The verdict in three sentences
For a fintech seeking FCA authorisation, the application is won less on the customer app than on the internal control framework: a back office that detects, documents and proves. A custom compliance tool covering AML alerts, regulatory reporting, an audit trail and complaints handling costs roughly 52,000 to 120,000 GBP and ships in 5 to 8 months. Since March 2025 the FCA's operational resilience rules are fully in force, so impact tolerances and incident handling must be designed in from day one.
What the FCA actually expects
Hannah is head of compliance at a London fintech offering buy-now-pay-later for tradespeople and small retailers. The company currently operates as an agent of a partner authorised payment institution and is preparing its own application to become an authorised payment institution. Volume stands at 18,000 transactions a month and should triple within 18 months.
The application must show a proportionate anti-money laundering framework under the Money Laundering Regulations 2017, plus systems and controls under SYSC and the Payment Services Regulations 2017. Today alerts live in a spreadsheet, suspicious activity reports to the National Crime Agency are drafted by hand and nothing proves who approved what. That is the point where many applications stall or get withdrawn.
| Requirement | Current setup | Compliance back office |
|---|---|---|
| Customer due diligence (KYC) | Documents in a shared drive | Structured customer file, risk rating, periodic review |
| AML monitoring | Ad hoc manual checks | Configurable scenarios, scoring, alert queue |
| Alert handling | Shared spreadsheet | Analyst workflow, four-eyes approval, written rationale |
| Suspicious activity reports | Manual drafting | Assisted preparation, timestamps, 5-year retention |
| Audit trail | None | Tamper-proof log of every action |
| Customer complaints | Email inbox | DISP deadline tracking, FCA complaints return |
| Operational incidents | Not formalised | Register, classification, notification |
Detailed 2026 budget
| Module | Content | Indicative 2026 cost (GBP) |
|---|---|---|
| KYC and customer file | Documents, checks, risk rating, sanctions freeze | 9,000 to 19,000 |
| AML scenario engine | Rules, thresholds, scoring, sanctions lists | 13,000 to 30,000 |
| Alerts and SAR handling | Workflow, four-eyes, NCA export | 9,000 to 19,000 |
| Regulatory reporting | Periodic returns, safeguarding reconciliation, control dashboards | 7,000 to 17,000 |
| Complaints and FOS | Deadlines, templates, statistics | 4,000 to 10,000 |
| Security and resilience core | Access rights, logging, incident register, continuity plan | 10,000 to 25,000 |
| Total | Delivered in 5 to 8 months | 52,000 to 120,000 |
Budget each year for a penetration test at 7,000 to 13,000 GBP, a sanctions and PEP screening subscription (4,000 to 13,000 GBP depending on volume), UK or EU high-availability hosting (700 to 2,200 GBP per month) and maintenance at around 15 to 20% of the build cost.
The FCA's operational resilience framework requires firms to identify important business services, set impact tolerances, map dependencies and run scenario tests. Payment institutions also face strict safeguarding rules, tightened in 2025, with daily reconciliations. The back office should hold those registers and produce evidence without manual work. If you also passport services into the EU, the EU's DORA regulation applies to your EU entity.
Build or buy
Specialist screening and monitoring tools exist and often cost 1,700 to 7,000 GBP per month for an early-stage fintech. They cover list screening well, internal workflows, business-specific reporting and end-to-end traceability less so. The most common 2026 pattern combines a screening and identity verification vendor connected by API to a custom back office that orchestrates everything and produces the evidence the FCA expects.
Mini case study
Hannah compares two three-year scenarios. The first stacks three SaaS tools (KYC, monitoring, complaints) at 5,600 GBP per month, 201,600 GBP over 36 months, plus a half-time analyst consolidating evidence by hand at about 22,000 GBP a year, 66,000 GBP. Total: 267,600 GBP.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
The second pairs a custom back office at 95,000 GBP with a screening vendor at 1,000 GBP per month (36,000 GBP), hosting at 1,300 GBP per month (46,800 GBP), an annual pentest at 10,000 GBP (30,000 GBP) and maintenance of 16,000 GBP a year (48,000 GBP). Total: 255,800 GBP, with evidence produced automatically and a tool that scales with volume without licence increases.
FAQ
How long does FCA authorisation take?
The statutory deadline is 6 months from a complete application and 12 months from an incomplete one, but pre-application work often takes 6 to 12 months. A demonstrable control framework shortens that phase noticeably.
Must the back office be hosted in the UK?
Not necessarily, but you must document outsourcing, exit plans and data transfers. Many fintechs choose a UK region for 5 to 15% extra cost to simplify the narrative.
Is a pentest needed before authorisation?
Strongly advised: a recent penetration test report at 7,000 to 13,000 GBP reassures the case officer and feeds your resilience self-assessment.
How many AML scenarios should we start with?
An early-stage fintech often starts with 15 to 30 scenarios, then tunes them against the false positive rate, aiming below 90%.
Can the tool be reused after authorisation?
Yes, that is the goal: the same back office supports ongoing monitoring, internal audit and the FCA's regular returns.
Let's scope your project. Tell us about your model, volumes and application status: we define priority modules and a 5 to 8 month plan aligned with the FCA timeline. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
