Banking regulation and PRA authorisation

Operating a bank in the UK requires dual authorisation from the Prudential Regulation Authority (PRA) and the Financial Conduct Authority (FCA). This is not optional - accepting deposits without authorisation is a criminal offence under the Financial Services and Markets Act 2000 (FSMA).

The PRA supervises prudential matters including capital adequacy, liquidity, and risk management. The FCA supervises conduct matters including customer treatment, market integrity, and Consumer Duty compliance. You must obtain both authorisations to operate as a bank.

Which route is right for you?

• Choose Option A if you have full capital available from day one, are an overseas bank establishing a UK subsidiary, or need unrestricted operations immediately after authorisation.
• Choose Option B if you're a new bank with limited initial capital, need time to develop systems under live regulatory supervision, or want to test your business model before scaling up.

Most new UK challenger banks use Option B mobilisation to reduce initial capital requirements and develop their infrastructure during the 12-month restricted period. Once ready, they transition to full authorisation with unrestricted deposit-taking.

What this means in practice: Your bank must hold capital (shareholder equity and retained earnings) equal to at least 8% of your Risk-Weighted Assets (RWA). Higher-risk lending (unsecured personal loans, for example) carries higher RWA weighting than lower-risk lending (mortgages with substantial deposits).

The Capital Conservation Buffer adds another 2.5% requirement, bringing the practical minimum to 10.5% for CET1 capital. The FPC's system-wide benchmark of approximately 13% Tier 1 capital (11% CET1) reflects supervisory expectations for adequately capitalised banks.

Basel 3.1 implementation: From 1 January 2027, updated capital calculation methods take effect. Banks should begin preparations in 2025-2026 to ensure compliance with the new framework.

Practical implications for new banks:

• Before launch: Identify which roles are Senior Management Functions (SMFs). Typical SMFs include CEO, CFO, CRO (Chief Risk Officer), MLRO (Money Laundering Reporting Officer), and Compliance Oversight Function holder. Each SMF holder needs FCA/PRA pre-approval before starting their role.
• Statements of Responsibilities: Document exactly what each SMF holder is personally accountable for. These must be clear, comprehensive, and updated when responsibilities change.
• Certification roles: Identify staff in Certification Functions (typically customer-facing roles with significant influence). You must assess and certify annually that these individuals remain fit and proper.
• Conduct Rules training: Almost all staff must understand and comply with the Individual Conduct Rules. Build training programmes and monitoring processes to demonstrate compliance.

The 2025 reforms (expected mid-2026) will simplify certification requirements by removing duplicative role definitions, reducing the compliance burden for smaller banks.

What this means for new banks:

• Product design: Before launching current accounts, savings accounts, or lending products, demonstrate they meet identified customer needs. Conduct needs assessments and target market identification.
• Price and value: Regularly review whether customers are getting fair value. This isn't just about low prices - it's about reasonable price relative to the benefits provided and the costs of production.
• Clear communications: Test customer communications to ensure they're understandable. Avoid jargon and complex terms and conditions that obscure important information.
• Accessible support: Design support channels (phone, online chat, branch access) that meet customer needs. Monitor response times and resolution rates.

The FCA's 2025 focus areas (small business current accounts, credit card T&Cs, savings account disclosure) indicate where the regulator expects improvements. Build these considerations into your product development from the start rather than retrospectively fixing issues.

Your obligations:

• FSCS membership: Mandatory for all deposit-taking institutions. You'll pay annual levies based on your deposit base.
• Customer disclosure: You must inform customers about FSCS protection - the £120,000 limit, the per-person-per-firm basis, and that the limit applies across all accounts they hold with your bank.
• Excluded deposits: Certain deposits aren't protected (large corporations, financial institutions, public authorities). Make this clear to affected customers.

FSCS protection is a key competitive advantage for authorised banks versus unregulated payment institutions and e-money firms, which don't offer the same level of depositor protection.