12 August 2026 · 7 min read
The FCA continues to raise the evidential bar for new applicants. Gateway assessments are more forensic, case officers ask earlier and harder questions, and incomplete applications are increasingly returned rather than remediated in flight.
Threshold conditions come first
Before any detail is reviewed, the FCA asks whether the firm has an appropriate legal structure, adequate financial and non-financial resources, effective supervision arrangements and a genuine UK presence. Applicants relying on offshore operations with a nominal UK office continue to be refused.
In practice this means UK-resident decision makers, a real office, contracts in the applicant entity's name and capital that can be evidenced with bank statements rather than pledges.
The regulatory business plan carries the case
Your business plan must describe the customer, the money flow, the counterparties and the risks in plain language, with financial projections that reconcile to the model. Generic templates are recognised immediately.
- A clear description of every regulated activity you intend to carry on
- End-to-end money flow diagrams including safeguarding and settlement
- Three-year projections with base and stress scenarios
- An organogram showing who owns each control
AML frameworks must be firm-specific
A business-wide risk assessment, tailored customer due diligence procedures and demonstrable transaction monitoring rules are expected at application stage — not after authorisation. The FCA will test whether your policies match the business you have described.
Named individuals need to be ready
SM&CR candidates should expect an interview. Directors and the MLRO must be able to explain the model, the risks and their own responsibilities without reading from the application. We rehearse these conversations with clients before the case officer calls.
Plan for the questions, not just the submission
Most timelines slip in the response phase. Build in capacity to answer case-officer questions within days, with a single owner coordinating responses and a version-controlled document pack behind them.
