6.7 Regulatory Processes, Regulated Activities and Authorisation

A person cannot carry on a regulated activity in the UK by way of business unless they are authorised by the FCA (or PRA, where applicable), exempt, or otherwise outside the regulatory perimeter. The authorisation process — the gateway — is the FCA's first and most important consumer protection tool. This section sets out what counts as a regulated activity, how authorisation is obtained, and how it can be varied, suspended or cancelled.

Regulated Activities and Specified Investments

Section 22 FSMA provides that an activity is a regulated activity if:

• It is specified in an order made by the Treasury (the Regulated Activities Order 2001, or RAO)
• It is carried on by way of business
• It relates to a specified investment (also defined in the RAO)

The RAO has two key parts:

Part 1 — Specified Investments

The list of specified investments in Schedule 2 to the RAO includes:

• Deposits (bank accounts)
• Rights under a contract of insurance (life, general, long-term)
• Shares (equity)
• Bonds and other debt instruments
• Units in a collective investment scheme (e.g. OEICs, unit trusts)
• Options (including traded options)
• Futures
• Rights under a pension scheme
• Certificated securities and dematerialised securities
• Contracts for differences (CFDs)
• Cryptoassets (extended 2024 onwards)

Part 2 — Specified Activities

The activities that are regulated when carried on in relation to a specified investment include:

For mortgage advisers, the regulated activity most often engaged in is advising on regulated mortgage contracts and arranging or bringing about regulated mortgage contracts. The definition of regulated mortgage contract is in the RAO at paragraph 12A and Article 61.

The Authorisation Process

A firm must be authorised before it carries on a regulated activity. The application is made under s.31 FSMA. The FCA will grant permission only where it is satisfied the applicant meets the Threshold Conditions in COND 2.

The Five Threshold Conditions

Application Process

The standard application path is:

1. Pre-application — the firm engages with the FCA's authorisations team, often via the Innovate or Startup Support route
2. Application submission via the Connect system, including business plan, financial projections, governance, and details of SMF candidates
3. Case officer assessment — the FCA reviews and asks questions
4. Decision within 6 months for standard cases, 12 months for complex cases (s.41 FSMA)
5. Determination — permission is granted, granted with conditions, or refused

The FCA operates a ready, willing and organised test — a firm that is not yet ready to start business may be refused or have its application held.

Variation of Permission

Once authorised, a firm can apply to vary its permission under s.42 FSMA — to add a regulated activity, change the investments it can hold, or remove a limitation. Variations are assessed against the same Threshold Conditions and can take 6-12 months for significant changes. A variation of permission application is a serious undertaking — the FCA may reject it and the firm may need to cease existing business if its permissions are removed.

Notifications

Authorised firms must notify the FCA of certain changes under SUP 15:

• Change of control (s.178 FSMA) — change in ownership of more than 10%, 20%, 30% or 50% must be approved in advance
• Change of SMF holders — approval must be obtained before the individual starts (with the 12-week rule allowing performance pending approval)
• Notifiable changes in circumstances (SUP 15.3) — significant events affecting the firm
• Annual reports and accounts under SUP 16
• Form C (changes to approved persons), Form D (directories), and others under SUP 10
• Breaches of rules or regulatory concerns under SUP 15.3.10R

Approved Persons and SMFs

Under the SMCR, individuals performing Senior Management Functions must be approved by the FCA before performing them. Approval is sought via Form A (or the new digital equivalent from 2026). For certified staff, the firm itself certifies annually — no FCA approval is required, but the FCA expects robust certification processes and may take enforcement action against the certifying firm if certification is inadequate.

Permissions

A firm's permissions are recorded in the Financial Services Register. They specify:

• The regulated activities the firm may carry on
• The specified investments to which those activities relate
• Any limitations or requirements attached to the permission
• The date from which permission takes effect

The Financial Services Register is publicly searchable and is the authoritative source for confirming whether a firm or individual is authorised. Mortgage advisers, debt advisers and investment advisers should always be checked on the Register before transacting with clients.

Cancellations and Cessation of Authorisation

Authorisation can be lost in three ways:

• Voluntary cancellation — under s.40 FSMA, the firm applies to the FCA to cancel its permission, typically when it has stopped carrying on the activities and has no outstanding client money or assets
• Withdrawal by the FCA — under s.4 FSMA, the FCA can withdraw authorisation where a firm no longer meets the Threshold Conditions, has failed to use its permission for 12 months, or has breached rules seriously
• Intervention — the FCA can vary or suspend permissions under s.45 and s.55J FSMA as an interim measure while it investigates

When a firm ceases to be authorised, its clients are notified, and client money and assets are returned. If the firm is insolvent, the FSCS may step in to compensate eligible clients (e.g. up to £85,000 per firm for investments).

Why This Matters for Mortgage Advisers

For mortgage advisers, the relevant regulated activities are advising on, arranging, and bringing about regulated mortgage contracts (RAO paragraph 39, 25A). These activities can only be carried on by an authorised firm, and the individuals performing them must be approved (SMF) or certified by the firm under the SMCR. Holding a CeMAP qualification is a necessary but not sufficient condition — the individual must also be working for an authorised firm and must follow the rules in MCOB, COBS and the wider Handbook.

Key Takeaways

• A regulated activity under s.22 FSMA must be specified in the RAO, carried on by way of business, and relate to a specified investment
• Specified activities include advising, dealing, arranging, managing and administering investments
• Authorisation under s.31 FSMA requires the five Threshold Conditions in COND 2
• Firms can vary permission (s.42), must notify changes (SUP 15), and need SMF approval via Form A
• Authorisation can be lost by voluntary cancellation (s.40), FCA withdrawal (s.4) or intervention (s.45/s.55J)