Variation of Permission: FCA Process, Requirements and Timelines

What Is a Variation of Permission?

A variation of permission (VoP) is an application by an FCA-authorised firm to change its Part 4A permissions — the specific regulated activities it is authorised to carry out. Under section 55H of the Financial Services and Markets Act 2000 (FSMA), a firm may apply to the FCA to:

• Add new regulated activities — for example, a payment institution adding account information services (AIS) or payment initiation services (PIS) to its existing permissions.
• Remove regulated activities — where a firm wishes to cease carrying on a particular activity.
• Vary limitations or requirements — where the firm's existing permissions are subject to conditions that it wishes to have changed or removed.
• Add or change investment types or customer types — expanding the scope of permitted activities within an existing regulated activity.

When Is a VoP Required?

A VoP is required in any situation where a firm's current permissions do not cover a new activity it wishes to undertake. Common scenarios include:

• A payment institution wishing to add new payment service types (e.g., adding PIS to an existing money remittance authorisation)
• An EMI wishing to add payment services that are not ancillary to e-money issuance
• A consumer credit firm wishing to add debt counselling or debt adjusting permissions
• An investment firm wishing to expand from advisory-only permissions to dealing or arranging
• A bank wishing to add new regulated activities such as insurance distribution
• Any firm wishing to remove limitations — such as a restriction on the types of customers it may serve or the maximum transaction values it may process
• A firm that has been subject to voluntary requirements and wishes to have them removed once the underlying issues have been addressed

The Application Process

Step 1: Regulatory perimeter analysis. Before applying, confirm that the proposed activity falls within the regulatory perimeter and identify exactly which regulated activities and investment types are needed. This analysis is critical — applying for the wrong permissions wastes time and may delay the firm's plans.

Step 2: Gap analysis. Assess the firm's current resources, systems and controls against the requirements for the new permissions. Identify any gaps that need to be addressed before or as part of the application. This may include additional capital, new compliance arrangements, revised AML procedures or additional staff with appropriate qualifications.

Step 3: Prepare the application. VoP applications are submitted through the FCA's Connect system. The application requires:

• A clear description of the activities the firm wishes to add, remove or vary
• A business plan covering the proposed activities, including projections for the first three years
• Details of the firm's governance arrangements and how they will accommodate the varied permissions
• Information on the firm's financial resources, including capital adequacy calculations under the new permission scope
• Details of the compliance arrangements for the new activities, including policies, procedures and monitoring plans
• AML/CTF arrangements relevant to the new activities
• Details of any outsourcing arrangements related to the new activities
• Information on the staff who will be responsible for the new activities, including their qualifications and experience

Step 4: Pre-application engagement. For complex VoP applications, the FCA offers pre-application meetings. This is an opportunity to discuss the proposed variation with the FCA case team, identify potential issues early and understand what the FCA will expect in the application. Pre-application engagement is strongly recommended for significant expansions of scope.

Step 5: Submit and respond. Submit the application through Connect and be prepared to respond to additional information requests from the FCA. The FCA may ask for clarification, additional documentation or evidence of readiness to undertake the new activities.

Assessment Criteria

The FCA assesses VoP applications against the same threshold conditions that apply to initial authorisation applications (Schedule 6 FSMA). These include:

• Location of offices: The firm's head office and registered office must be in the UK.
• Effective supervision: The FCA must be able to supervise the firm effectively with its varied permissions.
• Appropriate resources: The firm must have adequate financial and non-financial resources (human, technological, operational) for the varied permissions.
• Suitability: The firm must be fit and proper to carry on the varied activities, including having appropriate governance, compliance and risk management arrangements.
• Business model: The firm's business model must be suitable for the activities it proposes to carry on.

Documentation Requirements

A strong VoP application includes comprehensive documentation:

• Business plan. A detailed business plan for the new activities, including market analysis, product descriptions, pricing, target customers, projected volumes, revenue and cost projections for three years, and a risk assessment.
• Regulatory business plan. A specific section addressing how the firm will comply with the regulatory requirements applicable to the new activities. This includes conduct of business rules, financial promotions requirements, complaints handling, record-keeping and reporting obligations.
• Financial projections. Capital adequacy calculations showing the firm meets (and will continue to meet) its capital requirements with the varied permissions. Include stress testing scenarios.
• Compliance framework. Updated compliance policies, procedures and monitoring plans covering the new activities.
• AML arrangements. Updated business-wide AML risk assessment, CDD procedures and transaction monitoring arrangements reflecting the new activities and any new customer or product risks.
• Governance. Updated governance documentation including statements of responsibilities, management responsibilities map and terms of reference for any new committees.
• Staff competence. Evidence that staff responsible for the new activities have appropriate qualifications, experience and training.

Timelines

The FCA does not publish fixed timescales for VoP applications, but general guidance suggests:

• Simple variations (e.g., removing a limitation, adding a closely related activity): 3–6 months
• Standard variations (e.g., adding a new payment service type): 6–9 months
• Complex variations (e.g., significant expansion of scope, adding activities in a new regulatory category): 9–12 months or longer

These timelines include application preparation, FCA assessment and any information request periods. The clock stops when the FCA requests additional information, which can significantly extend the overall timeline.

Common Pitfalls

• Applying for the wrong permissions. Incorrect regulatory perimeter analysis leads to applications for permissions that don't match the firm's intended activities. This results in delay and may require a fresh application.
• Inadequate business plan. A vague or unrealistic business plan is a common cause of rejection or extended FCA questioning.
• Insufficient evidence of readiness. The FCA wants to see that the firm is ready to undertake the new activities — not that it will get ready after receiving approval. Firms should have policies, staff and systems in place (or credibly committed) before applying.
• Capital shortfalls. Applying before ensuring the firm can meet its revised capital requirements.
• Underestimating the timeline. Firms that plan product launches based on optimistic VoP timelines frequently face delays. Build contingency into business plans.

Practical Tips

• Start preparation 3–6 months before you intend to submit the application
• Use FCA pre-application meetings for complex variations
• Prepare all documentation to a high standard before submission — incomplete applications cause delays
• Ensure the firm's existing compliance is in good order — the FCA may review the firm's broader compliance record as part of the VoP assessment
• Monitor the FCA's expectations through recent Policy Statements, Dear CEO letters and supervisory communications
• Consider engaging specialist regulatory counsel to prepare and manage the application

Regulatory Outlook

The FCA has acknowledged that application processing times can be lengthy and has committed to improving turnaround times. However, the regulator's priority remains thorough assessment over speed. Firms that submit well-prepared, comprehensive applications with supporting evidence of readiness will typically experience smoother and faster processing. The FCA's gateway function remains a critical quality control mechanism, and firms should treat VoP applications with the same rigour as initial authorisation.