Regulatory project management for authorisation, remediation and regulatory change.

An authorisation application is a programme of work, not a document. The FCA expects to see a firm that is ready to operate: a business plan and financial projections consistent with each other, capital in place, governance and people in post, policies that match the actual operating model, and outsourcing, safeguarding and financial crime arrangements that exist rather than being promised. Most delays come from inconsistency between these workstreams and from slow, incomplete answers to the FCA's questions.

We run the application as a single programme. We set the plan and the critical path, assign owners for each workstream, from the business plan and wind-down plan to the anti-money laundering framework and safeguarding arrangements, and check every document against the others before submission. After submission we manage the FCA's information requests, with a log of each question, owner, draft answer, review and response date, so the firm answers fully and consistently. Where the FCA asks for changes, we track them through to every affected document. We also plan the steps after authorisation, such as opening safeguarding accounts and the first regulatory returns, so the firm can operate from day one.

Read what it takes to make a successful FCA application

Remediation starts when the FCA identifies a problem: through supervisory findings, a request that the firm agree a voluntary requirement (VREQ), for example to stop taking new business until an issue is resolved, an own initiative requirement (OIREQ) imposed by the FCA, or a skilled person review under section 166 of FSMA. The FCA also uses attestations, in which a senior manager personally commits that a specific action will be, or has been, taken. Each of these turns a compliance issue into a programme with deadlines the FCA will hold the firm to.

A credible remediation programme has a clear scope linked to each finding, a root cause analysis rather than a list of symptoms, realistic milestones, named accountable owners and evidence that each fix works in practice. We build the plan, agree it with the board, run delivery and prepare the closure evidence for each action. Where a skilled person will verify the work, we make sure each action can be tested against the original finding, so the firm closes the issue at the first review rather than having it reopened.

See our section 166 skilled person review service

Regulators judge a programme by its governance as much as by its output. If the board cannot show that it understood the risks, made the key decisions and tracked delivery, the FCA will doubt the result even when the work is done. We set up governance in proportion to the size of the programme:

• Steering committee: chaired by the accountable executive, meeting on a fixed cycle, with decisions and actions minuted.
• RAID log: a single record of risks, assumptions, issues and dependencies, each with an owner, a rating and a due date.
• Plan and milestones: a critical path that shows regulatory deadlines, FCA submission dates and internal approval points.
• Board reporting: a short, regular report on progress, risks, decisions needed and evidence completed, written so non-executive directors can challenge it.
• Accountability: where the Senior Managers and Certification Regime (SM&CR) applies, each workstream is mapped to the senior manager responsible for it.
• Evidence library: every deliverable and approval filed so the firm can answer an FCA request quickly.

Buckingham Capital Consulting (BCC) was established in 2013 and has obtained more than 250 licences in over 60 countries for payment, e-money and crypto firms. That licensing work means we know, from the application stage onwards, the controls, people and documents that regulators, bank partners and auditors expect to find when they test a regulated firm.

We do not stop at the licence. BCC also arranges banking and runs compliance for regulated firms, so our advice reflects how a regulated business actually operates day to day: how its bank partners review it, how its regulator supervises it and how its own board needs to evidence control. Our aim is set out in one line: we open global markets to payment, e-money and crypto businesses, with the licences to enter, the banking to operate and the compliance to scale. If you are weighing your options, use the contact form to describe your firm and what you need, and we will reply with a proposed scope.