Doing business in the UK: financial regulation - Dentons

The provision and advertising of financial services in the UK is highly regulated. In most situations anyone providing financial services in the UK or to UK customers needs to be authorised by the Financial Conduct Authority (FCA) and in some cases also by the Prudential Regulation Authority (PRA).

Investing in a UK authorised business can also trigger regulatory obligations on the investor, requiring pre-approval before the investment proceeds.

The Financial Services and Markets Act 2000 (FSMA) is the primary legislation governing regulation of financial services in the UK. At the heart of the FSMA regime are two key prohibitions:

A general prohibition which prohibits any person or firm from carrying on a financial services regulated activity (see below) in the UK, or purporting to do so, unless they are either authorised or exempt. The financial promotions restriction which prohibits a person or firm (wherever based) from making or issuing a financial promotion in or into the UK, unless they are either authorised to do so or an exemption applies.

While FSMA is the primary legislation in this area, and is the focus of this note, different but overlapping regimes apply to the regulation of payment services and e-money services (see further below).

Separately, a provider of financial services may also need to be registered under the UK 's anti-money-laundering regime.

Failing to check the regulatory position and the need for authorisation can have serious consequences. Doing financial services business without authorisation or an exemption is a criminal offence and agreements with customers will likely be unenforceable. Taking legal advice is therefore always recommended.

The Prudential Regulation Authority (PRA) and the Financial Conduct Authority (FCA)

The PRA is responsible for the prudential regulation of systemically important firms (i.e. making sure they are stable and resilient). This covers mainly banks, building societies, insurers and very large investment firms.

The FCA is responsible for the prudential regulation of firms not regulated by the PRA. It also regulates the conduct of all firms authorised under FSMA (i.e. making sure they conduct their business honestly and transparently), including those which are regulated by the PRA for prudential purposes.

The carrying out of any financial services regulated activity in the UK will generally require authorisation by the FCA and potentially the PRA. The authorisation process can be intensive, lasting for several months. Firms considering authorisation need to ensure they plan in advance and devote sufficient time and resources to prepare the necessary materials for an application.

What is a financial services regulated activity?

The FSMA regime contains a great deal of detail regarding what constitutes a regulated activity. Broadly, to constitute a regulated activity, the activity must:

relate to specified investments; and

be carried on by way of business in the UK.

The list of specified activities is extensive. Some of the most common examples are set out in the table below.

Accepting deposits Effecting and carrying on contracts of insurance Dealing in investments as principal Issuing e-money Insurance distribution activities Dealing in investments as agent Bidding in emissions auctions Administration and performance of contracts of insurance Arranging deals in or making arrangements with a view to transactions in investments (including insurance) Credit broking Debt related activities Managing or advising on investments Mortgage related activities Consumer credit regulated activities Safeguarding and administering investments

The list of specified investments is also extensive. Some of the most common examples are set out in the table below.

Deposits E-money Contract of insurance Shares Regulated mortgage contracts Rights under consumer credit and consumer hire agreements Options Futures Contracts for differences Greenhouse gas emissions allowances Government and public securities Instruments creating or acknowledging indebtedness Units in a collective investment scheme Rights under a pension scheme Alternative finance investment bonds

Neither the list of specified investments or activities is static. In particular, the UK is planning to bring stablecoin and cryptoassets within scope from 2027.

The business test is applied broadly and even where an activity is only ancillary to a main business it may still be considered as carried on "by way of business" by the UK regulators.

Additionally, the issue of whether the activity is being carried on in the UK may not always be straightforward. In some cases, cross-border activities are deemed to be carried on in the UK under FSMA. Even if the activity is not deemed to be carried on in the UK it is still often the case that selling products or services to customers in the UK will amount to carrying on activities in the UK even though the business itself is based outside the UK.

Are there any exclusions or exemptions?

The regulatory regime includes three main routes through which someone may be exempt from authorisation or their activities excluded from being regulated activities. These are:

through an exemption in the Financial Services and Markets Act (Exemption) Order 2001 which lists categories of persons who are exempt from authorisation either from a range of activities or in respect of particular activities;

through an exclusion in the Financial Services and Markets Act 2000 (Regulated Activities) Order 2001 which contains exclusions for some regulated activities, though these are generally interpreted narrowly; and

acting as an appointed representative. This only applies to certain activities and requires specific conditions to be satisfied. If these are met a person or firm may carry on business in the UK without being authorised, provided they do so under a contract with an authorised principal firm and the principal has accepted regulatory responsibility for the representative's actions.

A financial promotion is any invitation or inducement to engage in investment activity. Investment activity is defined very broadly and covers everything that would be a regulated activity as described above and all financial products falling within the scope of specified investments. Financial promotions are technologically neutral and can be made via social media, apps, websites or verbally. If the promotion is directed at the UK, it will usually be caught by the financial promotion regime unless an exemption applies or the promotion has been approved by a UK authorised person with permission to approve financial promotions.

Employees working for authorised firms

Most employees working for authorised firms will be subject to regulatory obligations of one form or another. The extent of those obligations will depend on the type of employee:

Conduct Rules Staff : All staff, except ancillary staff (e.g. receptionists, cleaners and security staff), must comply with basic conduct rules which include acting with integrity and with due care, skill and diligence and treating customers fairly. Conduct rule training must be delivered to all staff annually.

: All staff, except ancillary staff (e.g. receptionists, cleaners and security staff), must comply with basic conduct rules which include acting with integrity and with due care, skill and diligence and treating customers fairly. Conduct rule training must be delivered to all staff annually. Certified Staff : These are individuals who carry on specified "significant harm" functions and must be assessed as fit and proper by their firms (but there is no need for regulator approval).

: These are individuals who carry on specified "significant harm" functions and must be assessed as fit and proper by their firms (but there is no need for regulator approval). Senior Managers: These individuals, including Directors, Heads of Compliance and various other specified roles, need to be approved by the FCA or the PRA as being fit and proper before starting their role. Prescribed responsibilities must be allocated amongst Senior Managers and they are subject to a "duty of responsibility". This means they can be held responsible for the actions of their firm for which they have been allocated responsibility. Senior Managers are also subject to additional manager-specific conduct rules.

Both Certified Staff and Senior Managers will also be subject to regulatory reference rules if they move roles. These rules impose specific requirements to disclose information to future regulated employers including in respect of conduct or fitness and propriety concerns.

Once a firm is authorised by the FCA (and the PRA), it will be subject to ongoing regulatory obligations, including around conduct of business, systems and controls, reporting obligations and complaints handling. Firms are also under a proactive duty to notify the regulators of anything which they ought reasonably to be aware of.

Firms are also subject to ongoing supervision, with the largest firms being given a dedicated contact at the FCA and/or the PRA. Most supervision is routine and takes the form of questions about day-to-day business matters, data that firms have reported and areas of focus for the regulators. However, the supervision teams have very wide-ranging powers and include the ability to require firms to give undertakings about particular conduct, place requirements on a firm's permissions including to preserve records or assets or even to prevent firms from taking on new business, and to order firms to pay redress to customers where certain conditions are met.

The regulators have enforcement teams with powers to investigate firms for either regulatory or criminal breaches. If a regulator decides that there is a case to answer, it can issue sanctions including financial penalties and prohibiting individuals from working in the financial services sector.

Outside the spheres of consumer credit and regulated mortgage contracts, lending is not a regulated activity in the UK.

No authorisation is required for a non-UK entity to lend to a UK company. A loan to a UK corporate entity will always be outside the scope of the consumer credit/regulated mortgage contract sphere, other than where the loan is secured against a property used at least partly as a residential dwelling, and the corporate borrower is holding that property on trust for an individual resident of the property.

Lending to corporate entities may still require the lender to register for anti-money laundering as an "Annex 1 financial institution" if they are carrying on lending as a business in the UK. This is a fact- sensitive assessment and specific advice should be taken on this, especially if the lender has any connection with the UK.

No general authorisations or licences are required to borrow money in the UK.

The applicable regulatory regimes for payment and e-money services are set out in the Payment Services Regulations 2017 (PSRs) and the Electronic Money Regulations 2011 (EMRs) respectively. Undertaking regulated activities (as defined in those regulations) in relation to in-scope services without FCA authorisation is a criminal offence. Note that there are certain differences between these regimes and FSMA which firms looking to be authorised in this area should take specific advice on.

Investing into an authorised firm: the "change of control" regime

Investments into authorised firms above specified thresholds require pre-approval by the FCA and/or the PRA. In some circumstances, acquiring or increasing an existing stake to as little as 10% of the shares or voting rights in an authorised firm can require pre-approval. Failure to obtain pre-approval is a criminal offence and legal advice should be obtained as to whether and, if so, how the change of control regime impacts a transaction.