Lending money, brokering credit, accepting deposits, issuing e-money, processing payments, arranging mortgages, these are all separate regulated activities with their own authorisation routes. Conflating them is one of the fastest ways to submit an application that goes nowhere.
Operating without the right permission carries real consequences:
- Unauthorised business carries criminal and civil exposure under the Financial Services and Markets Act
- Enforcement action can include fines, public censure and forced wind-down
- Customers lose statutory protections, creating reputational and legal fallout
- Incomplete applications can stretch review periods from months into a year or more
This guide walks through identifying your regulated activity, choosing the right regulator and route, preparing a credible application, surviving the review process, and building compliance that holds up after approval. Rules and fees change often, so always check the current position against FCA, PRA and GOV.UK sources before you act.
Key Takeaways
- Most non-bank finance firms are regulated by the FCA; deposit-taking also involves the PRA and Bank of England
- Companies House incorporation creates a legal entity, not permission to conduct regulated business
- Strong applications need a credible business plan, suitable management, AML controls and customer protections
- Confirm your exact permission before marketing, onboarding customers, or touching client funds
Which UK Authorisation Does Your Finance Business Need?
Three different things get conflated constantly: a regulated activity (what you do), an authorisation (permission from a regulator to do it), and a business structure (how your company is legally organised).
Registering a limited company, LLP or branch with Companies House gives you a legal vehicle. It says nothing about whether you're permitted to lend money, broker credit, or handle client funds. Those are separate questions answered by the FCA or PRA, not by company registration.
Consumer Credit and Payments Routes
The FCA's PERG guidance on regulated activities sets out the specific activities requiring permission, rather than one blanket licence:
- Consumer credit lending or broking — lending, exercising lender rights, credit broking, debt adjusting and debt counselling each sits under a different permission category
- Payment services and e-money — API/SPI or AEMI/SEMI routes apply by volume; small PIs average under €3 million monthly, small EMIs under €5 million outstanding e-money
- Mortgages — entering into, administering, arranging or advising on regulated mortgage contracts each needs its own permission
- Investments, insurance and debt management — separate FCA permission categories entirely
When PRA and Bank of England Involvement Applies
If your model involves accepting deposits — operating as a bank — you're in different territory. New bank applications go through the Bank of England's New Bank Start-Up Unit; the PRA assesses and decides, but needs FCA consent.
There is also a "mobilisation" route: authorisation with restrictions while you build full operational capability.
A few other registrations matter depending on your activity:
- HMRC MSB supervision — currency exchange, money transmission and cheque cashing; FCA-supervised payment firms do not need a duplicate HMRC registration for the same activity
- Cryptoasset registration — required under the Money Laundering Regulations before trading; a broader FSMA regime began accepting applications from 30 September 2026
Before assuming you know your category, check PERG guidance directly. The FCA's Firm Checker tool only verifies whether an existing firm holds permission; it does not tell a prospective applicant what permission to apply for. That distinction trips up a surprising number of founders.
Appointed Representative and Partnership Models
Operating as an appointed representative (AR) of an already-authorised principal firm lets you conduct business within the scope of that principal's permissions. The principal takes on responsibility for your conduct and must actively control and monitor you.
This isn't a loophole around authorisation. It's a different compliance relationship, with real limits on what activities you can perform and real oversight obligations resting on your principal. For some early-stage models it's a legitimate commercial path; for others it simply delays the inevitable need for your own permission.
Requirements and Documents for a UK Finance Company Licence
Regulators assess suitability across several dimensions at once: business model, financial viability, governance, ownership, controllers, senior management, and operational capability to treat customers fairly. None of these stands alone—weakness in one area can stall the whole application.
Building the Business Plan
Your business plan needs to answer, in concrete detail, not generalities:
- Products offered and customers served
- Distribution channels and geographic scope
- Revenue model and pricing structure
- The customer journey, start to finish
- Projected transaction volumes and financial forecasts
- Expected funding sources The FCA expects three years of forecasts, with income statement, balance sheet, cash-flow statement and the assumptions behind them. Vague projections, or numbers that don't reconcile against staffing and operational capacity, are a common reason for stalled reviews.
Management, Ownership and Fitness
Document directors' and controllers' identities, relevant experience, and fitness-and-propriety information covering honesty, competence and financial soundness. Core items typically include:
- Identity and ownership details for directors and controllers
- Experience evidence tied to the proposed regulated activities
- Fitness-and-propriety information (honesty, competence, financial soundness) For firms within the Senior Managers and Certification Regime, this also covers approved senior management functions, certification of other staff, and adherence to the Conduct Rules.
The Compliance Framework
This is where applications most often fall short. Regulators want to see documented systems, not just policy statements:
- AML and CTF controls — risk assessment, customer due diligence, sanctions screening, suspicious activity escalation, record-keeping
- Consumer protection — affordability checks, responsible-lending controls, complaints handling, vulnerable-customer procedures, financial promotions review
- Governance and risk management — internal audit, data protection, information security, incident response, regulatory reporting Firms holding customer money face an additional layer: safeguarding. Under the Payment Services Regulations 2017 and Electronic Money Regulations 2011, relevant funds must be protected through segregation or qualifying insurance. That protection is mandatory for authorised payment and e-money institutions, and optional (but expected) for small payment institutions. Operational resilience sits alongside these controls. Cover at least:
- Business continuity and disaster recovery
- Outsourcing oversight
- A credible wind-down plan for exiting without customer harm
Building this file from scratch while running a startup is where many founders stall. VJM Global can support the commercial side of the pack—accounting records, financial forecasts, tax structuring and cross-border business planning. Regulatory legal advice and the FCA or PRA authorisation decision stay with separate specialist advisers.
How to Apply and Prepare for FCA or PRA Assessment
Think of this as a staged build, not a single submission event:
- Define your regulated activities precisely — match the permission category to what you'll actually do, not what sounds closest
- Structure the applicant entity correctly — incorporate or restructure so ownership and control lines are clean
- Appoint responsible personnel — senior managers and certified staff who meet fitness-and-propriety standards
- Build policies and systems — AML, consumer protection, governance, and resilience frameworks, operational before you submit
- Gather supporting evidence — forecasts, contracts, technology descriptions, controller information
- Submit and respond — through the FCA's Connect portal or the PRA's equivalent process, then answer follow-up questions promptly
Accuracy matters more than polish. Permissions requested have to match the business model described. If your forecasts assume 10,000 customers in year one but your staffing plan covers a team of three, expect questions.
What Happens After You Submit
The FCA reviews submissions for completeness before substantive assessment begins. A complete FSMA application is typically assessed within 6 months; a complete payments or e-money application within 3 months. An incomplete one can stretch to 12 months. The PRA applies similar statutory limits for new bank applications.
Expect interim steps:
- Acknowledgement and an initial completeness check
- Substantive questions from your case officer
- Possible requests for revised documents or additional evidence
- Interviews or meetings for more complex models
If your business model changes mid-review — for example, a shift in target market or funding source — tell the regulator. Withholding that information is treated far more harshly than disclosing it.
Common Reasons Applications Stall
The FCA's own published examples point to recurring, avoidable problems:
- Unclear or shifting description of the regulated activity
- Forecasts that don't hold up against resourcing plans
- Insufficient capital or working resources
- Weak or template AML controls that don't reflect the actual business
- Controllers or senior managers with unresolved fitness concerns
- Heavy reliance on outsourced providers without clear oversight arrangements
Don't start regulated activity before permission is granted, and verify current fees, forms and service standards directly with the FCA or PRA before you submit — requirements change.
Costs, Timelines and Ongoing Obligations After Approval
Costs fall into several categories. What you pay depends on the permission you apply for:
| Cost Category | What It Covers |
|---|---|
| Application fees | FCA or PRA charges, tied to permission category |
| Professional advice | Legal, regulatory and accounting support |
| Capital/liquidity | Minimum and ongoing prudential requirements |
| Compliance infrastructure | Staff, technology, monitoring systems |
| Insurance and audit | Professional indemnity, statutory audit |
| Safeguarding and reporting | Fund protection, periodic regulatory returns |
The FCA's fee categories run from roughly £280 at the lowest tier to £11,260 at the highest, set by the permission type you request. A new bank application carries a combined PRA and FCA fee of £56,300.
Initial capital for payment and e-money firms varies sharply: no minimum for account-information-only services, up to €350,000 for an authorised e-money institution.
Timelines Aren't Fixed
Resist the urge to promise yourself (or investors) a specific approval date. Timing depends on:
- The authorisation type you're pursuing
- How complete and internally consistent your application is
- Business model complexity
- How many rounds of regulator questions follow
A clean, well-prepared payments application can move through in months. A messy one, with gaps in ownership disclosure or inconsistent forecasts, can take considerably longer.
Life After Approval
Authorisation isn't the finish line. Post-approval obligations run continuously:
- Keep permissions current and meet ongoing prudential requirements
- File regulatory returns on the relevant schedule
- Monitor financial promotions for compliance
- Run complaints through a documented process
- Protect customer funds under safeguarding rules
- Notify the regulator of material changes to the business
- Review AML and risk controls as the business grows
You need accurate accounting and management information in place from day one, not retrofitted after launch. VJM Global's accounting, tax and reporting support helps UK founders keep that financial visibility as they scale. It complements—and never replaces—the regulated compliance oversight your authorisation requires.
Frequently Asked Questions
Do I need a licence to start a finance company in the UK?
It depends entirely on your activities. Regulated lending, credit broking, payments, e-money, mortgages and deposit-taking all require specific FCA or PRA permission, while general business services don't.
Who regulates finance companies in the UK?
The FCA regulates most non-bank finance activities, while the PRA and Bank of England oversee deposit-taking and other prudentially significant firms. The right regulator depends on your specific activity and firm type.
How much capital is needed to start a finance company in the UK?
Capital requirements vary enormously by authorisation type and business model, from no minimum for some payment services to €350,000 for e-money institutions. Always verify current thresholds directly with the FCA or PRA.
How long does FCA authorisation take?
The FCA typically assesses complete applications within 3 to 6 months depending on the permission sought, though incomplete submissions can take up to 12 months. Complexity and the number of follow-up questions also affect timing.
Can a foreign company apply for a UK finance licence?
Yes, using a UK or overseas-incorporated entity, but the FCA expects genuine UK establishment and the ability to supervise the whole firm effectively, including day-to-day oversight of compliance and AML functions.
What is the difference between FCA authorisation and a consumer credit licence?
There's no single "consumer credit licence" anymore; the FCA replaced the old OFT licensing system in 2014 with specific permission categories. The exact permission you need depends on which credit activities your firm actually performs.
