What the application has to prove
An investment firm application is judged on three things: that the business model is coherent and the firm can explain how it makes money; that it holds enough capital and liquidity for what it does, and will go on holding it; and that the people running it are fit and proper, with the time, knowledge and authority to run it. Everything in the application exists to evidence one of those.
The business model and the permissions
Each regulated activity and each type of investment has to be justified by what the firm will actually do, and the permissions sought have to match the business plan line for line. Asking for too much does as much damage as asking for too little.
Capital and the prudential regime
In the UK, MIFIDPRU sets the firm's permanent minimum capital by activity, and its own ICARA process has to show that it has assessed what could go wrong and holds enough to cover it. In the EU the equivalent sits in the Investment Firms Regulation and Directive. Projections that do not reconcile to the capital calculation are one of the commonest reasons an application stalls.
Senior managers and governance
Every senior management function needs the regulator's approval before the person performs it, with a clear statement of what they are responsible for. The board, its committees and the lines between the front office, risk and compliance have to exist on paper and in practice.
Client assets and conduct
Where the firm will hold client money or safeguard client assets, those arrangements are examined closely. Best execution, conflicts of interest, product governance and — where retail clients are served — the Consumer Duty all have to be addressed in the firm's own terms, not the handbook's.
Financial crime
An anti-money-laundering framework proportionate to the client base and the products: a business-wide risk assessment, customer due diligence, sanctions screening, and a money laundering reporting officer who understands the business.
Variations of permission
An authorised firm that wants to do more — a new activity, a new type of investment, retail clients where it had only professional ones, client money for the first time — applies to vary its permission. The regulator treats a significant variation much as it treats a new application, and reads it against everything the firm has told it before. We start with that history.
Adding a different kind of permission follows the same route. The most common is consumer credit: an investment firm whose model involves lending to or arranging credit for consumers needs full consumer credit permission alongside its investment permissions.
Cyprus and Malta
A Cyprus Investment Firm licence from CySEC, or an investment services licence from the MFSA in Malta, carries a passport into the rest of the EU and the EEA — and with it a regulator that expects substance: local management, a real office, and decisions taken where the licence is. We have worked a CySEC authorisation from the inside, and know where these applications spend their time.
Where a firm needs a UK authorisation and an EU one, we plan the two together, so that the business model, the capital and the people line up across both.