Payment and E-Money Authorisation: Five Common FCA Application Weaknesses.

The faces behind the application matter

One of the most common issues arises when the authorisation project is delegated to project teams or junior staff with limited to no involvement from the individuals who will ultimately hold responsibility for running the business.

The FCA expects senior management and board members to understand the business model, regulatory obligations and key risks. When case officers engage with proposed senior members, it quickly becomes apparent whether they have actively participated in building the application.

Applications are generally stronger when senior management has been directly involved in shaping the business plan, governance arrangements, financial forecasts, risk framework and operating model. Firms should view the application process as an opportunity to demonstrate leadership capability, not as a documentation exercise.

Governance: accountability that survives scrutiny

Governance remains a key focus area for the FCA.

Many firms present governance arrangements that look acceptable on paper but do not withstand detailed scrutiny. Common issues include insufficient senior management resources, unclear reporting lines, an overreliance on one or two individuals and a lack of relevant experience among proposed directors or senior managers.

The FCA expects clear accountability. While activities may be delegated, responsibility cannot be. Governance structures where operational staff are carrying the burden of oversight while senior managers have limited involvement in monitoring or challenging outcomes are a key stumbling block.

Location also matters. The FCA expects firms to demonstrate meaningful management and control within the UK. Where the majority of key decision-makers are based overseas and have limited day-to-day involvement in the UK operation, questions around effective oversight often follow.

A well-written risk assessment is not enough

The FCA expects firms to demonstrate a genuine understanding of the risks associated with their business model, customer base, products, distribution channels and geographic footprint. This is particularly important for financial crime risk management.

Many firms adopt generic anti-money laundering frameworks that bear little resemblance to the actual risks they will face. Others place excessive reliance on their MLRO, expecting a single individual to manage all aspects of financial crime compliance without adequate resources or support.

The FCA increasingly looks for evidence that risk management has been embedded throughout the organisation. Firms should be able to articulate their risk appetite, explain how risks are monitored and demonstrate how management information supports decision-making and regulatory reporting.

Without this understanding, controls often become reactive rather than preventative, creating concerns about the firm’s ability to protect customers and the wider financial system.

The numbers don’t stack up

Financial resources remain one of the most underestimated aspects of the authorisation process. Applicants often assume demonstrating minimum capital is sufficient. In reality, the FCA expects firms to show that they have adequate funding, understand their ongoing capital requirements and can remain financially resilient under stressed scenarios.

Common weaknesses include an inability to evidence the source of funds, funding rounds that have not yet been secured, unrealistic revenue assumptions and limited understanding of how regulatory capital requirements should be applied and monitored.

These shortcomings often impact other areas of the application. Weak financial planning often results in inadequate wind-down plans, insufficient stress testing and a poor understanding of safeguarding requirements. This is particularly relevant given the FCA’s increased focus on safeguarding standards for payment and e-money firms.

The business is not Ready or Organised

Back to the point made at the very beginning of this article, and perhaps the most fundamental weakness is applying before the business is genuinely ready.

The FCA does not expect every process to be fully operational before authorisation. However, it does expect firms to demonstrate a credible and executable operating model. Applications supported by generic policies, untested processes and assumptions that are not backed by operational reality rarely get past the initial interview with the case officer.

Typical signs that a business is not ready include:

• No key hires in place;
• No defined governance structure;
• Limited oversight of outsourced providers; and
• No evidence that critical systems have been selected or implemented.

The result is an application that feels theoretical rather than practical.

Successful applications typically contain a clear regulatory business plan, identified key personnel, documented processes, defined oversight arrangements and a realistic roadmap for future growth. The FCA wants confidence that the firm can begin operating compliantly from the day it receives its authorisation.