Getting FCA-Authorised: The UK Licensing Process End-to-End
Getting FCA-Authorised as a UK EMI or PI, stage by stage — scoping, the application pack, the completeness check, FCA questions, and the real end-to-end timeline.
Jul 24
Getting FCA authorised as a UK EMI or payment institution is a structured, multi-stage process: scope and structure the firm, plan the capital, build the application pack, submit it, then answer the regulator’s questions until it decides. The FCA must determine a complete application within three months. An incomplete application can take up to twelve months from receipt, while preparation before submission sits outside both periods.
As of July 2026, under the UK's Electronic Money Regulations 2011 and Payment Services Regulations 2017, supervised by the FCA.
01 - The clock vs the calendar
The FCA must determine a complete application within three months of receiving it. If the application is incomplete, the long-stop is twelve months from receipt. The calendar you actually live through is longer because preparation happens before submission, and a weak file can remain on the incomplete timetable. The three month period is the regulator’s decision clock, not the full project timeline.
That distinction is the single most useful thing to understand before you start. Preparation sits outside the statutory periods. FCA questions and remediation may happen during the assessment, so the real calendar still depends heavily on how complete and coherent the file is at submission. In forty years I have watched founders quote the three months to their board and then spend the first three of them just assembling a pack the FCA will accept as complete. Plan to the real calendar, not the statutory one, and the rest of the process gets a lot less stressful.
02 - Stage one: scope, structure, and capital
Before a form is filed, the applicant needs the right regulatory route, a credible UK structure and a clear capital plan. An AEMI must hold €350,000 before authorisation. For an API, the amount depends on the payment services and may be €20,000, €50,000 or €125,000. AIS-only models generally follow the RAISP registration route and do not carry an initial capital requirement. Capital is not only an entry test. The application also needs to show how ongoing own funds will be calculated and monitored. The FCA can accept capital evidence later in the process, but the requirement must be met before authorisation.
This stage confirms the regulatory route. The model may require AEMI or API authorisation, or a smaller registration route such as SEMI, SPI or RAISP. An API must be a UK body corporate with its head office and registered office in the UK. An AEMI can also apply through a UK branch of an overseas body corporate. In either case, the FCA expects genuine UK substance and looks at where central management and control sits.
Get the model and the capital wrong here and every later stage inherits the error.
03 - Stage two: build the application pack
The heart of the application is the regulatory business plan and its supporting documents: the business model and financial projections, the governance and organisational structure, the programme of operations, the safeguarding arrangements, the financial-crime/AML framework, and IT and operational-resilience controls. The application also needs to identify the people and controllers behind the firm. It should explain how the business will access payment systems and banking, and how it could wind down safely. The FCA assesses the firm against the conditions in the regulations — this pack is how you evidence them.
Two parts often attract the most challenge. The regulatory business plan has to show a viable firm the FCA can supervise, not a pitch deck. The safeguarding model has to show how relevant funds will be protected and reconciled in practice. Weak safeguarding is an obvious source of FCA challenge. New applications are now assessed against the safeguarding rules in force from 7 May 2026. The safeguarding model therefore needs to reflect CASS 15 from the outset.
Governance and the people behind the firm matter just as much. A strong pack at this stage is the best investment you can make in a short determination period.
The FCA authorises a credible operating model, not an idea that still needs to be designed.
04 - Stage three: submission and the completeness check
You submit through the FCA's Connect system and pay the application fee; the statutory clock does not start on submission — it starts when the FCA judges the application complete. That is the most misread step in the whole process: a submitted application and a complete application are not the same thing.
The FCA first checks whether the minimum information is there. If it is not, the submission may be rejected without assessment. If the application is accepted but remains incomplete, the FCA can ask for further information and the twelve month long-stop continues from receipt. The FCA will tell the applicant when the application becomes complete, which is when the three month period applies. The practical lesson, which I repeat to every founder, is that the work you do in stage two to make the file complete on first read is what actually shortens the calendar.
05 - Stage four: FCA review and case officer questions
A case officer is assigned and works through the file. They test whether the business is viable, whether the controls work and whether the people are credible. The quality and speed of your responses can materially affect progress Industry experience and FCA commentary alike point to incomplete or slow responses as a leading cause of delay.
This is a dialogue, not a verdict. The case officer may test whether your projections are realistic, whether your safeguarding method actually works operationally, and whether the named individuals are fit and proper to run a regulated firm. Treat each question as a chance to close a gap rather than a hurdle, keep a single owner for responses, and the review moves. Drift here can keep an application incomplete, increase the risk of refusal or lead the FCA to ask the firm to withdraw and reapply.
"Founders ask me how to make the FCA go faster. You can't make the regulator hurry — but you can stop being the reason it slows down. In forty years the firms that got through cleanly were never the ones with the slickest deck; they were the ones whose file was complete on the first read and who answered every question fully within days, not weeks." — Gary O'Brien, Senior Compliance Adviser, Advapay UK
06 - Stage five: determination, Authorisation, and go-live
When the FCA is satisfied, it grants Authorisation and enters the firm on the Financial Services Register — but Authorisation is a permission to operate, not the finish line: you still have to switch on the operating business, with banking access and the live safeguarding and compliance the FCA assumes you can run. A UK authorisation does not provide EEA passporting rights. Any overseas activity needs a separate assessment under the law of the country concerned.
Go-live is where the launch is won or lost. The safeguarding model you described in the pack now has to run in software, day in and day out; the AML/KYC controls have to operate on real customers; and you need banking access to hold client funds. Firms that planned these workstreams from stage one are better placed to go live soon after determination. The ones that treated the licence as the whole job discover the operating business is a second project.
07 - How Advapay helps
Advapay runs the UK Authorisation as one workstream alongside the technology and banking access, so you come out the other side with an operating business, not just an FCA permission. On the regulatory side, Advapay's licensing and consulting practice supports the company structure, regulatory business plan, safeguarding and compliance framework, and the preparation of responses to FCA questions across all five stages above. The applicant remains the FCA’s main contact and is accountable for explaining the application.
On the technology side, Macrobank provides the core banking platform — onboarding, AML/KYC, accounts, payments, accounting, and reporting — so the technology can support the operating model described in the application. Advapay ties the two together through support with the banking workstreams, the piece founders most often leave too late. By its own published numbers, Advapay runs this as a one-stop-shop across 100+ clients, 5 offices, and around 50 people. For a deeper view of the UK route, see Advapay's UK PI/EMI webinar and the upstream UK EMI & PI licence spotlight. (See the Lab posts on UK substance requirements, why applications get delayed, and the FCA regulatory business plan.)
How long does it take to get FCA-Authorised as an EMI or PI? The FCA must determine a complete application within three months. An incomplete application may take up to twelve months from receipt. In Advapay’s experience, the full process often takes around 9 to 12 months, depending on readiness and complexity.
When does the three-month clock start? Not on submission. It starts when the FCA judges the application complete. Until then, the application remains on the twelve month timetable. Completeness on first read is therefore one of the biggest levers on the overall timeline.
How much capital do I need to apply? An AEMI needs €350,000 before authorisation. An API may need €20,000, €50,000 or €125,000 depending on the payment services. AIS-only firms generally follow the RAISP route. The application must also address ongoing own funds requirement.
Does FCA Authorisation let me operate in the EU? No. Since Brexit a UK licence does not carry an EEA passport. A UK Authorisation covers the UK; operating in the EU needs a separate EU Authorisation. Decide whether you need one or both before you start.
What slows applications down the most? A weak initial file and slow or incomplete responses create the most avoidable delay. Missing information can keep the application on the incomplete timetable, while major changes can lead the FCA to ask the firm to withdraw and reapply.
Getting FCA-Authorised is not a form, and it is not three months. It is a multi-stage project where the work you do before you submit — the model, the capital, the regulatory business plan, the safeguarding method — decides how short the regulated part feels. In forty years I have watched the firms that treat Authorisation as the start of an operating business, not the end of a paperwork exercise, go live cleanly and stay out of trouble in supervision.
If you want a straight read on the UK route for your model, speak to our team. Advapay supports the authorisation, core banking platform and banking workstream as one connected launch.
Gary O'Brien, Senior Compliance Adviser, Advapay UK
