The short answer
You generally need FCA authorisation if you carry on a "regulated activity" in the UK by way of business, under the Financial Services and Markets Act 2000 (FSMA) and the Regulated Activities Order 2001 (RAO), unless an exclusion or exemption applies. The list of regulated activities is long and fact-specific: common ones include credit broking, lending, arranging or advising on investments, insurance distribution, payment services, e-money issuance and certain debt services. This page is general information, not a legal opinion on your business: where your position is unclear, get a fixed-fee, written Regulatory Perimeter Assessment (£2,500, usually 5 working days) or try the free perimeter self-check first.
Common activities and where they usually sit
| Activity | RAO / PERG reference | Likely position |
|---|---|---|
| Credit broking (introducing, presenting or helping arrange a credit agreement) | Article 36A RAO; PERG 2.7.7E | Regulated. If broking is secondary to a non-financial main business, limited permission may apply; see full vs limited permission. If it's your main business, or you also lend or collect debts, expect full permission. |
| Secondary credit broking under limited permission | FEES 3 Annex 1, fee-block CC1; PERG 2.7 | Regulated, but at a lighter tier if the credit activity is genuinely ancillary to a non-financial business. Get a perimeter review before assuming you qualify. |
| Buy-now-pay-later / deferred payment credit (DPC) | Article 60F(2) RAO (as amended by SI 2025, in force from 15 July 2026) | Regulated from 15 July 2026. The previous interest-free, short-term exemption was narrowed; most BNPL lenders now need authorisation or had to register for the temporary permissions regime before it closed. |
| Payment services (payment initiation, account information, money remittance) | Payment Services Regulations 2017; PERG 15 | Regulated under the PSRs rather than FSMA. Needs FCA authorisation or registration as a payment institution, not a RAO Part 4A permission. |
| E-money issuance | Electronic Money Regulations 2011; PERG 3A | Regulated under the EMRs. Needs authorisation or registration as an e-money institution. |
| Arranging deals in investments | Article 25 RAO | Regulated if you make arrangements for someone to buy, sell, subscribe for or underwrite an investment. A bare introduction (article 33 exclusion) may fall outside this if narrow conditions are met. |
| Advising on investments | Article 53 RAO | Regulated where you give advice on the merits of buying, selling or holding a specified investment, including a personal recommendation. Generic, non-personalised information is not automatically "advice". |
| Insurance distribution (selling, arranging or advising on insurance) | PERG 5 | Regulated as an insurance distribution activity if you deal, arrange or advise on contracts of insurance for remuneration, by way of business. |
| Debt adjusting | Article 39D RAO | Regulated: negotiating debt terms or taking over a borrower's obligation to repay, on a commercial basis. |
| Debt-counselling | Article 39E RAO | Regulated: giving advice to a borrower or hirer about liquidating a debt under a credit or consumer hire agreement. |
| Debt-collecting | Article 39F RAO | Regulated: taking steps to procure payment of a debt due under a credit or consumer hire agreement. |
| Debt administration | Article 39G RAO | Regulated: performing duties or enforcing rights under a credit or consumer hire agreement on behalf of the lender or owner. |
| Introducing (as distinct from arranging) | Article 33 RAO (exclusion) | Can fall outside regulation if the introduction is to an authorised or exempt person for independent advice or discretionary management, and the narrow conditions in article 33 are met. Introducing to a lender for credit is treated differently: see credit broking above. |
This table is a starting point, not an exhaustive map. The RAO contains further specified activities (for example, managing investments, safeguarding and administering assets, operating a collective investment scheme, and the various mortgage and home-finance activities in PERG 4) that aren't listed here. Our PERG explainer sets out the FCA's full chapter map and its own decision sequence for working through a perimeter question.
How the FCA actually tests this
The FCA (and the courts) work through a consistent sequence, set out at PERG 2.2.3G: is the activity carried on by way of business; does it relate to a specified investment or specified property; is it a specified activity; is it carried on in the UK; does an exclusion apply; is the person exempt; and if authorisation is needed, what scope of permission. Getting the order right matters. Firms that start by hunting for an exclusion, rather than first establishing whether the activity is regulated at all, tend to reach a confident answer that turns out to be wrong.
Substance matters more than labels. Calling an activity an "introduction" in your contracts doesn't change the legal analysis if, in practice, you're negotiating terms or helping complete an agreement. The FCA looks at what a business actually does: customer communications, the commercial arrangement, and who takes the steps that make a transaction happen.
Why this matters commercially, not just legally
Carrying on a regulated activity without authorisation breaches the general prohibition in section 19 of FSMA, a criminal offence under section 23. Separately, under section 26, agreements made in the course of the unauthorised activity can be unenforceable against the other party, who can recover what they paid. These are not theoretical risks: the FCA actively investigates unauthorised business, and a business built around an activity that turns out to be regulated can find its customer contracts unwound.
"The businesses that get caught out are rarely trying to dodge regulation," says Ademola Omosanya, founder of MEMA Consultants. "More often they've read one exclusion, assumed it covers their whole model, and never revisited the question as the business grew. A five-day perimeter review is cheap compared with finding out the hard way, through a section 26 claim or an FCA enquiry, that your contracts were never enforceable."
Getting a definitive answer
If this table leaves you reasonably confident your activity is unregulated, that's still not a substitute for a documented analysis if the FCA, a bank, a platform or an investor later asks for one. If it leaves you unsure, or shows your activity likely needs authorisation, the next steps are:
- Try the free perimeter self-check for an indicative, guided first read.
- Get a written Regulatory Perimeter Assessment: a fixed fee of £2,500, usually completed within 5 working days of us receiving complete information, covering your business model, activities and products, customer journey, money flows and jurisdictions, mapped against the current regulatory perimeter.
- If you already know you need credit-broking authorisation and expect to qualify for limited permission, compare DIY, MEMA's fixed-fee project and full consultancy before choosing a route, or go straight to the limited-permission credit-broking project.
- For the full authorisation process once you know which permissions you need, see FCA Authorisation.
No perimeter review or authorisation support can guarantee an FCA decision; the FCA alone decides whether an activity is regulated and whether a firm meets the Threshold Conditions. What a documented review gives you is a reasoned, evidenced answer before you commit to a route, and a record you can show the FCA, a bank or an investor if the question comes up later.
Frequently Asked Questions
Is this page regulatory advice I can rely on?
No. This is general information about how the FCA's regulatory perimeter is usually drawn, based on the Regulated Activities Order 2001 (RAO) and the FCA's Perimeter Guidance manual (PERG). It is not a substitute for advice on your specific business model, and the perimeter has fact-specific exclusions and exemptions that this page cannot cover exhaustively. Where your position is unclear, get a written perimeter review rather than relying on a general guide.
What's the difference between introducing and arranging?
An introduction, excluded under article 33 of the RAO where the conditions are met, is passing a customer to someone else without more. Arranging deals in investments, a specified activity under article 25, is making arrangements for a transaction to actually happen, for example negotiating terms or helping complete the paperwork. The same distinction matters for credit broking: article 36A catches introductions to lenders directly, so the 'just an introduction' argument does not work the same way there as it can for investments.
I think my activity is excluded or exempt. Can I just proceed?
Only with care. Exclusions in the RAO are narrowly drafted and fact-specific; relying on one incorrectly means you are carrying on a regulated activity without authorisation, which is a criminal offence under section 23 of FSMA. The FCA expects firms to hold a documented, contemporaneous analysis of why an exclusion applies, not just an assumption.
What happens if I operate without the authorisation I need?
Carrying on a regulated activity in the UK without authorisation or an applicable exemption breaches the general prohibition in section 19 of FSMA, a criminal offence under section 23 carrying up to two years' imprisonment and an unlimited fine. Under section 26, agreements made in the course of the unauthorised activity can be unenforceable against the other party, who can also recover what they paid.
Does buy-now-pay-later (BNPL) need FCA authorisation now?
Yes, in most cases. Deferred payment credit (DPC), commonly called BNPL, became a regulated activity from 15 July 2026 under the Financial Services and Markets Act 2000 (Regulated Activities etc.) (Amendment) Order 2025, which narrowed the exemption previously available under article 60F(2) of the RAO. A firm offering DPC agreements now generally needs authorisation for the relevant consumer-credit activities, or to have registered under the DPC temporary permissions regime before it closed.
How quickly can I get a definitive answer?
MEMA's fixed-fee Regulatory Perimeter Assessment is a written review of your business model, activities and permissions against the FCA's regulatory perimeter, usually completed within 5 working days of us receiving complete information, for a fixed fee of £2,500. For a quicker first read, our free perimeter self-check tool gives an indicative starting point.
Need help implementing this?
Our regulatory consultants can help your firm meet FCA requirements with practical, evidence-based implementation support.
Book a Free Consultation