This guide is for founders, board members, CFOs, legal advisers and compliance leaders weighing a new bank, a challenger bank, an embedded finance model or a regulated UK expansion. It covers choosing a route, what the PRA and FCA assess, how to apply, what it costs, how long it takes and where applicants stumble.
Check every figure and rule against current official sources before you file.
Key Takeaways
- Bank, EMI, payment institution and sponsor-bank routes carry different permissions and customer protections.
- Regulators assess the whole operating model, not just the paperwork.
- Budget for capital and full build costs, not only application fees.
- A consistent application and early engagement cut avoidable rework.
What a UK banking licence is and which authorisation route you need
What a UK bank licence authorises
A banking licence is permission under Part 4A of FSMA for an eligible entity to accept deposits and carry out related activities. The PRA grants it with FCA consent, and the permission specifies the activities and any limitations.
The word "bank" alone tells you little. The approved business model and permissions define what the firm may do.
Who regulates and supervises UK banks
The PRA leads the application decision, and the FCA must consent. Both assess the applicant. After authorisation the PRA supervises prudential soundness and the FCA supervises conduct.
The Bank of England also acts as the UK's resolution authority, with a remit to ensure any bank failure is handled in an orderly way. That role is separate from the authorisation decision.
FSCS protection attaches to eligible deposits at the authorised legal entity, up to £120,000 per person per PRA-authorised firm (effective 1 December 2025). Multiple brands sharing one authorised firm do not multiply the limit, and not every product qualifies.
Choosing between a bank, EMI, payment institution or sponsor-bank model
| Route | What it allows | Customer-money protection |
|---|---|---|
| UK bank | Deposit-taking under Part 4A | FSCS, for eligible deposits |
| Authorised EMI | Issuing e-money, plus payment services | Safeguarding, not FSCS |
| Authorised PI | Payment services under the PSRs 2017 | Safeguarding of relevant funds |
| Sponsor-bank arrangement | Depends on the partner and contract | Depends on the legal entity holding the funds |
Under the FCA's guidance, an authorised non-bank payment provider's customer balance is not an FSCS-protected bank deposit. A partner model gives you speed and less balance-sheet risk, but less control. A full licence gives control and brings full prudential obligations.
Fraxtional matches fintechs to sponsor-bank partners by product type, risk appetite and compliance posture, with most of that work to date on the US side. For UK models, confirm the legal entity holding customer funds before anything else.
UK bank licence requirements: what regulators assess
Business model, ownership and financial case
The regulatory business plan (RBP) is the core document. Regulators expect:
- A clear proposition, target customers, products and revenue model
- Funding plans, geographic scope and risk appetite
- Realistic forecasts with stress scenarios
- Market research specific to your model
Regulators also look through to controllers, ultimate owners and sources of funds. FCA control bands start at 10%, 20%, 30% and 50%. The PRA's published feedback flags reliance on one investor or a small pool, and weak fundraising contingencies.
Opaque structures and unexplained capital draw heavy scrutiny.
Capital, liquidity and prudential resources
The Threshold Conditions require adequate capital and liquidity from day one. The PRA sets separate mobilisation and post-mobilisation capital requirements. Without mobilisation, applicants must show resources for the first 12 months of planned operation, supported by ICAAP and ILAAP documents.
The PRA's process pages state no absolute initial-capital figure, so don't trust any universal number. Capital requirements also cannot fund launch spending, so keep regulatory capital apart from build costs and working capital.
Under SS3/21, resources must cover Pillar 1, Pillar 2A and buffers. The current statement sets the new-bank buffer at six months' projected operating expenses. The PRA also expects a credible, board-approved recovery plan and solvent exit analysis.
Governance, senior management and control functions
Applicants need SMF applications and evidence that key people are fit and proper. The minimum leadership for authorisation is a CEO, a board chair and one additional executive SMR holder.
Show clear responsibilities, escalation routes and documented oversight. Risk, compliance and internal audit need real independence. The PRA's feedback also flags boards that cannot demonstrate understanding of, or challenge to, the ICAAP.
Financial crime, technology and operational resilience
Banks fall under the Money Laundering Regulations 2017. The FCA expects business-wide risk assessments, risk-based CDD, ongoing monitoring and senior-management AML responsibility, plus sanctions controls.
Its 2022 challenger-bank review found weak CDD, missing customer-risk assessments, inconsistent enhanced due diligence and poorly handled monitoring alerts.
On resilience, in-scope firms had to operate important business services within impact tolerances by 31 March 2025. Outsourcing falls under SS2/21, with an updated version effective 18 March 2027.
Crypto-related or stablecoin models should read the PRA letters of May 2026, which update expectations without creating separate permissions.
How to apply for a UK bank licence: step-by-step
Step 1: Confirm the regulatory perimeter and application strategy
Start with a perimeter analysis. Do you need deposit-taking at all? Which activities are in scope? Is a subsidiary or branch right, or would an EMI or partner model fit better?
Then complete the groundwork:
- Gap assessment against current PRA and FCA guidance
- Ownership review
- Capital plan and governance map
- Dated application roadmap
The joint New Bank Start-up Unit offers pre-application meetings, and using them early pays off.
Step 2: Build the application and supporting evidence
Typical workstreams:
- Business plan and financial forecasts
- Capital and liquidity analysis (ICAAP, ILAAP)
- Governance documents and senior-manager information
- Risk frameworks and AML policies
- Technology architecture and outsourcing arrangements
- Operational resilience, recovery and wind-down plans
Fraxtional offers director-led fractional compliance leadership for fintech, banking and crypto companies that need flexible help with compliance governance and financial crime frameworks. It supports preparation but does not represent applicants before regulators or guarantee approval.
Step 3: Submit the application and manage regulator questions
Submit a complete, candid application where figures, ownership information, policies and projected activities reconcile across every document. Expect information requests, interviews, background checks and challenges to your assumptions. The regulators decide, not your advisers.
The statutory periods are 6 months from a complete application and 12 months from receipt of an incomplete one. Completeness matters.
Step 4: Prepare for mobilisation or conditional approval
Mobilisation is optional authorisation with restrictions. Aggregate deposits are limited to £50,000, normally for no more than 12 months. All Threshold Conditions and capital standards still apply. It is not permission to run the full business, and you should not treat it as the moment to start building the bank. Confirm current conditions in the PRA's mobilisation guidance.
Step 5: Satisfy conditions before launch
Evidence readiness before exit:
- Committed capital and approved policies
- Staffed senior and control functions
- Tested systems and customer processes
- Outsourcing oversight and financial crime controls
- Incident response and management information
Exit requires governance sign-off and a Variation of Permission application. The PRA says assessment usually takes at least three months.
Step 6: Manage obligations after authorisation
Authorisation starts a continuing supervisory relationship. Ongoing obligations typically include:
- Prudential returns and capital and liquidity management
- Conduct obligations and financial crime monitoring
- Governance assessments and resilience testing
- Regulatory notifications
SS3/21 typically covers the first five years as a new bank develops.
UK bank licence costs, timeline and common pitfalls
What to include in the cost model
The FCA lists a Category 7 bank application fee of £28,150, and the PRA's 2026 instrument lists a Type 3 fee of the same amount. How the two fees relate is not always clear from the published instruments, so confirm the amount payable on the FCA's fee page rather than adding them.
The fee is the small part. Plan for:
- Regulatory capital and liquidity
- Legal, compliance and audit advice
- Senior staff and control functions
- Core banking technology, cybersecurity and testing
- Insurance, outsourcing and infrastructure
- Ongoing PRA and FCA periodic fees and the FSCS levy
No single "cost to open a bank" figure applies universally. Label every number a planning estimate.
How long a UK bank licence application takes
Statutory periods are not launch promises. In the PRA's 2025/26 reporting, the median for new authorisations was 276 days across 9 cases, including two deposit-taking cases. That cohort isn't bank-only. The PRA's list shows 40 new banks authorised since 2013.
Timing depends on model complexity, ownership structure, submission quality, regulator questions, background checks, systems readiness and conditions.
Common pitfalls and a pre-submission checklist
Recurring weaknesses include:
- Wrong application route
- Generic market research
- Underestimated costs
- Weak SM&CR arrangements
- Inconsistent forecasts
- Immature AML controls
- Thin third-party or wind-down planning
Revolut shows the staged path. It announced restricted UK authorisation on 25 July 2024 and its mobilisation exit on 11 March 2026. That is a company-announced milestone, not a standard timeline.
Pre-submission checklist:
- Perimeter and route confirmed
- Ownership and source of funds documented
- Capital plan and forecasts reconciled
- Board, SMFs and control functions in place
- Financial crime framework tested
- Technology, resilience and outsourcing evidenced
- Customer protection and disclosures clear
- Wind-down and recovery plans approved
- Funds for post-authorisation obligations
Conclusion and next steps
A strong application aligns the business model, capital, governance, controls, technology and launch plan before submission. Treat compliance as part of the build, not a paperwork exercise left until the end.
Before you file:
- Confirm your regulatory perimeter
- Read the current PRA and FCA materials
- Get specialist input early
- Build a dated readiness plan
This article is informational, so verify current requirements independently before filing.
Frequently Asked Questions
How much will it cost to open a bank?
Costs go well beyond the application fee. They include regulatory capital, advice, technology, staffing, controls, testing and ongoing obligations. Check current PRA and FCA sources for applicable figures.
How much does it cost to get an EMI licence in the UK?
The FCA application fee is £5,640 (Category 5). Minimum initial capital is €350,000 under the Electronic Money Regulations 2011, and safeguarding, implementation and compliance costs come on top.
How do you get a banking licence?
Define the perimeter, prepare the business plan and evidence, and apply through the PRA and FCA process. Then answer scrutiny, complete any mobilisation or conditions, and show operational readiness.
Who issues a banking licence?
The PRA decides the application, with FCA consent. After authorisation, the PRA leads prudential supervision and the FCA leads conduct.
What is a banking licence?
It is regulatory authorisation to carry on specified activities, including deposit-taking. It differs from an EMI, payment institution or sponsor-bank arrangement, which carry different permissions and protections.
What are the new bank rules in the UK?
Rules keep changing. The FSCS limit rose to £120,000 in December 2025, the Strong and Simple regime and Basel 3.1 take effect from January 2027, and new incident-reporting rules start in March 2027. Check the latest PRA, FCA and Bank of England publications.
