Private banking business modelGuide to applications and ongoing compliance

Deposit, credit and wealth services for high-net-worth clients; permission to provide investment advice, management and custody cannot be inferred merely from the bank's name. Client classification and sources of funds require specific analysis.

Private banking is a banking business model serving high-net-worth individuals, families and related structures, not a separate low-threshold licence or an exemption from customer protection. Deposit-taking must follow the banking framework of PRA authorisation with FCA consent; actual permissions for investment advice, discretionary management, dealing and custody must be checked separately. Building on common banking requirements, this page explains the applicable focus on wealth and sources of funds, cross-border and high-risk clients, confidentiality and anti-money laundering, concentration risk and ongoing client reviews after acquisitions.

Private banks may serve high-net-worth individuals, families and structures such as their companies or trusts through permitted deposit, account and credit services. Formal rights derive from the Part 4A permissions and restrictions held by the specific legal entity, not the Private Bank name. PRA is responsible for prudential authorisation and must obtain FCA consent; neither fewer clients nor greater wealth removes banking threshold conditions.[1] [6]

Distinguish deposit-taking, securities investment and wealth management services individually. Permission to provide investment advice, manage investments, arrange or execute transactions, or safeguard and administer investments cannot be inferred solely from Accepting Deposits. Where another group entity or an external institution provides services, specify who contracts with the client, who gives advice or makes management decisions, and who holds assets and assumes the corresponding responsibilities. For regulated mortgages, consumer credit or other products, check the activity, client and product boundaries separately.[2] [6]

High net worth is a business positioning, not a basis for automatically treating all clients as professional clients or for disapplying Consumer Duty or anti-money laundering requirements. Assess applicability according to the classification of the clients actually served and the scope of the rules. Products and services within the retail scope must still deliver customer understanding, fair value and support, and avoid foreseeable harm. Local solicitation and service rules must also be checked separately for overseas clients; UK authorisation is not a passport to conduct business worldwide.[6] [7]

Select the minimum sufficient combination of permissions that lawfully supports the actual business, client scope and financial responsibilities, rather than treating the broadest permissions or fastest approval as the sole objective.

• Within the scope actually permitted, customer deposit, account and credit needs can be brought into a single banking relationship; a clear permissions and responsibilities matrix should first be established if wealth management is also intended. The value of business integration lies in coordinated service and governance, not in promising that bank status covers all investment activities.[1] [2] [6]

• Eligible deposits may qualify for FSCS protection. The general limit is £120,000 per depositor, per PRA-authorised institution, rather than per account or brand. Large private banking deposits do not receive full protection simply because the customer has a high net worth; excess amounts and the eligibility of corporate, trust and other accounts must be checked individually.[5]

• Organising products, charges and support around clients' actual financial needs can create clearer customer journeys and risk responsibilities. However, bespoke services must still demonstrate fair value, effective controls and sustainable operations. They must not be marketed as offering relaxed regulation, absolute confidentiality, guaranteed returns or guaranteed approval.[6] [7] [300]

• First select the legal route of a UK-incorporated entity, a UK subsidiary of an overseas bank or a UK branch, then define the private banking client and product scope. UK-incorporated entities are generally subject to the common banking conditions on capital, head office, governance and effective supervision. Overseas branches must be assessed in light of supervisory cooperation for the bank as a whole and UK business arrangements; adopting a private banking designation alone does not justify applying the UK-incorporated entity template or exemption from authorisation.[3] [6] [11]

• The regulatory business plan RBP should explain target customers and verifiable evidence supporting customer acquisition, distinguishing income from deposit spreads, lending and wealth services actually permitted. Projections should consider the relocation of a few major clients or families, relationship manager departures, declining fees and customer acquisition below expectations. These are key risk-analysis considerations for this model, not separate statutory profitability or asset-size thresholds for private banks. The board must challenge assumptions and ensure that RBP is consistent with ICAAP and ILAAP.[6] [7]

• The business-wide anti-money laundering risk assessment should cover customers and beneficial owners, corporate or trust structures, wealth generation, source of funds, cross-border jurisdictions, products and channels. Source of wealth explains how a customer or beneficiary accumulated their overall wealth; source of funds explains how the funds for the particular business relationship or transaction were generated and transferred. Account balances, customer reputation or a transfer from another bank cannot replace the source analysis and evidence required by the risk.[7] [300]

• Cross-border customers need not all be rejected, nor can they all be deemed low risk. Relationships connected with higher-risk countries or sectors, opaque beneficial ownership or transactions lacking an apparent legitimate economic purpose should be subject to risk-based enhanced due diligence and ongoing monitoring. Proportionate measures and senior management approval should be applied to PEP and their family members or known close associates under the applicable rules; high net worth alone neither proves low risk nor justifies assigning all customers the same high-risk rating.[300]

• Longstanding relationships between relationship managers and customers must not undermine independent judgement. Banks should control sales or revenue pressure, promotion of affiliated products, and conflicts between lending and investment services, ensuring that compliance and anti-money laundering teams can review, challenge and escalate high-risk relationships, rather than allowing relationship managers to lower risk scores without adequate grounds.[7] [300]

• The ICAAP and ILAAP of a UK-incorporated private bank should assess capital and liquidity against its actual assets and liabilities. Key areas include concentrations of large, withdrawable-on-demand deposits, credit concentrations involving customers and related families, relevant collateral price movements and loan recovery risk. Where securities-backed financing is provided, collateral valuation, calls for additional security and liquidation assumptions should be included; high-net-worth borrowers must not be treated as having no credit risk.[6] [7]

• Deposits, permitted investments and custody services should have enforceable product terms, customer support, complaints and operational resilience arrangements. Data confidentiality should be reflected in authorised access, secure data transmission, retrievable records and third-party oversight, and must not impede customer identification, the provision of necessary regulatory information or legally required suspicious activity reporting. Bespoke services for retail customers should still identify customer vulnerability and demonstrate good outcomes.[6] [7] [300]

Shareholders and controllers must disclose ownership chains, ultimate owners, group relationships and sources of capital funding under the common banking framework. Where founding shareholders or connected families are also important customers, borrowers or product providers, identify related-party transactions and risks to board independence. Reviewing customers’ sources of wealth and investors’ sources of capital injections concerns different subjects; neither can replace the other.[6] [7] [10]

The board and management should have capabilities proportionate to the proposed deposit-taking, credit and wealth services and cross-border risks, with evidence of independent challenge and fitness and propriety. On entry, the joint new bank mobilisation route requires at least CEO, a board chair and another executive, usually CFO. A fully functioning board and executive team are required at full authorisation or exit from mobilisation. Having two independent non-executive directors is published good practice and should not be restated as a uniform additional statutory headcount for all private banks. Approval for required SMF must be sought according to actual functions.[6] [7] [8]

Compliance and anti-money laundering reporting leads and their teams should have sufficient resources, access to information and channels for escalation to senior management. Private banks should be particularly alert to relationship managers downplaying risks because of close relationships or clients' high revenue contributions. Approval of high-risk relationships, ongoing reviews and suspicious activity assessments should be independently reviewed, and team capabilities and processing capacity must keep pace with customer and business growth.[7] [300]

If wealth management is performed by another group entity or an outsourced provider, the supervisory and responsibility interfaces between UK bank management and the other party’s responsible persons should be clearly defined. A global group compliance department, overseas relationship managers or third-party due diligence cannot be taken to mean that the UK bank has fulfilled its own regulatory obligations. There is no basis for imposing a separate uniform nationality requirement, fixed number of local relationship managers or private banking qualification threshold for this model.[6] [7] [11] [300]

Private banks use the common banking capital framework; there is no separate or reduced capital threshold solely because they target high-net-worth clients. The basic minimum capital resources for an ordinary bank incorporated in the UK are the currency equivalent of €5,000,000. Small specialist banks may use the corresponding lower minimum only if they genuinely meet the PRA definition; they cannot choose it simply because they have few clients, wealthy clients or the Private Bank name. An overseas branch is not a separate UK legal entity and should be analysed under the applicable requirements for the bank as a whole and its UK business, rather than mechanically applying the UK-incorporated entity minimum.[11] [13]

Base capital is not the total project budget, nor is it equivalent to customer deposits or assets under management. Banks must also maintain Pillar 1, Pillar 2A and applicable buffers according to their actual risks, and meet MREL where applicable. When commencing full operations directly or exiting mobilisation, they must demonstrate that they can maintain the requirements for at least the first twelve months of operation. Forecasts should include expected losses and funding needed for personnel, systems, independent compliance and exit preparations.[6] [7]

Capital and liquidity analysis for this model should focus on scenarios such as large client deposit outflows, coordinated withdrawals by related families, client or collateral concentrations and declining wealth services revenue. High net worth is not a reason to dispense with impairment assessments or capital and liquidity stress testing; nor should uniform capital adequacy ratios, client assets under management or special reserve amounts be invented for private banks.[7]

The new bank PRA buffer is generally calibrated to six months of projected routine operating expenses, under the common framework and case-specific requirements. Capital and liquidity requirements must continue to be met during mobilisation. The typical £50,000 limit on total bank-wide deposits is not a capital floor and must not be described as the amount each private banking client may deposit.[6] [7]

A UK-incorporated private bank must have its head office and registered office in the UK and be capable of effective supervision by PRA and FCA. It should explain where actual management, customer services, systems and records are located and how regulators can access them. A correspondence address or a London address in promotional materials alone does not demonstrate operational substance. This page does not guarantee physical premises, and there is no basis for imposing a separate private-bank-specific office floor area or fixed employee count.[3] [6] [7]

For cross-border customer services, offshore booking, group shared services and remote relationship managers, clarify the UK bank's decision-making, oversight and information-access arrangements. Confidentiality or overseas storage must not prevent UK management and regulators from obtaining necessary information. Outsourcing should have governance, access controls, recovery and alternative arrangements. Overseas branches must also disclose the division of responsibilities between the head office and UK branch; the parent bank's head-office address cannot serve as the entirety of the evidence of UK operating arrangements.[7] [11] [300]

• The application form and activity permission matrix should itemise deposit-taking, accounts, credit and proposed wealth services, specifying customer classifications, service-providing entities, asset custodians and all restrictions. Confirm application fees under the current PRA/FCA rules at submission. This page does not combine regulatory fees, capital, consultancy fees or acquisition prices into one item, or promise a fixed quotation.[2] [6]

• RBP should include target clients and regions, the basis for customer acquisition, products and charges, service channels, revenue composition and multi-year forecasts. Include analysis of major-client or family concentration, transfer of client relationships, loan losses and adverse market scenarios, and retain records of board challenge, approvals and responses to pre-application feedback. Regulatory and investor materials should use a consistent business plan, not separate sets of assumptions.[6] [7]

• UK-incorporated entities and subsidiary banks submit the applicable ICAAP and ILAAP, explaining individual capital, funding structure, deposit concentration and stressed outflows, together with corresponding risk controls. Include capital instrument terms, classification applications and evidence that capital has actually been paid in. Overseas branches should provide institution-wide and UK business information under the international banking arrangements; a private banking model is not grounds for omitting prudential evidence.[6] [7] [11] [13]

• Controller and governance information should include the ownership chain, ultimate owners, sources of capital contributions, connected customer or borrowing arrangements, explanations of board skills and independence, applicable SMF applications and responsibility documents. It should also explain how compliance, anti-money laundering and audit functions operate independently, and how handovers are managed when relationship managers or key managers leave.[6] [7] [8] [10]

• The business-wide anti-money laundering risk assessment and operational policies should explain customer and beneficiary verification, source of wealth and source of transaction funds, identification of PEP and high-risk jurisdictions, the basis for risk ratings and approval procedures. Supporting evidence of business operations, asset sales, inheritance or other wealth generation may be organised according to risk, with an explanation of analysis and cross-checking. These are examples of evidence types, not a statutory checklist requiring every customer to submit the same wealth documentation.[7] [300]

• Ongoing monitoring design and testing materials should cover expected account use and transactions, group or family connections, unusual cross-border fund flows, risk rating updates, alert reviews and suspicious activity escalation. Demonstrate adequate staffing for high-risk reviews and alert backlogs; merely submitting a vendor system name, a relationship manager's verbal familiarity or a day-one KYC template is insufficient.[7] [300]

• Product and customer documents for authorised wealth services should explain the actual provider, scope of authorisation, fees and conflicts of interest, with customer classification, suitability or appropriateness, and custody records prepared under the applicable rules. Retail services should also provide evidence of fair value, customer understanding, support and complaints handling; customer protections cannot be omitted simply by asking customers to sign generic high-net-worth or own-risk declarations.[6] [7]

• Operational information should cover core banking and customer relationship systems, data access permissions and secure transmission, critical outsourcing and cross-border sharing arrangements, with evidence of testing, recovery and business continuity. Explain how the bank obtains all necessary records and how important customer information is made available securely and under controlled conditions for compliance and regulatory inspection.[6] [7] [300]

• Deposit protection and exit information should include FSCS disclosures, a Single Customer View consolidated by customer and institution, exclusions files and applicable recovery and resolution preparations; those covered by the relevant regime should also prepare a solvent exit analysis. Private banks should separately explain large unprotected balances and arrangements for returning investment or custody assets. Deposit protection must not be equated with protection of investment value or all assets held in trust.[5] [6] [7] [9] [22]

This is provided as a reference for organising the project; it cannot replace current official application forms or case-specific requests for additional materials. Please do not send identity documents or customer records through website forms.

• At the preparation stage, first establish the legal entity and UK business route, then map private banking products, customers, territories and service-providing legal entities. Distinguish the required deposit-taking authorisation from actual wealth services permissions; if the proposal involves only investment advice or wealth management without accepting deposits, reassess the appropriate regime rather than proceeding directly with a bank application because of the business name.[1] [2] [6]

• New banks may use the optional but officially strongly recommended NBSU initial, feedback and technical challenge pre-application discussions. Private banks should demonstrate why they need to become a bank, target client needs, the allocation of wealth service responsibilities, and principal financial crime and concentration risks; the management team must understand and lead RBP, rather than relying solely on consultants to explain it.[6] [7]

• Complete RBP, ICAAP, ILAAP and governance materials, finalise controller and key personnel materials, and respond to regulatory comments with a clear feedback-response record. In parallel, design customer source-of-funds evidence requirements, high-risk approvals, ongoing monitoring and operational capacity so that business growth assumptions match compliance staffing, systems and capital budgets.[6] [7] [300]

• Submit the formal application form, supporting documents and applicable fee under the PRA new bank procedure. The electronic submission channel currently specified in the detailed instructions is NewFirmAuthorisation@bankofengland.co.uk; an initial private bank application cannot be described simply as completing a form on Connect. Submissions must still comply with the specific official documentary requirements in force at the time.[6]

• PRA and FCA each assess their respective threshold conditions, the business, customer harm and financial crime controls, and may request further information or interviews. After individual capital and liquidity requirements are confirmed, the applicant provides evidence that they are in place. Permitted activities and restrictions arise only when PRA obtains the consent of FCA and grants approval. Neither completion of pre-application discussions nor a capital commitment constitutes approval.[6] [7] [8]

• Those choosing direct full authorisation must have sufficient operational capability for their launch activities; those using mobilisation have already received authorisation with restrictions but must comply with the approval notice, with a typical aggregate bank-wide deposit cap of £50,000. Private banks must not circumvent restrictions by invoking high-net-worth clients, relationship testing or preparatory work; systems, customer checks and teams should be completed according to the mobilisation plan.[6] [7]

• Allow time for review when exiting mobilisation, request removal of restrictions through the applicable VoP procedure and provide evidence of readiness; business may be expanded within the actual permissions only after approval. After launch, continue updating customer and risk information, monitoring customer outcomes, capital and liquidity, and addressing required notifications and variations of permission before adding wealth activities or making material changes to the model, rather than treating licensing as the end of the lifecycle.[6] [7] [300] [301]

Private banks are subject to the common statutory decision framework for new banks: six months from when an application is deemed complete for complete applications, and twelve months from submission for incomplete applications. These are deadlines for a decision to approve or refuse, not a promise of fast-track licensing for high-net-worth models; there is no basis for setting a separate private bank approval timetable.[6]

There is no fixed preparation completion period for pre-application. Cross-border structures, controller and key personnel information, wealth service permission boundaries, financial crime controls and system readiness affect the proposal's maturity. Project plans should allow time for evidence and remediation; these must not be described as fixed official extensions. New bank personnel SMF applications have their own applicable approval processes and time limits and should not be combined into a single processing period for all directors.[6] [8]

Mobilisation normally lasts no more than twelve months. Exit documentation should be submitted at least approximately three months before the anticipated end, allowing time for assessment. Three months is a window for arranging the exit review, not a guarantee that restrictions will be lifted; the statutory decision rules for complete and incomplete applications under VoP still apply. Bank acquisitions and controller approvals also have separate assessment periods and are not waived because clients are high-net-worth individuals or already hold shares in a UK bank.[6] [10] [20]

Increases in shareholdings or indirect control of private banks should follow the common banking Section 178 prior notification and approval rules. Credit institutions are usually assessed against the 10%, 20%, 30% and 50% control bands, with analysis of significant influence, parent undertakings, acting in concert and indirect control. Introducing family investors or inserting a holding company requires more than an assessment of apparent shareholding percentages to determine whether approval is needed, even if the ultimate owner remains unchanged.[10] [19]

A complete control notification generally has a sixty-working-day assessment period, excluding lawful pauses for further information. Obtain the required decision before completion; separately check notification requirements for reductions or movements to a lower band. A change in controllers does not automatically add investment, management or custody permissions, nor lift mobilisation restrictions.[6] [10] [20] [301]

Changes in directors, senior managers or persons responsible for anti-money laundering should first be assessed for relevant SMF approvals and other notification requirements, with suitability, responsibilities and independent oversight arrangements updated. The departure of key relationship managers should involve customer and alert handovers and service continuity controls, but not every relationship manager requires the director approval procedure.[7] [8] [300]

Before adding wealth management activities, overseas service entities, cross-border booking or significant customer acquisition channels, assess the impact on permissions, customer protection, AML, capital and liquidity, and information access. Communicate material business plan changes to regulators in advance. Where permissions or restrictions require variation, complete the relevant VoP first; do not expand business unilaterally by changing marketing names or customer contracts.[6] [7] [11] [300] [301]

Private banks must continue to meet PRA and FCA threshold conditions and maintain applicable capital, liquidity, audit, regulatory reporting and fee arrangements. They should update RBP, ICAAP and ILAAP using actual data, and track deposit concentration among major clients or families, withdrawal behaviour, loan and collateral risks, and changes in wealth services income. Specific returns and reporting frequencies depend on the legal entity, permissions and regulatory requirements; a uniform monthly reporting regime for all private banks must not be invented.[6] [7]

Customer due diligence cannot stop at account opening. Customer and beneficial ownership information, the purpose of relationships, and evidence of sources of wealth and funds should be kept current on a risk-sensitive basis, and transactions compared with expected activity. Changes in identity, control structure, public functions, geography or transactional behaviour should prompt risk reassessment and appropriate review. High-risk relationships require enhanced ongoing monitoring, examination of explanations for anomalies, review of alerts and retention of the basis for conclusions, rather than substituting a customer's longstanding reputation or profit contribution for scrutiny.[300]

Confidentiality and AML must both be implemented. Banks should protect customer information, control access, transmission, backups and supplier access, and ensure that authorised compliance personnel and regulators can obtain necessary records. Confidentiality commitments must not prevent lawful assessment and reporting of suspicious activity. Explanations to customers about account restrictions or requests for further information must also observe applicable tipping-off prohibitions and must not disclose reports or investigation information that could prejudice an investigation.[6] [7] [300]

Wealth services should continually check actual investment permissions, client categorisation, charges, conflicts of interest and applicable client assessments and records. Retail services must monitor fair value, customer understanding, support and complaint outcomes; customer wealth or a dedicated relationship manager cannot substitute for Consumer Duty. For investment and custody services provided by group entities or outsourced providers, check contractual responsibilities and the bank’s oversight obligations. Ordinary bank deposits are repayment obligations of the bank, not invariably segregated in trust under CASS; investment money and assets require a separate assessment of CASS applicability and banking exemptions.[6] [7] [22]

Maintain accurate FSCS disclosures, SCV and exclusion documentation, particularly the identification of multiple brands under the same authorised institution, corporate or trust structures and excess deposits. The general limit is £120,000, with a separate £1,400,000 limit for temporary high balances meeting specified conditions; not all large private banking balances are protected. Maintain applicable recovery, resolution and solvent exit arrangements, planning deposit repayment or transfer, the orderly termination of investment and custody services and the handover of customer information.[5] [6] [7] [9]

Before acquiring a private bank, verify the specific legal entity, FRN, Accepting Deposits and each wealth service permission, customer scope and regulatory restrictions, and obtain approval notices and actual regulatory correspondence. The Private Bank trading name, assets under management or customer lists do not establish a full set of banking, investment, management and custody permissions. If the target is in mobilisation, check the remaining time, outstanding matters, deposit cap and capital consumption. Buying shares does not reset the mobilisation period.[6] [10]

Financial due diligence should reconstruct deposit and loan concentrations among customers and related families, deposits withdrawable on demand and unprotected deposits, loan impairment and the realisability of collateral, and review capital instruments and individual capital and liquidity requirements. Wealth service revenue and customer retention may also depend on relationship managers, third-party products or group entities. Buyers should test customer transfer and key staff departure scenarios; these are risk due diligence priorities, not grounds for guaranteeing acquisition value, profitability or a fixed price.[5] [7] [13]

Compliance due diligence should examine customer and beneficial ownership files, source-of-wealth and source-of-funds analysis, approvals of high-risk and PEP relationships, cross-border transaction monitoring, backlogs of alerts and periodic reviews, regulatory remediation and complaints. It must not be limited to sampling accounts with balances or accepting the seller's claim that all customers have been KYC. Risk classifications and the quality of source evidence should be reviewed, with resources allocated for supplementary reviews, escalation or relationship exits following identified gaps. Confidentiality does not mean the buyer may have unlimited access to complete customer files; due diligence and post-completion information transfers must take place under lawful, necessary and controlled arrangements.[6] [7] [300]

The transaction structure should make Section 178 approval, necessary SMF arrangements and permission changes corresponding conditions, with existing obligations continuing after completion and customer data and system integration completed. A share acquisition normally involves continued operation by the same authorised legal entity. Transfers of customer business or assets require separate checks of contracts, transfer structures and regulatory procedures; the licence cannot be treated as a separately transferable asset. A UK branch of an overseas private bank has no separate UK legal-entity shares to purchase. The actual implications of acquiring the overseas bank, transferring business or converting to a subsidiary, and regulatory cooperation, require analysis.[6] [8] [10] [11] [301]

The following are specific permissions, organisational models or statutory categories covered by this topic. They do not necessarily each constitute a separate financial licence.

Primarily based on FCA, PRA / Bank of England, GOV.UK and current legislation. Older third-party guides supplied by users are used to organise business material and do not override the latest official requirements.

Information compiled by: RenGang Yongsheng (Hong Kong) Limited

Tang Shangyong (Mr Tang / Drew) · Business Manager
Global financial licence application, transaction and ongoing compliance services

Contact the author and enquire about projects