A variation of permission (VoP) is the FCA's approval to change what an authorised firm is allowed to do. Every FSMA firm holds a Part 4A permission that lists its regulated activities, the investments and client types they cover, and any limitations or requirements attached. The scope shown on the Financial Services Register should match what the firm actually does.
Payment and e-money institutions are authorised under the Payment Services Regulations 2017 and the Electronic Money Regulations 2011 rather than FSMA. Their equivalent is a variation of authorisation or registration. The process runs through the same FCA system, Connect, but the fees, capital and statutory periods follow those regulations.
The test is simple: does the planned activity fall within the firm's current permission? If it does not, the firm needs approval before it starts. The FCA states that beginning the activity before approval breaches its rules and can lead to enforcement action. Firms that want to add accepting deposits or effecting or carrying out contracts of insurance apply to the Prudential Regulation Authority instead.
| Firm | Common reasons to apply |
|---|---|
| Authorised payment institution | Adding payment services, such as moving from money remittance to payment accounts, card issuing or acquiring, or adding payment initiation or account information services |
| Authorised e-money institution | Adding payment services unrelated to issuing e-money, or adding payment initiation and account information services |
| Small payment institution or small e-money institution | Adding payment services within the small-firm limits |
| Investment firm | Adding dealing, arranging, managing or safeguarding and administering investments; taking on retail clients; holding client money |
| Consumer credit firm | Moving from limited to full permission, or adding lending, debt collection or debt administration |
| Insurance or mortgage intermediary | Adding advising, arranging or lending activities, or new product types |
Some changes need a different application. A small payment institution or small e-money institution that grows beyond the small-firm limits, or wants the wider rights of an authorised firm, applies for full authorisation; it cannot vary into one. A new owner taking 10% or more of the firm needs change of control approval. A new senior manager needs a separate senior manager application, which can run alongside the variation.
The FCA sets the fee by reference to its pricing categories, published on its variation of permission fees page and in Annexes 8 and 10 of the FEES 3 chapter of its Handbook. The fee is paid on Connect before assessment starts and is not refunded. The figures below use the 2026/27 categories (Category 2 £560, Category 3 £1,130, Category 4 £2,820, Category 5 £5,640).
| Variation | Fee |
|---|---|
| Firm stays in the same fee-block | £560 (Category 2) |
| Firm moves into one new fee-block | 50% of the new-firm application fee for that fee-block |
| Firm moves into more than one new fee-block | The highest of the relevant fees |
| Firm keeps or reduces its scope | No fee |
| Variation | Fee |
|---|---|
| Authorised payment institution adding payment services | £1,410 (50% of Category 4) |
| Authorised e-money institution adding services | £2,820 (50% of Category 5) |
| Authorised e-money institution adding payment initiation or account information services | £1,410 (50% of Category 4) |
| Small payment institution adding payment services | £565 (50% of Category 3) |
| Small e-money institution varying its registration | £565 (50% of Category 3) |
| Removing services only | No fee |
The payment institution fees apply regardless of how many agents the firm has. A variation can also change the firm's annual periodic fees, because those depend on the fee-blocks it sits in, so the new annual cost belongs in the business case.
FSMA gives the FCA 6 months to decide a complete application and 12 months from receipt to decide an incomplete one. Since January 2026 the FCA has measured itself against shorter targets, and it publishes the results each quarter in its authorisations service metrics.
| Application | Complete | Incomplete |
|---|---|---|
| Statutory maximum (FSMA) | 6 months | 12 months |
| FCA target: variation of permission | 4 months | 10 months |
| FCA target: variation close to the existing business | 3 months | 6 months |
| FCA target: payment and e-money variations | 3 months | 10 months |
In Q1 2026/27 the FCA's median time to determine a variation close to the existing business model was 44 days. For payment and e-money variations the median was 164 days, about 5.4 months, because adding services usually changes the firm's capital, safeguarding and financial crime controls. A variation that is well documented at the outset, with the systems already built, sits at the shorter end of these ranges.
The FCA treats a variation as a test of whether the firm will still meet the threshold conditions once it carries on the new activity. The case officer looks at the change itself and at the firm's record since authorisation.
A firm with a clean reporting record and a variation close to its current business gives the FCA the least to examine, which is reflected in the shorter target for adjacent variations.
For payment and e-money institutions a variation usually changes the prudential position as well as the permission.
Initial capital rises with the services held: €20,000 for money remittance only, €50,000 for payment initiation services and €125,000 for other payment services, set in euros by the Payment Services Regulations 2017. The FCA expects to see the higher capital in place, the own funds calculation updated, safeguarding extended to the new flows and transaction monitoring adapted to the new financial crime risks.
An e-money institution holds €350,000 initial capital. Where it adds payment services unrelated to issuing e-money, it calculates own funds for both activities, safeguards both sets of funds and shows how its governance covers each. The application should set out the combined capital and safeguarding position.
An authorised payment institution licensed for money remittance only holds €20,000 initial capital. To offer payment accounts and cards it applies to add the relevant payment services, and the fee is £1,410. The application shows initial capital of at least €125,000 in place, a revised own funds calculation, safeguarding extended to account balances, transaction monitoring updated for account-based activity and a revised wind-down plan. Once approved, its monthly safeguarding return and annual safeguarding audit under CASS 15 cover the new flows from the first day.
A small payment institution can add services within the small-firm conditions, including the average monthly payment transactions limit of €3 million. Above that, or to gain the wider rights of an authorised firm, it applies for authorisation; the firm's UK payment institution licence guide covers that application.
A variation is made on Connect, through the Part 4A variation forms for FSMA firms or the payment services and e-money variation forms. The case officer may ask for more. A complete application normally includes:
Systems descriptions need specifics: how transaction monitoring scenarios cover the new product, how safeguarding reconciliations include the new flows and which reports go to the board. Generic statements prompt follow-up questions that extend the assessment.
If the FCA proposes to refuse a variation, or to grant it on terms the firm has not agreed, it gives a warning notice and explains how to respond. A firm can withdraw an application before a decision by writing to its case officer. The firm's guide to applying for FCA authorisation explains the decision process in full.
The new permission brings new obligations from the first day. Regulatory returns may change in content and frequency, so reporting systems need to produce the new data from the date of approval. Annual fees can rise where the firm moves into new fee-blocks, and capital and safeguarding calculations must reflect the expanded business at once.
The FCA expects permissions to be used. It can cancel a permission that has not been used for 12 months, so a firm that adds an activity should plan to start it within that period. Senior managers taking on the new activity need their Statements of Responsibilities updated, and the firm's SM&CR guide covers what changes when responsibilities move.
For FSMA firms it is £560 in the same fee-block, or 50% of the new-firm fee for a new fee-block. An authorised payment institution adding services pays £1,410, an authorised e-money institution adding services pays £2,820, and small payment and e-money institutions pay £565.
The FCA targets 4 months for a complete application, 3 months for variations close to the existing business, and 3 months for payment and e-money firms. The statutory maximum is 6 months for a complete FSMA application and 12 months for an incomplete one.
No. The FCA states that carrying on the activity before approval breaches its rules and can lead to enforcement action.
No. There is no application fee where a firm keeps or reduces its scope, or where a payment or e-money firm only removes services.
No. A small payment institution applies for full authorisation under the Payment Services Regulations 2017 to become an authorised payment institution.
Only if the variation creates a new senior management function or moves responsibilities to someone not yet approved. That person's application can run alongside the variation.
Yes. The FCA can cancel a permission that has not been used for 12 months.
Buckingham Capital Consulting has obtained FCA authorisations and variations since 2013, including a variation of permission for Moneliq and payment and e-money licences for Nexpay, Orbital, Global Send, Dzing Finance and Hryze. The firm confirms whether a variation is needed, prepares the business case, forecasts, capital calculations and policies, and manages the FCA's questions through to approval.
Speak to an expert: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or info@buckinghamcapitalconsulting.co.uk.
This article is general information, reviewed against the regulator’s published requirements on the date shown. It is not legal advice; the regulator’s current publications take precedence.