HMRC Trust or Company Service Providers (TCSP): AML SupervisionGuide to applications and ongoing compliance

Includes forming legal entities, selling shelf companies, providing company addresses or virtual offices, and arranging directors, secretaries, partners, trustees or nominee shareholders. Exclusions may apply to activities such as solely renting physical office space, ordinary recruitment services or certain low-risk trusts, subject to the specific conditions listed in official guidance.[30]

Select the minimum sufficient combination of permissions that lawfully supports the actual business, client scope and financial responsibilities, rather than treating the broadest permissions or fastest approval as the sole objective.

• Precise route selection avoids incorrectly applying as a full-service payment institution for a business providing only account information, or misdescribing ancillary credit reporting services as securities credit ratings. Applications should cover only activities genuinely ready to be undertaken; business expansion still requires a separate assessment of the necessary permissions.[3] [26] [41]

• Specialist regimes can offer different access routes for suitable businesses. For example, non-significant benchmark administrators may meet registration conditions, and AR may carry out specified activities under written responsibility arrangements with an eligible principal. A lighter route does not mean exemption from supervision or automatically confer market access outside the UK.[11] [24]

• Including customer data, transaction records, complaints and exit resources in market-entry planning helps identify actual responsibilities in partnerships and acquisitions. For exchanges and repositories, system continuity, record portability and financial resources are equally critical conditions for ongoing operation.[7] [13] [18]

Relevant businesses not supervised by another eligible supervisor must register with HMRC and pass the BOOM fitness and propriety test, and must not operate before successful registration is confirmed. Where FCA or a professional supervisory body actually provides AML supervision, do not apply again for HMRC supervision; details of professionally supervised TCSP are still passed to HMRC for record-keeping.[30] [31]

Shareholders: disclose direct and indirect holders, ultimate controllers, voting rights and joint acquisition arrangements, and retain evidence of sources of funds. For firms subject to the FSMA control regime, a proposed acquisition or increase of control generally requires prior notification and approval; registration, recognition and AML regimes must be checked separately. There is no rule uniformly making a 10% holding the sole approval threshold for all specialist institutions.[39]

Directors and management: FCA examines integrity, competence, time commitment and disclosure history, but not every director requires the same Form A or SMF approval. RAISP must register members of the management board, persons managing the registered business and relevant management officers, and notify changes to responsible persons in advance. RIE, benchmarks and repositories are assessed under their respective governance and fitness rules; it should not be asserted that the full SM&CR applies universally.[3] [7] [11] [18]

Compliance and anti-money laundering: there must be a responsible person capable of overseeing the actual business, with reporting lines, resources, conflicts from combined roles and outsourcing arrangements explained. The MSB/TCSP application to HMRC must list all applicable BOOM, namely beneficial owners, officers and managers, who are subject to fitness and propriety testing. Whether a specific MLRO or individual regulatory approval is required depends on the actual business, the applicability of MLR and the corresponding regime, rather than a blanket rule based on FCA registration status.[1] [31] [33]

Local substance: explain how UK services are actually managed, identifying contactable management personnel, methods of accessing records and the locations of key systems. Overseas personnel are not automatically ineligible, but FCA requires an explanation of how they perform their duties remotely and are supervised. A UK registered address, a consultant's office or nominee directors cannot replace genuine management capability, and this topic specifies neither a uniform number of directors of UK nationality nor a uniform minimum headcount.[1] [18]

There is no general initial capital threshold for TCSP AML supervision. Fees and resources for meeting liabilities should be budgeted separately. The HMRC application fee of £300, annual premises fee of £400 and applicable personnel test fee of £500 are not capital. Company formation agent status must not be described as a full-permission FCA trust management licence.[32]

Provide the entity's genuine registered address, business locations, the responsible person's contact address and the location where the regulator can access records, and explain the division of UK and overseas operations. HMRC must register all premises where supervised activities are carried out; purely online businesses cannot disregard entity addresses and operating premises on the grounds that they have no physical shop. Repositories should disclose the primary site, backup technical locations and business continuity arrangements, rather than providing only a mailbox.[18] [31] [33]

Ren Gang Yong Sheng’s Hong Kong or Shenzhen office addresses are consultancy contact details, not the applicant’s UK registered office. TCSP provision of company registered addresses or virtual office services may itself constitute business requiring AML supervision; a client’s rental of physical space and the provision of address forwarding services have different legal classifications. When proposing a shared office, accurately explain the available space, access to records and managers’ performance of their duties; do not promise that a particular address will necessarily be accepted by the regulator.[30]

• Entity and ownership documents: submit evidence of formation, articles or partnership agreements, registered and business addresses, a group chart, an explanation of control and evidence of sources of funds according to the actual legal form. Overseas recognition applications also require information on home-country law, supervisory status and regulatory cooperation; a UK incorporation certificate alone is insufficient.[1] [9] [33]

• Business and permissions statement: provide an item-by-item mapping of specific products, service processes, customer locations, charging methods and proposed activities. CMC must specify which of the seven permissions are actually needed; for AR, the principal must document the activities and allocation of responsibilities; for Benchmark, explain the administrator and benchmark classifications.[19] [20] [24] [11]

• Personnel materials: submit curricula vitae for directors and those responsible for the business, suitability disclosures, allocation of responsibilities and explanations of time commitments, using the personal forms specified for the regime. RAISP and HMRC BOOM materials differ from FSMA SMF applications. All previous refusals, regulatory sanctions and other relevant facts should be disclosed honestly.[1] [3] [31]

• Financial and insurance documentation: submit substantiated forecasts, existing financial statements, capital calculations, funding commitments and wind-down resource arrangements. For RAISP, include evidence of professional indemnity insurance or a comparable guarantee; for CMC, include calculations of categorised income, adjusted expenses and additional client money requirements. Bank balance screenshots alone cannot replace the entire financial plan.[4] [22] [18]

• Systems and operational materials: submit architecture, data security, account consent or data reporting processes, exception remediation, business continuity testing and outsourcing contracts. RIE additionally requires trading rules, membership and market surveillance arrangements; TR additionally requires regulatory data access, record retention and migration procedures. The same generic IT description cannot substitute for these.[7] [13] [18]

• Consumer and AML information: submit customer terms, sample advertising and charges, complaints processes, error-correction procedures and the applicable client money regime according to the business. Before HMRC registration, complete money laundering, terrorist financing and proliferation financing risk assessments and implement policies and controls; separately list premises and BOOM. Firms for which FCA is the lead authority must also prepare arrangements for AR supervision and annual data reporting.[19] [26] [31] [25]

This is provided as a reference for organising the project; it cannot replace current official application forms or case-specific requests for additional materials. Please do not send identity documents or customer records through website forms.

• First, determine the legal perimeter and competent authority classification, checking whether the activities require regulatory admission and whether an exclusion or valid exemption exists. Confirm which parts fall respectively to FCA, HMRC, professional supervisory bodies and the Bank of England, rather than treating one registration as a substitute for all business qualifications.[1] [29] [30] [36]

• Second, put the entity, governance, funding and production systems in place, and prepare signed final documents. Pre-application discussions may be sought on complex matters, but consultant advice, PASS feedback or regulatory innovation support does not amount to formal permission to operate.[1] [39]

• Third, submit through the designated channel and pay the applicable fees, rather than uploading everything to Connect. Ordinary FCA authorisation, RAISP and many Benchmark activities use Connect. The current TR page requires technical standards information to be submitted by email and prior contact with the TR supervisory team. HMRC uses its own AML online service, while AR is notified by the lead authority.[1] [3] [10] [13] [31] [24]

• Step four: respond to the completeness review and supplementary questions, maintaining version and evidence consistency. Repository and benchmark regimes have separate completeness clocks; applicants cannot continue claiming to be within the complete-application decision period while supplying missing information. If FCA finds that an application is not actually ready, it may require withdrawal and resubmission rather than guarantee approval through supplementary submissions.[1] [11] [14] [16]

• Step five: undergo assessment of the business, personnel, resources and systems, attending interviews and demonstrating controls in operation where necessary. The approval notice should specify the start date, activities and restrictions, and must be read together with the register. For AR, the principal agreement, appointment notice and registration information must also be consistent; business cannot commence solely on the basis of FRN or a website screenshot.[1] [24]

• Step six: establish a calendar for ongoing reporting, information updates, fees and incident escalation, and reassess before adding activities, changing management or making an acquisition. Business exit also requires addressing customers, data, funds and outstanding complaints, and obtaining deregistration or an exit outcome under the relevant regime. Selling physical assets is not the same as acquiring shares in a regulated entity; status does not transfer automatically by contractual agreement.[13] [25] [31] [39]

Ordinary Part 4A authorisation under FSMA: current section 55V requires a decision within six months of receipt of a complete application; an incomplete application must be decided within twelve months of initial receipt. CMC and other firms covered by this topic using the ordinary Part 4A route should start from this statutory framework, but it cannot be applied to categories governed by separate statutory provisions. These are deadlines for decisions, not guaranteed approvals; preparation, withdrawal and resubmission, and acquisition completion arrangements must be accounted for separately.[2]

RAISP: regulation 19 of PSR applies regulations 7 to 12 to registration, so the framework in regulation 9 of three months for complete applications and twelve months from receipt for incomplete applications also applies. From 2026, FCA adopts faster voluntary targets for payments and electronic money business of three months for complete applications and ten months for incomplete applications, but the current legislation still specifies three and twelve months. Neither the ten-month target nor the three-to-six-month estimate in the appendix can be treated as a statutory guarantee.[5] [6] [40]

Benchmark: Article 34 of UK BMR requires a completeness check within fifteen business days of receipt of an application; where additional information is requested, that completeness-check period applies from its submission. Complete authorisation applications are decided within four months, and complete registration applications within forty-five business days; third-country recognition and endorsement each have a ninety-business-day processing framework. There is no universally applicable twelve-month limit for incomplete applications in this category; time limits must be calculated under each relevant BMR procedure.[10] [11]

TR: Article 56 of UK EMIR and Article 5 of UK SFTR provide for a twenty-working-day completeness check. Incomplete applications require supplementary information as requested by the regulator. Following notification of completeness, Article 58 of EMIR and Article 7 of SFTR provide for a decision within forty working days; a SFTR decision takes effect on the fifth working day after it is made. Document preparation, supplementary submissions and launch testing are not included in this forty-working-day commitment, and there is no general rule guaranteeing approval in three to six months.[14] [15] [16] [17]

RIE: section 290 of FSMA requires a decision within six months on a complete recognition application by a UK investment exchange and expressly states that this six-month limit does not apply to overseas applicants. FCA requires a complete ROIE application to be submitted at least six months before the proposed effective date of recognition. This is an advance preparation requirement, not a statutory guarantee of overseas recognition approval within six months. Relevant fees are also an important part of a complete application.[8] [9]

HMRC: official guidance states that reviewing a new AML supervision application may take up to forty-five days, or longer if additional documents, payment or account updates are required. This is not a statutory forty-five-day cap distinguishing complete from incomplete applications. For AR appointments, the principal institution must notify FCA at least thirty calendar days in advance; contractual, fitness and propriety, and necessary personnel arrangements are also required. Thirty days does not mean that a standalone AR licence application is automatically approved. CCP and CSD should prepare timetables under central bank procedures and their respective specific legislation, rather than import the ordinary FCA authorisation clock.[31] [24] [36] [38]

Preparation should be estimated separately according to business complexity, key recruitment, insurance arrangements, data contracts and system testing. There is no regulator-prescribed general period of one to three months. FCA announced that, from 2026, performance would be measured against proposed faster general targets of four months for complete applications and ten months for incomplete applications. However, that announcement coexists with the current six- and twelve-month periods in Article 55V; it must not be described as a fully implemented legal change before legal commencement is confirmed. Website schedules should describe preparation, completeness review, the statutory decision period and commercial launch in separate columns.[1] [2] [40]

Control: an acquirer subject to FSMA Part XII must notify the regulator after deciding to acquire or increase control and obtain approval before completion; FCA has sixty working days to assess the notification from the date it is deemed complete, excluding any lawful interruption for further information. A decrease in control may also require notification, but usually not the same prior approval procedure. For RAISP, RIE, TR, Benchmark and HMRC AML entities, a standard section 178 template alone cannot establish that transaction requirements are identical; each specific legislative regime and the entity’s current permissions must be checked.[39]

Directors and responsible persons: appointments subject to SMF must follow its approval procedures. Falling outside SMF does not mean governance information need not be updated. RAISP must give advance notification of changes to persons responsible for registered services. Changes to HMRC BOOM should be reflected in registration and fitness information; amendments following material changes to registered information or discovery of errors generally must be provided within thirty days. Companies House director filings cannot replace financial regulatory notifications.[3] [33]

Changes to AR: the principal must notify proposed changes to regulated activities at least ten calendar days in advance; other changes to AR information must be notified within ten business days after the change. Changing principal, adding another principal or terminating a relationship requires a review of responsibility allocation and customer arrangements; existing contracts and status must not be assumed to continue automatically following an acquisition. Where the principal undertakes regulatory hosting, the FCA page specifies a separate sixty-day advance notification requirement.[25]

Business and AML changes: new payment services, expansion of TR across EMIR/SFTR, material changes to Benchmark arrangements and additional CMC permissions must follow their respective procedures. Applicable FSMA firms supervised by FCA AML remain subject to a twenty-eight-day notification requirement when starting or ceasing MSB/TCSP. Article 23 of the MLR in force in 2026 separately requires updates within thirty days of material changes or errors in reported information. The twenty-eight-day commencement or cessation notification and the thirty-day information update are not interchangeable deadlines.[13] [11] [34]

Continue maintaining risk assessments, customer and beneficiary due diligence, records, annual declarations and fees. As of the verification date, FCA states that the future professional services AML takeover is expected to begin in autumn 2028 and finish around 2030, subject to legislation. Obligations remain owed to existing supervisors; do not advertise that all TCSP has already transferred to FCA.[30] [31] [35]

First verify the acquisition target’s actual status, permitted activities, restrictions, legal basis for registration or recognition, and whether the same group has multiple FRN or legal entities. Buying a shell company with a registration record does not mean acquiring all the seller group’s qualifications or entitlement to conduct new financial activities. Completion conditions should cover change-of-control consent, personnel arrangements, continuity of systems and client contracts, and notifications required by the competent authority.[1] [39]

Specialist due diligence for AR focuses on the principal agreement, the principal's permissions and willingness to continue accepting responsibility, historical REP025, supervisory reviews and outstanding complaints. For RAISP, the focus is data access consent, interfaces and certificates, PII coverage, responsible personnel and any undisclosed payment initiation activity. Credit information firms should also check the transferability of data contracts, promises to delete errors, privacy and complaint risks. Technology contracts, insurance and principal relationships may all require renewed consent following a change in control; transactions should not be priced and completed solely by reference to the licence.[3] [24] [25] [26]

For RIE, Benchmark and TR, additionally verify market or benchmark methodologies, intellectual property rights, member or data provider agreements, integrity controls, business continuity and historical regulatory issues. Separately check the registration coverage of TR under EMIR/SFTR and test record migration and exit plans. For CMC, sample-check customer authorisations, lead sources, advertising, fee restrictions and historical compensation liabilities. The record of client money held by CMC over the preceding twelve months affects post-acquisition capital budgeting; a book position of “zero client money” does not exclude this additional requirement.[13] [18] [19] [22]

MSB/TCSP should verify the actual AML supervisor, all BOOM, each operating location, annual fee declarations and past enforcement records. A legal entity's asset transaction may require the buyer to register afresh. FMI projects also involve central bank recognition, designation and continuity of system services; ordinary FCA change-in-control approval cannot be treated as clearance for completion of every infrastructure transaction. A brand's claimed network, historical success rate or regulatory “fast track” is not a transferable asset or evidence of official endorsement.[29] [30] [31] [36]

The following are specific permissions, organisational models or statutory categories covered by this topic. They do not necessarily each constitute a separate financial licence.

Primarily based on FCA, PRA / Bank of England, GOV.UK and current legislation. Older third-party guides supplied by users are used to organise business material and do not override the latest official requirements.

Information compiled by: RenGang Yongsheng (Hong Kong) Limited

Tang Shangyong (Mr Tang / Drew) · Business Manager
Global financial licence application, transaction and ongoing compliance services

Contact the author and enquire about projects