Variation of Permission and Change in Control — FCA Requirements Explained

Variation of Permission

As financial services firms grow, evolve or pivot their business models, they frequently need to change the scope of their FCA permissions. Under section 55H of FSMA, a firm can apply to the FCA to:

• Add new regulated activities — for example, a payment institution adding e-money issuance, or an investment adviser adding discretionary portfolio management
• Remove existing permissions — where the firm no longer conducts certain regulated activities
• Vary limitations or requirements — modifying conditions attached to existing permissions

Operating regulated activities without the appropriate permission is a criminal offence under section 23 of FSMA. Firms must obtain the variation before commencing the new activity — not after.

When Is a VoP Required?

Common scenarios requiring a variation of permission include:

• Product expansion — launching a new product that involves a regulated activity not covered by existing permissions (e.g., a PI adding credit broking, or a wealth manager adding insurance mediation)
• Client category expansion — extending services to client categories not covered by existing limitations (e.g., moving from professional clients only to retail clients)
• Geographic expansion — providing services in new jurisdictions that require additional permissions or regulatory notifications
• Structural changes — changes in the firm's legal structure, group structure or outsourcing arrangements that affect the scope of regulated activities
• Removing dormant permissions — proactively removing permissions for activities the firm no longer conducts (the FCA encourages this as good regulatory housekeeping)

The VoP Application Process

Step 1 — Gap analysis: Identify exactly which permissions need to be added, removed or varied. Review the RAO to ensure you are applying for the correct activities and specify any limitations or requirements that should apply. Common errors include applying for overly broad permissions (triggering additional capital or conduct requirements) or overly narrow permissions (requiring a further application later).

Step 2 — Updated regulatory business plan: The FCA requires an updated business plan explaining why the variation is needed, how the new activities will be conducted, the expected volumes and revenues and how the firm will manage any additional risks. The business plan should demonstrate that the variation is consistent with the firm's overall strategy and does not create unacceptable risks.

Step 3 — Compliance framework updates: For each new regulated activity, demonstrate that the firm has appropriate policies, procedures and controls in place. This may include new compliance monitoring procedures, updated conflicts of interest policies, additional staff training and revised financial promotions processes.

Step 4 — Capital adequacy reassessment: Adding new permissions may increase the firm's regulatory capital requirements. Calculate the revised capital requirement and demonstrate that the firm holds (or will hold) adequate capital. For investment firms, this means recalculating the IFPR own funds requirement; for payment institutions, reassessing the safeguarding and capital requirements under the PSRs.

Step 5 — SM&CR updates: If the new activities require additional Senior Management Function holders or create new Certification Regime roles, submit the relevant applications alongside the VoP. Update Statements of Responsibilities and the management responsibilities map to reflect the expanded scope of the firm's business.

Step 6 — Submit the application: VoP applications are submitted through FCA Connect. The statutory determination period is three months for straightforward variations and six months for more complex changes. In practice, information requests frequently extend the timeline.

FCA Assessment of VoP Applications

The FCA assesses VoP applications against the same threshold conditions as initial authorisation:

• Effective supervision — can the FCA continue to supervise the firm effectively with the expanded scope?
• Appropriate resources — does the firm have adequate financial, human and technological resources for the additional activities?
• Suitability — are the firm's governance, management and compliance arrangements adequate for the expanded scope?

The FCA will pay particular attention to: - Whether the new activities introduce risks the firm has not previously managed - Whether the firm's compliance and risk management functions are adequately resourced for the expanded scope - Whether the proposed SMF holders have relevant experience in the new activity areas

Change in Control

Separate from variation of permission, any proposed change in control of an FCA-authorised firm requires prior notification to the FCA. The change in control regime is set out in Part XII of FSMA (sections 178–191).

What constitutes a change in control?

A change in control occurs when any person proposes to: - Acquire 10% or more of the shares or voting rights in the firm (or its parent undertaking) - Increase an existing holding to cross the 20%, 30% or 50% thresholds - Acquire the ability to exercise significant influence over the management of the firm

This captures a wide range of transactions including share purchases, mergers, internal group reorganisations, new investment rounds and management buyouts. Both direct and indirect holdings are relevant — for example, a change in the ownership of a holding company that controls the authorised firm is a change in control.

The notification process:

The proposed acquirer (not the firm) must submit a section 178 notice to the FCA before completing the acquisition. The notice must include:

• Details of the proposed acquirer (identity, ownership structure, financial position)
• The size and nature of the proposed holding
• The proposed acquirer's strategic intentions for the firm
• The source of funds for the acquisition
• Evidence that the proposed acquirer is suitable to hold a qualifying holding in an authorised firm

FCA assessment:

The FCA has 60 working days to assess the notification (which may be extended by up to 30 additional working days if the FCA requests further information). The FCA will assess:

• Reputation of the proposed acquirer — including criminal history, regulatory history, financial soundness and connections to persons who may pose a risk
• Reputation and experience of proposed new directors — if the acquisition will result in changes to the firm's management
• Financial soundness — whether the acquisition is financially sound and the proposed acquirer can support the firm's regulatory capital requirements
• Compliance impact — whether the acquisition will affect the firm's ability to meet its regulatory obligations
• Money laundering risk — whether there are reasonable grounds to suspect the acquisition involves money laundering or terrorist financing

The FCA may: - Approve the change in control (with or without conditions) - Object to the proposed acquisition — providing written reasons and the right of referral to the Upper Tribunal

Consequences of non-compliance:

Completing a change in control without prior FCA notification is a criminal offence. Additionally, shares acquired in breach of the notification requirement carry no voting rights — the FCA can apply to court to void the transaction.

Practical Recommendations

Plan VoP applications alongside business strategy. If your business plan anticipates new products or activities within 12–18 months, begin the VoP process early. The FCA assessment period can be 3–6 months, plus preparation time.

Engage the FCA early for complex changes. For significant variations — such as adding dealing on own account or client money handling — consider a pre-application discussion with the FCA. Early engagement reduces the risk of surprises during the formal assessment.

Map your change in control obligations proactively. If your firm has investors, a complex group structure or anticipates future funding rounds, ensure all stakeholders understand the section 178 notification requirement. Build the notification timeline into transaction planning — a 60-working-day assessment period cannot be compressed.

Maintain comprehensive records. Both VoP and change in control processes generate significant documentation. Maintain a complete audit trail of applications, FCA correspondence, supporting evidence and internal governance decisions. These records may be relevant to future supervisory interactions.

Consider the cumulative impact. Multiple variations over time can create complexity in the firm's permissions profile. Periodically review your permissions to ensure they accurately reflect your current business activities — and remove any dormant permissions that no longer serve a purpose.