FCA authorisation and beyond: making every interaction count

Most authorised firms typically interact with their regulator through routine touchpoints rather than dramatic interventions. The bulk of these interactions include PRA and FCA authorisation applications, change in control notifications, senior manager appointments and responses to information requests, surveys and thematic reviews. But those interactions shape the regulator’s view of the firm and can influence the less routine engagements. So, it’s essential to use all engagement opportunities to instil confidence from the regulator and establish a reputation as a firm that demonstrates good practice across the sector. 

Faster FCA authorisation decisions

Since January 2026, the regulators have applied shorter timelines to several application types, including new FCA authorisations, variation of permission and Senior Management Function applications. FCA authorisation has historically taken up to 12 months, but a complete application can now be assessed in four months. That’s good news for businesses, as part of the regulators’ efforts to boost growth and competition, but it comes with a trade-off – less room to manoeuvre once an application is submitted.

Firms now face much tighter deadlines to respond to regulator’s queries, sometimes as little as a week for straightforward points, although they do offer longer timeframes for more substantial ones. The pressure to turn around responses to information gaps or answer follow-up questions has increased even as overall timelines have shortened, which makes early preparation more valuable than ever.

Article

FCA authorisations: shorter timelines to promote growth

Read more

Fixed versus flexible supervision

Firms supervised on a fixed basis have a named supervisor and a more direct line of communication. That creates the opportunity to build a relationship with the regulator and establish a greater sense of trust. Having a clearer idea of where the firm stands means they have more opportunity to make proactive queries, with greater confidence over how they’ll be received. But being higher profile carries inherent risk, with more chance of receiving information requests, and greater likelihood of being drawn into thematic reviews and similar exercises.

On the flipside, flexible portfolio firms (supervised alongside peers by a supervision team) aren’t under as much scrutiny on a day-to-day basis. This lack of visibility means they don’t have a direct ongoing relationship with the regulator, which carries lower inherent regulatory risk. But it also means that firms don’t necessarily know how the regulator views them and they have less opportunity to influence this.

Neither position is necessarily better. Each carries its own advantages and costs, but firms do need to factor that context into how they approach the regulator. 

Navigating regulatory milestones 

Many of the most significant touchpoints with the FCA and PRA are ones that firms initiate themselves through the FCA gateway. It covers new firm authorisation, variations of permission, change in control notifications, SM&CR-related applications, appointed representative changes, sensitive business names, waivers and modifications, and cancellations. A firm may go through several of these in sequence, particularly during a reorganisation or ownership change. The timing, substance and quality of these interactions is largely within the firm's own control, so effective planning, upfront preparation, and clear communication are essential. 

Navigating FCA authorisation 

When applying for FCA authorisation, the regulators expect firms to be ‘ready, willing and organised’ to use their permissions safely at the point of application, insofar as possible. They don’t want a theoretical picture of how a firm may meet expectations further down the line. As such, firms need to demonstrate how they’ll meet the regulator's requirements through a clear strategy, effective planning and evidence of a robust governance, risk management and controls environment.  

Good preparation is a must, and FCA authorisation support is available. The free Pre-Application Support Service (PASS), may be available to firms that want to discuss their application before submitting it. However, it’s worth noting that the threshold for a meeting tends to be higher for business models that the FCA would consider to be routine and well-understood. 

It’s also important to remember that the authorisation process is a dialogue. The regulator may have queries and expects clear communication throughout, not just at the point of submission. Where the FCA considers that part of an application isn't quite ready, firms are expected to reply promptly and in full to explain the gap and the plan to close it. This will build confidence and trust and firms that can’t offer an appropriate response may leave the FCA questioning whether the firm is genuinely ‘ready, willing and organised’. 

Mergers and acquisitions activity 

Change in control notifications are common, driven in part by high M&A activity across the financial services sector. The process looks beyond fit and proper checks to assess the financial structure behind an acquisition (including any debt and the cost of servicing it). The FCA is particularly interested in customer outcomes and the extent to which firms have planned for, and considered the impact of, a change in control. 

These concerns are particularly prevalent in wealth management and in payment services, where the regulator wants assurance that the firms won’t cut costs or push revenue to service acquisition debt in ways that could harm customers. In doing so, the FCA isn’t saying leveraged acquisitions are inherently problematic, but it wants evidence of a financially resilient and well controlled structure. Where that evidence is missing, the FCA can withhold approval, or ask for specific capital and liquidity commitments. 

Managing SM&CR 

Senior Management Function (SMF) appointments are another frequent point of contact with the FCA, and the rules recently changed under phase one of SM&CR reforms. Firms now have 12 weeks to submit an SMF application following an appointment for an unforeseen vacancy, rather than being subject to a 12-week timeframe for their approval. The FCA expects firms to use this rule appropriately, and clear evidence of succession planning will be viewed more favourably. 

Another reform to note is the change to threshold criteria for a firm to be categorised as an enhanced SM&CR firm, meaning more firms will remain as core, and some firms may be able to move down a category. This change isn’t automatic. Firms will need to take necessary action, with a formal application for the category change and controlled descoping of enhanced requirements once the opt-down is approved. 

Making proactive notifications or queries to the FCA 

As operating models evolve, or in the event of crystallising risk incidents, firms need to notify the FCA or PRA about another change to their business. These notifications should be precise, well-timed and transparent, with a clear goal in mind. The FCA is unlikely to give a general view or endorsement in response to a request or notification, and vague notifications and queries are likely to spark interest in broader areas of the business and prompt further questions.  

Article

SM&CR reform – less paperwork, same accountability

Read more

Responding to regulatory enquiries and data requests 

Over the last few years, the FCA’s increased its use of surveys, data requests, questionnaires, market studies and thematic reviews as part of its supervisory toolkit. Recent examples include a non-financial misconduct questionnaire, an ongoing advice charges survey, and market studies on pure protection and premium finance, among others. 

These requests carry additional resource requirements, but they are also an opportunity to demonstrate strengths to the regulator. The FCA appears to be looking for firms whose responses mark them out as outliers from their peer group, in either direction. A strong, well-prepared response can enhance a firm's standing, while a weak one tends to invite further questions and closer scrutiny. 

Quality and timeliness of responses 

The key consideration for the regulator is whether the response answers the questions asked, and if the information looks accurate and credible. However, they’ll also be interested in how readily the firm was able to prepare and approve the submission, and whether it was subject to appropriate board or senior management oversight. 

Context and positioning 

The regulator will want a response that’s easy to navigate and understand, and consistent with what it already knows about the firm from previous interactions. Responses should clearly contextualise the issue and effectively position anything likely to be of significant interest to the regulator, as the FCA will follow up on anything that isn’t fully explained. 

Outliers 

Firms want to stand out as an example of good practice. However, inaccurate data, poorly positioned responses, limited quantitative or qualitative evidence, or inconsistencies with regulatory returns will make firms stand out for the wrong reasons. 

Next steps for stronger regulatory engagement 

Authorised firms may interact with the FCA and PRA more frequently and meaningfully than they realise, and each of those touchpoints shapes the regulator's view of the firm. So the quality of routine interactions matters as much as how a firm handles the less routine ones. Across all of these, the same principles apply: be prepared, communicate openly, and make sure responses are accurate, well-governed and consistent with what the regulator already knows about the business. Firms that treat routine regulatory contact as an opportunity to build trust will start from a stronger position in all future regulatory engagements. 

For further information contact David Morrey or Peter Lovegrove.