Full vs Limited Permission: Choosing the Right FCA Authorisation Scope

What It Is

Full and limited permission represent two distinct tiers of FCA authorisation that determine the scope of regulated activities a firm is permitted to carry on. The distinction is most significant in the consumer credit sector, where it was introduced following the transfer of consumer credit regulation from the Office of Fair Trading to the FCA in April 2014 under the Financial Services and Markets Act 2000 (as amended). Understanding which tier applies to your business is a foundational decision that shapes your ongoing regulatory obligations, costs, and operational flexibility.

Full permission — sometimes referred to as full authorisation — grants a firm the right to carry on any of the regulated activities specified in its permission profile. A fully authorised firm is subject to the complete suite of FCA rules applicable to its activities, including the full range of reporting requirements, prudential standards, and conduct of business obligations set out in the FCA Handbook. Fully authorised firms are placed within the FCA's supervisory framework and assigned a risk category that determines the intensity of supervision they receive.

Limited permission is a more restricted form of authorisation available to firms that carry on certain lower-risk consumer credit activities as a secondary or ancillary business. It was designed to create a proportionate regulatory regime for businesses such as retailers offering store credit, motor dealers arranging vehicle finance, or professional firms offering fee-deferral arrangements. Limited permission firms carry on credit-related activities that are supplementary to their main (non-financial-services) business, and they benefit from a lighter regulatory framework in recognition of their lower risk profile.

The choice between full and limited permission is not discretionary in many cases — the nature and scale of your consumer credit activities determines which tier you fall into. However, there are boundary cases where the characterisation is less clear, and firms in those situations must make a considered assessment. Getting this wrong carries serious consequences: operating under limited permission when full authorisation is required is a criminal offence under section 23 of FSMA.

Why the FCA Cares

The FCA's two-tier approach to consumer credit authorisation reflects a deliberate policy choice about proportionate regulation. When the FCA inherited the consumer credit regime from the OFT, it took on responsibility for a vastly expanded population of firms — approximately 50,000 consumer credit businesses, many of which were small enterprises for whom consumer credit was a minor adjunct to their main commercial activity. Applying the full weight of FCA regulation to every retailer offering interest-free credit or every dentist offering payment plans would have been disproportionate and economically damaging.

The limited permission regime was the FCA's answer to this proportionality challenge. It creates a lower-cost, lower-burden pathway for firms whose consumer credit activities are genuinely secondary, while preserving the full regulatory framework for firms whose primary business is lending, broking, or debt-related services — the firms that pose the greatest conduct risk to consumers. The FCA's Policy Statement PS14/3 set out the rationale explicitly: firms carrying on credit activities as a main business require the full suite of regulatory protections because they handle larger volumes of consumer credit transactions, their business models create more acute conflicts of interest, and the potential for consumer harm is correspondingly greater.

The FCA monitors the boundary between limited and full permission closely. In its thematic reviews of the consumer credit sector, the regulator has identified firms that appear to be carrying on credit activities at a scale or in a manner inconsistent with limited permission. Where the FCA determines that a firm's activities have outgrown limited permission, it expects the firm to apply for full authorisation promptly. Firms that fail to do so face enforcement action — and the FCA has shown willingness to act, including through criminal prosecution for section 23 offences.

The regulator also cares about the downstream implications of permission scope. A firm operating under the wrong tier may be subject to inadequate prudential requirements, insufficient consumer protections, and lighter supervision than its risk profile warrants. This creates a regulatory gap that can result in consumer harm — precisely the outcome the two-tier system was designed to prevent.

Who It Affects

The full-versus-limited permission decision is most directly relevant to businesses in the consumer credit sector. This includes motor dealers that arrange finance for vehicle purchases, retailers that offer store credit or buy-now-pay-later arrangements, professional services firms that offer fee-deferral or instalment payment facilities, and any business that introduces customers to credit providers as part of a broader commercial relationship. For these businesses, limited permission may be appropriate — but only if the credit activity is genuinely secondary to their main business.

Firms whose primary business involves consumer credit activities — lenders, credit brokers operating as their main line of business, debt collection agencies, debt management companies, and credit information services providers — will almost always require full permission. The test is not purely volumetric; the FCA considers whether the firm holds itself out as providing credit services, whether its commercial model depends on credit-related revenue, and whether the credit activity is integral to the firm's value proposition rather than incidental to it.

The decision also affects firms that are growing or pivoting their business model. A retailer that begins as a limited permission credit broker may find that its credit broking activities have grown to the point where they constitute a main business activity. Similarly, a professional firm that introduces an instalment payment scheme may discover that the scheme becomes a significant revenue stream and customer acquisition tool, blurring the line between ancillary and primary activity.

Firms in the payments sector should also be aware of the distinction, particularly where they provide credit in connection with payment services. The interaction between the Payment Services Regulations 2017, the Electronic Money Regulations 2011, and the consumer credit regime can create complex perimeter questions about which permissions are required and at what tier.

What Firms Get Wrong

The most common error is underestimating the scale or significance of consumer credit activity within the business. Firms apply for or remain on limited permission because it is cheaper and less burdensome, without rigorously assessing whether their activities genuinely qualify. The FCA's test is not based solely on revenue proportions — it considers the nature, scale, and prominence of the credit activity, how the firm presents itself to consumers, and whether the credit activity is integral to the firm's commercial offering. A motor dealer that derives 40% of its revenue from finance commission is unlikely to be carrying on credit broking as a secondary activity, regardless of how the firm characterises it internally.

Another frequent mistake is failing to understand the specific activities that limited permission covers. Limited permission is not a general-purpose consumer credit licence — it covers only certain specified activities (credit broking, debt adjusting, debt counselling, and credit information services) carried on as a secondary business. Lending itself is not covered by limited permission. A firm that makes loans directly to consumers requires full authorisation, full stop. Firms that move from introducing customers to third-party lenders (broking) to funding credit arrangements from their own balance sheet (lending) must upgrade their permissions before doing so.

Firms also get the timing wrong. The variation of permission process takes months, and during that period the firm must not carry on activities that require the higher tier of permission. Firms that realise belatedly that they need full authorisation face a difficult period where they must either restrict their activities or risk a section 23 offence while the application is processed. Planning ahead — monitoring the growth trajectory of credit activities and initiating the variation process proactively — avoids this trap.

Finally, some firms treat the distinction as purely administrative. They obtain limited permission, pay the lower fees, and assume that the FCA will not scrutinise whether their activities genuinely fall within the limited permission scope. This is a dangerous assumption. The FCA conducts supervisory assessments of limited permission firms, and its data analytics capabilities allow it to identify firms whose credit-related activity patterns are inconsistent with secondary-business status.

What Evidence Is Expected

When applying for limited permission, the FCA expects evidence that the firm's consumer credit activities are genuinely secondary to its main business. This means demonstrating that the firm has a substantive non-financial-services business, that its credit-related activities arise in the context of that main business, and that the credit activity is ancillary rather than central to the firm's commercial proposition. The application should include a clear description of the firm's main business, the nature and volume of credit activities, the proportion of revenue derived from credit-related services, and the firm's assessment of why limited permission is appropriate.

For full permission applications, the evidential requirements are substantially more extensive. The firm must demonstrate compliance with the full Threshold Conditions as set out in Schedule 6 of FSMA and COND in the FCA Handbook. This includes evidence of appropriate financial resources (capital adequacy under the applicable prudential regime), a regulatory business plan that addresses conduct risks specific to consumer credit activities, a compliance monitoring programme covering CONC requirements, and details of proposed Senior Managers with demonstrable competence in consumer credit regulation.

The FCA expects full permission applicants to address specific conduct risks relevant to their activities. For lenders, this includes affordability assessment processes (CONC 5), responsible lending policies, and collections and arrears procedures. For credit brokers, it includes commission disclosure, customer information requirements, and conflicts of interest management. For debt management firms, it includes fee transparency, fair treatment of customers in financial difficulty, and regulatory capital requirements.

Firms applying to vary from limited to full permission must provide evidence that they now meet the full Threshold Conditions, including any changes to governance, staffing, capital, and compliance arrangements that have been made to support the transition. The FCA will treat this as equivalent to a new full-permission application in terms of scrutiny and expect the same quality of evidence.

Good Implementation Looks Like

Good implementation begins with a rigorous self-assessment at the outset. Before applying for any form of FCA authorisation, the firm conducts an honest evaluation of its current and planned consumer credit activities. It maps each activity against the regulatory perimeter, identifies which regulated activities it will carry on, and determines whether those activities qualify for limited permission or require full authorisation. This assessment is documented, reviewed by senior management, and updated periodically as the business evolves.

A firm that correctly identifies itself as a limited permission candidate establishes internal controls to ensure it stays within scope. It monitors the volume and proportion of credit-related activities against defined thresholds, has a clear escalation process for when activities approach the boundary, and includes permission scope in its annual compliance review. The firm does not treat limited permission as a permanent status — it recognises that business growth may necessitate upgrading to full permission and plans accordingly.

A firm that requires full permission invests appropriately in the infrastructure needed to meet its regulatory obligations. It recruits or develops staff with consumer credit expertise, implements systems that support CONC compliance (including affordability assessments, customer communications, and complaints handling), and establishes a compliance monitoring programme that covers all applicable FCA requirements. The firm treats its full authorisation not as a burden but as the foundation of its commercial credibility.

Critically, well-run firms review their permission scope regularly — at least annually and whenever there is a material change in business model, scale, or strategy. They do not wait for the FCA to raise questions about whether their activities match their permissions. They seek advice proactively when they identify potential scope issues and initiate variation of permission applications in good time when a change is needed.

Related Tool

The MEMA FCA calculator helps firms model the financial implications of full versus limited permission, including periodic fees, application costs, and ongoing prudential capital requirements. By inputting your expected regulated activity revenue, firm type, and permission scope, the calculator provides a side-by-side comparison of the cost profiles for each tier, allowing you to make an informed commercial decision that accounts for all regulatory costs — not just the headline application fee.

The perimeter assessment tool complements the calculator by helping firms determine which regulated activities they carry on and whether those activities qualify for limited permission. It walks through the relevant provisions of the Regulated Activities Order (RAO), identifies applicable exclusions and exemptions, and provides a preliminary view of whether the firm's activities are consistent with limited or full permission. This is particularly valuable for firms with complex business models where the perimeter analysis is not straightforward.

Together, these tools provide a structured, evidence-based approach to the permission scope decision — replacing guesswork and assumption with regulatory analysis and financial modelling.

Related Service

Our FCA authorisation service includes a detailed permission scope assessment as a standard component. For firms facing the full-versus-limited permission decision, we conduct a thorough analysis of the firm's current and planned activities, map them against the regulatory perimeter, and provide a clear recommendation on the appropriate authorisation tier. Where the position is borderline, we document the analysis in a form that can be shared with the FCA if questions arise during the application process or subsequently.

For firms that require full permission, we provide end-to-end application support — from regulatory business plan development through to Senior Manager interview preparation and post-authorisation compliance setup. For firms that qualify for limited permission, we ensure the application accurately reflects the firm's activities and establish the ongoing monitoring framework needed to maintain limited permission status as the business grows.

We also support firms that need to transition from limited to full permission. This involves a gap analysis of the firm's current arrangements against full-permission requirements, development of an implementation plan for any changes needed, preparation of the variation of permission application, and support through the FCA's assessment process. Our goal is to make the transition smooth and timely, minimising the period of uncertainty and operational disruption.

Related Sectors

Consumer credit is the sector where the full-versus-limited permission distinction has the greatest practical impact. Thousands of UK businesses — from car dealerships to furniture retailers to dental practices — carry on some form of consumer credit activity, and each must determine whether limited permission is sufficient or full authorisation is required. The FCA's 2023 review of the consumer credit market highlighted ongoing concerns about firms operating beyond their permission scope, and supervisory attention in this area remains high.

The payments sector intersects with the consumer credit perimeter in complex ways. Firms providing buy-now-pay-later services, merchant cash advances, or credit facilities in connection with payment transactions must navigate both the Payment Services Regulations and the consumer credit regime. The FCA's approach to regulating BNPL products — evolving through successive consultation papers — has created additional uncertainty about where the perimeter falls for innovative payment-linked credit products. Firms in this space should seek specialist advice on their permission requirements.

Insurance brokers who arrange premium finance as part of their insurance distribution activities must consider whether this activity constitutes credit broking requiring separate consumer credit permissions. The answer depends on the specific arrangements — whether the broker introduces the customer to a premium finance provider (credit broking) or simply facilitates the insurer's own instalment payment terms (which may not be regulated credit). The distinction is fact-specific, and firms that get it wrong may be carrying on an unauthorised activity.