capital has been funded and is available. Provide outflow assumptions and liquidity contingency analysis for digital distribution and platform funding concentration, and distinguish restricted mobilisation funding requirements from those for full launch.[6] [7] [13]

• Ownership structure, controller and ultimate owner materials, sources of funds and group service relationships; biographies, fitness and propriety assessments, statements of responsibilities and governance information for directors and relevant SMF. Supplement these with evidence of the team’s banking, technology and financial crime risk capabilities and arrangements for replacing key personnel; technology project experience does not automatically substitute for banking competence.[6] [7] [8]

• The complete customer journey, account and fee terms, onboarding verification and a business-wide financial crime risk assessment. Explain how identity and beneficial ownership verification, risk escalation, fraud prevention and ongoing monitoring operate, and provide customer support, account restriction review and complaints processes; automated tools used should have explainable business controls and supporting test evidence.[6] [7]

• Core systems and digital channel architecture, implementation and testing plans, and testing evidence appropriate to the application stage. Material outsourcing documentation should identify the scope of services, supplier and bank responsibilities, oversight and necessary data access arrangements. Drawing on contracts and actual system arrangements, it should explain migration and continuity if a supplier is replaced, terminated or unavailable, rather than merely supplying cloud service brochures or supplier certifications.[6] [7]

• Operational resilience materials covering important business services and impact tolerances, dependency mapping and scenario testing plans; attach applicable self-assessments and remediation evidence before direct authorisation without mobilisation restrictions or exit from mobilisation. Use scenarios relevant to the bank, such as cloud or identity provider failures, payment connection outages and cyber incidents, to explain customer service recovery and incident communications, and obtain board approval.[6] [7]

• Arrangements for implementing Consumer Duty and monitoring customer outcomes in retail business, together with evidence of generating and validating FSCS disclosures, SCV and exclusion files. Across apps and partner brands, identify the same depositor and the actual providing legal entity, and verify that accurate customer and balance information remains accessible during system or platform outages.[5] [6] [7]

• Board-approved materials for applicable recovery, exit and resolution preparedness. Firms covered by the non-systemic solvent exit regime must prepare SEA, explaining the personnel, funding, systems, third-party services and customer communications needed to repay or transfer deposits. Firms using mobilisation must also submit a mobilisation plan with clear milestones, confirmed suppliers, testing and acceptance, financing, and buffers for exit review.[6] [7] [9]

This is provided as a reference for organising the project; it cannot replace current official application forms or case-specific requests for additional materials. Please do not send identity documents or customer records through website forms.

• First analyse whether the actual activities constitute accepting deposits, and identify the providing legal entity, product permissions and customer scope. Explain why a banking model is chosen rather than a payment or electronic money model. Distinguish individually the responsibilities of the app operator, partner brands and the bank itself; do not use a technology label as the basis for authorisation.[1] [2] [6]

• Initial, feedback and technical challenge pre-application discussions may be held with the New Bank Start-up Unit. Initially, explain the digital business model and funding; then use RBP to explain customer journeys, distribution channels, outsourcing, fraud prevention and governance. The technical challenge links risk evidence to ICAAP, ILAAP and system development plans. Respond to all feedback; concluding the meetings does not constitute permission or any advance guarantee of approval.[6] [7]

• Once the forms and supporting documents reach an acceptable standard, submit the application and supporting documents electronically to NewFirmAuthorisation@bankofengland.co.uk under the PRA new bank procedure, and arrange payment of application fees as required by both regulators. Prepare controller and SMF materials in parallel; initial bank authorisation must not be reduced to merely completing forms on Connect.[6]

• PRA and FCA assess completeness, threshold conditions and the ability to comply on an ongoing basis. Applicants must explain remote verification and fraud controls, funding risks through digital channels, dependencies on important services and actual management capability, respond to requests for further information and demonstrate that capital is in place. PRA may authorise only with the consent of FCA. Both authorities' application of proportionality does not mean digital risks can go unexamined.[6] [7]

• Those choosing to launch fully from the outset must have full operational capability when authorised without mobilisation restrictions; those using mobilisation must already meet the threshold conditions and complete the remaining work in accordance with the deposit restrictions and build-out conditions in the approval letter. During mobilisation, continue submitting applicable regulatory data and evidence of progress, and complete customer journeys, control functions, systems testing, supplier arrangements, and recovery and continuity plans. Firms must not accept deposits on a large scale first and complete their systems later.[6]

• Before exiting mobilisation, submit an application to remove restrictions approved through the bank's governance arrangements under the VoP procedure, together with evidence that all conditions have been met and applicable operational resilience materials. Digital system availability, customer data, supplier arrangements and end-to-end service testing must demonstrate readiness for the intended scale at launch; an App store listing alone cannot demonstrate readiness. Operations may be expanded within the approved scope only once written removal of restrictions has been obtained and has taken effect. Continue testing and improving controls using actual data after launch.[6] [7]

Digital banks have no separate fast-track approval clock merely because they operate online. For new banks, the statutory decision period is six months from an application being deemed complete, or twelve months from submission for an incomplete application. The decision may be approval or refusal. Pre-application preparation of the business model, personnel, funding and technology is not included in the six months for a complete application, and there is no uniform completion commitment.[6]

Digital model schedules should make core system integration, confirmed account-opening and payment providers, the bank’s own testing, data quality remediation and effective team performance readiness conditions. PRA explicitly states that new banks often underestimate the time needed to build, test and implement IT. An app development cycle cannot substitute for the full bank preparation period or guarantee launch in a particular month.[6]

Mobilisation normally lasts no more than twelve months, with a typical restriction of £50,000 in total deposits across the bank, not a per-customer limit or permanent digital-bank allowance. An exit VoP should be submitted at least three months before that twelve-month period expires, allowing time for review and remediation. Official guidance states that exit assessment normally takes at least three months, but the statutory decision rules of six months for a complete VoP and twelve months for an incomplete VoP still apply. This is not a commitment that restrictions will necessarily be lifted on time.[6]

When raising finance or selling equity, first assess whether bank change-in-control notification and approval are triggered. UK-incorporated banks are generally assessed against the 10%, 20%, 30% and 50% control bands, together with indirect holdings, acting in concert and significant influence. Inserting a holding company may trigger requirements even if the ultimate controller remains unchanged. Matters requiring Section 178 approval must be handled before implementation; merely registering with Companies House is insufficient simply because the transaction is technology financing or an App brand acquisition. The sixty-working-day assessment period for a complete control notification must also allow for statutory suspensions for further information.[10] [19] [20]

When replacing directors, CEO or personnel performing actual senior functions such as technology operations, assess the need for SMF approval, reallocation of responsibilities and replacement cover. Departures of key digital bank personnel may also affect outsourcing oversight, incident response and system access. Update arrangements for discharging duties rather than merely changing website team profiles; ordinary registration as a company director cannot replace regulatory approval for a new appointee.[6] [7] [8]

Expanding customer markets, introducing new products or distribution partnerships, migrating cloud and core systems, or making major changes to identity or payment providers should trigger an assessment of changes to permissions, capital and liquidity, financial crime controls and customer outcomes, with prior notification, approval or VoP handled under the applicable rules. Not every app update requires a new licence, but material business or operational changes cannot be treated merely as internal technical updates. Material changes to strategy or personnel during mobilisation may also affect the basis of the original approval and exit conditions, and should be discussed promptly with the regulators.[6] [7]

From authorisation, including during mobilisation, a bank must maintain applicable capital and liquidity and submit regulatory data corresponding to its legal entity and activities. After launch, RBP, ICAAP and ILAAP should be continuously calibrated using actual business data, with particular review of deposit growth through digital and intermediary channels, funding concentrations, outflow assumptions and customer acquisition costs. Control functions and system capacity must keep pace with business growth; user expansion must not precede risk controls to be added later.[6] [7]

The effectiveness of remote account-opening controls must be continuously validated, and customer identity and beneficial ownership information, risk classification, transaction monitoring, investigation of anomalies, suspicious activity escalation and training arrangements should remain effective. Fraud prevention may monitor impersonation, account takeover, money mules, false positives and investigation backlogs according to actual risks, feeding findings back into verification and transaction rules. Changes to supplier algorithms or data sources also require an assessment of whether controls have become ineffective; download or interception counts alone do not demonstrate that risks are properly managed.[6] [7]

The board must oversee important business services and impact tolerances, review the list of important services at least annually and reassess it in advance of material changes. Maintain dependency mapping, self-assessments, severe but plausible scenario testing and remediation plans, incorporating cyber risks, cloud failures, ageing systems and rapid technological change into practical testing. Also maintain incident escalation, internal and external communications, customer support and recovery arrangements; the bank remains responsible for its customer services and regulatory obligations when technology suppliers are unavailable.[7]

Outsourcing and digital distribution relationships require ongoing oversight. Obtain information that allows verification of service capacity, failures, necessary data quality and migration feasibility, and update risk analysis for concentrated dependencies and material changes. When customers open accounts through partner platforms, ensure that the actual deposit-taking legal entity, product terms and protection information are clear, that the bank can access the underlying customer information needed for its business, and that customer support or account access problems caused by the platform are addressed, rather than assuming the partner has assumed all responsibility.[5] [6] [7]

For retail customers, continuously monitor customer outcomes relating to charges, account-opening refusals or account restrictions, customer service and complaints, including for customers unable to use digital channels easily. FSCS information, SCV and exclusion files must remain accurate and capable of being produced promptly as required. Standard protection is calculated at £120,000 per depositor per PRA institution. Ordinary deposits are repayment obligations of the bank, not client money all segregated in trust under CASS. If investment or client asset business is also conducted, its rules must be checked separately.[5] [6] [7] [22]

Recovery plans should remain executable in light of the actual business and be updated regularly. UK banks covered by the non-systemic solvent exit regime must maintain SEA on an ongoing basis and prepare an execution plan when exit becomes reasonably likely. Digital models should particularly include retention of key personnel, ongoing cloud and payment service costs, data extraction, deposit repayment or transfer and customer communications in their resource assessments. Supplier exit and bank exit are different matters: closing an App or terminating a cloud contract does not extinguish deposit liabilities. Resolution preparedness and continuity of important services apply according to the actual resolution strategy; uninterrupted operation of every account in every failure or exit cannot be promised.[6] [7] [9]

Before acquisition, first verify the actual banking legal entity, permission, customer scope and restrictions in the Financial Services Register, and obtain the authorisation letter and regulatory correspondence. Buying a brand, App, code or supplier contracts does not confer permission to accept deposits; a share transaction still requires analysis of conditions precedent such as Section 178. Separately examine the target's remaining mobilisation period, unfinished testing and capital consumption. Completion does not automatically remove or reset restrictions.[6] [10]

Prudential due diligence must still examine loan quality, impairment, deposit structure, capital instruments and individual requirements, liquidity stress and funding sustainability. Digital models should also test growth and profitability forecasts against actual customer activity, deposit retention and platform concentration, and examine fraud losses, remediation expenditure and long-term investment in technology and customer service. User numbers or a supposed licence-shell price must not replace balance-sheet and sustainability analysis.[6] [7] [13]

Technical and operational due diligence should examine actual control and portability of systems and data, continuity arrangements for key contracts following a change in control, dependencies on suppliers and group services, and whether the bank can continue to obtain complete customer and balance information. Review evidence of cyber incidents, major outages, identity verification deficiencies, anti-fraud measures and customer complaint remediation, and assess operational resilience using actual tests and bank management records rather than supplier certifications or seller demonstrations alone.[6] [7]

The integration plan should explain how customer identity data, accounts, payments and SCV will be linked securely, avoiding loss of customer access to funds, duplicate or incorrect customer records and confusion over protection information during migration. Also verify whether key staff retention, responsibility allocation and recovery, SEA and resolution preparations remain executable after the transaction. Business transfers, permission changes or control events requiring approval should be arranged separately; do not promise immediate rebranding and full operation after acquisition.[5] [6] [7] [9] [10]

The following are specific permissions, organisational models or statutory categories covered by this topic. They do not necessarily each constitute a separate financial licence.

Primarily based on FCA, PRA / Bank of England, GOV.UK and current legislation. Older third-party guides supplied by users are used to organise business material and do not override the latest official requirements.

Information compiled by: RenGang Yongsheng (Hong Kong) Limited

Tang Shangyong (Mr Tang / Drew) · Business Manager
Global financial licence application, transaction and ongoing compliance services

Contact the author and enquire about projects