From process to proof: PRA and FCA reinforce expectations for Variations of Permission

In June 2026, the Prudential Regulation Authority (PRA) and the Financial Conduct Authority (FCA) invited dual-regulated firms and advisors to an industry seminar exploring the application process for firms wanting to vary their regulatory permissions. In this article, we explain the background to the topic and discuss key takeaways from the event.

A recent PRA/FCA industry seminar on variations of Part 4A permissions (VoPs) sought to support dual-regulated firms (or firms who are prudentially regulated by the PRA) in navigating VoP applications. The event highlighted key steps firms can take both to reduce the burden of preparing VoP applications and support timely determinations.  

Making regulatory processes such as VoP applications more accessible, transparent and predictable is part of the PRA and FCA’s shared agenda to advance their secondary international competitiveness and growth objectives. Other complementary regulatory initiatives include a concerted push to drive down application decision times and plans to enhance the PRA’s web guidance on the VoP process.

Key messages from the event

At the seminar, the PRA and FCA had the following key messages for dual-regulated firms:

• Legal basis: the law places a duty on us to properly assess your VoP application against minimum legal standards even if you feel a change in your regulated activities is not material relative to your other business lines.
• Not a “tick-box”: don’t assume that a VoP application is a purely administrative process; we’ll be looking at substantive risks to our objectives and will want adequate evidence to get comfortable.
• Pre-application engagement: tell us about your plans and ask what we’ll need before submitting a formal VoP application.
• Proportionate but focused evidence: Just as your own Board would need key details before signing off on a material proposal, we need to see clear evidence of readiness. This doesn’t mean a mountain of paperwork but clear and comprehensive coverage of the key issues – if you engage with us early, we’ll help you understand what these are.
• Readiness: be operationally prepared to start an activity before applying; you are not applying for permission to go away and build. Applying before you’re ready won’t make things go faster.
• Regulatory priorities: if you have outstanding remedial actions which we’ve requested, you’ll need to demonstrate that any new activity will not detract from remediation focus and agreed timeframe.

In this article, we’ll explain more about the background to Part 4A permissions, VoP applications and the regulators’ VoP assessment process, and reflect on the thinking behind these key messages.

Introduction to Part 4A permissions

Part 4A permissions under the Financial Services & Markets Act (FSMA) set the regulatory boundaries for the financial services activities each regulated firm can do. They take their name from the FSMA Part (Part 4A) which deals with regulatory authorisation. 

Part 4A permissions correspond to the “regulated activities” and “specified investments” listed in the Regulated Activities Order (RAO). The RAO is a piece of secondary legislation which sets the scope of UK financial regulation or the ‘regulatory perimeter’. It outlines those activities and investments covered by the ‘general prohibition’ (s. 19 FSMA). The general prohibition prevents firms from undertaking certain financial services activities in the UK unless they are authorised by regulators to do so (or otherwise exempt).

Before undertaking any of the regulated activities listed in the RAO, a firm must apply to the regulators for the relevant Part 4A permission.

Authorisation and applying for a first Part 4A permission

A firm becomes an authorised firm when it obtains its first Part 4A permission and ceases to be authorised when it no longer holds any Part 4A permissions.

If proposed activities include any PRA-regulated activities (e.g. accepting deposits or underwriting insurance contracts), authorisation applications are made to the PRA, with the FCA required to consent. Other applications are made to the FCA.

Before a Part 4A permission is granted, the applicant must be able to demonstrate to the regulators that they meet the Threshold Conditions (or minimum gateway standards set out in law) to be authorised. The Threshold Conditions can be found in Schedule 6 of FSMA.

A dual-regulated firm must satisfy both regulators’ Threshold Conditions.  The Threshold Conditions for authorisation by the PRA are slightly different than those for authorisation by the FCA. However, PRA and FCA Threshold Conditions share common principles; a firm must have appropriate resources (both financial and non-financial), be run by people with the right skills and standards of behaviour and be capable of being effectively supervised by the relevant regulator(s).

Each Part 4A permission granted to a firm will indicate the relevant regulated activity, the specified investments covered by the activity and any limitation on the clients a firm can serve for the activity. For example, a firm may have permission to advise on investments but only in respect of shares and units, or to accept deposits but only from wholesale clients. You can see the Part 4A permissions a firm holds, together with details of any limitations or permitted client types, on the Financial Services Register.

Introduction to VoP applications

As authorised firms develop their business models, the regulated activities they do might change. Business lines may be discontinued and others prepared for launch.

Under the regulatory system (s. 55I FSMA for dual-regulated firms), such changes trigger the need for authorised firms to apply to vary the Part 4A permissions they hold; that is, to remove permissions no longer used, to request one or more new permissions before starting new regulated activities or to vary a limitation currently applied to an existing Part 4A permission.

VoP applications for dual-regulated firms are made to the PRA. The FCA must also consent to the application. Applications are usually made via the Connect electronic system, although credit unions may use a paper form. 

PRA and FCA approach to VoP applications for dual-regulated firms

Mirroring the process for initial authorisation, the PRA and FCA will assess VoP applications by dual-regulated firms against their respective Threshold Conditions.

The regulators are keen to stress that their assessment of VoP applications is substantive and not just a “tick-box” exercise. The PRA and FCA will assess any risks to their respective objectives from an application and will need to see evidence of how a firm intends to mitigate these. For example, if an application seeks to remove permissions for an activity, the PRA would want to gauge any financial impacts from ceasing that business line, whilst the FCA might focus on how the firm intends to communicate its plans and mitigate any impact on customer outcomes.

Due to the structure of the regulatory framework, the regulators are under a duty to assess applications to add a new Part 4A permission based on the full regulated activity that a firm would be permitted to undertake when holding that permission. This means that a relatively small, incremental change to a firm’s business model which requires a new permission would still attract substantive regulatory scrutiny.

However, within this constraint, the regulators are committed to a risk-based and proportionate approach. There is likely, for example, to be more intensive oversight of applications to add new activities or remove limitations than of applications to remove permissions. Regulators will also consider the extent to which proposed activities require capabilities and resources which the firm does not currently deploy.

The Authorisations function at the PRA will lead on assessing VoP applications for dual-regulated firms, with close collaboration with FCA counterparts. A case handler in PRA Authorisations will be the primary contact with the firm. Authorisations at both the PRA and the FCA will keep their respective Supervision departments informed and ask them for input as needed. In the PRA (where firms will have designated supervisors), Supervision may play a more significant role in assessing VoP applications, particularly where there are more complex risks or interactions with existing issues at a firm.

Regulatory assessment of VoP applications

At the seminar, the regulators explained that, when assessing an application to add new activities or remove a limitation against Threshold Conditions, they need to see clear evidence that a firm is “ready, willing and organised” to deliver a new or expanded activity. 

• Ready: An applicant firm should have analysed proposed new activities and correctly identified the Part 4A permissions needed. Documentation should be in final form and any necessary internal testing and governance completed.
• Willing: Firms should be open and honest about their plans. They should also have resources available to respond promptly to regulators’ questions during the application period and to make any necessary changes to their plans or application. However, the regulators were clear that they do not expect to see firms submitting low-quality applications with the expectation that the regulators will coach them to plug any gaps.
• Organised:  An applicant firm should be ready to comply with its regulatory obligations for the new activity from Day 1. Preparations should not be at a formative stage but developed to the point where a firm would be ready to deliver the new activity tomorrow if an application was approved. This includes having any relevant IT infrastructure and compliance, audit and reporting controls in place.

Common problems with VoP applications

During the event, the PRA and FCA cited several issues which frequently cause problems or delays with VoP applications.

• Lack of pre-application engagement: Applications which land unannounced are often weaker. This is because firms have not had the benefit of a steer from the regulators about potential areas of concern or the evidence which they will want to see.
• Lack of context: The case handlers for VoP applications will be based in the Authorisations department at the PRA and FCA. They may not have day-to-day familiarity with the firm and the context for the application. Failing to provide any background or context on the reasons behind the VoP application will mean it takes longer for a case handler to gather that information from data sources and Supervision colleagues before moving an application to the next stage.
• Unclear timetable or inadequate lead times: Firms are not always clear about business-critical milestones for their application such as a firm’s pre-planned launch date. Advising the regulators early in relation to any planned timing constraints will make it more feasible for them to accommodate these. Firms also tend to underestimate the time it takes to complete an application and have it determined. Firms should make sure they are realistic on timeframes when planning for activities which will require new Part 4A permissions.
• Premature applications: Firms sometimes think that applications will be determined quicker if they submit them at the earliest opportunity, even if some elements of the application are then provisional or incomplete. The statutory time periods for the regulators to process an application do not start to run until the application is complete. Firms are unlikely to gain anything by submitting applications prematurely and may undermine confidence in their capability by doing so.
• Lack of evidence of required capability: Applications can lack clear evidence that firms have benchmarked their expertise, operational capability and regulatory compliance against prerequisites for a new activity. The evidence that regulators need to assess a VoP application will align closely with the submissions a firm’s Board would expect to see before signing off on a new business line. Make sure your application covers the ground, is coherent and supported by evidence.
• Firm bandwidth: The regulators may have concerns if a firm is applying for new activities at the same time as undertaking remediation work to address regulatory compliance issues with its existing activities. There would need to be compelling evidence that similar compliance weaknesses would not also arise with new activities, and that expansion of activities would not prove a distraction from timely delivery of a remediation project.

Our top takeaway

So, if you are a dual-regulated firm looking to apply to the PRA to vary your permissions, what learnings should you take away from this industry event?

Pre-application engagement is vital. If you let regulators know of your plans early, there will be no surprises. Regulators will do initial thinking on any concerns, allowing them to tell you the areas on which they will want assurance, suggest the type of evidence they will need and even front-load assessment work. Focusing on preparing the right evidence on the right issues will, in turn, cut your own time and costs of preparing the subsequent application and make it more likely that it’ll be approved.

Yet engaging early doesn’t mean rushing to apply. When you submit a VoP application, you should be confident that you are “ready, willing and organised” and could commence operations as soon as your application is determined. Your application should set out convincing evidence that your proposed activities will not present any out-of-tolerance regulatory risks. Apply the same rigour you employed to get approval for new activities from your Board to preparing your VoP application. Expect similar scrutiny.

Our number one takeaway is: Engage early, apply ready.