Business scope and permission boundaries
Involves distinct permissions for establishing and operating personal or stakeholder pensions, pension transfer advice and other activities, with the perimeter of The Pensions Regulator also requiring assessment.
Application value and choice of route
Select the minimum sufficient combination of permissions that lawfully supports the actual business, client scope and financial responsibilities, rather than treating the broadest permissions or fastest approval as the sole objective.
After obtaining the appropriate FCA permissions, a firm may provide investment services to UK retail or professional clients within the scope specified in its permission, allowing clients to verify its status and permissions on the Financial Services Register. Authorisation is an important basis for lawful operation and counterparty due diligence, but does not mean the regulator guarantees product returns or approves the firm's commercial performance.[4]
Configure permissions around the actual business, making a clear choice between brokerage or portfolio management models that do not handle client assets and higher-risk models such as proprietary trading and custody. The proportionate SNI regime and research payment options may reduce some burdens, but do not mean that all start-ups qualify as SNI or are exempt from risk management.[5] [6] [24]
The UK allows eligible overseas institutions to apply for authorisation through a UK subsidiary or a substantive UK business presence of an overseas legal entity, providing options for different group structures. UK permission does not itself confer EU passporting rights or global operating eligibility; local rules must still be checked country by country when serving clients across borders.[7]
Application conditions and entry requirements
First prepare an activity and permissions matrix, identifying advising, arranging, dealing as agent, dealing as principal and managing investments separately, then map these to financial instruments and client categories. Clearly map the routes for orders, cash, securities, collateral and settlement. Marketing descriptions such as ‘STP’, ‘ECN’ or ‘matching only’ cannot replace legal analysis.[1] [3]
Demonstrate that the applicant continuously meets the threshold conditions, including effective supervision, appropriate resources, suitability and a credible business model. A UK Ltd is not the only form: FCA wholesale application materials expressly accept evidence of LLP capital agreements, and international legal entities may also apply; the corresponding legal and substance requirements must still be implemented when selecting a form.[1] [7]
Submit monthly profit and loss, balance sheet, cash flow and capital analyses for three years, specifying account-opening numbers, trading volumes, customer acquisition costs, revenue sources and liquidity assumptions. Capital must actually be injected into the applicant legal entity before authorisation, supported by account records, share allotment evidence or a partnership agreement; a group support letter or unfulfilled financing intention is not equivalent to eligible own funds already in place.[1]
Client categorisation must genuinely distinguish retail clients, professional clients and eligible counterparties, applying suitability or appropriateness assessments according to the service. Advice and portfolio management require sufficient information on clients' objectives, capacity for loss and risk. Upgrading a client to professional status merely because they want high leverage is not a compliant basis for categorisation.[2] [8]
Retail CFD must implement leverage limits ranging from 30:1 to 2:1 according to underlying asset risk, the close-out rule when account margin falls to 50%, and negative balance protection. Cash and other trading incentives must also be prohibited, and the prescribed risk warning and the firm’s percentage of loss-making retail accounts prominently displayed. Clients must not be transferred to overseas affiliated platforms to circumvent the restrictions.[8]
Investment businesses must have functioning processes for conflicts of interest, best execution, product governance, complaints and financial promotion approval. Buy-side firms may use joint payments for research and execution where conditions are met, but still need justifiable fee governance. The UK’s abolition of RTS27/28 reports does not abolish best execution obligations.[23] [24]
Where a firm proposes to hold or control client money and securities, it should specify the applicable CASS chapters, account trust and segregation methods, legal custody arrangements and reconciliation controls. Even where clients contract directly with an independent custodian, the firm's actual control and authority to give instructions must be verified; using a third party alone does not justify claiming that client asset rules are entirely inapplicable.[9] [10]
Trading systems should record orders, trades, prices, client and algorithm identities, and address erroneous trades, market abuse, outages and abnormal liquidity. Derivatives business must also identify UK EMIR reporting, mandatory clearing and risk mitigation obligations for uncleared contracts. MiFIR transaction reporting must not be confused with EMIR trade repository reporting.[11] [12] [30]
Shareholders, directors and key personnel
Shareholders and ultimate control chains must be fully disclosed. FCA considers controllers’ integrity, financial soundness, sources of capital injections and influence over the regulated company. Control of MiFID investment firms is generally assessed at the 10%, 20%, 30% and 50% levels, including parent companies, indirect holdings and significant influence; these are not the PSC threshold under Companies House or anti-money laundering beneficial ownership thresholds.[17] [18]
For firms subject to SYSC4.2, at least two independent minds should participate in all significant decisions, rather than having one actual boss and a nominal director with no participation rights. SM&CR is implemented according to Core, Enhanced or Limited Scope classification and specific functions. SMF16, SMF17 and other roles must be determined by the business; every company cannot be required to have a full set of SMF comprising CEO, CFO, CRO and a head of internal audit. Each applicable SMF should have a clear statement of responsibilities and undergo ongoing fitness and propriety assessments.[19] [20]
Compliance and anti-money laundering leads must understand UK rules and customer and product risks, and have access to the board, information and the necessary budget. Outsourced advisers cannot replace management responsibility. There is no uniform UK nationality requirement for directors and responsible persons in this area, nor a uniform statutory experience threshold of “ten years in CEO and five years in compliance”. FCA focuses on competence, experience, time commitment and the ability to perform duties effectively.[4] [20]
UK substance should be proportionate to customer services and risks and enable FCA to supervise UK operations and necessary overseas components effectively. PS26/6 revised the review and reporting processes for SM&CR in stages in 2026. Applications should use the latest rules and forms rather than an outdated fixed document checklist, and should not treat pending second-stage reforms as having already abolished the certification regime.[7] [21]
Capital and financial resources
Personal pensions, SIPP operation and transfer advice require checks of capital, professional indemnity and client asset resources against the actual regulated activities and prudential category. There is no uniform 'pension management licence' capital amount applicable throughout this article. Occupational pensions and the perimeter of The Pensions Regulator require separate confirmation.
Registered office and operational substance
UK applicants should have a designated principal place of business, explain which activities are conducted where in the UK, and provide evidence of substance such as a company bank account. A registered address, mail forwarding or virtual office service alone cannot demonstrate that investment decision-making, compliance oversight and client money management are operating effectively in the UK.[1]
For applications by overseas legal persons, FCA expects a UK establishment or physical presence and assesses the entire legal person and its overseas offices as necessary. There is no universal requirement to rent a large, separate London office, but keeping all key personnel and decision-making overseas while using a UK correspondence address does not establish local substance.[7]
Application document checklist
Company incorporation documents, articles of association or LLP agreement, organisational and ownership charts, ultimate controller details and the regulatory status of affiliated groups. Evidence of capital contributions should be consistent with the shares, capital terms and financial projections, and explain the source of funds or wealth and any proposed financing arrangements.[1] [17]
A regulatory business plan and permissions matrix listing securities, debt, foreign exchange and other derivatives services, client categories, charges and acquisition channels individually. Include descriptions of order execution, custody, settlement and fund flows, and explain intragroup outsourcing, counterparty and key service provider relationships.[1] [2] [3]
Three years of monthly financial forecasts, PMR/FOR and applicable K-factor calculations, liquidity analysis, stress scenarios and an orderly wind-down budget. Explain how funding needs will be met when revenue deteriorates, margin requirements jump and clients withdraw funds, and align the ICARA conclusions with the regulatory reporting basis.[1] [25]
Applicable SMF applications and statements of responsibilities, career histories, competence and integrity assessments, regulatory references and criminal record checks required under current rules are needed. Responsibility maps are primarily determined by applicable rules such as Enhanced; not all directors and controllers should be treated as applicants under the same Form A.[20] [21]
Client agreements, investment management mandates, categorisation and assessment questionnaires, fee and risk disclosures, complaints procedures, financial promotion reviews and product governance documents. Retail CFD must additionally include implementation plans for leverage, close-out, negative balance protection, the proportion of loss-making accounts and the prohibition of trading inducements.[2] [8]
Where client assets are involved, prepare client money account arrangements, bank confirmations, custody agreements, internal records and reconciliation procedures, and allocation of CASS responsibilities. Also clarify the applicability of CASS audits, CMAR and the resolution pack, rather than submitting only a generic 'fund segregation undertaking'.[9] [10]
Trading and reporting system architecture, order records, MiFIR/EMIR reporting arrangements, data security and business continuity plans. Proprietary trading, market-making, algorithmic trading or trading facility models should also have trading limits, shutdown controls, market monitoring and necessary member or client rules.[11] [12] [22] [30]
This is provided as a reference for organising the project; it cannot replace current official application forms or case-specific requests for additional materials. Please do not send identity documents or customer records through website forms.
Application process and key steps
First complete an analysis of regulated activities, financial instruments and exemptions, and select the FCA or PRA/FCA regulatory route. Exclude collective fund management, exchange recognition and ordinary payment and currency exchange activities from MiFID investment permissions where they do not fit, to avoid applying for unnecessary permissions or omitting required ones.[1] [2] [16]
Determine the legal entity and UK substance arrangements, complete due diligence on controllers, directors and the compliance team, and put capital and systems development in place. The FCA pre-application support service PASS may be used where needed, but a pre-application meeting is neither an approval stage required of everyone nor advance regulatory endorsement.[1] [7]
Produce final versions of the business plan, forecasts, policies and application attachments reviewed by management, ensuring they can be implemented from the first day of authorisation. FCA expressly does not review drafts; a plan to refine materials while applying cannot replace the ready, willing and organised standard.[4]
Submit the firm authorisation application, applicable MiFID supplementary information and corresponding individual applications through Connect, and pay the non-refundable application fee appropriate to the business. Most brokerage or corporate finance businesses fall within Category 4; most investment managers, CFD, proprietary trading and custody businesses fall within Category 6; and MTF/OTF falls within Category 8. Confirm against the current permissions-based fee schedule.[1] [28]
FCA assesses permissions, capital, control chains, personnel and operational arrangements, and may raise written questions, request meetings or seek additional evidence. Responses should be complete and meet the actual case deadlines. If the business model changes materially, FCA may require withdrawal and resubmission; it should not be assumed that every round of enquiries automatically pauses the statutory period.[4] [29]
After approval, first check the authorisation effective date, Register record and restrictions on customer and investment types, then commence business within the permission. Register for RegData, establish a reporting calendar and annual fee arrangements, and check whether account-opening, custody and transaction reporting systems are operationally ready; trial operations must not begin without authorisation or outside the approved restrictions.[4] [28]
Approval deadlines and project timelines
Statutory decision deadlines: the current text of section 55V of FSMA2000 checked in this review still requires a complete Part4A application to be determined within six months of receipt of the completed application; an incomplete application must be determined within twelve months of initial receipt. These deadlines govern decisions, not guaranteed approval, do not include the preparation stage, and must not be advertised as automatically stopping the clock whenever additional information is requested.[29]
Accelerated targets: the FCA announcement states that, from 2026-01, performance is measured against new targets of four months for complete applications and ten months for incomplete applications, and describes shorter statutory deadlines as proposed government reforms. Complete VoP closely matching existing models have a separate three-month target, or six months if incomplete; these must not be conflated with the legal text verified in this review as statutory commitments for all investment firms.[31]
Preparation: business perimeter analysis, teams, capital, accounts, financial forecasts and system development should be scheduled separately. Practical projects may allow around three to six months, but this is only a consulting planning range, not a uniform standard published by FCA. Complex retail CFD, client asset, proprietary trading or trading facility projects should allow additional contingency based on actual delivery conditions. Total periods of six to twelve months or nine to eighteen months cannot guarantee an opening date.[1] [4]
Changes to shareholders, directors and permissions
Acquiring or increasing control of a MiFID investment firm, or crossing the 10%, 20%, 30% or 50% thresholds, generally requires prior notification and approval under FSMA178. Parent undertakings, indirect control and significant influence must also be checked. FCA has up to sixty working days from a complete notification to assess it, subject to statutory interruption arrangements for information requests. Reducing a holding into a lower band or ceasing control still requires prior notification, but generally does not require approval for the reduction.[17] [18]
Director changes should distinguish ordinary company registration, applicable prior SMF approval, and notifications of departures or changes in responsibilities. Not every director falls within the same SMF. Non-executive directors who are not SMF may still require fitness, reference and conduct-rule arrangements. Current forms and processes as revised by PS26/6 should be used.[20] [21]
Before adding proprietary trading, client assets, retail clients or new financial instruments, assess whether VoP, removal of restrictions or additional permissions are required, and recalculate capital and systems requirements. Approval of control does not constitute approval of a change in business model, nor does it permit the original company's permission to be transferred to the acquirer's new legal entity. The authorised legal entity remains responsible for ongoing obligations after the acquisition.[4] [17]
Ongoing compliance and annual maintenance
Prudential reporting should submit the MIF series of returns according to the actual RegData schedule and ensure that capital, liquidity and K-factors are consistent with the board-approved ICARA. The FCA data quality review clearly distinguishes quarterly returns from the annual MIF007; monetary data should be entered in thousands of pounds sterling. Ongoing monitoring of capital triggers and business changes is more important than copying an old report once a year.[25]
Transactions subject to Article 26 of UK MiFIR must be reported as soon as possible and no later than the end of the next working day. Scope is determined by the relevant financial instruments and the definition of “executing a transaction”; not all regulated instruments necessarily require reporting. Firms may submit directly to MDP, appoint ARM or have a trading facility report on their behalf, but must still reasonably verify completeness, accuracy and timeliness, and notify and correct errors when discovered. EMIR reporting has separate arrangements for trade repositories, allocation of responsibility and risk mitigation.[11] [12] [30]
Firms holding client money and securities must continuously maintain CASS segregation, bank and custodian due diligence, reconciliations and discrepancy resolution, and arrange independent client asset audits under the applicable rules. For CASS medium and large firms, CMAR is a monthly return submitted through RegData within fifteen business days of the reporting period end. Financial statement audits and CASS audits are not the same report, and RMAR cannot be treated as a universal audit return for all MiFID firms.[9] [10]
Anti-money laundering controls should include institutional and customer risk assessments, customer and beneficial owner verification, sanctions screening, handling of high-risk cases or PEP, and ongoing transaction monitoring. Suspected money laundering should be reported to NCA through appropriate procedures, whereas STOR for suspicious market transactions and orders are market abuse reports under FCA. The two should not be described as the same notification.[11] [32] [41] [42]
Regularly maintain customer categorisation, suitability or appropriateness, product target markets, execution quality, promotional materials, complaints and staff responsibility arrangements, and pay current regulatory fees and applicable levies. For applicable retail business, Consumer Duty outcomes must also be monitored; FSCS investment compensation may be up to £85,000 per eligible person per failed institution, but does not compensate for poor market performance or automatically protect every product.[20] [28] [33]
Acquisition due diligence and transaction considerations
Before acquisition, first verify the authorised legal entity's FRN, current permissions, restrictions on customer and investment types, client money eligibility and any requirements, rather than relying solely on the seller's “FCA licence certificate”. Obtain FCA correspondence, requests for additional information or remediation, historical VoP and Section 178 information, and confirm that sufficient UK substance and qualified responsible personnel will remain after group restructuring or a change of business.[4] [17]
For securities and CFD acquisition targets, conduct targeted sample checks on the basis for opting clients up to professional status, leverage and close-out execution, negative balance protection costs, connected liquidity providers and allocation of trading losses. Also reconcile front-office trades against MiFIR reporting, review EMIR mandates and historical late reporting, complaints and potential compensation; do not verify only current account net assets or normal trading volumes.[8] [11] [12] [30]
Where client assets are held, independently verify bank and custody balances, reconciliation discrepancies, account confirmations, CASS audit deficiencies and legal opinions on client asset ownership, and check the operational feasibility of returning funds on exit. Capital due diligence must recalculate PMR, FOR, K-factors, ICARA wind-down costs and post-acquisition-financing cash flows. Client money or assets intended to be extracted from the target cannot serve as acquisition financing freely available to the buyer.[9] [10] [25]
Transaction documents should make applicable change-in-control approval, key personnel and permission arrangements conditions precedent to completion, and allocate responsibility for historical CASS, misreporting, mis-selling and complaints. Trading shares in an authorised legal entity does not mean “free transfer of the licence”. New services and customer types still require the necessary separate permissions. Shell, dormant or long-unused-permission targets cannot be guaranteed exemption from regulatory reassessment.[4] [17]
View the complete process for acquiring a licensed companyBusiness segments and applicable regimes
The following are specific permissions, organisational models or statutory categories covered by this topic. They do not necessarily each constitute a separate financial licence.
Frequently asked questions
Does the UK have a single comprehensive licence for securities and foreign exchange?+
No. Authorisation must specify the activities, financial instruments, clients and restrictions. CFD dealing as principal, securities execution as agent and portfolio management may require different permissions, while holding client assets also changes capital and operational requirements.[1] [14]
Is the minimum capital £75,000 or €75,000?+
The MIFIDPRU capital table in this topic is in sterling. £75,000 is only the PMR for specific activities that do not trigger a higher tier. Holding client money or assets, dealing on own account or underwriting, trading facilities, targeted support and fund depositary activities may trigger higher amounts. Ongoing capital must also take account of FOR, K-factors and ICARA.[13] [14] [25]
Can STP or fully hedged CFD dealers operate solely under £75,000?+
The decision cannot be based solely on the STP label or evidence of hedging. Where a legal entity acts as principal counterparty to clients and has permission to deal on own account, this generally triggers £750,000 PMR. The actual legal trading relationship and permission restrictions must be checked, rather than whether net market risk is retained.[14] [35]
Is SNI simply a small company with capital below a certain amount?+
No. SNI must meet all conditions in MIFIDPRU1.2 simultaneously. These principally include AUM below £1.2 billion, cash COH below £100 million per day and derivatives below £1 billion per day, zero ASA and CMH, total on- and off-balance-sheet amounts below £100 million, and two-year average annual gross investment income below £30 million. It must also not hold the specified proprietary trading or firm-commitment underwriting permissions or trigger the clearing, DTF or depositary exclusion conditions.[5]
Is spot foreign exchange entirely unregulated?+
Genuine spot exchange may fall outside MiFID derivatives, but settlement and genuine exchange conditions must be verified; forwards for payment purposes may also be excluded only if strict conditions are met. Rolling leveraged foreign exchange and cash settlement without actual delivery cannot be excluded merely by being called spot, while ordinary currency exchange or payments may also engage other regimes.[8] [34]
Has the statutory time limit for a complete application changed to four months?+
The current text of FSMA55V obtained in this review still states six months for complete applications and twelve months for incomplete applications. FCA has adopted accelerated targets of four and ten months from 2026; proposed statutory reforms in announcements cannot replace the verified legislative text, and time limits do not guarantee approval.[29] [31]
Does every question from FCA stop the approval clock?+
Ordinary Part 4A authorisation cannot be characterised in this way; this claim in the original guide has no verified statutory support. Change-in-control notifications have a separately defined mechanism for interrupting the assessment period in connection with information requests, which should not be applied to all authorisation applications. Applicants must still respond promptly within the actual deadlines for their case.[4] [17] [29]
Are two British executive directors and a compliance officer with five years' experience mandatory?+
There are no uniform nationality or years-of-experience thresholds of the kind described above for this topic. The two-person effective management rule focuses on two independent minds participating in major decisions. SMF, compliance and anti-money laundering arrangements must be configured according to the firm’s size, permissions and actual capabilities; a list of positions cannot be applied mechanically.[19] [20]
Must an overseas company establish a UK Ltd rather than a branch?+
No. FCA expressly allows international institutions to use UK- or overseas-incorporated legal entities and expects a UK establishment or physical presence. Effective supervision and risk mitigation should be demonstrated. Resources and prudential applicability for a UK entity, LLP or an overseas branch require separate analysis.[1] [7]
Does placing all client assets with a third party remove the need for CASS?+
Not necessarily. This depends on the contracts, asset ownership and the applicant legal entity’s actual custody, control and instruction powers. Clients contracting directly with an independent custodian may reduce certain obligations, but outsourcing the firm’s own custody does not remove responsibility. CASS and permissions must be checked individually.[2] [9]
How do CASS monthly reporting and annual audits differ?+
For CASS medium and large firms, CMAR is submitted monthly, normally through RegData within fifteen business days after the reporting period ends. Independent CASS audits and financial statement audits each have applicable requirements; monthly CMAR, annual MIF007 and company audits must not be conflated into a single RMAR report.[10] [25]
Must transaction reports be submitted to ARM?+
No. UK MiFIR allows investment firms to submit directly to MDP, or through ARM or a trading facility. Firms must first identify reportable instruments and transactions and reasonably check data submitted on their behalf. Applicable transactions must be submitted by the end of the next working day at the latest; not all investment activities uniformly generate reports.[11] [12]
Does the UK still require publication of RTS27 and RTS28 best execution reports?+
The UK removed these two reporting requirements from 2021-12-01. Best execution policies, monitoring and client protection obligations were not removed as a result; evidence of trades and execution venues is still required to demonstrate that business processes are effective.[23]
Can you change the business immediately after buying an authorised company?+
No. First confirm whether change-in-control approval, current permissions, personnel and restrictions cover the new model. Changing ordinary securities arranging business to retail CFD dealing as principal or custody may require VoP, higher capital, customer protection and system upgrades. Acquisition approval is not blanket authorisation for all changes.[4] [14] [17]
Does FCA authorisation mean that all customer losses are eligible for FSCS compensation?+
No. Where an institution fails and the client, service and other conditions are met, investment compensation may be up to £85,000 per eligible person per institution. Falling market prices and poor investment performance are not covered. Certain crypto ETN to which FCA permits retail access are also expressly without FSCS protection.[33] [36]
Can retail binary options or crypto derivatives be sold after obtaining FCA investment permission?+
This does not establish that sales are permitted. The sale, marketing and distribution of binary options to retail customers in or from the UK are permanently banned. The measures by 2025-10-08 opening access to certain qualifying crypto ETN retained the retail crypto derivatives ban; the two products must not be confused.[36] [37]
Does UK authorisation still automatically allow service to all EU clients?+
It cannot restore the pre-Brexit EU passport. Overseas client business should be checked against target-market rules and any genuinely applicable cross-border arrangements. The NPPR for marketing AIF is not a universal passport for all MiFID investment services either.[7]
Does targeted support introduced in 2026 fall within existing investment advice permissions?+
It requires a separate permission for the relevant activity, but is not a new general trading licence. The regime targets groups of consumers with shared characteristics and takes effect on 2026-04-06. The MIFIDPRU capital table lists £500,000 PMR for the relevant permission; the applicant's overall prudential category should still be verified.[14] [38]
Official basis and verification sources
Primarily based on FCA, PRA / Bank of England, GOV.UK and current legislation. Older third-party guides supplied by users are used to organise business material and do not override the latest official requirements.
Tang Shangyong (Mr Tang / Drew) · Business Manager
Global financial licence application, transaction and ongoing compliance services