Introduction
An FCA regulatory business plan is not a commercial pitch. It shows the regulator that a proposed firm understands its regulated activities, customers, risks, governance and resources before it seeks authorisation.
Don't confuse it with the FCA's own annual Business Plan. That is a corporate publication about the regulator's priorities. The plan in this guide is part of a firm's application.
Delays are common. Per the FCA's metrics, median determination time for new-firm authorisations was 131 days, and 219 days for payments and e-money.
Below we cover structure, preparation and the mistakes that trigger questions. Check the latest FCA guidance and Handbook before relying on any detail here.
Key Takeaways
- The FCA has no universal format; tailor the plan to your permissions and risk profile.
- Link activities to governance, capital, controls and customer outcomes.
- Projections need capital, liquidity, assumptions and a credible adverse case.
- Keep the plan consistent with Connect answers, SMF submissions and policies.
What Is an FCA Regulatory Business Plan, and Why Does It Matter?
The Purpose of the Document
The plan describes how you will conduct regulated business in practice: legal structure, permissions, products, customers, operating model, controls and financial resources.
The FCA is assessing regulatory readiness. Whether the commercial opportunity looks attractive is secondary. Its sample business plan says the plan cannot be generic and must reflect the firm's own model and permissions.
What the FCA Is Likely to Assess
The plan feeds the FCA's view of the threshold conditions (FSMA Schedule 6 and COND 2). These cover:
- Location and effective supervision
- Appropriate financial and non-financial resources
- Suitability of the firm and its management
- Business model
They do not apply identically to every firm. Consumer credit firms have modified treatment, and payment and e-money institutions face their own conditions under the Payment Services Regulations 2017 and Electronic Money Regulations 2011. Check COND 2 and the guidance for your regime.
Who Typically Needs One
Detailed plans are expected from:
- Firms seeking FSMA Part 4A permissions
- Firms applying for a variation of permission
- Authorised and small payment or e-money institutions
- Investment firms and managers
- Consumer credit firms
- Cryptoasset businesses registering under the Money Laundering Regulations
Routes differ. Crypto registration is separate from FSMA authorisation, and small institutions are registered rather than authorised. Confirm which route applies before drafting.
What Should an FCA Regulatory Business Plan Include?
Executive Summary, Firm Profile and Ownership
Cover the legal entity, proposed activities, ownership, group structure, purpose of the application, target customers and high-level governance. Write the summary last. A reviewer should grasp the application without marketing language or unsupported growth claims.
Regulated Activities and Permissions Sought
Describe each regulated activity and permission, why you need it, and how it connects to the customer journey and revenue model. Requesting permissions broader than your real operating model invites questions you can't answer. Show how permissions map to your Connect application and supporting documents.
Business Model, Products and Target Market
Explain:
- How customers are acquired, onboarded, served and supported
- How the product works and how money or assets move
- How the firm earns revenue
- Which activities are outsourced
Define the target market by customer needs, sophistication, potential vulnerability and distribution channel, and show how the model produces appropriate outcomes.
Financial Resources and Projections
Set out start-up funding, expected income, operating costs, capital, liquidity, cash flow and the assumptions behind them. The FCA's financial information guidance treats three-year forecasts in Excel as best practice. For payment and e-money firms, the PSR 2017 and EMR 2011 schedules expressly require a forecast budget for the first three financial years. Crypto and consumer credit pages don't set a single horizon.
Tie projections to the relevant prudential requirements. Include an adverse scenario: slower growth, higher costs, operational disruption or loss of a key provider. For MIFIDPRU firms, the ICARA process adds severe but plausible stresses and wind-down analysis.
Compliance, Risk, AML and Operational Resilience
Detail your compliance framework, risk process, monitoring, assurance, escalation routes and board reporting. Then cover:
- Customer due diligence and enhanced due diligence
- Sanctions and PEP screening
- Transaction monitoring and suspicious activity reporting
- Fraud controls
- MLRO arrangements
Add cyber risk, technology failure, important business services, incident response, continuity and third-party providers.
People, SMF Roles, Outsourcing and Governance
Identify proposed senior managers and SMF holders, with experience, responsibilities, reporting lines and time commitment. SM&CR scope depends on firm classification, so don't assume it applies identically to payments, e-money or MLR registration routes.
For outsourcing, the FCA says firms remain accountable for outsourced functions. Document monitoring, record access, service standards and contingency plans. Keep the plan consistent with Statements of Responsibilities, individual applications, the organisation chart, policies and third-party agreements.
How to Build the Plan for an FCA Authorisation Application
Start With the Regulatory Perimeter
Map the customer journey against regulated activities, exemptions and perimeter issues. PERG 2 is the starting point. Where the business touches payments, cryptoassets, lending, investments, safeguarding, financial promotions or cross-border services, confirm your analysis with current FCA guidance and specialist advice.
Gather Evidence Before Drafting
Build a checklist:
- Incorporation and ownership documents
- Organisation charts and CVs
- SMF materials
- Policies and risk assessments
- Technology information
- Outsourcing contracts
- Financial forecasts and proof of resources
Each major statement should point to a document, named owner, system or control.
Translate the Model Into a Customer and Risk Journey
Walk the lifecycle: marketing, onboarding, use, complaints, closure and post-sale support. At each stage, note where customer harm, financial crime, data, fraud or operational risk could arise. Then show the control, its owner, how it is monitored and what happens when it fails.
Build and Test the Financial Model
Use real pricing, headcount, technology, compliance and third-party costs, not fundraising optimism. Build base and adverse cases. Reconcile the figures with the capital assessment, funding evidence, staffing plan and regulatory returns.
Decide How Compliance Leadership Will Be Resourced
Permanent, interim and fractional models each suit different firms. The choice depends on size, complexity, permissions, risk profile and application stage. No staffing model automatically satisfies the FCA.
Fractional support can suit early-stage fintech, payments and crypto firms. Fraxtional, for example, provides director-led fractional CCO and MLRO leadership, and can act as a named MLRO. Accountability still sits with the applicant firm.
Review the Complete Application as One Pack
Before submitting, check the plan against Connect answers, forms, the financial model, policies, SMF submissions, customer materials and outsourcing documents. The FCA expects final, signed-off documents, not drafts.
Assign owners for FCA information requests, keep version control, and update the plan if the model changes mid-application.
How to Demonstrate Readiness, Not Just Intent
Align the Plan With Current FCA Rules
Translate expectations into operating arrangements, controls, responsibilities and evidence. Repeating regulatory language proves nothing. Check the latest FCA publications and Handbook before you submit.
Put Customer Outcomes Into the Operating Model
Where the Consumer Duty applies (PRIN 2A: products and services, price and value, understanding, support), show how you will deliver:
- Clear communications
- Fair value
- Effective complaints handling
- Accessible journeys
Explain how outcome data is collected, reviewed by management and used to correct harm.
Make Financial Crime Controls Operational
Connect your risk assessment to CDD, EDD, sanctions, monitoring, fraud prevention, investigations, SARs and training. Distinguish intention from readiness: name the systems, responsible people, procedures, testing and escalation routes that will exist on day one.
The FCA's crypto feedback gives a concrete example. A generic sanctions policy with no update procedure counts as poor quality.
Address Operational Resilience and Third-Party Dependence
Cover important business services, impact tolerances where SYSC 15A applies, cloud providers, banking partners, safeguarding or custody arrangements and cyber recovery. Explain how you would continue, pause or wind down if a critical supplier, sponsor bank or payment partner failed.
Establish Management Information and Oversight
Describe the compliance calendar, monitoring programme, risk reporting, board oversight, breach escalation, complaints analysis and regulatory reporting. Show how you will test that controls work, record remediation, and review the plan when the perimeter changes.
Common Mistakes That Can Delay FCA Authorisation
Vague or Inconsistent Scope
- Unclear permissions
- Contradictory product descriptions
- Unexplained group-company roles
- Differences between the plan and Connect answers
If you can't yet show the systems, people and resources for an activity, narrow the scope.
Unrealistic Financials or Under-Resourced Compliance
- Unsupported revenue assumptions
- Missing cost categories
- Weak stress scenarios
- Vague capital or liquidity explanations
- Too little time or authority for compliance, risk and MLRO roles
Evidence each assumption and reconcile it with the staffing, technology, outsourcing and governance sections.
Generic Policies and Failure to Respond Directly
- Copied policies
- Controls that don't exist yet
- Evasive answers
These generate more information requests. Use a documented quality assurance step, answer questions directly, update the plan when the model changes, and get specialist review for complex or high-risk applications.
Frequently Asked Questions
What are the 7 main components of a business plan?
The FCA does not prescribe a fixed seven-part structure. Useful areas typically include executive summary, firm and ownership, activities and business model, target market, governance and compliance, operations and risk, and financial projections.
Can you provide an example of an FCA business plan?
An anonymised structure would follow the headings above, tailored to the applicant's permissions, customer journey, risks, governance and financials. Don't copy another firm's plan. The FCA's sample business plan page is the best reference.
How do I apply for FCA authorisation?
Assess the perimeter and permissions, then prepare the Connect application and supporting documents, including the business plan and SMF materials. Respond to FCA questions promptly, and confirm current requirements on the FCA website.
What are the two types of FCA authorisation?
That's an oversimplification. Routes include authorisation, registration and variation of permission, depending on activities, legal status and regime. Authorised payment institutions are authorised; small payment institutions and crypto firms are registered.
Who is required to be authorised by the FCA?
Anyone carrying on specified regulated activities in the UK generally needs authorisation or registration, unless an exemption applies, such as appointed representatives. Check the perimeter (PERG 2) before trading.
What is an FCA regulated business?
It is a firm authorised or registered for specified activities. It remains subject to FCA rules, supervision, reporting, governance, conduct and financial-crime obligations within its permissions.
