Tech Sector Licensing and Authorisations

Understanding licensing requirements

Technology businesses may require multiple licences and authorisations depending on their activities. The requirements you face depend on what your business does:

Payment or financial services: FCA authorisation or registration (see Financial Services below)
Telecommunications provider: Ofcom notification and possible spectrum licensing
Export controlled technology: ECJU export licence for dual-use items or cryptography
Medical or health technology: MHRA device registration
EdTech processing children's data: Enhanced data protection requirements

Data protection registration and assessments

Before processing personal data, you may need to conduct a Data Protection Impact Assessment (DPIA) for high-risk processing activities.

Data Protection Impact Assessment (DPIA)

Data Protection Impact Assessment (DPIA) - Data processing (high-risk activities)

Regulator: Ico
Typical fee: None (internal assessment)
Frequency: as needed
Legal basis: UK GDPR Article 35

Required before processing likely to result in high risk to individuals' rights and freedoms. Mandatory for systematic monitoring, large-scale processing of special category data, or automated decision-making with legal effects. Must consult ICO if risks cannot be mitigated.

Financial services authorisations

If your tech business provides payment services, issues e-money, or offers other financial services, you need FCA authorisation or registration. The route depends on your activities and scale.

FCA Full Authorisation

FCA Full Authorisation - Regulated financial services

Regulator: Fca
Typical fee: £1,500-£25,000 application fee
Timeline: 6-12 months
Frequency: one time
Legal basis: Financial Services and Markets Act 2000

Required for deposit-taking, insurance, investment services, and consumer credit. Stringent capital, governance, and systems requirements. Consider Regulatory Sandbox for testing innovative products. Initial application fee varies by permission type; ongoing annual fees apply.

FCA Payment Services Registration

FCA Payment Services Registration - Payment services (account information/payment initiation)

Regulator: Fca
Typical fee: £1,500 application fee
Timeline: 3-6 months
Frequency: one time
Legal basis: Payment Services Regulations 2017

Required for payment initiation services (PIS) and account information services (AIS). Lower barriers than full authorisation - no capital requirement for AIS, £50k safeguarding for PIS. Must comply with Strong Customer Authentication (SCA) requirements.

Small Payment Institution Registration

Small Payment Institution Registration - Small-scale payment services (<€3m per month)

Regulator: Fca
Typical fee: £500 application fee
Timeline: 3-6 months
Frequency: one time
Legal basis: Payment Services Regulations 2017

Simplified registration for payment services processing under €3 million per month average over 12 months. Limited to UK only (no passporting). Safeguarding and governance requirements apply but no minimum capital. Annual fee £250.

E-Money Institution Authorisation

E-Money Institution Authorisation - Electronic money issuance

Regulator: Fca
Typical fee: £5,000 application fee
Timeline: 6-12 months
Frequency: one time
Legal basis: Electronic Money Regulations 2011

Required for issuing stored-value products (e-wallets, prepaid cards). Minimum capital: £350,000. Must safeguard customer funds. Small EMI regime available for average outstanding e-money under €5 million (£1,500 application fee, no minimum capital).

FCA Appointed Representative Status

FCA Appointed Representative Status - Representing an authorised firm

Regulator: Fca
Typical fee: None (sponsor firm pays)
Timeline: 1-3 months
Frequency: one time
Legal basis: Financial Services and Markets Act 2000, Section 39

Allows conducting regulated activities under supervision of an authorised principal firm. Principal firm registers you with FCA (no application fee for AR). Principal liable for your regulatory compliance. Cannot take deposits or hold client money.

Telecommunications authorisations

Businesses providing electronic communications networks or services need Ofcom authorisation.

Ofcom General Authorisation

Ofcom General Authorisation - Telecoms network provision or services

Regulator: Ofcom
Typical fee: None (notification only)
Timeline: Immediate (self-certification)
Frequency: one time
Legal basis: Communications Act 2003; Electronic Communications Code

All providers of electronic communications networks or services automatically authorised under General Authorisation. Must notify Ofcom via online form. Annual administrative charge applies (£50-£1,000s based on turnover and services). Must comply with General Conditions of Entitlement.

Ofcom Numbering Allocation

Ofcom Numbering Allocation - Telephone numbering allocation

Regulator: Ofcom
Typical fee: £200-£1,500 per number range
Timeline: 4-6 weeks
Frequency: as needed
Legal basis: Communications Act 2003; National Telephone Numbering Plan

Required for allocating telephone numbers (geographic, non-geographic, mobile, freephone). Must be a Communications Provider notified under General Authorisation. One-off application fee plus annual administration charge. Unbundled tariff number rules apply for 084/087 ranges.

Ofcom Spectrum Licence

Ofcom Spectrum Licence - Radio spectrum use

Regulator: Ofcom
Typical fee: Varies (£50-£100,000s)
Timeline: 4-12 weeks
Frequency: as needed
Legal basis: Wireless Telegraphy Act 2006

Required for transmitting radio signals. Types: Business Radio (Simple UK, Simple Site, Technically Assigned), Fixed Links, Satellite, Mobile Spectrum. Some exempt uses (low power devices, Wi-Fi). Fee depends on frequency, power, and location. Annual renewal fees apply.

Export controls and sanctions

Tech businesses exporting controlled technology, software, or cryptography may need export licences.

ECJU Export Licence (Dual-Use)

ECJU Export Licence (Dual-Use) - Export of controlled cryptography or dual-use items

Regulator: Ecju
Typical fee: None
Timeline: 4-8 weeks (standard), up to 90 days (complex)
Frequency: as needed
Legal basis: Export Control Order 2008; Dual-Use Regulation (EU) 2021/821

Required for exporting controlled goods, software, or technology listed in UK Strategic Export Control Lists. Cryptography over 56-bit may require licence. Check SPIRE system for licensing requirements. Some items covered by Open General Export Licences (OGELs). Penalties up to 10 years imprisonment.

Trade Sanctions Licence

Trade Sanctions Licence - Provision of technical assistance to sanctioned countries

Regulator: Ofsi
Typical fee: None
Timeline: Varies (emergency to 90 days)
Frequency: as needed
Legal basis: Sanctions and Anti-Money Laundering Act 2018; Russia Regulations 2019 (and others)

Required for providing technology, software, or technical assistance to designated persons or sanctioned territories (Russia, Iran, North Korea, etc.). Applies to cloud services, software updates, and technical support. Check OFSI Consolidated List before contracting with foreign entities.

End-User Undertaking

End-User Undertaking - End-user assurance for controlled tech

Regulator: Ecju
Typical fee: None
Timeline: Part of export licence application
Frequency: as needed
Legal basis: Export Control Order 2008

Written assurance from end-user about intended use of controlled goods. Required for most dual-use export licence applications. Must specify end-use, confirm no military/WMD end-use, and commit not to re-export without permission. Template available from ECJU.

Intellectual property protection

Protecting your software and brand through IP registration.

UK Patent Application

UK Patent Application - Patent protection (UK)

Regulator: Ipo
Typical fee: £310 (application + search + examination from April 2024)
Timeline: 2-4 years to grant
Frequency: as needed
Legal basis: Patents Act 1977

Protects inventions (technical innovations with industrial application). Must file before public disclosure. Annual renewal fees from 5th year (£70 year 5, up to £610 year 20). Consider Patent Box tax relief (10% effective rate on patent income). Software "as such" not patentable but technical effect can be.

UK Trade Mark Registration

UK Trade Mark Registration - Trademark protection (UK)

Regulator: Ipo
Typical fee: £170 (online, 1 class)
Timeline: 3-4 months (if no opposition)
Frequency: as needed
Legal basis: Trade Marks Act 1994

Protects brand names, logos, and slogans. Valid 10 years, renewable indefinitely. Additional classes £50 each. EU and international registrations separate (EUTM, Madrid Protocol). Must use within 5 years to maintain protection. Renewal fee £200 every 10 years.

UK Registered Design

UK Registered Design - Design protection (UK)

Regulator: Ipo
Typical fee: £50 (online)
Timeline: 1-2 months
Frequency: as needed
Legal basis: Registered Designs Act 1949

Protects visual appearance of products. Must be new and have individual character. Valid 5 years initially, renewable up to 25 years (£130/5 years, £210/10 years). Automatic unregistered design right also exists (10-15 years, no registration needed).

Sector-specific registrations

Some tech sub-sectors have additional registration requirements beyond the general obligations above.

MHRA Medical Device Registration

MHRA Medical Device Registration - Medical device software (UK market)

Regulator: Mhra
Typical fee: Varies by device class
Timeline: 6-18 months
Frequency: one time
Legal basis: Medical Devices Regulations 2002 (as amended); UK MDR 2024

Software as a Medical Device (SaMD) requires MHRA registration. Classification depends on risk (Class I, IIa, IIb, III). Class I can be self-certified; higher classes need Approved Body assessment. Must appoint UK Responsible Person. UKCA marking deadline extended to 30 June 2030 (CE marking remains valid until then).

Education Sector Data Protection Compliance

Education Sector Data Protection Compliance - Educational technology for schools

Regulator: Ico
Typical fee: None (compliance requirement)
Frequency: ongoing
Legal basis: Data Protection Act 2018; Education (Information About Individual Pupils) Regulations 2013

No specific licence but must comply with enhanced data protection for children under 18. Age-appropriate design code applies. Schools require Data Processing Agreements. Must not use pupil data for marketing without explicit consent. Consider Age Appropriate Design Code (Children's Code).

UNDER CONSTRUCTION

Content Graph

Guvnor

Tech Sector Licensing and Authorisations

Understanding licensing requirements

Data protection registration and assessments

Financial services authorisations

Telecommunications authorisations

Export controls and sanctions

Intellectual property protection

Sector-specific registrations

Compliance Assistant

🚧 UNDER CONSTRUCTION

◉ Content Graph

Understanding licensing requirements

Data protection registration and assessments

Financial services authorisations

Telecommunications authorisations

Export controls and sanctions

Intellectual property protection

Sector-specific registrations

Related guides in Digital & Technology

UNDER CONSTRUCTION

Content Graph