Applying to the FCA vs Buying an FCA-Authorised Firm

10 August 2026
#FCA Authorisation#FCA Acquisition#Change of Control#EMI Licence#UK Fintech#Market Entry#Timeline#Regulatory Cost
Ihor Vlasov

Ihor Vlasov

Author

Applying to the FCA vs Buying an FCA-Authorised Firm
4 min read

FCA authorisation vs acquisition is a decision that most UK market entry candidates approach as a cost comparison and should approach as a timeline comparison. Cost matters — but the dominant variable in most cases is how long it takes before the first client transaction can legally occur, and how certain that timeline is. In 2026, the FCA operates a dual-speed mandate: complete applications are targeted for a four-month turnaround, while those deemed incomplete face a ten-month outer limit. The clock stops every time the FCA issues an information request, and complex applications routinely see two to four rounds of supplementary questions, each adding approximately six to eight weeks. That variability is the core of the comparison — and it is precisely what acquiring an existing FCA-authorised firm eliminates.

Key Takeaways

  • FCA authorisation vs acquisition is primarily a timeline decision, not a cost decision — the dominant question is how long before the first regulated transaction can occur, and how certain that date is

  • The FCA's 2026 dual-speed mandate targets complete applications in four months and caps incomplete ones at ten months — but the distinction between complete and incomplete is consequential: a six-month discrepancy is often commercially catastrophic for firms with investors waiting for a launch date

  • Professional fees for legal advice, compliance consultancy, and document drafting run £30,000 to £75,000 for a standard application — plus non-refundable application fees and regulatory capital that for client-money firms escalates into six figures

  • Completing a transaction without prior FCA approval is a criminal offence and can expose individuals and firms to fines and enforcement action — the FCA may also object to the acquisition, impose restrictions on the firm's permissions, or require the firm to cease authorised activities

  • From 17 January 2025, the FCA requires proposed individual controllers in a change-of-control transaction to obtain criminal background checks from the Disclosure and Barring Service — plan this into the deal timeline, not after LOI

The Fresh Application Path

The Fresh Application Path

A fresh FCA application requires four core inputs: the regulatory business plan, the financial projections, the compliance and AML policies, and the governance framework including identified controlled functions. The regulatory business plan is the document on which the FCA's assessment turns most heavily — it describes the firm's proposed business, regulatory framework, and governance structure. The FCA has become increasingly adept at spotting automated templates that lack the necessary bespoke detail — if a case officer cannot assess the specific risks of the business model from the document, the application is classified as incomplete before the substantive assessment clock even starts.

The cost structure has three components that candidates consistently underestimate. Application fees are non-refundable — a rejected application still costs the full fee, and resubmission requires paying again. Professional fees for compliance consultancy, legal advice, and document preparation run £30,000 to £75,000 for a standard application. And regulatory capital — the minimum financial resources the FCA requires to be held at all times, not just at application — is the single largest hidden cost, escalating sharply into six figures for firms that intend to hold client money.

For cryptoasset firms, the timeline is categorically different. The FCA's cryptoasset registration regime has been significantly more challenging than most applicants anticipate — rejection rates are high, and firms should plan for nine to eighteen months from submission to determination. The new FSMA cryptoasset authorisation gateway is expected to open in September 2026, with anticipated timelines of six to twelve months based on application volume and regime complexity.

The Acquisition Path

Acquiring an existing FCA-authorised firm delivers something the fresh application cannot: a supervisory relationship, a compliance history, established banking arrangements, and operating permissions — all of which exist on the day the change-of-control assessment concludes. The acquired entity's authorisation is not a new relationship with the FCA; it is an existing one that the buyer steps into, assessed for suitability before the transfer completes.

The change-of-control process is not a notification. The FCA assesses the suitability of every proposed controller — whether or not they have made a formal decision to acquire, and whether or not Section 178 of FSMA applies to them. The FCA looks at multiple factors when considering whether someone has made the decision to acquire or increase control over an authorised firm. From 17 January 2025, proposed individual controllers must also obtain DBS criminal background checks — or equivalent for persons outside England and Wales — as part of the assessment. Building this into the deal timeline before LOI, not after signing, avoids the most common source of change-of-control delay.

The minimum assessment period after a complete submission is 60 working days — approximately three months. For a well-prepared buyer with a clean regulatory profile, the total timeline from submission to non-opposition is typically three to five months. That compares favourably against the fresh application path for most applicants, before accounting for the additional time required to establish banking relationships, build a compliance programme, and generate the two-year revenue history that makes the firm credible to institutional counterparties.

When Each Path Is Correct

When Each Path Is Correct

Fresh application is the right choice when: the buyer wants to build a specific product architecture from scratch without inheriting any prior compliance history; no FCA-authorised entity in the target category is available for acquisition at a reasonable price; or the buyer has sufficient time and regulatory expertise to produce a compliant application at first submission — and the commercial cost of a 4 to 12 month delay is manageable.

Acquisition is the right choice when: the buyer needs UK market access in a defined commercial window that a fresh application cannot reliably meet; the acquired entity is an operational going concern with existing clients, revenue, and banking relationships that compound the regulatory value of the licence; the FCA category being targeted has limited availability through the fresh application route (the FCA stopped issuing EMI licences freely after 2019, making acquisition often the only practical path); or the buyer's own regulatory profile is clean enough that the change-of-control assessment presents no material risk.

Conclusion

FCA authorisation vs acquisition resolves to a timeline and certainty question in most commercial contexts. The fresh application is the correct path when time is not the binding constraint and no suitable existing entity is available. Acquisition is the correct path when the commercial window is defined, when the FCA category has limited fresh application availability, and when an operational entity compounds the regulatory value of the authorisation being acquired. For buyers mapping where FCA-authorised entities are available for acquisition, N5Deal catalogues licensed entities across UK and EU jurisdictions. A full overview of available FCA-authorised assets is at n5deal.com.

Disclaimer

This page is for informational purposes only. It does not constitute legal, financial, or regulatory advice. Readers should consult qualified professionals before making any decisions.

Comments

Frequently Asked Questions

Clear, concise info to help you understand the process!

In 2026, the FCA targets a four-month turnaround for complete applications and a ten-month outer limit for incomplete ones. In practice, the clock stops with each information request round — typically two to four rounds adding six to eight weeks each. Most applications for payment institutions and EMIs take six to twelve months from submission to determination. Cryptoasset firm registration timelines are nine to eighteen months, with high rejection rates.
The FCA assesses the suitability of every proposed controller — their regulatory history, financial standing, governance structure, and relevant experience. From 17 January 2025, proposed controllers must also obtain DBS criminal background checks or equivalent. The FCA's November 2024 guidance on the prudential assessment of acquisitions provides the current framework. The assessment covers both the incoming buyer and any other persons who will acquire or increase control as a result of the transaction.
No. Completing a transaction without prior FCA approval is a criminal offence under Section 191 of FSMA. The firm continues to operate under its existing ownership structure during the assessment period — the buyer cannot direct the business, instruct the compliance function, or rebrand the entity until the FCA has issued non-opposition. Operational deployment begins after regulatory clearance, not after the purchase price is paid.