Tech Sector Licensing and Authorisations

Guide summary

Check if your tech business needs licences from the FCA, Ofcom, ECJU, or ICO. Apply for FCA authorisation if you handle payments or e-money – fees range from £500 to £25,000. Notify Ofcom if you provide telecoms services, and get an export licence from ECJU for controlled technology or cryptography over 56-bit (penalty up to 10 years in prison).

Register with ICO and do a Data Protection Impact Assessment for high-risk processing
Apply for FCA authorisation for payment services – fees £500 to £25,000, timeline 3–12 months
Use FCA’s Small Payment Service registration if processing under €3m per month
Notify Ofcom as a Communications Provider – no fee but annual charge based on turnover
Get an Ofcom spectrum licence to transmit radio signals – fee £50 to £100,000s
Check ECJU export licences for dual-use, cryptography over 56-bit, or technical assistance
Apply for OFSI sanction licence if providing tech to designated persons or sanctioned countries
Ensure MHRA registration for medical or health technology products
Comply with enhanced data protection rules for EdTech processing children’s data
Keep records of all licences and renewals to avoid penalties

Understanding licensing requirements

Technology businesses may require multiple licences and authorisations depending on their activities. The requirements you face depend on what your business does:

Payment or financial services: FCA authorisation or registration (see Financial Services below)
Telecommunications provider: Ofcom notification and possible spectrum licensing
Export controlled technology: ECJU export licence for dual-use items or cryptography
Medical or health technology: MHRA device registration
EdTech processing children's data: Enhanced data protection requirements

Data protection registration and assessments

Before processing personal data, you may need to conduct a Data Protection Impact Assessment (DPIA) for high-risk processing activities.

Data Protection Impact Assessment (DPIA)

Data Protection Impact Assessment (DPIA) - Data processing (high-risk activities)

Regulator: Ico
Typical fee: None (internal assessment)
Frequency: as needed
Legal basis: UK GDPR Article 35

Required before processing likely to result in high risk to individuals' rights and freedoms. Mandatory for systematic monitoring, large-scale processing of special category data, or automated decision-making with legal effects. Must consult ICO if risks cannot be mitigated.

Financial services authorisations

If your tech business provides payment services, issues e-money, or offers other financial services, you need FCA authorisation or registration. The route depends on your activities and scale.

FCA Full Authorisation

FCA Full Authorisation - Regulated financial services

Regulator: Fca
Typical fee: £1,500-£25,000 application fee
Timeline: 6-12 months
Frequency: one time
Legal basis: Financial Services and Markets Act 2000

Required for deposit-taking, insurance, investment services, and consumer credit. Stringent capital, governance, and systems requirements. Consider Regulatory Sandbox for testing innovative products. Initial application fee varies by permission type; ongoing annual fees apply.

FCA Payment Services Registration

FCA Payment Services Registration - Payment services (account information/payment initiation)

Regulator: Fca
Typical fee: £1,500 application fee
Timeline: 3-6 months
Frequency: one time
Legal basis: Payment Services Regulations 2017

Required for payment initiation services (PIS) and account information services (AIS). Lower barriers than full authorisation - no capital requirement for AIS, €50,000 initial capital for PIS. Must comply with Strong Customer Authentication (SCA) requirements.

Small Payment Institution Registration

Small Payment Institution Registration - Small-scale payment services (<€3m per month)

Regulator: Fca
Typical fee: £500 application fee
Timeline: 3-6 months
Frequency: one time
Legal basis: Payment Services Regulations 2017

Simplified registration for payment services processing under €3 million per month average over 12 months. Limited to UK only (no passporting). Safeguarding and governance requirements apply but no minimum capital. Annual fee £250.

E-Money Institution Authorisation

E-Money Institution Authorisation - Electronic money issuance

Regulator: Fca
Typical fee: £5,000 application fee
Timeline: 6-12 months
Frequency: one time
Legal basis: Electronic Money Regulations 2011

Required for issuing stored-value products (e-wallets, prepaid cards). Minimum capital: €350,000. Must safeguard customer funds. Small EMI regime available for average outstanding e-money under €5 million (£1,500 application fee, no minimum capital).

FCA Appointed Representative Status

FCA Appointed Representative Status - Representing an authorised firm

Regulator: Fca
Typical fee: None (sponsor firm pays)
Timeline: 1-3 months
Frequency: one time
Legal basis: Financial Services and Markets Act 2000, Section 39

Allows conducting regulated activities under supervision of an authorised principal firm. Principal firm registers you with FCA (no application fee for AR). Principal liable for your regulatory compliance. Cannot take deposits or hold client money.

Telecommunications authorisations

Businesses providing electronic communications networks or services need Ofcom authorisation.

Ofcom General Authorisation

Ofcom General Authorisation - Telecoms network provision or services

Regulator: Ofcom
Typical fee: None (notification only)
Timeline: Immediate (self-certification)
Frequency: one time
Legal basis: Communications Act 2003; Electronic Communications Code

All providers of electronic communications networks or services automatically authorised under General Authorisation. Must notify Ofcom via online form. Annual administrative charge applies (£50-£1,000s based on turnover and services). Must comply with General Conditions of Entitlement.

Ofcom Numbering Allocation

Ofcom Numbering Allocation - Telephone numbering allocation

Regulator: Ofcom
Typical fee: £200-£1,500 per number range
Timeline: 4-6 weeks
Frequency: as needed
Legal basis: Communications Act 2003; National Telephone Numbering Plan

Required for allocating telephone numbers (geographic, non-geographic, mobile, freephone). Must be a Communications Provider notified under General Authorisation. One-off application fee plus annual administration charge. Unbundled tariff number rules apply for 084/087 ranges.

Ofcom Spectrum Licence

Ofcom Spectrum Licence - Radio spectrum use

Regulator: Ofcom
Typical fee: Varies (£50-£100,000s)
Timeline: 4-12 weeks
Frequency: as needed
Legal basis: Wireless Telegraphy Act 2006

Required for transmitting radio signals. Types: Business Radio (Simple UK, Simple Site, Technically Assigned), Fixed Links, Satellite, Mobile Spectrum. Some exempt uses (low power devices, Wi-Fi). Fee depends on frequency, power, and location. Annual renewal fees apply.

Export controls and sanctions

Tech businesses exporting controlled technology, software, or cryptography may need export licences.

ECJU Export Licence (Dual-Use)

ECJU Export Licence (Dual-Use) - Export of controlled cryptography or dual-use items

Regulator: Ecju
Typical fee: None
Timeline: 4-8 weeks (standard), up to 90 days (complex)
Frequency: as needed
Legal basis: Export Control Order 2008; assimilated Council Regulation (EC) No 428/2009 for Great Britain; Regulation (EU) 2021/821 for Northern Ireland

Required for exporting controlled goods, software, or technology listed in UK Strategic Export Control Lists. Cryptography over 56-bit may require licence. Check SPIRE system for licensing requirements. Some items covered by Open General Export Licences (OGELs). Penalties up to 10 years imprisonment.

Trade Sanctions Licence

Trade Sanctions Licence - Provision of technical assistance to sanctioned countries

Regulator: Ofsi
Typical fee: None
Timeline: Varies (emergency to 90 days)
Frequency: as needed
Legal basis: Sanctions and Anti-Money Laundering Act 2018; Russia Regulations 2019 (and others)

Required for providing technology, software, or technical assistance to designated persons or sanctioned territories (Russia, Iran, North Korea, etc.). Applies to cloud services, software updates, and technical support. Check OFSI Consolidated List before contracting with foreign entities.

End-User Undertaking

End-User Undertaking - End-user assurance for controlled tech

Regulator: Ecju
Typical fee: None
Timeline: Part of export licence application
Frequency: as needed
Legal basis: Export Control Order 2008

Written assurance from end-user about intended use of controlled goods. Required for most dual-use export licence applications. Must specify end-use, confirm no military/WMD end-use, and commit not to re-export without permission. Template available from ECJU.

Intellectual property protection

Protecting your software and brand through IP registration.

UK Patent Application

UK Patent Application - Patent protection (UK)

Regulator: Ipo
Typical fee: £405 (application + search + examination from April 2026)
Timeline: 2-4 years to grant
Frequency: as needed
Legal basis: Patents Act 1977

Protects inventions (technical innovations with industrial application). Must file before public disclosure. Annual renewal fees from 5th year (£70 year 5, up to £610 year 20). Consider Patent Box tax relief (10% effective rate on patent income). Software "as such" not patentable but technical effect can be.

UK Trade Mark Registration

UK Trade Mark Registration - Trademark protection (UK)

Regulator: Ipo
Typical fee: £170 (online, 1 class)
Timeline: 3-4 months (if no opposition)
Frequency: as needed
Legal basis: Trade Marks Act 1994

Protects brand names, logos, and slogans. Valid 10 years, renewable indefinitely. Additional classes £50 each. EU and international registrations separate (EUTM, Madrid Protocol). Must use within 5 years to maintain protection. Renewal fee £200 every 10 years.

UK Registered Design

UK Registered Design - Design protection (UK)

Regulator: Ipo
Typical fee: £60 (online)
Timeline: 1-2 months
Frequency: as needed
Legal basis: Registered Designs Act 1949

Protects visual appearance of products. Must be new and have individual character. Valid 5 years initially, renewable up to 25 years (£130/5 years, £210/10 years). Automatic unregistered design right also exists (10-15 years, no registration needed).

Sector-specific registrations

Some tech sub-sectors have additional registration requirements beyond the general obligations above.

MHRA Medical Device Registration

MHRA Medical Device Registration - Medical device software (UK market)

Regulator: Mhra
Typical fee: Varies by device class
Timeline: 6-18 months
Frequency: one time
Legal basis: Medical Devices Regulations 2002 (as amended); UK MDR 2024

Software as a Medical Device (SaMD) requires MHRA registration. Classification depends on risk (Class I, IIa, IIb, III). Class I can be self-certified; higher classes need Approved Body assessment. Must appoint UK Responsible Person. UKCA CE-marked legacy MDD/AIMDD devices can be placed on the Great Britain market until certificate expiry or 30 June 2028, whichever is sooner. Devices compliant with the EU MDR or IVDR, and IVDs compliant with the EU IVDD, can be placed on the market until certificate expiry or 30 June 2030, whichever is sooner.

Education Sector Data Protection Compliance

Education Sector Data Protection Compliance - Educational technology for schools

Regulator: Ico
Typical fee: None (compliance requirement)
Frequency: ongoing
Legal basis: Data Protection Act 2018; Education (Information About Individual Pupils) Regulations 2013

No specific licence but must comply with enhanced data protection for children under 18. Age-appropriate design code applies. Schools require Data Processing Agreements. Must not use pupil data for marketing without explicit consent. Consider Age Appropriate Design Code (Children's Code).

Legal basis

Primary legislation and key regulations

Data Protection Act 2018 Primary 2018 · UK-wide Communications Act 2003 Primary 2003 · UK-wide Financial Services and Markets Act 2000 Primary 2000 · UK-wide Trade Marks Act 1994 Primary 1994 · UK-wide Patents Act 1977 Primary 1977 · UK-wide Medicines and Medical Devices Act 2021 Primary 2021 · UK-wide Sanctions and Anti-Money Laundering Act 2018 Primary 2018 · UK-wide Wireless Telegraphy Act 2006 Primary 2006 · UK-wide Registered Designs Act 1949 Primary 1949 · UK-wide Payment Services Regulations 2017 SI 2017 · UK-wide Export Control Order 2008 SI 2008 · UK-wide Electronic Money Regulations 2011 SI 2011 · UK-wide Medical Devices Regulations 2002 SI 2002 · UK-wide Assimilated Council Regulation (EC) No 428/2009 EU Retained 2009 · UK-wide

Browse UK legislation legislation.gov.uk

Official guidance

Consultation: Proposal to apply Code powers to 4 Fibre Limited (opens in a new tab)

Ofcom

Consultation: Proposal to apply Code Powers to Atlas Tower Group Limited (opens in a new tab)

Ofcom

Proposal to give a direction applying the Electronic Communications Code to Telensa Ltd (opens in a new tab)

Ofcom

Statement: Review of Security Guidance (opens in a new tab)

Ofcom

Statement: General policy on ensuring compliance with security duties (opens in a new tab)

Ofcom

Key concepts and definitions (opens in a new tab)

ICO

Tech Sector Licensing and Authorisations

Understanding licensing requirements

Data protection registration and assessments

Financial services authorisations

Telecommunications authorisations

Export controls and sanctions

Intellectual property protection

Sector-specific registrations

Legal basis

Official guidance

Related guides in Digital & Technology

Office and business support compliance checklist

Which office and business support regulations apply to your business

Software licensing compliance

E-commerce regulations for online selling

Network and Information Systems (NIS) Regulations