UK Banking Licence: How to Get PRA and FCA Bank Authorisation

What a UK banking licence permits

Accepting deposits is a regulated activity where the money taken in is lent to others, or where the firm funds any other activity wholly or to a material extent from deposits or the interest on them (article 5 of the Financial Services and Markets Act 2000 (Regulated Activities) Order 2001). A firm doing this needs a Part 4A permission that includes accepting deposits.

A bank holds that permission as a credit institution that is not a building society, friendly society or credit union. Carrying on a regulated activity without permission breaches the general prohibition in FSMA section 19. Under section 23 that is a criminal offence, with up to two years' imprisonment, a fine, or both on conviction on indictment.

Most banks add other permissions to the same application, such as consumer credit lending, mortgage lending or payment services. The PRA and FCA assess the full scope in one process.

The New Bank Start-up Unit and pre-application

The New Bank Start-up Unit (NBSU) is the joint PRA and FCA team for firms considering a UK bank. Pre-application engagement is optional, offered at no charge and sits outside the statutory process. In practice it is where a strong application is shaped, and the regulators publish a three-stage path with target response times.

Full authorisation or the mobilisation route

There are two routes to a UK banking licence. Full authorisation means the bank is ready to trade without limits on the day it is authorised. Authorisation with restrictions, known as mobilisation, is aimed mainly at UK start-ups. The bank is authorised early, with a small deposit cap, and finishes building itself under supervision.

The NBSU states that information requirements for mobilisation are proportionate to the restrictions and that this route will likely result in a quicker authorisation. It is the route most new UK banks choose, because it lets the founders raise the main capital round and sign major suppliers once the licence is secured.

How mobilisation works

• - Total deposits are capped at £50,000 while restrictions apply
• - The bank must hold enough capital for its mobilisation capital requirement from day one, and capital held for that requirement cannot be spent on mobilisation costs
• - Mobilisation can take a few months and should take no longer than 12 months
• - Work completed in mobilisation: raising the full capital, finishing senior hires, finalising products, pricing and onboarding, building risk, compliance and internal audit, testing IT and outsourcing, and completing the recovery plan, business continuity plan and solvent exit analysis
• - The PRA and FCA receive monthly copies of board papers and regular progress reports
• - To exit, the bank applies for a Variation of Permission (a request to change its permission) through the FCA Connect system at least three months before the 12 month period ends. Assessment of that request usually takes at least three months

Capital: the legal minimum and what the PRA expects

The legal floor is set in the PRA Rulebook: €5 million for a bank, or the higher of €1 million and £1 million for a small specialist bank. A small specialist bank is one that provides current and savings accounts, lends to small and medium-sized enterprises or lends secured on residential property, and holds capital below the €5 million level.

The floor is rarely the binding number. The PRA expects a new bank to hold enough capital to meet its Pillar 1 requirement (the standard minimum ratios), its Pillar 2A requirement (extra capital the PRA sets for risks specific to the bank), its buffers and any MREL requirement (loss-absorbing resources for resolution) for at least 12 months after authorisation. For new banks the PRA buffer is sized to six months of projected operating expenses.

The bank sets out how it meets these in its ICAAP (Internal Capital Adequacy Assessment Process: the bank's own documented view of how much capital it needs and why) and its ILAAP (the same exercise for liquidity). The ICAAP must be approved by the board and updated at least annually. Proof of capital is required before authorisation and again before exit from mobilisation.

The PRA's simplified capital regime for Small Domestic Deposit Takers, part of its Strong and Simple framework, takes effect on 1 January 2027. New banks that meet its criteria plan their capital against that regime from the outset.

Senior managers and the board

Every bank operates under the Senior Managers and Certification Regime. Individuals in Senior Management Functions (SMFs) need regulatory approval before they start. The PRA reviews each application within 90 days of receipt, with the clock paused while it waits for information, and charges no fee for these applications.

• - Mandatory for every bank: SMF1 Chief Executive, SMF2 Chief Finance and SMF9 Chair of the Governing Body
• - Usually required as the bank grows: SMF4 Chief Risk, SMF5 Head of Internal Audit, SMF10 to SMF14 committee chairs and Senior Independent Director, and SMF24 Chief Operations
• - FCA functions: SMF16 Compliance Oversight and SMF17 Money Laundering Reporting
• - Entry into mobilisation: at minimum a CEO, a CFO or another executive director, and an independent Chair
• - Full authorisation or exit from mobilisation: a full executive team and board, with at least two independent non-executive directors described as good practice
• - By year three: at least three independent non-executive directors including the Chair, and a majority-independent board scaled to the bank's size

The documents in a strong application

The application goes to the NBSU with the non-refundable fee. The core of it is the Regulatory Business Plan, which the regulators expect to be independently reviewed and consistent with the ICAAP and ILAAP.

• - New bank application form for full authorisation, authorisation with restrictions, or a UK branch
• - Regulatory Business Plan: strategy and route to profitability, forecast balance sheet and income statement with key performance indicators, funding, owners and controllers, governance, risk and control framework, culture, customer journey, conduct risk and Consumer Duty, operational resilience, IT and outsourcing, scope of permissions and, where used, the mobilisation plan
• - ICAAP and ILAAP
• - Controller forms for each person who will own or control 10% or more, or exercise significant influence
• - Senior Managers Regime forms (Long Form A, Short Form A and Form M for notified non-executive directors)
• - UK holding company approval or exemption application, where a parent financial holding company is involved
• - FCA IT Controls Form
• - Board-approved recovery plan, plus solvent exit preparations, a Phase 1 resolution pack and the ability to produce a Single Customer View file (the FSCS depositor record) for a bank authorised without restrictions

Payment system access

The NBSU states that a new bank is unlikely to operate without access to a payment system, and asks applicants to plan this early. There are three routes: full direct access with a direct technical and settlement relationship, direct technical access, or indirect access through an Indirect Access Provider that acts as sponsor.

The choice shapes cost, IT build and the operational resilience section of the business plan, so it is settled before the draft business plan stage.

International banks: UK branch or subsidiary

An overseas bank can enter the UK through a branch or a UK-incorporated subsidiary. The PRA's approach is set out in Supervisory Statement SS5/21, and there is a separate branch application form. A branch suits wholesale business. A subsidiary is the route for retail deposit-taking, and it carries the full new bank expectations described on this page.