Regulatory Authorization

Regulatory authorization is the formal permission that a financial regulator grants a company to carry on activities that the law reserves for approved firms, such as taking deposits, providing payment services, issuing electronic money, transmitting money, managing investments or offering crypto-asset services. Without it, carrying on those activities as a business is usually a criminal offence. Authorization is the gateway through which a firm enters the regulated sector and becomes subject to ongoing supervision. Some firms need no authorization because they are an exempt person.

Terminology differs by jurisdiction. The United Kingdom and European Union speak of authorisation or registration, the United States more often of a licence or charter, and many other countries use "licence" for the document that records the permission. In each case the substance is similar: the regulator assesses whether the firm, its owners and managers meet legal standards, and then records the activities the firm may perform, its permitted payment activities or equivalent, on a public register.

An authorization is specific, not general. It identifies the legal entity, the activities it may carry on, any limits on those activities, and often the jurisdictions in which it may operate. A payment institution in the European Union, for instance, is authorised for particular payment services; an electronic money institution is authorised to issue e-money and may also provide payment services; a US state money transmitter license covers money transmission in that state only. Activities outside the authorised scope require a new permission or a licence variation.

Authorization defines the regulatory perimeter for that firm. It also determines which rules apply, from capital and safeguarding requirements to conduct, reporting and anti-money laundering duties.

Although details vary, most authorization processes share common stages:

1. Preparation. The firm builds its compliance framework, policies, governance and financial plans, work sometimes called pre-compliance, and may hold a pre-application meeting with the regulator.
2. Submission. It files an application with a business plan, financial projections, descriptions of systems and controls, details of shareholders and beneficial owners, and information on directors and key staff.
3. Assessment. The regulator reviews the application, asks questions, may interview senior managers and tests whether the firm meets the legal conditions. Statutory deadlines often apply once an application is complete, but requests for information can pause the clock.
4. Decision. The regulator grants authorization, sometimes with conditions or restrictions, or refuses it. Some regulators signal approval in principle before final conditions, such as capital or bank accounts, are met.

Regulators look for evidence that the firm can be run safely and lawfully. Typical tests include adequate initial and ongoing capital, a credible business model, sound governance with clear lines of responsibility, effective risk management and AML compliance arrangements, arrangements to protect customer funds, and owners and managers who are fit and proper, meaning honest, competent and financially sound. Where a firm outsources key functions or relies on a group company, the regulator examines those arrangements too. Firms must usually show a genuine presence in the jurisdiction, with decision-making located there rather than abroad.

The depth of review generally rises with the risk of the activity. Deposit-taking banks face the longest and most demanding process, followed by e-money and larger payment firms, while small payment institutions and registered money services businesses usually face lighter requirements. Crypto-asset service providers are now subject to full authorization regimes in many jurisdictions, replacing earlier registration-only approaches.

Authorization brings continuing obligations. Firms must keep meeting the conditions they satisfied at application, report regularly, notify the regulator of significant changes and seek approval before a change of control or of key individuals. Supervisors check compliance through monitoring and examinations. In the European Economic Area, certain authorizations can be passported to other member states, a right covered under licence passporting.

Regulators can vary, restrict, suspend or cancel an authorization if a firm breaches its conditions, stops trading, or is found to have provided misleading information, usually as part of regulatory enforcement.

Not every firm needs its own authorization. Some operate as agents or distributors of an authorised firm, relying on that firm's permission, and some activities fall within exemptions such as limited networks or commercial agents. Regulatory sandboxes let new firms test products under restricted conditions. These routes reduce cost and time but tie the business to a partner or to narrow limits, and regulators have tightened oversight of agent and sponsorship models after problems with firms operating at the edge of the perimeter.