FCA Authorisation for Fintech Startups: Routes, Timelines and Costs

TL;Dr

Financial Conduct Authority (FCA) authorisation is essential for fintech startups that want to offer regulated financial services in the UK. The right route depends on your business model: e-money, payment services, or cryptoasset activities. Application timelines vary, and the FCA’s Q1 2026/27 operating metrics reported a median of 219 days for authorisation applications. Startups should plan for application fees, regulatory capital, safeguarding, governance, and ongoing compliance before applying.

• FCA authorisation is based on your business activities. Fintech startups should identify whether their services fall under the Financial Services and Markets Act 2000, the Electronic Money Regulations 2011, the Payment Services Regulations 2017, or the upcoming cryptoasset regulatory framework.
• Payment institutions and e-money institutions follow distinct regulatory routes. Payment institutions are usually regulated under the Payment Services Regulations 2017, while e-money institutions fall under the Electronic Money Regulations 2011.
• FCA application fees depend on the type of authorisation. The applicable fee varies based on regulatory category and application type. Check the FCA’s latest application fee schedule before preparing your application.
• Regulatory capital requirements differ by licence type. Authorised e-money institutions usually need initial capital of about €350,000. Payment institutions have distinct capital requirements depending on the payment service they offer, as set out in Schedule 3 of the Payment Services Regulations 2017.
• Application timelines depend on complexity and completeness. The FCA states that complete payment institution and e-money institution applications are assessed within three months, while incomplete applications can take up to 12 months. Actual timelines can differ, as shown in the FCA’s authorisation service metrics.
• Safeguarding and record-keeping continue after authorisation. Payment and e-money firms should maintain appropriate safeguarding arrangements and meet applicable reconciliation and record-keeping requirements under CASS 15.

FCA authorisation is permission from the Financial Conduct Authority to carry on regulated financial activities in the UK. You need it if your startup provides payment services, issues e-money, arranges investments, or lends to consumers; from October 2027, offers cryptoasset services, unless a partner model or exclusion applies.

This guide helps CTOs and non-technical founders choose a route, estimate costs and timelines, and understand what the platform should do. It separates statutory deadlines from real outcomes.

Do You Need FCA Authorisation?

Yes, if you carry on a regulated activity by way of business in the UK and no exclusion applies. The law lists regulated activities, so the test is what your platform does with credit, money, cryptoassets, or investments, not how you describe your business. Serving UK customers from abroad can also bring you within scope.

Three layers apply. The Financial Services and Markets Act 2000 (FSMA 2000) restricts regulated activities without permission; Part 4A of FSMA 2000 grants that permission for credit, investments and, soon, crypto.

Payments and e-money sit under the Payment Services Regulations 2017 (PSRs 2017) and the Electronic Money Regulations 2011 (EMRs 2011). Financial promotions are also controlled, so you can’t market a regulated product unless an authorised firm approves it.

A remittance app offers payment services, and a wallet that stores balances issues e-money. An invoice finance platform may sit outside consumer credit rules if it lends only to companies, but sole traders can change that.

Taking deposits is a different regime. If you are planning a neobank, our guide to full banking licences covers that route.

Which FCA Permission Does Your Fintech Need?

The permission follows your business model. Holding customer balances points to e-money; moving money for others points to payment services; arranging investments points to Part 4A permissions; and lending points to consumer credit. Under the new regime, crypto services need FSMA authorisation; the table maps common models to routes.

If X, then Y:

• You hold customer balances: plan for an authorised EMI, or a small one under the limit.
• You move money between parties: use a payment institution for small amounts below €3 million.
• You only read bank data: register as an account information provider.
• You lend to individuals: seek consumer credit permission; marketplace models meet extra lending platform rules.
• You arrange or manage investments: seek Part 4A permissions or an appointed representative arrangement.
• You offer crypto services: plan for FSMA authorisation, not registration alone.

FCA Authorisation Routes Compared

EMI and payment institution routes carry the heaviest payment obligations; small registrations are lighter but capped, and credit, investment and crypto routes stay under different FCA rules. The table compares what each route allows: safeguarding, complexity, and capital. Complexity ratings are our experience-based view, not FCA classifications.

The FCA Authorisation Process, Step by Step

The FCA authorisation process runs from perimeter analysis to a decision, and your preparation largely decides how long it takes. You submit through Connect, the FCA’s online application system, with a business plan, governance, projections, safeguarding, and anti-money laundering evidence. The FCA then asks questions until the application is completed. These steps cover the usual FCA authorisation requirements.

• Confirm the perimeter and route. Get written advice on which permission fits.
• Use pre-application support. The FCA’s free pre-application support service (PASS) is open to payment, e-money, and crypto applicants; it offers no advice or guarantee. The FCA regulatory sandbox suits novel propositions but is no shortcut.
• Write the business plan and programme of operations. Explain customers, projections, money flows, and a wind-down plan. Prove governance, fitness, and propriety. Controllers, directors, and responsible persons are assessed; FSMA firms also name SM&CR roles.
• Evidence safeguarding and financial crime controls. Policies should fit working systems, with a credible money laundering reporting officer.
• Submit through Connect and pay the fee: It’s non-refundable.
• Answer FCA information requests, then receive a decision. If refused, the FCA’s refusal process applies.

How Long Does FCA Authorisation Take?

By law, the FCA has three months to decide a complete payments or e-money application and up to 12 months if it’s incomplete. In practice, the FCA’s published median for April to June 2026 was 219 days. Treat statutory deadlines as legal limits and observed medians as planning guides, not commitments.

These medians are observed results, not FCA commitments, and incomplete applications take longer. Preparation before submission is extra.

Download the FCA Authorisation Readiness Checklist to test your application before you submit.

How Much Does FCA Authorisation Cost?

The FCA application fee is only one cost line. As of November 2026, it runs from £1,130 to £5,640 for payments and e-money firms and is non-refundable. Regulatory capital, compliance staff, technology, legal advice, and ongoing fees add to it, so budget for all six lines below.

What the FCA Expects From Your Product and Technology

The FCA partly judges your application on whether your platform can confirm it protects customer money and manages risk. Safeguarding records, reconciliation, incident reporting, audit trails, data protection, resilience, and strong customer authentication should be designed in, not added later. Each requirement below demonstrates what it means for the build.

1. Safeguarding and Reconciliation

From 7 May 2026, new UK safeguarding requirements apply to authorised payment institutions (except payment-initiation-only or account-information-only firms) and authorised and small EMIs; small payment institutions may opt in under the FCA safeguarding rules. Expect internal and external reconciliation at least once every reconciliation day under CASS 15, a resolution pack, a monthly return within 15 business days of month-end, and an annual audit, unless exempt. The audit exemption applies if the firm has not been required to safeguard more than £100,000 at any time over at least 53 weeks, as explained in the FCA’s policy statement. Build segregated ledgers, automated reconciliation with exception queues, and exportable records.

2. Audit Trails

Books and records should be accurate and retrievable. Build append-only logs of payments, balance changes, admin actions, and access. Customer checks belong in the same trail; see KYC and AML compliance for fintech.

3. Incident Reporting

From 18 March 2027, FCA rules require payment service providers and Part 4A firms to report operational incidents through Connect. Build detection, severity classification, and a workflow that captures timelines and root cause.

4. Operational Resilience

Map critical services, test recovery, and track third-party dependencies. From 18 March 2027, authorised payment institutions and authorised EMIs should report material third-party arrangements under PS26/2.

5. Data Protection

UK GDPR applies. Accumulate only what you need, encrypt data, limit access, and set retention rules.

6. Strong Customer Authentication

The PSRs 2017, Regulation 100, require strong customer authentication when users access payment accounts online, perform certain risky remote actions, or initiate electronic payments, subject to specific exemptions. Build two-factor authentication, exemption logic, and fraud monitoring.

Common Reasons Applications Are Delayed or Refused

Delays usually start with incomplete and unconvincing applications. An application is complete only when the FCA holds everything it needs, and the 12-month limit applies. These eight issues commonly slow or sink applications, and you can fix them before submission.

• Incomplete submissions that compel the FCA to chase evidence.
• A business plan that doesn’t match how the platform moves money.
• Safeguarding described, not evidenced, against the rules in force since 7 May 2026.
• Weak financial crime controls or an under-resourced MLRO.
• Projections and capital that do not hold up, or no wind-down plan.
• Fitness and propriety concerns about directors, controllers or funding sources.
• No real UK presence: payment institutions need a UK head office.
• Unmanaged third-party dependency without oversight or exit plans.

Authorised Firm, Appointed Representative or Partner Model: Which Is Right?

Choose your authorisation for control, an appointed representative arrangement for FSMA activities such as investments, or a partner model for speed. Each option forces you to choose between freedom, time, and money. The right fit depends on whether the regulated activity is your core product, and whether a partner will accept the risk.

A partner doesn’t remove your own duties. See wider fintech compliance requirements before you decide.

How Nimble AppGenie Supports Your FCA Application

Nimble AppGenie builds the technology side of regulated fintech products. Authorisation is a legal and regulatory process that requires qualified advisers, and we don’t give legal advice or submit applications. We create the platform, controls, and documentation your adviser needs. Our fintech app development service covers:

• Compliance-ready architecture for your chosen permission.
• Audit logging for payments, balances, and admin actions.
• Safeguarding and reconciliation ledger with exception queues.
• KYC and AML integrations for onboarding and monitoring.
• Technical documentation for the application.
• Regulatory reporting for returns and incident reports.

Conclusion

FCA authorisation comes down to three things: choosing the right permission, submitting a complete application, and building a platform that proves its controls. Fees are modest, but capital, systems, and advice drive the real cost, and decisions take months, not weeks.

Your next step is to confirm your route with a regulatory lawyer, then scope the technology early so the application and the build stay aligned. Book a free fintech consultation, and we will map what the platform should do.

FAQs

These answers cover common founder questions about FCA authorisation, from timelines and costs to partner models. They reflect regulatory information as of 4 November 2026 and are general information, not legal advice, so confirm your position with a regulatory lawyer before you apply.

Niketan Sharma

Niketan Sharma, CTO, Nimble AppGenie, is a tech enthusiast with more than a decade of experience in delivering high-value solutions that allow a brand to penetrate the market easily. With a strong hold on mobile app development, he is actively working to help businesses identify the potential of digital transformation by sharing insightful statistics, guides & blogs.