FCA Permission: How to Check and Vary Yours
Your firm's permission is the list of regulated activities you are allowed to carry on. The FCA's rule about it is short: "Your firm's scope of permission should accurately show the activities it carries out." If the business has moved and the permission has not, the two have drifted apart — and the consequence is not a paperwork tidy-up.
The regulator states the risk in the same breath as the process: "Your firm cannot start the activities you've requested until we approve your application. If you do, this is a breach of our rules and we can take enforcement action."
This guide covers how to read what your permission actually says, the four situations that need a variation of permission (VoP), what one costs, and how long the FCA has to decide.
Where your permission lives, and how to read it
Your permission sits on the Financial Services Register, and the FCA's instruction is to go and look: "You should review your current permissions on our Financial Services Register and decide whether you need to vary a permission".
A permission is not a single label. It has three moving parts, and drift usually happens in the second and third rather than the first:
- The regulated activities — advising on investments, arranging deals, credit broking, and so on.
- The client and product or investment types each activity is expressed against.
- Limitations and requirements — restrictions attached to your permission, which can be as consequential as the activity itself.
The common small-firm failure is not "we do an activity we are not permitted to do". It is "we do a permitted activity for a client type or product our permission does not cover". That is why reading the whole entry matters rather than checking the headline activity list.
The statutory mechanism
Section 55H of FSMA gives the FCA the power on application: it "may, on the application of an authorised person who has a Part 4A permission but is not a PRA-authorised person, vary the permission by— (a) adding a regulated activity, other than a PRA-regulated activity, to those to which the permission relates; (b) removing a regulated activity from those to which the permission relates; (c) varying the description of a regulated activity to which the permission relates."
The same section also provides that the FCA "may, on the application of an authorised person who has a Part 4A permission but is not a PRA-authorised person, cancel the permission."
Three things follow from the wording. The variation is made on your application, so nothing happens because your business changed — you have to ask. Removing an activity is a variation in exactly the same way as adding one. And a PRA-regulated activity is not available through this route at all.
When you need a variation
The FCA lists the triggers. You should consider whether you need to vary a permission if you want to:
- "start a new line of business"
- "start a new regulated activity"
- "add a new product or client type to your business line"
The third trigger is the one that catches firms, because it does not feel like a change of business. Beginning to advise a client type you have not served before, or on a product outside your current description, can require a variation even though the underlying activity is one you already perform.
There is also a reducing case, which firms skip because nothing is being added. If your firm stops a business line or wants to narrow its scope, the FCA says to consider whether you should "remove the regulated activity in question", "change the client or product/investment types", or "add or delete a limitation or requirement".
It is worth doing. Carrying a permission you no longer use is not free — it shapes your fee block, your reporting, and the FCA's view of what your firm does.
One routing point: if you are dual-regulated and want to add accepting deposits, effecting contracts of insurance or carrying out a contract of insurance, the FCA directs you to "apply for a VoP through the Prudential Regulation Authority (PRA)". For the typical solo-regulated adviser or broker, this does not arise.
What it costs
Applications go through Connect — "You must use Connect to apply for a VoP" — with paper submissions accepted only in rare circumstances.
The fee depends on where you land relative to your current fee block. The FCA's structure is:
| Scenario | Application fee |
|---|---|
| Firm remains in the same fee block after varying | Category 2 |
| Firm moves into a new fee block | 50% of the fee for a new firm application for that fee block |
| Firm moves into more than one new fee block | The higher of any relevant fees |
| Firm is maintaining or decreasing its scope | No application fee |
Two features of that table matter for planning. Reducing scope is free, which removes the last excuse for leaving a stale permission in place. And the fee "must" be paid "before we start to process your application, and it's non-refundable" — so a rejected or withdrawn application does not return the money.
Actual amounts sit in the FCA's fees manual (FEES 3 Annex 1A for the charge per category, FEES 4 Annex 1A for the fee blocks) and are re-set periodically, so check the current figures rather than working from a number in an article — this one included.
The knock-on costs are easier to forget than the application fee. The FCA notes that "by increasing or reducing the scope of your permission, your firm's annual fees may change", and that "your firm's financial category, financial resource requirement and reporting requirements may change to reflect the new permission scope". A VoP can therefore change your capital requirement and your regulatory reporting, not just your activity list.
How long it takes
The FCA works to the FSMA determination periods: "We process most applications and make decisions well within FSMA's standards – this will be the earlier of: 6 months from when we decide that the application is complete 12 months of receiving an incomplete application (missing documents or information)."
Read the two limbs together, and read "the earlier of" carefully, because it is the part firms misread. The six-month limb does not start running until the FCA decides your application is complete. The twelve-month limb runs from the day the FCA received an incomplete application, and it is an outer backstop — being the earlier of the two, it can only bring the statutory deadline forward, never push it back. So gaps in a submission do not extend the clock; what they do is delay the point at which the six-month limb starts, which is the limb that actually gets most applications decided.
The process itself is three steps: Connect confirms receipt, a case officer is assigned and may ask for more information, and the FCA makes a decision. If the answer is going to be negative, "We'll send you a warning notice and/or let you know if we're going to: reject or refuse your application impose other requirements make other changes that you've not agreed to", along with how to appeal.
Practical steps for a small firm
- Read your Register entry in full, once a year. Activities, client and product types, and every limitation and requirement. Put it in the compliance monitoring plan so it happens on a date rather than on a prompt — see our compliance monitoring plan guide.
- Check the permission before you commit commercially. The lead time is measured in months, and you cannot start the activity until approval lands.
- Treat a new client type as a permission question, not just a suitability question.
- Review permissions you have stopped using — reducing scope carries no application fee.
- Budget the second-order effects, not just the fee: capital requirement, fee block, reporting.
- Submit complete. The six-month limb does not start until the FCA decides the application is complete — that is the part of the timetable you control.
- Keep the approval evidence with your governance records. The permission is the foundation everything else sits on; when a Senior Manager's Statement of Responsibilities describes a business area, the permission is what makes that area lawful. Our Statement of Responsibilities guide covers how those responsibilities are documented, and our SMCR plain-English guide sets out the wider framework.
Summary
- Your permission "should accurately show the activities it carries out" — drift between the business and the Register is the thing to look for.
- Starting a requested activity before approval "is a breach of our rules and we can take enforcement action".
- FSMA section 55H lets the FCA, on your application, add an activity, remove one, or vary the description — and cancel the permission entirely.
- Variation triggers: a new line of business, a new regulated activity, or a new product or client type on an existing line.
- Reducing scope is a variation too, and it is free.
- The fee is payable before processing and is non-refundable; amounts sit in FEES 3 Annex 1A and FEES 4 Annex 1A.
- Decision times run to the earlier of six months from when the FCA decides the application is complete, or twelve months from its receipt of an incomplete application — so completeness is what starts the six-month limb, and the twelve-month limb is an outer backstop rather than a penalty.
Last reviewed: 13 October 2026. This guide explains how FCA permissions and variations of permission work for small solo-regulated firms. It is general information, not regulatory or legal advice, and it does not describe a ConductLog product feature — ConductLog is validating demand for a tool that helps small FCA-regulated firms handle conduct and misconduct processes. Fees and fee-block categories change; check the current FEES manual and the FCA's variation of permission page before relying on any figure.