Retail banking business modelGuide to applications and ongoing compliance

Personal deposit, account, consumer lending and residential mortgage models require separate consideration of customer vulnerability, Consumer Duty, deposit protection and relevant credit activities.

Retail banking is a banking business model focused on individual customers, retail deposits, accounts and applicable personal credit products, not an additional retail licence. Deposit-taking authorisation is still granted by PRA with the consent of FCA, with ongoing supervision by both. This model must embed Consumer Duty, customer support, deposit protection disclosures, customer data and service continuity in the business plan, risk evidence and day-to-day operations. Information has been checked as at 2026-11-07; approval or an opening date is not guaranteed.[1] [6] [7]

This model primarily serves individual customers, providing services such as savings, current accounts, personal loans and residential mortgages within the permitted scope. Actual rights derive from the institution's Part 4A permission and its customer, activity and scale restrictions, rather than the name 'Retail Bank'. Personal loans, overdrafts, residential mortgages and related advice or arranging activities must each be assessed according to the nature of the contract, the bank's actual role, applicable exemptions and specific permissions. Permission to accept deposits must not be understood as automatically covering all retail financial products.[1] [2] [6]

The explanations of new applications, ICAAP and ILAAP on this page focus on UK-incorporated banks and also apply to UK subsidiaries of international banks regulated under the corresponding UK corporate framework. Choosing an overseas bank's UK branch requires a separate assessment of bank-wide prudential resources, home-state supervisory cooperation, treatment of UK depositors and the acceptability of the retail scale; the incorporated-bank route cannot simply be copied. Building societies and credit unions serve individual customers but retain their own legal and membership regimes and do not become ordinary banks by adopting retail service models.[3] [11]

For products and services offered to retail customers and within the scope of the Consumer Duty, consumer-outcome requirements should be implemented throughout product design, distribution channels, price and value, consumer understanding and support arrangements. Ordinary bank deposits are repayment obligations of the bank; not all balances are segregated on trust under CASS. Where investment or client-asset services are also provided, the applicability of their rules should be assessed separately.[7] [22]

Select the minimum sufficient combination of permissions that lawfully supports the actual business, client scope and financial responsibilities, rather than treating the broadest permissions or fastest approval as the sole objective.

• After obtaining the relevant banking authorisation, deposits may be accepted from individual customers within the approved scope, and services developed around the accounts and credit products actually authorised. Savings, accounts used for payments and personal borrowing should each have clear terms, permissions and risk explanations; retail bank status cannot replace specific product review.[1] [2] [6]

• Eligible deposits may qualify for FSCS deposit protection. The general limit verified in the current review is £120,000 per depositor, per PRA-authorised institution, from 2025-12-01. Different brands under the same authorised institution are normally aggregated; qualifying temporary high balances have separate conditions and limits. Protection disclosures should help individual customers assess their funding arrangements, rather than promise that all products, all large balances or each brand are independently protected.[5]

• Consumer Duty provides verifiable outcome requirements for retail services: products should meet target customers' needs, provide fair value, enable customers to understand key information and provide appropriate support when needed. Its purpose is to put these requirements into practice through evidence and remediation, not for the regulator to guarantee a product's returns, price or service quality.[7]

• The same banking threshold conditions apply: the applicant must have an appropriate legal form, conduct business prudently, have sufficient resources and be capable of effective supervision by PRA and FCA. UK-incorporated banks must meet UK head office and registered office requirements. A retail business model does not lower capital, governance or effective supervision standards.[3] [6]

• RBP should explain the specific retail customer groups, savings and account needs, proposed personal credit, product pricing, acquisition channels and path to profitability. Support deposit and lending growth with market evidence and test consistency between deposit interest costs, marketing, customer support, bad debts and systems investment. The board should challenge assumptions, rather than merely submitting customer growth charts or product promotions.[6] [7]

• Products subject to Consumer Duty must address the four outcomes of products and services, price and value, consumer understanding and consumer support, and identify foreseeable harm and barriers vulnerable customers may face. Retail models should particularly test journeys involving fee and interest-rate information, account-opening refusals or delays, restricted access to funds, account closures, complaints and, where applicable, loan repayment difficulties. These are priorities for risk evidence organised around the intended products, not a separate set of licensing thresholds.[6] [7]

• A UK-incorporated bank’s ICAAP and ILAAP should reflect personal loan or mortgage losses, interest rate changes, deposit concentration, outflows of on-demand deposits and funding changes arising from online or intermediary customer acquisition channels. Stress scenarios should be consistent with RBP products and balance-sheet growth and demonstrate that contingency funding and management actions are realistic and feasible. They must not assume that retail deposits are always stable or that FSCS will make up the bank’s liquidity shortfall.[6] [7]

• The board and senior management must be able to understand and challenge retail prudential risks and customer outcomes, with clear responsibilities across business, risk, compliance and audit. Customer support, complaints, financial crime controls and product governance must have sufficient resources and escalation mechanisms; outsourcing or intermediary channels do not transfer the bank's regulatory responsibilities.[6] [7] [8]

• Identify important business services, set appropriate impact tolerances and map dependencies on people, systems and suppliers based on the account access, deposits and withdrawals, payments and customer support actually used by individual customers. Before opening directly with unrestricted authorisation or exiting mobilisation, provide applicable operational resilience self-assessments, scenario testing and evidence of remediation. Technical launch or supplier certification cannot replace evidence that customers can use services safely.[6] [7]

• Deposit protection disclosures, the Single Customer View (SCV) and exclusions files should be capable of being generated from actual customer and account data. The application must also include recovery, resolution and solvent exit materials as applicable, explaining how personal deposits will be repaid or transferred and how critical services will be maintained. Exit materials should align with capital, liquidity and operational arrangements, rather than consist solely of a plan to stop marketing.[5] [6] [7] [9]

A retail model must still disclose shareholders, ultimate controllers, group structure and sources of funds, and seek relevant senior manager approvals under the banking SM&CR and actual functions. The board should have evidence that its collective capabilities are sufficient to scrutinise retail deposits, personal credit, asset and liability management, financial crime and operational risk. External advisers’ assistance with drafting materials cannot replace management’s ability to understand RBP, ICAAP and ILAAP.[6] [7] [8]

Staffing arrangements should explain who is responsible for products and pricing, customer understanding, customer support, complaints and treatment of vulnerable customers, and who independently monitors customer outcomes and challenges the board. Responsibilities may be organised proportionately to scale, but department names or nominal credentials cannot replace the ability to perform duties, nor should every business role be described as the same type of SMF requiring separate approval.[6] [7] [8]

At initial launch and as the business grows, demonstrate sufficient staffing and backup capacity for account-opening checks, customer service, financial crime escalation, credit management and critical systems, supporting resource planning with expected customer volumes and service needs. Do not invent uniform retail bank standards for total staff, UK nationals or customer service headcounts; actual key appointments, board composition and approval requirements must still be met individually according to the application stage and regulatory arrangements.[6] [7]

Retail models follow the banking prudential authorisation framework; there is no separate ‘retail bank capital tariff’. Under the current PRA Definition of Capital 12.1, the base capital resources requirement for an ordinary bank is €5,000,000, not £5,000,000. Only small specialist banks meeting the definition are treated under their applicable rules; a bank cannot choose lower capital requirements merely because it offers only savings, personal accounts or residential mortgages.[13]

Base capital is not a start-up budget. A UK-incorporated bank must also meet capital requirements determined by its own risks, Pillar 2A and applicable buffers, taking MREL into account where applicable. Capital forecasts should include personal loan or mortgage losses, interest rate risk, operational incidents and expected start-up losses. Retail customer support, remediation of customer outcomes, system operation and outsourcing costs should also be included in realistic operating forecasts, rather than using projected deposit growth as a substitute for eligible loss-absorbing capital.[6] [7]

Capital and liquidity must be demonstrated separately: personal instant-access deposits, large or concentrated deposits, funding behaviour across distribution channels and competition on deposit rates should be incorporated into ILAAP and stress testing. Even where customer deposits qualify for FSCS, this does not exempt the bank from its own liquidity requirements. Board-approved ICAAP and ILAAP must be consistent with the same RBP.[5] [6] [7]

Before authorisation to enter mobilisation, the firm must demonstrate that capital for that stage is in place and requirements continue to be met. Direct launch or exit from mobilisation requires evidence of adequate capital for the first twelve months of planned operations; the mobilisation deposit cap must not be treated as a capital or funding budget. Where an overseas branch is used, capital and liquidity must be analysed under the applicable bank-wide and UK arrangements, rather than applying a uniform amount for a UK legal entity.[6] [7] [11]

A UK-incorporated retail bank must have its head office and registered office in the UK, and its actual management, records and systems arrangements should support effective supervision by PRA and FCA. A correspondence address or an enquiry contact address on a website does not demonstrate that the bank has a head office capable of being supervised. This page does not verify or guarantee the availability of any ready-to-use offices, rental resources or branches.[3] [6]

A retail model should further explain how individual customers obtain services and support through branches, telephone, websites, apps or intermediaries, including account opening, access to funds, complaints and alternative arrangements during service disruption. Choosing remote or digital services does not change regulatory accessibility or customer outcome requirements; it is not presumed that every retail bank must have the same number of branches, office floor area or uniform nationwide counter configuration. An overseas branch must additionally explain UK management and head-office responsibilities and information interfaces.[6] [7] [11]

• Application form, proposed permissions and restrictions, company legal identity and fee documentation: itemise personal deposits to be accepted, account purposes, credit products, customers and channels, and the assessment of applicable activities or exemptions. Check fees against the PRA and FCA rules applicable at submission; do not combine bank application fees, capital, annual regulatory fees and consultancy quotations into a single item.[2] [3] [6] [17] [18]

• A consistent RBP and multi-year financial projections: include target retail customers, products, pricing, channels, the basis for deposit and lending growth, the path to profitability and adjustments under stress; attach records of board approval, independent challenge and responses to pre-application feedback. The core plans provided to investors and regulators should be consistent: one must not promise high growth while the other is submitted on low-risk assumptions.[6] [7]

• Final versions of ICAAP and ILAAP, capital instruments and evidence of funding: cover the proposed retail credit, interest rate, operational and deposit outflow risks, explaining funding sources and contingency measures. Under current PRA guidance, capital funding may be confirmed by an auditor or evidenced by a combination of bank statements showing the capital injection, Companies House SH01 and board records approving the issue of share capital; prepare applicable capital instrument classification approvals separately.[6] [7] [13]

• Controller and governance information: the complete ownership chain, ultimate owners, sources of funds and group arrangements; senior managers' experience, suitability assessments, statements of responsibilities and allocation of responsibilities. Also provide explanations of responsibilities and resources for product approval, pricing and value reviews, customer support and complaints, financial crime, risk management and audit. An ordinary organisational chart is not a substitute for evidence of retail responsibilities being discharged.[6] [7] [8]

• Consumer Duty and conduct risk evidence: map target customer needs, product design and fair value, understanding of terms and charges, and barriers to accessing and using customer service individually to controls, responsible persons, management information and remediation mechanisms. Attach proposed launch product terms, interest rate and fee disclosures, examples of customer communications, and procedures for handling complaints and, where applicable, repayment difficulties. Explain how poorer outcomes for different customer groups and vulnerable customers will be identified; the focus is on testable practical arrangements, not general assertions of 'valuing consumers'.[6] [7]

• The complete customer journey and financial crime controls: from customer acquisition, identity verification and account opening through account use, closure and issue escalation, explain the boundaries of responsibility between the bank and any intermediary, onboarding review supplier or customer service provider. Provide procedures and test records for the proposed services; where account restrictions are involved, customer support must be balanced with applicable financial crime and confidentiality requirements.[6] [7]

• Systems, outsourcing and service continuity materials: account and customer data structures, key supplier contracts and oversight arrangements, important business services and impact tolerances, dependency mapping, severe but plausible disruption scenarios, and recovery and communication plans. Complete applicable operational resilience self-assessments and testing evidence before commencing business directly with unrestricted authorisation or exiting mobilisation, focusing on whether individual customers can access funds and receive necessary support.[6] [7]

• Deposit protection and customer data materials: FSCS eligibility assessments, institution-to-brand mapping, customer information sheets and disclosures, and processes for generating and reconciling SCV and exclusions files. They should demonstrate the ability to aggregate by depositor rather than calculate solely by account or brand; where a deposit aggregation platform is used, verify underlying customer data and the records available to the bank, rather than submitting only the platform account's total balance.[5] [6] [7] [11]

• Recovery, resolution and applicable solvent exit materials: recovery options, Phase 1 resolution information, board-approved exit preparations and applicable SEA, explaining customer deposit repayment or transfer, maintenance of support services, and staffing and outsourcing exit costs. Where mobilisation is selected, also attach a build-out plan, outstanding deliverables and evidence requirements for readiness to open, rather than treating unrestricted retail customer acquisition as a trial operating plan during the restricted period.[6] [7] [9]

This is provided as a reference for organising the project; it cannot replace current official application forms or case-specific requests for additional materials. Please do not send identity documents or customer records through website forms.

• First determine the applicant entity and business perimeter. Prepare a permissions list based on the actual personal deposit, account, loan or mortgage services, and confirm whether a UK legal entity or subsidiary bank framework will be used. Analyse overseas branches and mutual institutions separately under their respective regimes. Do not submit an application for a non-existent standalone ‘retail licence’ or substitute company registration for bank authorisation.[1] [2] [3] [11]

• Choose and prepare for NBSU pre-application engagement. Although optional, the initial, feedback and technical challenge stages are strongly recommended by the authorities. Provide well-developed materials covering retail RBP, sources of funding, individual customer journeys, Consumer Duty and key risks, and document responses. Management must be able to explain the proposal; attending meetings or completing feedback does not constitute a promise of approval.[6]

• Apply the same retail product and customer assumptions consistently across RBP, ICAAP, ILAAP, governance, customer outcomes and operational materials, and develop the formal application following board challenge. Submit the application form and supporting documents electronically under the PRA new bank process and address applicable fees; this must not be described generically as simply completing a retail licence application in Connect.[6] [17] [18]

• PRA and FCA each review completeness and their respective threshold conditions, requesting further information, assessing controllers and interviewing senior managers as necessary. In addition to capital and liquidity, a retail model should demonstrate specifically that individual customers can obtain suitable products, understand important terms, use accounts and receive support. PRA may grant authorisation only with the consent of FCA.[6] [7] [8]

• Proceed with direct full launch or authorisation with restrictions according to the approved route. Direct launch requires the relevant full operational standards to be met; those entering mobilisation must still meet the threshold conditions and comply with the approval notice. A typical restriction is total deposits across the bank of £50,000; neither £50,000 per retail customer nor a large-scale public trial launch should be treated as permitted.[6]

• Complete development and applicable reviews before exiting mobilisation, demonstrating that capital is in place, support for individual customers and product arrangements are mature, key services have been tested and SCV can be generated, and submit the VoP to remove restrictions. Retail business may be expanded within the full permissions only after the variation has been approved. Continue monitoring deposit risks and consumer outcomes after formal launch, rather than treating authorisation as the end of the project.[6] [7] [300]

There is no separate fast-track approval period for retail models. The statutory decision rules for formal bank authorisation still apply: six months from when an application is deemed complete, or twelve months from submission for an incomplete application. A decision may approve or refuse the application. Information quality, responses to feedback and necessary evidence determine completeness; submitting a product introduction or registering a company cannot start a ‘guaranteed authorisation’ countdown.[6]

There is no uniform completion deadline for pre-application and build-out. Customer understanding, support processes, product and value reviews, account and deposit data, and service continuity testing for a retail model must be planned alongside staffing and funding development. The work required varies with actual products, channels and maturity. Postponing customer service or SCV work until after full launch is not a reliable way to shorten initial approval preparation.[6] [7]

Mobilisation is a restricted build-out period after authorisation, normally lasting no more than twelve months. An exit VoP must be submitted at least three months before the period ends, allowing time for review. This build-out window is not a deadline for automatic removal of restrictions, nor is it the twelve-month statutory decision period for an incomplete application. Recruiting retail customers and receiving funds must always comply with the actual approval status; these periods must not be added together and promoted as a fixed time to launch.[6]

Before adding personal deposit products, changing account purposes, expanding personal credit or mortgage services, changing target customers, using deposit aggregation channels or significantly changing service delivery, check actual permissions and restrictions and assess whether VoP, notification or another procedure is required. Product or channel changes within existing permissions should also update RBP, relevant risk assessments, capital and liquidity, and Consumer Duty evidence. Not every product change requires a separate licence, but firms must not operate beyond their permissions before completing the necessary procedures.[2] [6] [7] [300]

Changes to interest rates and charges, access to funds, customer service channels, account migration and outsourcing suppliers that are sensitive for retail customers should be assessed for their effects on different customer groups, customer understanding and support. Retain testing, board or appropriate governance approvals and remediation records. Important business services, dependencies and impact tolerances should be reviewed following material changes; significant strategy or personnel changes during mobilisation may affect the basis of the original approval, so the original conditions must not be assumed to continue applying automatically.[6] [7]

Acquiring or increasing control of a bank still requires prior notification to PRA and approval under Section 178, analysing the 10%, 20%, 30% and 50% thresholds, indirect control, acting in concert and significant influence. Inserting a holding company may also trigger the procedure. Changes to directors or senior managers require separate assessment of SMF approval and responsibility updates. Companies House registration or post-transaction filing cannot replace prior financial regulatory approval.[8] [10] [19]

After commencing full operations, banks must continue to meet capital, liquidity, audit and applicable regulatory reporting requirements. Retail models should update forecasts using actual personal deposit and lending data and monitor instant-access deposits and channel concentrations, deposit outflows, credit losses and operational risk. ICAAP and ILAAP should be updated periodically as required, with earlier review upon material changes. The same reporting frequency cannot be applied to every banking structure.[6] [7]

Consumer Duty is not a document submitted once at business launch. Outcomes relating to products and services, price and value, customer understanding and support should be monitored continuously, identifying whether different groups of individual customers experience poorer outcomes. Management information should reflect the bank's risks, including complaints, service waiting times and failures, understanding of charges and terms, account closures and, where applicable, repayment difficulties. Problems identified should be investigated for their causes, appropriately remediated and followed up by the governing body; overall satisfaction or sales volumes cannot replace actual customer outcomes.[7]

Maintain financial crime controls, staff competence and customer issue escalation mechanisms appropriate to the retail services provided, and continuously oversee the quality of intermediary and outsourced services. Customer support arrangements during account restrictions or reviews should take account of applicable financial crime and confidentiality requirements. When important systems or suppliers fail, restore services, communicate and assist affected customers under tested plans; do not assume outsourcing removes responsibility.[6] [7]

Keep FSCS information sheets, institution-to-brand mappings, customer eligibility, SCV and exclusions files accurate. The current general protection limit is £120,000 per depositor per PRA-authorised institution, and the limit for qualifying temporary high balances is £1,400,000. Protection must not be advertised as duplicated across brands, nor may all large balances be presented as additionally protected. Under current supervisory expectations, credible SCV and exclusions files should be available within 24 hours of a request; aggregation and exclusion assessments for new customers, platform data and migrated data must be continually checked.[5] [7]

Ordinary bank deposits do not thereby become CASS funds segregated under a trust; where there are additional investment or client asset activities, the rules and disclosures must be assessed separately. Recovery and resolution information should be updated in line with the scale of retail business and services critical to customers. Non-systemic UK-incorporated banks covered by the regime must maintain SEA in their ordinary operations, explaining the feasibility of repaying or transferring individual deposits and maintaining essential services; this specific regime must not be applied unconditionally to overseas branches.[7] [9] [11] [22]

For a retail bank acquisition, first distinguish acquiring control of a UK banking entity from purchasing part of a business or a loan portfolio. The former requires prior notification to PRA under Section 178 and approval; the latter requires separate examination of the applicable procedures based on the actual transfer structure. Not every transaction is the same change-in-control application. Check the Financial Services Register, authorised entity, individual customer scope, all permissions and restrictions, and obtain actual regulatory correspondence. If the target is in mobilisation, acquisition neither removes deposit restrictions nor resets the remaining build-out period.[6] [10]

Unlike a new establishment, which primarily demonstrates future plans, an acquisition requires verification of the true quality of existing personal deposits and loans: whether deposits depend on high interest rates, a single channel or concentrated customers; whether loans and mortgages carry impairment, collateral or repayment risks; whether capital instruments qualify; and whether integration and remediation costs erode capital and liquidity. Recalculate stress and funding arrangements using actual data; existing authorisation or customer numbers alone cannot serve as evidence of value.[6] [7] [13]

Customer outcomes due diligence should sample product terms, price and value assessments, fee and interest-rate disclosures, complaints, restricted access to funds, account closures and applicable records of handling repayment difficulties, and check for unresolved harm affecting different customer groups and vulnerable customers. Acquirers should identify existing remediation, compensation or service improvement matters and associated resource needs; new shareholders do not make existing customer problems disappear.[6] [7]

Deposit due diligence should verify, item by item, FSCS eligibility, consolidation of brands under the same legal entity, customer and account matching, and the completeness of SCV and exclusions files; where an aggregation platform is involved, verify underlying customer records. System migrations and changes to brands or the structure of authorised institutions may affect deposit protection calculations and customer support. Data reconciliation, customer communications and service continuity testing should be arranged before implementation, rather than merely changing website branding or counting protection repeatedly across post-acquisition brands.[5] [7] [11]

Completion conditions should include required change-in-control and other approvals, suitable management arrangements, evidence of funding and an executable integration plan. A complete change-in-control notification normally has a sixty-working-day assessment period, excluding lawful suspensions for further information. No fixed transaction price, completion timetable or immediate post-acquisition expansion of permissions is promised. If the target is actually an overseas branch or member-owned mutual institution, its legal structure and transaction method require separate analysis rather than treatment as an ordinary UK bank share sale.[10] [11] [20]

The following are specific permissions, organisational models or statutory categories covered by this topic. They do not necessarily each constitute a separate financial licence.

Primarily based on FCA, PRA / Bank of England, GOV.UK and current legislation. Older third-party guides supplied by users are used to organise business material and do not override the latest official requirements.

Information compiled by: RenGang Yongsheng (Hong Kong) Limited

Tang Shangyong (Mr Tang / Drew) · Business Manager
Global financial licence application, transaction and ongoing compliance services

Contact the author and enquire about projects