UK FinTech Compliance Guide (2026)

FCA authorisation timeline: (1) Full FCA authorisation (e.g., payment institution, credit broker, investment firm): 12–18 months from application submission. (2) FCA Sandbox (Regulatory Sandbox): 3–6 months (faster — restricted authorisation for testing). (3) AISP registration (for Open Banking AISP — no money movement): 4–8 weeks. (4) Credit Broker registration (introducing customers to lenders): 2–4 months. Software preparation for FCA application: ClickMasters builds compliance-ready systems before FCA submission — FCA technical review (IT questionnaire) covers PS21/3 architecture, DTAC-equivalent security controls, and AML system documentation. Poorly prepared IT systems are a top reason for FCA application delays. ClickMasters IT questionnaire preparation: 2–4 weeks, included in project scope for FCA-regulated clients.

FCA COBS (Conduct of Business Sourcebook): detailed prescriptive rules for specific business areas (COBS 4 — financial promotions, COBS 6 — advised services disclosure, COBS 9 — suitability, COBS 14 — information to clients). Consumer Duty PS22/9: overarching outcome-based standard — requires firms to deliver good outcomes across all four outcomes (products/services, price/value, understanding, support). Relationship: Consumer Duty is additional to, not a replacement for, COBS. A firm must comply with both. Software implication: (1) COBS generates specific functional requirements (suitability report field, disclosure timing, information document format), (2) Consumer Duty generates design principles (readability, accessibility, cancellation ease) that apply across the entire product. ClickMasters builds both into software design — COBS requirements as acceptance criteria, Consumer Duty as design principles.