The regulatory business plan: what the FCA actually looks for
A single inconsistency between your financial projections and your regulatory business plan is enough to stall an FCA application clock indefinitely. At Compliance Consultant, we see dozens of financial services applications delayed because leadership teams treat the Regulatory Business Plan (RBP) as an investor pitch deck rather than an operational compliance baseline. The document serves as the foundation for your firm's regulatory perimeter, governance design, and capital adequacy under the Financial Services and Markets Act 2000 (FSMA). Case officers cross-reference this document against every supplementary policy, SMCR form, and liquidity forecast, meaning any gap between your commercial narrative and your supervisory obligations triggers immediate challenge.
Defining regulated activities before drafting a single page
The primary mistake applicants make happens before writing the opening executive summary. They draft a narrative describing commercial market share without first mapping specific commercial activities to the regulated permissions defined within the Financial Services and Markets Act 2000 (Regulated Activities) Order 2001 (RAO). The Financial Conduct Authority assesses applications strictly through the perimeter of these regulated activities. If the text of your business plan describes operating an investment platform, but your requested permissions do not include arranging deals in investments or safeguarding assets, the discrepancy renders your submission fundamentally flawed from day one.
Precision here dictates every operational requirement downstream. A firm developing an automated investment tool might assume it only requires advisory permissions, yet automated execution models typically encompass discretionary management. Conversely, a payment application operating under the Payment Services Regulations 2017 requires specific authorization as an authorized payment institution or registration as an account information services provider, which carries distinct safeguarding requirements separate from general credit brokerage. Applying for superfluous permissions introduces supervisory burdens and capital requirements that drain working capital; applying for insufficient permissions ensures that live trading constitutes an immediate regulatory breach.
Before any section of the business plan is drafted, map your end-to-end customer journey against specific RAO activities. Identify where client money is touched, who exercises discretion, and where execution takes place. This scoping exercise establishes the precise regulatory perimeter for the rest of your application. You can review our detailed walkthrough on scoping permissions within How to Get FCA Authorisation in 2026: A Step-by-Step Guide to establish this foundation correctly.
Why a commercial business plan fails the regulatory test
Commercial business plans and regulatory business plans serve opposing objectives. An investor-facing deck exists to showcase market upside, optimistic user acquisition trajectories, and aggressive revenue expansion. A regulatory business plan exists to demonstrate containment, risk management, and consumer protection. When applicants submit repurposed pitch decks, case officers encounter aggressive hockey-stick projections unsupported by operational infrastructure, triggering immediate concerns regarding capital adequacy and operational resilience.
Under its statutory duties set out in the About the FCA framework, the regulator takes a proportionate approach to supervision while actively seeking to detect market-wide harm. Case officers read your business plan looking for points of failure: what happens when customer acquisition quadruples overnight, how systems respond during outages, and how the firm survives prolonged trading downturns. A commercial document typically ignores downside risks or dismisses them as marketing obstacles. An RBP must quantify downside operational scenarios, complete with capital buffers and wind-down calculations.
Treating the RBP as a marketing exercise also compromises the tone required by the regulator. A commercial pitch emphasizes disruptive pricing or market aggression; a regulatory submission must explain pricing structures through consumer outcomes, transparent distribution, and fair value. If the document prioritizes market capture over compliance controls, the assessment team will conclude that senior management lacks a mature compliance culture.
| Dimension | Commercial Business Plan | Regulatory Business Plan (RBP) |
|---|---|---|
| Primary Objective | Persuade investors of upside potential and market share growth | Prove operational resilience, capital adequacy, and regulatory compliance |
| Growth Projections | Aggressive, optimistic forecasts showing rapid scale | Stress-tested, conservative forecasts tied to capital buffers and liquid resources |
| Customer Proposition | Broad total addressable market with marketing-focused acquisition hooks | Granular target market definition paired with a Consumer Duty fair value assessment |
| Risk Profile | High-level competitor risks, tech hurdles, and general commercial threats | Specific regulatory risk registers, financial crime vulnerabilities, and conduct risks |
| Governance Model | Lean operational team focused on agile execution and product velocity | Explicit SMCR allocations, documented reporting lines, and independent oversight |
| Wind-Down Planning | Typically omitted entirely or treated as insolvency mechanics | Comprehensive, actionable wind-down plan protecting client money and market stability |
The anatomy of a resilient regulatory business plan
A resilient RBP provides an exhaustive, mechanical explanation of how the business functions in day-to-day operations. Rather than presenting abstract statements, it documents operational workflows, data paths, client categorizations, and prudential reserves.
Governance and management structure
The FCA assesses whether the individuals directing the business possess the necessary competence and integrity to discharge their responsibilities. Under the Senior Managers and Certification Regime (SMCR), the business plan must document clear reporting lines, explicit allocations of Senior Management Functions (SMFs), and Prescribed Responsibilities.
Case officers examine whether the proposed compliance officer or head of risk holds adequate independence and authority. Presenting an organisational chart where the compliance officer reports directly to a commercial sales lead without independent board access indicates weak governance. Outline board committee structures, terms of reference, and decision-making thresholds in granular operational detail.
Compliance monitoring arrangements
An RBP must establish how the firm will oversee its own activities once authorized. The FCA looks for a fully developed Compliance Monitoring Programme (CMP) that details:
- The scope, methodology, and frequency of internal monitoring reviews
- The escalation mechanisms for reporting material compliance breaches directly to the board
- Clear allocation of testing duties, ensuring operational units do not mark their own homework
- Documented testing regimes for AML onboarding, sanctions screening, and complaint handling root-cause tracking
The operational approach must reflect a disciplined operational rhythm. When building frameworks for firms, we use an engage, execute, embed methodology: engage (establish regulatory requirements before infrastructure is built), execute (drive process and organisational change in parallel with technology development), and embed (integrate compliance into real-world operations through testing and scaling). If the business plan cannot articulate how monitoring will be carried out across daily transactions, the submission fails the threshold conditions.
Identifying and mitigating regulatory risks
Your business plan must contain a bespoke risk register reflecting the firm's actual operations rather than generic sector headings. Map every risk directly to its practical mitigation, identifying specific system controls, segregation procedures, and capital allocations.
If the firm operates an algorithmic trading or digital wealth platform, the RBP must document model drift safeguards, latency monitoring, and client appropriateness assessments. You can inspect an operational application of this documentation in our review of MIFIDPRU authorisation for a London wealth manager: The exact ICARA documentation. Address operational risk, third-party vendor failure, cyber resilience, and financial crime directly within the core risk narrative.
The cross-referencing trap and application rejection triggers
FCA internal figures show that approximately 1 in 4 FCA applications are rejected or withdrawn before authorization. Applications rarely fail because of a single drafting oversight; they fail because the case officer identifies systemic discrepancies when cross-referencing the RBP against secondary submission documents.
The formal statutory turnaround target for an application is 6 months for a complete application and 12 months for an incomplete one. However, while official guidelines cite these targets, the current typical processing range for mid-sized applications often extends well beyond initial expectations if case officers must issue repeated information requests. When a case officer identifies conflicting statements between your business plan and supplementary files, the application clock effectively pauses while remediation takes place.
Inadequate governance and SMCR gaps
The most frequent source of delays is friction between the RBP narrative and SMCR Form A applications. If the RBP states that the firm relies on proprietary algorithm design, yet the nominated individual for SMF3 (Executive Director) demonstrates no technical background in software governance, the application stalls.
Case officers systematically verify that the governance framework documented in the business plan aligns with:
- Statements of Responsibilities (SoRs) submitted for each senior manager
- The Management Responsibilities Map (for enhanced firms)
- The practical capacity of individuals holding multiple operational roles
- The independent reporting lines connecting internal audit or compliance directly to non-executive directors
If an executive is assigned conflicting duties—such as leading revenue generation while managing MLRO responsibilities—the case officer will challenge the conflict of interest.
Consumer Duty failures in practice
Under the Consumer Duty (Principle 12 and PRIN 2A), aspirational commitments to high standards carry zero weight. Case officers expect the RBP to outline operational evidence demonstrating good consumer outcomes across the four required outcomes: products and services, price and value, consumer understanding, and consumer support.
Applicants often stumble on fair value assessments. If your RBP models revenues that rely heavily on back-end transaction penalties, high cash interest retention margins, or opaque unbundled fees, the FCA will flag potential consumer harm. We examined the quantitative mechanics of these assessments in The 2026 Consumer Duty fair value benchmark: cash interest margins and tiered custody fees. Your business plan must present verifiable metrics showing how service charges correlate directly to delivery costs and client value.
Furthermore, if your financial forecasts anticipate significant revenue scale while customer operations staffing remains static, case officers will identify an immediate failure under the consumer support outcome. The RBP must model customer service capacity in proportion to projected user volumes.
Conducting a pre-submission assurance review
Attempting to identify internal contradictions within a 200-page application pack is remarkably difficult for the team that drafted it. Internal teams know their business model so intimately that they subconsciously fill in operational gaps, missing the fact that the written plan fails to articulate a required control.
A structured pre-submission review examines the entire filing through the lens of a regulatory case officer. At Compliance Consultant, we evaluate application packs against our proprietary 195+ point assessment framework, which audits the filing across:
- Threshold conditions and regulatory perimeter mapping
- SMCR governance structures and Statements of Responsibilities
- Financial crime controls and AML/CTF risk assessments
- Consumer Duty fair value methodologies and distribution frameworks
- Operational resilience, IT infrastructure, and third-party dependency mapping
- Prudential capital resilience, liquidity stress tests, and solvent wind-down planning
This audit surfaces omissions, numerical mismatches, and compliance policy gaps before the submission reaches the FCA. You can benchmark your submission's regulatory readiness by running through the FCA Application Readiness Questionnaire | 195+ Point Assessment, which outputs a clear RAG-rated diagnostic covering your critical risk areas.
Resolving contradictions between financial models, risk registers, and governance maps prior to submission eliminates the supervisory friction that inflates authorisation timelines. Treat the Regulatory Business Plan as a live architectural schematic for your firm's compliance operations—rigorous, self-consistent, and built to survive close inspection.
To identify gaps and contradictions in your Regulatory Business Plan before the regulator finds them, schedule an assessment with our advisory team. Visit Compliance Consultant to book a discovery review for your FCA authorisation application.