FCA Variation of Permission: How Payment Firms Expand or Change Their Authorisation

A variation of permission allows an FCA-authorised payment institution or electronic money institution to change the scope of its regulatory authorisation — most commonly by adding new regulated payment services, expanding into additional activities or modifying existing permissions. The process is governed by the Payment Services Regulations 2017 (for PIs) and the Electronic Money Regulations 2011 (for EMIs), and applications are submitted through the FCA's Connect portal. This guide covers the circumstances requiring a VoP, the application process, FCA assessment criteria and practical considerations.

When Is a Variation of Permission Required?

A VoP is required whenever a firm wishes to change the regulated activities covered by its FCA authorisation. The most common scenarios include:

• Adding new payment services. A money remittance operator that wants to offer merchant acquiring, or a payment execution firm that wants to add payment initiation services (PIS), must apply for a VoP to add the new service to its authorisation.
• Upgrading from SPI to API. A small payment institution approaching or exceeding the €3 million monthly transaction threshold must apply for full API authorisation. This is technically a new application rather than a variation, as the regulatory status changes.
• Expanding geographic scope. While not strictly a VoP under the PSRs, firms significantly expanding their geographic operations may need to demonstrate to the FCA that their existing controls, governance and capital are adequate for the expanded scope.
• Adding e-money issuance. A payment institution that wants to issue electronic money cannot do so under its PI authorisation. It must apply for separate EMI authorisation under the EMRs 2011. This is a new authorisation application, not a VoP.
• Removing services. Firms can also apply to remove payment services from their authorisation — for example, if they discontinue a particular business line. This is a simpler process but still requires formal application.

Application Process

VoP applications are submitted through the FCA's Connect online portal. The application requires: a completed variation form specifying the services to be added or changed; an updated business plan covering the new activities, including projected volumes, revenue and risk analysis; updated governance documentation showing how the firm will manage the expanded scope; evidence of adequate capital to support the additional activities; updated AML risk assessment reflecting the new services; and any additional information specific to the services being added (e.g., for PIS — technical architecture, API security measures and liability arrangements).

The FCA may request additional information during the assessment process. Firms should expect at least one round of information requests (section 55V notices) for complex variations. The quality and completeness of the initial application directly impacts the timeline — incomplete applications almost always result in significant delays.

FCA Assessment Criteria

The FCA assesses VoP applications against substantially the same criteria applied to new authorisation applications. The assessment focuses on whether the firm has: adequate governance and senior management with relevant experience for the new activities; sufficient initial and ongoing capital to support the expanded business; appropriate safeguarding arrangements (if the new activities involve holding customer funds); an AML framework that addresses the risks associated with the new services; a viable business model that demonstrates the firm can sustain the expanded operations; and adequate systems, controls and operational resilience for the new activities.

The FCA will also consider the firm's existing compliance track record. A firm with a history of supervisory concerns, late regulatory returns or unresolved compliance issues is less likely to receive approval for expanded activities — or will face a more intensive assessment process.

Timelines and Practical Considerations

The FCA does not publish a statutory determination period for VoP applications in the same way as for new authorisation applications. In practice, straightforward variations — such as adding a single additional payment service to an existing well-functioning authorisation — typically take 3–6 months. More complex variations — such as adding multiple services, significant business model changes or variations that require assessment of new senior managers — can take 6–12 months.

Firms should plan the VoP application well in advance of the intended launch date for the new activity. The FCA has made clear that it will not be pressured by commercial timelines, and applications submitted under time pressure tend to be less well-prepared, resulting in longer processing times. Firms must not commence the new activity before the VoP is formally granted — providing payment services outside the scope of the firm's authorisation constitutes an unauthorised activity offence under Regulation 138 of the PSRs 2017.

Common Pitfalls

The most common pitfalls in VoP applications include: underestimating the level of detail required — the FCA expects the same rigour as a new application for the new activities; failing to update the AML risk assessment for the new services; insufficient evidence of senior management expertise relevant to the new activities; inadequate capital planning that does not account for the additional regulatory capital requirements; and submitting the application before the firm's internal preparations are complete — the FCA may assess the firm's operational readiness during the application process.

VoP vs New Application

In some cases, what appears to be a variation is actually a new application. The most important distinction is between adding payment services (VoP under PSRs 2017) and obtaining EMI authorisation (new application under EMRs 2011). A PI cannot add e-money issuance via a VoP — it must apply for a separate EMI authorisation. Similarly, upgrading from SPI to API status is treated as a new application. Firms should seek regulatory advice early to ensure they pursue the correct application route.

Regulatory Counsel advises payment institutions and EMIs on VoP applications, new authorisation applications and regulatory strategy. Contact us for a free initial consultation. See our licensing and authorisation services page for more.