FCA Authorisation Timeline 2026: What to Realistically Expect

Every firm founder considering FCA authorisation asks the same question within the first five minutes of any advisory conversation: "How long will this take?" It is the question that shapes business plans, determines launch dates, and, when answered poorly, leads to frustrated founders staring at an inbox waiting for a case officer who assigned their application to the bottom of a very tall pile. The honest answer is that it depends, but it will almost certainly take longer than you hope and shorter than it needs to be if you invest properly in preparation.

The gap between expectation and reality is where most of the pain lives. We have seen firms told by well-meaning accountants that authorisation takes "about three months," only to find themselves many months into a process with no decision in sight. We have also seen firms who prepared meticulously, submitted a complete application, and had a decision well within the FCA's time limit. The difference was never luck. It was always preparation, and it was always rooted in understanding how the FCA actually processes applications rather than how firms wish it worked.

The FCA publishes statutory timelines, but the real clock starts months before you submit. Understanding each phase, and where firms lose weeks, is the difference between a smooth process and a long ordeal.

The FCA's Official Position on Timelines

The Financial Conduct Authority works to statutory assessment periods. For FSMA firms they are in the Financial Services and Markets Act 2000. For payments and e-money firms they are in the Payment Services Regulations 2017 and the Electronic Money Regulations 2011. These periods are the maximum time the FCA has to determine a completed application, and the FCA states them on its website. What catches firms out is that the clock runs from the date the FCA receives the completed application, and "complete" in the regulator's eyes often differs from what applicants believe they have submitted.

Two sets of rules matter. For firms authorised under FSMA, section 55V says the FCA must determine an application before the end of six months beginning with the date it received the completed application. It may determine an incomplete application if it thinks that appropriate, and in any event must do so within 12 months beginning with the date it received it. Payment services and e-money firms are in a different position. Regulation 9 of the Payment Services Regulations 2017 and regulation 9 of the Electronic Money Regulations 2011 give the FCA three months from receipt of the completed application, and the same 12-month limit for an incomplete one.

The FCA describes the same periods in plainer terms. If your application is complete, it says it will usually assess it within six months for an FSMA firm or three months for a payments or e-money firm. If it is not complete, it could take up to 12 months. It also warns that you are unlikely to be authorised straight away, because it usually has questions.

Three points follow. The period starts when the FCA has the completed application, not when you start preparing. A decision within the period can still be a refusal. And the FCA can ask for further information at any time before it decides (FSMA s55U(5)), so questions are normal, not a sign that something has gone wrong.

Two Clocks: Preparation and Assessment

Treat authorisation as two projects. The first is building a complete, credible application. The second is the FCA's assessment. Only the second has a published limit.

Do not build a launch date by adding three or six months to an incomplete draft. Plan preparation, assessment and the work needed to start trading as three separate pieces.

Phase by Phase: The Real Journey

The formal FCA assessment is only one segment of a much longer process. When experienced compliance consultants talk about authorisation timelines, they count from the moment a firm begins serious preparation, not from the date Connect accepts the submission. The full journey, from first regulatory conversation to permissions granted, typically spans five distinct phases, each with its own pitfalls and each offering opportunities to either compress or extend the overall timeline.

Scoping and Permissions Mapping

Before a single form is completed, a firm must determine precisely which regulated activities it intends to carry out and which FCA permissions it needs to conduct those activities lawfully. This sounds straightforward but it is the phase where the most consequential mistakes are made. A firm that applies for the wrong permissions will either be rejected outright or, worse, granted permissions that do not cover its intended business model, requiring a costly variation of permission application months later.

The scoping phase involves mapping every product, service, and client interaction against the FCA's Regulated Activities Order (RAO) and the regulatory perimeter. For firms operating in areas where the perimeter is ambiguous, such as certain fintech business models, payment services, or hybrid advisory-and-discretionary propositions, this analysis can be genuinely complex. Our Perimeter Assessment tool provides an initial framework, and our free FCA authorisation readiness check shows how far along you are against the areas the FCA assesses, but the critical output of this phase is a definitive permissions map that aligns your commercial intentions with the FCA's regulatory categories.

Firms that rush this phase or treat it as a formality almost always pay for it later. In our experience, firms often have to amend the original permissions request after submission, either because they over-scoped (requesting permissions they did not need, which invites additional scrutiny) or under-scoped (missing permissions essential to the business model). Each amendment adds time to the process.

Building Your Regulatory Infrastructure

Once permissions are mapped, the firm must build the regulatory infrastructure that will convince the FCA it can meet threshold conditions on an ongoing basis. This is the most labour-intensive phase and the one where quality of preparation has the greatest impact on overall timeline. The FCA does not simply want to see that a firm has policies; it wants to see that those policies are tailored to the firm's specific business model, proportionate to its risk profile, and evidently understood by the people who will implement them.

The core deliverables during this phase include a regulatory business plan that meets the FCA's expectations (which are considerably more detailed than a commercial business plan), a compliance monitoring programme, a complaints handling procedure, financial projections demonstrating adequate capital resources, and a complete Senior Managers and Certification Regime mapping. The SMCR mapping is particularly important because the FCA will scrutinise who holds which senior management functions and whether those individuals have the competence and integrity to discharge their responsibilities. Our SMCR Navigator helps firms work through the allocation of prescribed responsibilities and the identification of certification functions, but the underlying work of documenting accountabilities and building governance frameworks requires genuine organisational effort.

The compliance manual must be bespoke, even for a modest advisory firm. Case officers see many applications and can usually tell a template compliance manual quickly. Firms that submit generic documents downloaded from the internet or purchased from document mills are likely to face information requests, and those requests will ask the firm to explain, in specific terms, how each policy applies to its particular circumstances. It is far more efficient to write it properly the first time.

Application Submission

The FCA's Connect system is the gateway for all authorisation applications, and navigating it successfully requires attention to detail that borders on the obsessive. The system asks a structured series of questions, requests supporting documents, and requires specific information about the firm's controllers, senior managers, and regulatory arrangements. A well-prepared firm can complete the Connect submission without delay, but this assumes that all supporting documents are finalised, all individual forms (for senior managers and controllers) are ready to submit simultaneously, and the firm has resolved any corporate structure questions that might complicate the application.

Common errors at this stage include submitting individual applications for senior managers separately from the firm application (they should be submitted together), failing to provide adequate detail in the business plan section of Connect, uploading documents in formats the system cannot process, and neglecting to pay the correct application fee. The FCA charges between 280 and 225,170 pounds depending on which of ten pricing categories your permissions fall into, so check the fee category before you submit. For a comprehensive breakdown of all associated costs, our analysis of FCA authorisation costs in 2026 provides the complete picture.

The legal period runs from the date the FCA receives the completed application. If the application is incomplete, the twelve-month limit runs from the date it receives it. If the minimum information is missing, the FCA can reject the submission without assessing it and refund the fee.

FCA Assessment and Questions

Once the application is accepted, it is assigned to a case officer within the FCA's Authorisations Division. The case officer becomes the firm's primary point of contact and is responsible for assessing whether the firm meets the threshold conditions for authorisation. These conditions, set out in Schedule 6 of FSMA, require the firm to demonstrate that it has appropriate resources (both financial and human), that its business model is viable, that its senior managers are fit and proper, and that its regulatory arrangements are adequate for the activities it proposes to carry out.

A case officer is appointed after submission, and it can take a little while. Use that period to prepare the documents the case officer is likely to ask for (for an investment firm, its advisory or management agreements or fund offering documents), so you can send them promptly when requested.

The case officer will review every document submitted, cross-reference information provided in Connect against supporting materials, and conduct background checks on all proposed senior managers and controllers. In many cases, the case officer will issue at least one information request, which is a request for further information. These requests require a written response by the deadline the case officer sets.

The quality of responses to information requests matters a great deal. A firm that responds promptly, comprehensively, and with supporting evidence will generally see its application move on faster. A firm that provides vague or incomplete responses, or that takes the whole response period to answer a simple question, signals to the case officer that it may lack the organisational capability to operate as a regulated firm. This is not a signal any applicant wants to send. For firms navigating this process for the first time, our complete guide to FCA authorisation walks through each stage in greater detail, including how to handle information requests effectively.

Decision and Post-Authorisation

When the case officer is satisfied that the firm meets all threshold conditions, the application is escalated for a decision. For straightforward applications, this decision is made under delegated authority by senior staff within the Authorisations Division. If the FCA proposes to refuse, the decision is taken through its statutory notice procedure.

If the decision is positive, the firm receives a formal notice of authorisation specifying the regulated activities it is permitted to carry out, any limitations or requirements attached to its permissions, and the date from which it may commence regulated business. The firm is simultaneously entered on the Financial Services Register, which is the public record of all FCA-authorised firms and individuals.

Post-authorisation, the firm must immediately comply with all applicable FCA rules, including regulatory reporting requirements (through RegData), capital adequacy maintenance, and ongoing SMCR obligations. The FCA may place some newly authorised firms in its Early and High Growth Oversight team and will contact you if so. Treat authorisation as the starting line, not the finish line.

What Causes Delays and How to Avoid Them

The single most common cause of delay is submitting an incomplete application. In our experience, many applications are returned or draw immediate information requests because basic required information is missing. This is not a matter of complex regulatory judgment; it is a matter of failing to answer every question in Connect, failing to attach every required document, or failing to ensure that individual applications for senior managers are submitted alongside the firm application. The solution is unglamorous but effective: use the FCA's published application pack as a checklist, verify every attachment before submission, and have a second pair of experienced eyes review the entire application before it is submitted. Firms that engage professional support, whether from compliance consultants or specialist regulatory lawyers, are less likely to submit an incomplete application, and the time saved can outweigh the cost of that support. Our step-by-step guide on how to get FCA authorised covers the practical mechanics of avoiding these errors.

The second major cause of delay is a poor-quality regulatory business plan. The FCA's expectations for business plans are specific and demanding. The plan must demonstrate not only that the firm's business model is commercially viable but that the firm understands the regulatory risks inherent in its proposed activities and has designed its operations to mitigate those risks. A business plan that reads like a pitch deck, full of market opportunity analysis and revenue projections but light on regulatory substance, will generate detailed information requests that can add a long delay to the process. The FCA wants to see client journey maps, detailed descriptions of how advice or products will be delivered, conflict of interest analyses, and evidence that the firm has considered its obligations under the Consumer Duty. The plan should be written in clear, specific language rather than marketing prose.

The third and most avoidable cause of delay is slow responses to FCA information requests. When a case officer issues a requirement for further information, the firm must respond by the deadline the case officer sets. Many firms treat that deadline as a target and submit on the last day. This approach is counterproductive for two reasons. First, it extends the elapsed time when the information could often be provided much sooner. Second, it creates an impression of disorganisation or reluctance that colours the case officer's view of the entire application. Best practice is to acknowledge the information request promptly, agree a realistic timeline for response, and then deliver a comprehensive, well-evidenced response ahead of that timeline. Firms that adopt this approach tend to see shorter assessment periods and fewer follow-up questions.

Five Problems the FCA Itself Points To

The FCA's published good and poor practice on authorisation applications gives a useful list of what slows firms down. It also warns firms not to rely on consultants to the point where they cannot explain their own obligations. These five themes recur:

• Permissions that do not match the service. The FCA has seen good practice where firms set out how each permission applies to the activity, using legal advice or PERG. It expects the business model to line up with the permissions requested.
• Templated policies. The FCA criticises policies that are not tailored to the firm, repeat its rules instead of showing how the firm will comply, or do not fit together.
• People who cannot show capacity or understanding. Individuals with several roles need to show how they will split their time. The firm needs to show it understands its obligations without its consultant.
• Weak financial evidence. The FCA has seen historic accounts left out of the first submission, inaccurate figures and thin evidence of funding. It likes to see funding commitments and contingency plans.
• Technology described as something to be designed later. The FCA wants clear information on planned systems, including whether they are off the shelf, modified or custom, with realistic timelines.

Most of these can be found before you submit. Our guide to being ready, willing and organised sets out what the FCA means by those words, and the documents checklist lists what to have ready.

Worked Example: The Launch Date That Moves

A payments applicant plans to launch in March and submits in December. Its business plan says a safeguarding account and a third-party transaction monitoring tool will be live. Neither contract is agreed. During the assessment the FCA asks for evidence of the real arrangements.

The problem is bigger than a late signature. The missing contracts affect the funds flow, the risk framework and operational readiness, so several documents need to change together. Because the FCA says it expects you to demonstrate that your technology and systems are ready, a plan that treats them as future work is exposed. The better approach is to list those dependencies before filing, build in contingency, and keep one consistent description of the intended model. The FCA will not design the business for you.

Running the Questions Phase

Speed helps only when the answers are right. The FCA says its case officer will usually have follow-up questions, may ask for further documents and may hold a call or meeting, and that calls may be recorded. It also says it expects to deal with the firm directly, not with its adviser.

• Log each question, the concern behind it and the document that answers it.
• Name a factual owner and a reviewer for every answer. A consultant can coordinate, but management stays accountable.
• Check whether an answer changes the model, the permissions, the forecast or the policies.
• Update every affected document, not just the paragraph the FCA queried.
• Meet the FCA's response dates, and ask for clarification when a question is genuinely unclear.

The FCA does allow changes after submission, but warns that substantive changes which show you are not ready, willing and organised may lead it to ask you to withdraw and reapply.

The firms that move fastest through FCA authorisation are not the ones that rush. They are the ones that invest time in preparation to ensure that once the formal process begins, nothing slows it down.

Your Timeline Readiness Check

If these foundations are missing, your submission date may be too early.

• Activities and permissions have been checked and signed off.
• The customer journey and key provider arrangements are defined enough to describe.
• The regulatory business plan, policies and forecasts are final, consistent and signed off. The FCA says it will not review drafts.
• People and controller evidence is ready, and the named managers can explain the application themselves.
• One tracker covers open dependencies and, after filing, FCA questions.
• The commercial launch plan allows for assessment time that is not in your control.

Take the Complexity Out of Your Authorisation Timeline

The difference between a smooth authorisation and a frustrating ordeal is almost entirely determined by the quality of preparation before the application is submitted. At MEMA, we help firms prepare applications that are complete, consistent and ready to be assessed, with the regulatory infrastructure behind them. If you are considering FCA authorisation and want to ensure your timeline stays predictable, explore our FCA Authorisation service or read our detailed costs breakdown for 2026 to understand the full investment required.