Getting to Market: How Financial Services Authorisation Actually Works in the UK

Most businesses that want to offer financial services in the UK reach the same question at roughly the same point. The commercial model is settled, the funding is in place, and then someone asks whether the firm needs to be authorised. That question is usually asked too late.

The UK does not operate a light touch registration system, and it does not operate a single one either. There is no general financial services licence. Instead, there are a number of regimes, each with its own prohibition on doing the work without permission, its own gateway and its own rulebook. This article uses three of the most common as its examples: the regime under the Financial Services and Markets Act 2000, the payment services regime and the e-money regime. They are not the only ones, and part of the exercise below is working out which of them, or which others, apply to a given business.

What the regimes have in common is the consequence of getting it wrong. Each of them prohibits the activity unless the firm is authorised, registered or exempt, and under each of them carrying on the business without permission is a criminal offence. Customers who lose money have a right of action against the firm, and the regulator can require it to pay back what it has received. The contracts themselves are also at risk. Under the Financial Services and Markets Act an agreement made in the course of a breach cannot be enforced against the customer, who may be entitled to recover money paid under it, and a payments or e-money business that has contracted unlawfully cannot safely assume its agreements will stand either. A firm that gets this wrong does not simply have a regulatory problem. Its senior people are exposed to prosecution, and it may find that its entire book of contracts is worth nothing.

Step One: Work Out What You Are Actually Doing

The first exercise is to describe the business as a set of activities rather than as a product. What the customer experiences as one service often involves several distinct regulated activities, and they will not all sit in the same place.

Three questions then run across every regime. Is the activity on the relevant list of regulated activities or services? Is it carried on by way of business? Is it carried on in the UK, or provided into the UK from abroad? A business incorporated overseas but dealing with UK customers is very often inside the perimeter, whatever its constitutional documents say.

None of the lists reads the way a commercial team would describe the business, and small differences change the answer. Who holds the money, at what point it moves, and what the firm is contractually promising will often decide whether an activity is regulated at all. This is where the money is saved or lost, because a change to a product, a customer journey or a contractual structure can take a business outside the perimeter, or turn one permission into three. Advertising and marketing are restricted separately, and how a firm promotes itself needs its own analysis whatever regime the underlying business sits in.

Step Two: Identify the Gateway

Once you know what the activities are, you can identify which regime governs each of them and which authorisation is needed. The three below account for most of the businesses we see, and they show how differently the regimes operate.

Investment business, insurance, mortgages, consumer credit and deposit taking sit under the Financial Services and Markets Act. A firm carrying on those activities needs permission from the FCA, or from

both the FCA and the Prudential Regulation Authority where the business is large enough or systemically important enough to be dual regulated.

Payment services and electronic money sit outside that framework, under their own sets of regulations. Firms are authorised as payment institutions or electronic money institutions rather than given a permission under the Act, with lighter registration routes available to smaller firms below certain turnover thresholds.

The distinction is not academic. The application, the capital requirements, the statutory timetable, the ongoing rules and the protection available to customers all differ between regimes. Money held by a payment or e-money institution, for instance, is not covered by the Financial Services Compensation Scheme. It is protected by safeguarding requirements instead. A firm offering a wallet, a credit facility and investment products is looking at three different gateways, not one.

Those three regimes are the most common, but they are only part of the picture. Anti money laundering registration, various sector specific frameworks and, in some cases, oversight by a regulator other than the FCA all sit alongside them. A business may need to go through more than one gateway, and the fact that it has cleared one says nothing about the others.

Step Three: Consider Whether There is a Route Round it

Not every business needs its own authorisation, but the ways out are regime specific and they do not mirror each other.

Under the Financial Services and Markets Act there are exclusions for particular structures and dealings, exemptions for certain bodies, and the appointed representative route, under which a firm operates under the responsibility of an authorised principal. The payments regime has its own exclusions, covering arrangements such as limited networks, commercial agency and certain technical service providers, and a firm can instead be registered as the agent of an authorised institution. Comparable arrangements exist for the distribution of e-money.

These routes are faster and cheaper than direct authorisation, but they are not a way of avoiding regulation. The principal or the institution takes on real liability for what the other firm does, and the FCA has tightened its expectations of principals considerably.

Step Four: The Application

Applications across the regimes are made through the FCA’s online system and they ask broadly the same underlying question: can this business be run soundly, by these people, with these resources and these controls. The application usually stands or falls on the regulatory business plan, which needs to show that the applicant understands its own risks, its customers and its obligations, and that governance, compliance, financial crime controls and capital have been built for the business as described.

The detail then differs. An applicant under the Financial Services and Markets Act must meet the FCA’s threshold conditions and have its senior managers individually approved, and the FCA has six months to determine a complete application and twelve months for an incomplete one. A payment or e-money institution applicant faces its own capital requirements, must document and evidence how customer money will be safeguarded, and works to a shorter clock of three months from receipt of a complete application.

In every case, applications returned as incomplete or withdrawn under pressure are common, and each round trip costs months. The FCA offers a free pre application support service, which is worth the time if the business model and the perimeter analysis are already in order.

Step Five: Authorisation is the Beginning, Not the End

Whichever gateway a firm comes through, it takes on continuing obligations: conduct standards, the Consumer Duty where retail customers are involved, regular regulatory reporting, and a duty to tell the FCA about significant changes. Permissions must continue to match what the business actually does. Businesses drift, and permissions do not follow automatically.

Rules also move. Payments and e-money firms saw the FCA’s strengthened safeguarding requirements take effect in May 2026, bringing monthly safeguarding returns and, for most firms, an annual safeguarding audit.

How We Can Help

We advise firms on where they sit against the regulatory perimeter, on which gateway applies to their model, on structuring products and contracts to fit the permissions they hold or intend to seek, on authorisation applications and regulatory business plans, and on responding when the FCA raises questions. We also act for businesses that have discovered the problem after the fact.

If you are planning to launch, expand or restructure a financial services business, the earlier the perimeter question is answered, the cheaper it is to answer.

Please get in touch with our Financial Services and Regulatory team to discuss your position.

This article is general information and does not constitute legal advice. It is current as at August 2026.