Variation of Permission (VoP): when and how

What a variation of permission actually is

A variation of permission is a formal change to the scope of your firm's Part 4A permission under the Financial Services and Markets Act 2000 (FSMA). Section 55H of FSMA gives an authorised person that is not a PRA-authorised person the right to apply to the FCA to vary its permission. Under that section a firm may apply to add a regulated activity to its permission, remove a regulated activity from it, or vary the description of a regulated activity already included. The same route can also be used to cancel a permission entirely.

The FCA describes the purpose plainly: a firm's scope of permission should accurately show the activities it carries out. Your permission is meant to be a live description of your business, not a snapshot from the day you were first authorised. As your firm grows, adds product lines, or steps back from certain activities, the permission should be kept in step. This firm-requested VoP under section 55H is separate from the FCA's own-initiative power to vary a permission, which is used by the regulator, not the firm.

Some changes are handled by the Prudential Regulation Authority (PRA) instead. Firms that are FCA-regulated or dual-regulated and want to add deposit-taking, effecting contracts of insurance, or carrying out contracts of insurance must apply through the PRA. If you are unsure which regulator owns the change, confirm before you start.

When you need a variation of permission

You need a VoP whenever your firm wants to change the regulated activities covered by its FCA authorisation. The FCA points to three common triggers: starting a new line of business, beginning a new regulated activity, and adding new product or client types. Each of these takes your firm beyond the boundary set by your existing permission.

In practice, the scenarios are broad. A firm might add a new regulated activity, such as an authorised payments firm offering an additional payment service. It might widen the customer types it can serve, or add investment types to an existing activity. It might also narrow its permission, for example by removing an activity it no longer offers so its authorisation reflects the business it actually runs.

The test is not whether the change feels large or small, but whether it moves you outside your current permission. Adding a genuinely new regulated activity clearly needs a VoP; refining or removing activities you already hold may too, because the permission's description would otherwise become inaccurate. If your intended change falls entirely within your existing permission, you may not need a VoP at all. When it is not obvious, check your permission on the Financial Services Register and, where doubt remains, discuss it with the FCA before you commit.

How to apply: the VoP process step by step

The FCA requires firms to apply for a VoP online through Connect, its application and notification system. Paper submissions are accepted only in rare circumstances, such as where a firm genuinely cannot use Connect, or during an extended system outage where a backup form is available. For firms whose application covers only credit-related regulated activities, the Handbook provides an alternative form.

SUP 6.3 of the FCA Handbook sets out the mechanics. Under SUP 6.3.15D a firm, other than a credit union, must apply online using the specified forms, and must inform the FCA of any significant change to the information given as soon as it becomes aware of it. The Handbook also advises firms to discuss the application with the regulator before submission, particularly where the variation is needed within a short timescale.

The content is partly fixed by statute and partly shaped case by case. FSMA requires the application to contain a statement of the regulated activities the firm proposes to carry on if its permission is varied. Beyond that, the FCA determines the supporting information it needs on a case-by-case basis, taking into account what it already knows about your firm.

Typical supporting material includes an updated business plan for the new activity, governance and compliance arrangements covering the expanded scope, organisation charts showing individuals in controlled or senior management functions, and financial information demonstrating you can meet the threshold conditions for all the activities you will hold. The more complete your submission, the less likely you are to face rounds of information requests that slow determination.

How long a VoP takes and how the FCA decides

The FCA works to statutory determination periods set by FSMA. It must decide within six months of the application being complete, and there is a longstop of twelve months from receipt of an incomplete application. The FCA says it processes most applications within these standards, decided at the earlier of six months from when it decides the application is complete, or twelve months from receiving an incomplete application.

In deciding a VoP, the FCA applies the same yardstick used at authorisation: the threshold conditions. SUP 6.3 explains that the regulator must be satisfied a firm satisfies, and will continue to satisfy, the threshold conditions in relation to all of the regulated activities for which it will have permission. Adding an activity therefore invites scrutiny of your resources, governance, and ability to run the new business soundly. The statutory clock is a maximum, not a target: incomplete applications reset expectations, so the Handbook's advice to include as much detail as possible and to engage supervisors early keeps determination on the shorter track.

Once it has determined the application, the FCA confirms the outcome. It may grant the variation as requested, grant it with limitations or requirements, or refuse it. A firm that disagrees with a proposed refusal, or with requirements the FCA intends to impose, has procedural protections under FSMA, including the right to make representations.

What a VoP costs

The FCA charges an application fee for most variations, and the amount depends on how the change affects your fee blocks. Where the variation stays within the same fee block your firm already pays, the FCA applies a fixed category fee. Where it moves your firm into a new fee block, the fee is 50% of the application fee a new firm would pay to join that block. If a variation would place you into more than one new fee block, the fee charged is the highest applicable amount rather than the sum. Where a variation only maintains or decreases the scope of your permission, for example removing an activity you no longer carry on, the FCA does not charge a fee.

Because fees are reviewed and published by the FCA, and category amounts change over time, you should always check the current fees in the FCA Handbook and on the FCA website before you apply. Payment is made at submission, by credit or debit card through Connect, or by cheque for the rare paper applications.

Fees are only part of the cost picture. Firms should also budget for the internal work and any professional support needed to prepare a complete application, since a well-evidenced submission reduces the risk of delay. For firms planning their permission strategy, structured support through Nasara Authorise can help map the change, assemble the evidence, and manage the Connect submission.

Common pitfalls and how to avoid them

The single most important rule is timing: you must not start the new activity until the FCA has approved the variation. Beginning a regulated activity you are not yet permitted to carry on is unauthorised business, a breach of the FCA's rules, and can trigger enforcement action. Plan launch dates around approval, not around your submission date.

The second frequent misstep is submitting an incomplete application. Because the FCA determines supporting information case by case, firms sometimes send a thin application and then face rounds of requests that push determination toward the twelve-month longstop. Providing a detailed business plan, clear governance, and full financials up front keeps the process on the shorter track. A related pitfall is applying to the wrong regulator or misjudging whether a VoP is required at all: deposit-taking and insurance activities generally route through the PRA, and some changes may already fall within your existing permission.

Finally, remember your ongoing obligation to keep the FCA informed. Under SUP 6.3 you must notify the regulator of any significant change to the information in your application as soon as you become aware of it. Treating the application as a live process, not a one-off form, keeps you compliant and helps the case officer reach a decision.

Conclusion

A variation of permission is the mechanism that keeps your FCA authorisation matched to the business you actually run. Whether you are adding a regulated activity, widening the customers or products you serve, or trimming activities you have stopped, the VoP is how you stay inside the legal boundary of your permission and avoid the serious consequences of unauthorised business.

The path is well signposted: confirm the change needs a VoP, prepare a complete and well-evidenced application, submit it through Connect with the correct fee, and wait for approval before you launch. Firms that engage early, apply the threshold conditions to their own plans, and keep the FCA informed give themselves the best chance of a swift, clean determination.

Frequently asked questions