General insurance companiesGuide to applications and ongoing compliance

General insurance underwriting across 18 classes is authorised by class of insurance, with SCR/MCR, reinsurance, claims handling and operational resilience calibrated to risk.

Select the minimum sufficient combination of permissions that lawfully supports the actual business, client scope and financial responsibilities, rather than treating the broadest permissions or fastest approval as the sole objective.

• Lawfully obtaining UK underwriting permissions matching the specified classes of contract allows an entity to establish its own insurance balance sheet within permitted territorial, customer and business restrictions. Regulatory registration improves transparency for counterparties identifying the responsible entity, but UK permissions do not automatically confer eligibility to sell or underwrite in the EU or other countries.[1] [3]

• Depending on risk and business model, firms may choose a UK insurance subsidiary, a permitted overseas branch or the Lloyd's market route, rather than only establishing a new company. Capital market risk transformation may also be conducted through a qualifying ISPV, but its financing and claims-payment structure differs significantly from that of an ordinary insurer.[12] [13] [19]

• Eligible new insurers may discuss mobilisation or an accelerated wholesale insurance route to reduce some start-up barriers while maintaining regulatory thresholds. Captive simplification proposals may also reduce group self-insurance costs, but as at the verification date, proposed capital and approval targets must not be presented as an already available low-cost licence.[10] [11] [15]

• First determine who bears the contractual risk, and map each product to the non-life or long-term insurance classes under RAO. The application scope must separately explain the permissions required for effecting and carrying out insurance contracts, as well as direct insurance, reinsurance, customer types and cross-border territories; merely stating ‘insurance technology’ or ‘insurance services’ is insufficient.[1] [3]

• A general insurance underwriter's statutory legal form must be a body corporate, a registered friendly society or a member of Lloyd's; the body corporate category expressly excludes LLP. Registration of a UK Ltd or PLC is not insurance authorisation. A sole trader, ordinary partnership, LP or SLP also cannot be used as an ordinary independent underwriter without meeting its specifically applicable conditions.[2]

• Compliance with the threshold conditions of both PRA and FCA must be demonstrated, including prudent conduct, suitability and effective supervision. Complex overseas holding structures, funding flows with affiliates or restrictions under overseas law must not impede regulatory data access, inspections or accountability. Ownership arrangements should be disclosed fully through to the ultimate controller.[1] [2]

• The business plan must explain actual insurance needs, target customers, underwriting limits and sustainable pricing, rather than merely describing market size and revenue growth. PRA will assess commercial viability and the customer journey; the application should provide at least three years of financial forecasts, claims and expense assumptions, reinsurance arrangements and stress scenarios.[7] [10]

• Insurers subject to Solvency UK must assess the solvency capital requirement SCR and minimum capital requirement MCR, covering each with eligible own funds. They must also prepare an own risk and solvency assessment ORSA, linking underwriting, reserving, market, credit, liquidity and operational risks to capital planning; the absolute capital floor is not the total project budget.[4] [7] [21]

• Technical provisions must be based on reliable policy and claims data and actuarial assumptions; claims tails and reinsurance recoverables must not be underestimated. Governance must cover at least the four key functions of risk management, compliance, actuarial and internal audit. Any permitted combination or outsourcing must preserve capability, independence and accountability.[21]

• Products for retail customers within scope must be assessed under Consumer Duty for target market, fair value, consumer understanding and service outcomes. This duty does not apply indiscriminately to all reinsurance or commercial large-risk contracts. The scope of ICOBS, COBS, PROD and DISP must be checked individually for insurance product rules.[32] [34]

• IT, policy administration and claims systems must support actual post-authorisation operations, and critical outsourcing must preserve the insurer's oversight and regulatory access. Application materials should explain service continuity, data management, third-party concentration risk and exit or alternative arrangements. Delegating management responsibilities to a cloud provider, MGA or claims agent does not discharge those responsibilities.[7] [21]

• Small insurers may fall under the non-Directive prudential regime, but this is only a distinction in the scope of applicable rules, not an exemption from authorisation to underwrite or a “limited insurance licence”. The current exclusion conditions require the premium, reserves, group reserves, classes of insurance and reinsurance proportion tests, among others, to be satisfied together. Annual premiums below £25,000,000 alone do not entitle a firm to exempt itself.[5]

• When choosing mobilisation, foundational governance meeting the threshold conditions, funding for the period and a board-approved build-out plan must already be in place. Remaining work should be limited to final-stage build-out and must be completed within a maximum of 12 months. Full capital and operational requirements for normal business must be met before business restrictions are lifted.[10]

• Applicable UK insurers should prepare a solvent exit analysis SEA during normal operations, rather than waiting until capital is exhausted before planning run-off. The relevant rules take effect from 2026-06-30 and exclude passive run-off firms, UK branches of overseas insurers and Lloyd's managing agents; the same policy must not be mechanically applied to these entities.[30]

• Application fees, annual PRA and FCA regulatory fees, applicable FSCS levies and consultancy fees should be budgeted separately. The original page's underwriting application quotations divided into “limited permission £1,500” and “full licence £5,000” must not be reused; actual regulatory fees must be checked against the application type and current official rates.[7] [13]

Shareholders and controllers: explain direct and indirect holdings, voting rights, acting in concert and significant influence through the full ownership chain, and provide verifiable evidence of sources of funds and wealth. PRA assesses controllers’ reputation, financial soundness and capacity for continued capital injections after acquisition; a personal bank balance certificate alone is insufficient. Typical shareholding or voting-right thresholds under the applicable insurance control regime are 10%, 20%, 30% and 50%; becoming a parent undertaking or acquiring significant influence must also be examined.[25] [26]

Directors and senior management: the proposed board should have experience in the relevant insurance classes, UK regulation, capital and actuarial governance, rather than consisting entirely of group commercial executives holding concurrent posts. Prior approval for the PRA and FCA senior management functions in the application must be sought according to actual responsibilities, with statements of responsibilities, fitness information and regulatory references. SM&CR has applied to insurers since 2018-12-10. Firms assess certified staff’s fitness on an ongoing basis under the applicable regime; this does not mean every SMF reapplies for regulatory approval annually.[7] [33]

Compliance and local substance: a UK-incorporated insurer must have both its head office and registered office in the UK, with effective direction and management, personnel, systems and records sufficient to enable effective supervision by both regulators. The four key functions may be organised proportionately, but the responsible compliance, risk, actuarial and internal audit personnel or qualified outsourcing leads must be clearly identified. Entry into mobilisation requires at least the board chair, CEO and another executive to be in place. Formal exit from that stage requires a complete key team and appropriate non-executive oversight; this does not imply a minimum board of only three people for all standard insurers.[2] [10] [21]

For direct general insurers subject to Solvency UK that do not cover non-life classes 10 to 15, the absolute MCR floor is £2,400,000; if any of those classes is covered, it is £3,500,000. Risk-based SCR/MCR and quality-of-funds requirements must also be met, and actual insurance classes, mobilisation and other applicable exceptions checked.[4]

UK-incorporated insurers must have their head office and registered office in the UK. Applications must explain where substantive operations, decision-making, personnel and records accessible to the regulators are located. A registry address, mail forwarding service or consultant’s office alone cannot demonstrate UK substance; UK branches of overseas insurers must clarify responsibilities between branch management and the parent institution and arrangements for access to records.[2] [19]

uk-fca.com is an independent financial consulting website. Topic materials may be prepared by Ren Gang Yong Sheng (Hong Kong) Limited, with Tang Shangyong (Mr Tang) providing explanations on application preparation and commercial coordination. Consultant contact details may use the Hong Kong WhatsApp +852 9298 4213, Shenzhen WeChat/mobile +86 159 2000 2080 and Drew@cnjrp.com from the original material, but these are user-provided contact details, not official service channels of PRA or FCA. The Hong Kong and Shenzhen office addresses on the original page have not been independently verified and cannot serve as evidence of a UK applicant's regulatory business address.[35]

• Submit the relevant PRA new insurer application form and supplementary information required by both regulators, clearly identifying all insurance activities and contract classes. ISPV, PCC and Lloyd’s managing agents use their respective applicable materials; the ordinary insurance intermediary Connect application form cannot simply be reused.[7] [13]

• Provide incorporation documents, articles, group structure and ultimate controller information, together with explanations of shareholdings and voting rights at each level. Establish a verifiable evidence chain covering controller suitability, sources of funds, holding arrangements and necessary overseas regulatory information.[2] [7]

• Provide business and financial plans covering at least three years, detailing assumptions for insurance classes, written premiums, claims, provisions, expenses and sources of capital. Explain the pricing rationale, distribution channels, risk appetite and sustainability for the proposed customers and territories; do not substitute unverified total market figures for business evidence.[7] [10]

• Submit SCR, MCR and eligible own funds calculations, a capital build-up plan and stress test results. Solvency UK applications also require a draft ORSA, while non-Directive applications should use capital and risk materials appropriate to their own regime rather than borrowing a bank ICAAP template.[7] [21]

• Submit the board and key function structure, relevant SMF forms, candidate career histories and responsibility descriptions, and suitability materials such as regulatory references. Governance documents should explain how actuarial advice, independent challenge, major decisions and conflicts of interest are reported to the board.[7] [21] [33]

• Submit underwriting policies, sample policies and claims processes, explaining claim rejection, cancellation, renewal and complaints arrangements. Where relevant retail products are involved, provide specific evidence on target markets, fair value, vulnerable customers and customer outcome monitoring, rather than merely a generic Consumer Duty statement.[7] [32] [34]

• Submit reinsurance agreements or reliable drafts, counterparty assessments, the basis for recoverable amounts and concentration risk analysis. ISPV also requires risk transformation and securities financing documents, explanations of the subordination of investor rights and effective risk transfer, and, where necessary, legal opinions on enforceability.[13] [14] [21]

• Submit system architecture, data flows, key outsourcing contracts, and business continuity and disaster recovery testing materials. Compliance and financial crime documents must distinguish applicable obligations by long-term insurance, general insurance and customer model, identifying responsible persons and monitoring mechanisms.[7] [21] [23]

• Submit applicable exit analysis, run-off arrangements and recovery plans, explaining how claims obligations will continue to be met after new policy issuance stops. Choosing mobilisation requires an additional board-approved build-out plan within 12 months; choosing an overseas branch requires additional parent institution financial information, home-state supervisory cooperation and analysis of UK policy liabilities.[10] [19] [30]

This is provided as a reference for organising the project; it cannot replace current official application forms or case-specific requests for additional materials. Please do not send identity documents or customer records through website forms.

• The first step is to define the business and select the structure, confirming whether the risk is actually borne by the applicant, an existing insurer or a Lloyd’s member. Design the scope of permission according to the RAO contract classes, and assess whether the ordinary insurer, non-Directive, overseas branch and ISPV routes genuinely apply, rather than first purchasing a supposed universal insurance licence.[1] [3] [5] [13]

• The second step is to engage in pre-application discussions with the PRA New Insurer Start-Up Unit on key gaps in the business plan, capital and management team. Mobilisation or the wholesale insurance accelerated route may be discussed at this stage, but an invitation to use a route does not mean that PRA and FCA have confirmed that the threshold conditions are met.[6] [10] [11]

• The third step is to complete the application and supporting documents required by both regulators and submit them electronically through the PRA insurance application channel. The email currently listed on the NISU page is NewInsurerStartupUnit@bankofengland.co.uk; files exceeding 25MB should be split across emails. ISPV uses ISPVMailbox@bankofengland.co.uk; it is incorrect to state that all underwriting applications are submitted through Connect.[7] [13]

• Step four: PRA logs the application and forwards it to FCA, arranging case officers from both authorities and an assessment of completeness. NISU currently states that receipt is normally acknowledged within five working days, with an initial assessment and requests for missing information within eight weeks. Management interviews, site visits and regular progress discussions may also take place. These milestones are not promises of approval.[7]

• The fifth step is to provide supplementary explanations on capital, business viability, shareholders and senior management, governance, customer journeys and outsourcing. Both regulators must complete their respective threshold condition assessments. Finally, PRA makes the permission decision after obtaining FCA’s consent, with the effective date and business restrictions specified in a written notice.[1] [7] [8]

• Step six: commence within the approved scope and put regulatory reporting, insurance premium tax and relevant ongoing compliance arrangements in place. Institutions in mobilisation may move to normal-scale operations only after restrictions have been removed through a variation of permission. New transactions for ISPV and multi-arrangement platforms must follow their non-public Scope of Permission and notification rules.[10] [13]

Statutory time limits: section 55V of FSMA, as verified as of 2026-11-07, still provides that a complete application for authorisation to underwrite insurance must be determined within six months of receipt of the complete application; an incomplete application must be determined within twelve months of its initial receipt. Where another regulator’s consent is required, that regulator must also make its decision within the same time limits. The statutory limits are deadlines for decisions, not guarantees of approval. The special three-month rule for applications relating only to insurance distribution activity should not be misapplied to underwriters.[8]

Regulatory service targets: PRA currently commits to shorter targets of four months for complete applications and ten months for incomplete applications, expressly stating that these targets have not yet been incorporated into FSMA. The four and ten months on the NISU page are service arrangements, not new law replacing the statutory six and twelve months. Poor-quality materials, business model changes or withdrawal and resubmission may all affect actual project timelines.[7] [9]

Preparation: establishing the underwriting entity, recruiting the team, securing funding, building systems and completing actuarial models are tasks outside the formal application clock. There is no official uniform preparation period for all insurance start-ups or guaranteed timeframe from consultation to opening; projects should plan separately around completion of these tasks. Approval for mobilisation provides up to a further twelve months to complete final development work; it does not extend the statutory application assessment period.[6] [10]

Special routes: the joint process for Lloyd's managing agents may be completed in approximately six months with a high-quality application and prompt cooperation; it must not be described as invariably taking twelve to eighteen months or guaranteeing approval within six months. The accelerated route for eligible ISPV targets ten working days for a complete application; the wholesale insurance accelerated route has no uniform ten-day commitment. The four-to-six-week Captive target was only a consultation proposal in 2026. Eligibility conditions, statutory deadlines and commercial preparation time for all three should be assessed separately.[11] [12] [14] [15]

Changes in control: before acquiring or increasing control over a dual-regulated insurer, submit a notice under section 178 of FSMA to PRA and obtain approval; do not complete first and file afterwards. Typical insurance control bands are 10%, 20%, 30% and 50%. Significant influence or becoming a parent undertaking may also trigger requirements, and inserting an intermediate holding company requires assessment even if the ultimate controller is unchanged. The statutory assessment period for a complete control notification is generally sixty working days, subject to permitted interruptions for further information. Reducing holdings across a threshold or ceasing control also requires prior notification; 33% is not a universal threshold for insurers.[25] [26] [27]

Changes to directors and senior management: directors or executives performing regulated SMF responsibilities must first apply for approval under the applicable regime and update statements of responsibilities, responsibility allocations and relevant notifications. Ordinary company director registration and financial regulatory approval of senior functions are separate procedures. A Companies House update or Form C departure notification cannot replace approval for appointment to a new function. Material changes to business, capital, reinsurance, outsourcing or new classes of contract should first be assessed for whether a PRA variation of permission and FCA consent are required, rather than all being treated as routine contact-detail changes.[1] [7] [33]

Prudential reporting: firms subject to Solvency UK must report capital, assets, provisions and other data under the PRA Reporting rules and their own reporting schedules; MCR must be calculated at least quarterly. Standard solo quarterly quantitative templates are generally due within thirty business days after quarter-end, and annual quantitative templates and SFCR within seventy business days. The ORSA report should be submitted within ten business days after completion of the assessment; different deadlines apply to internal models, groups or special templates. PRA insurance data should be submitted via BEEDS using the applicable formats, while FCA conduct reporting follows the FCA systems and schedules. These cannot all be described as quarterly RegData capital returns or annual Connect reports.[4] [13] [20]

Governance and audit: the board remains responsible for reserves, capital, risks and policies. Key policies must be reviewed at least annually and upon material changes. Financial statement audits and external audits under PRA of relevant parts of SFCR are different obligations. The latter has exemptions subject to conditions such as size scoring; it must not be claimed that all small insurers require the same full SFCR audit. Applicable retail business also requires ongoing monitoring of Consumer Duty customer outcomes and an annual board-level assessment, alongside complaints handling and reporting within the specific DISP scope.[21] [22] [32] [34]

AML and financial crime: MLR 2017 includes authorised insurers within the definition of financial institution when entering into or performing long-term insurance contracts, so long-term insurance generally requires corresponding customer due diligence, ongoing monitoring and anti-money laundering governance. An insurer dealing only in general non-life insurance cannot be assumed to require the same MLR or the same type of SMF17 appointment merely because it is called an insurance company. It must nevertheless fulfil applicable financial crime, sanctions, anti-fraud and incident reporting obligations according to its business. Insurance groups should also check whether other activities independently trigger anti-money laundering rules.[21] [23]

Funds and insurance premium tax: the insurance intermediary client money chapter of CASS 5 expressly excludes an insurer’s own permitted activities and activities carried on by a managing agent in that capacity; payment institution safeguarding templates cannot be applied to premiums. Collection by intermediaries and risk transfer arrangements still require separate assessment of the contracts and CASS, while insurers themselves must maintain sufficient assets, provisions and claims-paying liquidity. HMRC's standard rate of Insurance Premium Tax (IPT) is 12%, with 20% applying to travel insurance and certain insurance sold with vehicles or electrical appliances; most long-term insurance, reinsurance and similar categories are exempt. The authority must be notified within the prescribed thirty-day period after the intention to receive taxable premiums arises, with returns normally submitted every three months as notified by HMRC.[24] [29]

New rules and exit: insurers meeting the large-scale and derivatives or repo exposure criteria face additional liquidity reporting requirements from 2026-09-30, but not all insurers must report monthly or daily. Most overseas branch reporting reforms take effect only on 2026-12-31, with a separate transition period until 2027-12-31 for branches affected by the new full reporting requirements. These must not be treated prematurely as a complete exemption from quarterly reporting. Applicable UK insurers must also maintain solvent exit preparations effective from 2026-06-30. Ceasing to write new business does not end policy performance or regulatory responsibilities.[19] [20] [30]

When acquiring an insurer, first check the entity’s permissions, restricted contract classes, whether it may still write new business and any regulatory requirements, rather than merely confirming that FRN exists. Control approval should be a condition of completion, and changes to existing directors, compliance, actuarial and reinsurance arrangements should be assessed for their effect on the basis of authorisation. A share sale does not turn existing insurance liabilities into a freely detachable “clean licence”; a business transfer cannot be completed through an ordinary asset sale alone.[3] [25]

Specialist due diligence should examine policy liabilities, reported outstanding claims, IBNR, long-tail claims, inflation assumptions and reserve development year by year, and verify reinsurance recoverables and counterparty solvency. For life insurance, review guaranteed returns, longevity risk, matching adjustment or internal model permission conditions, and asset-liability and liquidity stresses. The history of SCR and MCR, capital quality, regulatory communications, customer redress, exit plans and outsourcing substitutability should be cross-checked against independent actuarial assessments and actual claims records, rather than looking only at net assets.[4] [7] [21] [30]

When acquiring a Lloyd's business, distinguish the managing agent company, member capital and annual syndicate accounts, and examine reinsurance to close and Lloyd's approval conditions. Acquiring ISPV or PCC requires obtaining the non-public Scope of Permission and evidence of risk financing and segregated assets for each transaction. Do not infer permission to assume new risks solely from public registration. For overseas branches, further verify the parent institution's resources and continuity of UK policies. Captive projects must specify whether they use the current regime or await the simplification reforms expected in 2027, avoiding pricing based on capital thresholds not yet in force.[12] [13] [15] [19]

The following are specific permissions, organisational models or statutory categories covered by this topic. They do not necessarily each constitute a separate financial licence.

Primarily based on FCA, PRA / Bank of England, GOV.UK and current legislation. Older third-party guides supplied by users are used to organise business material and do not override the latest official requirements.

Information compiled by: RenGang Yongsheng (Hong Kong) Limited

Tang Shangyong (Mr Tang / Drew) · Business Manager
Global financial licence application, transaction and ongoing compliance services

Contact the author and enquire about projects