Equity Capital Markets Blog

Compliance guide on starting an online finance business in the UK

For both established business as well as start-ups looking to enter the UK financial market, navigating the complex regulatory landscape can be a daunting task. To assist organizations looking to start an online finance business in the UK we've consulted some of the top experts in the space. This webinar is will provide you with actionable tips that will allow you to get a better understanding of this complex legal framework.   

For this webinar we were joined by Matt Williamson, Head of Fintech at Thistle Compliance and one of the leading crowdfunding and P2P lending legal experts in the UK and Sophie Long, Head of Sales at Thistle Compliance, responsible for leading customers along the FCA compliance journey.

Some of the topics discussed in this webinar include: 

  • What do you need to start the financial business and/or product in the UK
  • How to determine if you need FCA authorization or not
  • What do you need for Direct Authorisation with the FCA
  • How to leverage Appointed Representative (AR) while dealing with the FCA
  • Best practices in compliance - consumer protection, financial crime protection, and effective governance arrangements


Read the full webinar transcript here:

Katipult: Hello and welcome to today’s webinar. I brought Sophie Long and Matthew Williamson for today’s topic. They are both from Thistle. We are going to discuss about this innovation hub today, basically cover everything you need to know about compliance.

Welcome Sophie, welcome Matt. If you guys could just give us a short introduction about yourself, then we will get started with our topic for today.

Sophie: My name is Sophie, Marketing Director at Thistle. I speak with a number of clients who are coming to market, who are maybe ready to start their business, to help guide and support people from very early stages as well as established businesses. We look at new projects and I work across all the divisions. I’ll introduce Matt, who can tell you a bit more as well.

Matthew: I am head of the fintech team in Thistle Initiatives. Obviously primarily working with fintech firms and helping a lot of them from startup and trying to get into the regulated sector or otherwise the unregulated, we will get into that a bit later on. I’m doing a lot of the background process work to help them structure a business from scratch almost and either become regulated or get into the unregulated sectors, sort of cryptocurrency. It is really a development and support role and all done through the Innovation Hub.

Katipult: Thanks to both of you. My name is Brian. I’m from Katipult and I am leading our webinar series here, working in business development department of Katipult and have been doing that for almost four years now.

I am very delighted that I can introduce you to both Sophie and Matthew  so we can hopefully educate people on the UK market and how you navigate the rules and regulations out there.

Why don’t we start with the basics here. For example, I am looking to start a financial business in the UK. What do I actually need to do that?

Sophie: Our clients will need to set up UK listed company. Then we need at least one but ideally two in most cases, UK bank directives by people who are here and have the ability to work here full time. From that point it depends on the type of regulated permission they are applying for.  Depending on that, we will put requirements on staff in their senior management role and often they need knowledge and experience at the market they dive into. So if you were a P2P lending company, they would expect to see an individual who has underwriting experience.

Katipult: Perfect. Leading that question into today’s topic as well, how will Thistle Innovation Hub help companies achieve this?

Sophie: So, one of the earliest things we do is a regulatory road map, or business model design. When people come to us, often they have really strong technology background, fantastic commercial ideas. What they are often lacking is financial services knowledge or any form of regulatory experience.

Matt and his team will have an initial meeting with the client and they will walk through the whole customer journey. If they are developing an app for example, what that customer journey looks like, what the end goal is. If it is a lending app for example, how that lending will work and they will start assessing where they fall into regulations and spaces and will come up with short, middle and long term solutions for their applications.

We might give them option A, which keeps them in our regulated space, which is really good for people who want to do some testing work before they go into costly process of becoming regulated; option B, maybe low level regulation or becoming an appointed representative of Thistle, which is a six weeks process; option C may be a long term solution for the firm to be directly authorized, part of that process will be talking about training, we cover basics, like what is the FCA, what are its roles and responsibilities to GDPR, to credit browsing, and so on.

We will also help with the assessment of staff, the equipment process, we talk about the structuring of required qualifications and backgrounds of individuals. We really do get heavily involved in this staff aspect part of business. From that point we can also introduce the firm with investors, if they are looking for that initial round of funding.

Matthew: I think I could add to that. It is a lot of operational support. As opposed to it being a consultancy and sort of an ad hoc advice, it is really doing workshops and going into firms and holding these conversations face to face.

On the practical level, do they need new staff, if they need new staff is there training involved. Sophie mentioned it, it becomes more of a hands on management and helping of the structuring of the business, but also then how that is going to be implemented and how the regulations apply and whatever the business challenge might be and making sure the end product works, and it’s not just advice and leave the firm to get on with it themselves. I think the Innovation Hub really focuses on that as well.

Sophie: I hear a lot of feedback from clients, which we have been doing unofficially and especially in fintech. A lot of our clients have been to lawyers themselves, tried to receive opinions in a different way and they often just quote the rule or the regulation. If you do not understand the rule of the regulation it is very hard to navigate that, how to commercially lift your business.

The feedback from nearly everybody who worked with Matt and his team has been that they put the regulation into the practical sense of their business. Instead of Matt saying “No, you can’t do that, the rule says no. This rule says no, that rule says no…”, he instantly would say “OK, maybe you can’t do it this way, but if we change X,Y and Z in your model, we can get around this part”. He has given people the opportunity to start a business when they probably would not have been able to do so before.

Katipult: That sounds really, really helpful. Instead of saying no, giving alternatives, which is really well thought of by the people I speak to as well. They want to go in one direction and that is what they have decided and then they get a no and the business just stops. It is good to hear that you are helping them and telling them what can they actually do. Seems like you are doing a really good job.

We’ve got the basics done now, how do you actually know if you need an FCA authorization or not?

Sophie: What we do in the early stage are the meeting that Matt has and I also meet with all clients at first, just to establish what the activity looks like and where it might fall in or out of the regulation. Sometimes it can be a little bit unclear because a client sometimes comes to us without a defined business model. They may have an end goal where they know they want to have a P2P platform for example, but they don’t know the ins and outs of what that regulation looks like. When people have different  paths to their business model, you put them in or out the regulation depending on the journey, what they are offering.

Just to give you an example from the lending perspective.  If you are lending to a consumer, you are always going to be regulated, business to business – outside of regulation, but there are different aspect within that scope, that put different types of regulatory spin on things. I think it is really clear to define that model area and if the client does not have it defined, part of what Innovation Hub does is to define it for the client.

We have clients working with at the moment who aren’t startups, they are established businesses but they are just not in the regulated space. They are thinking about branching in the regulation, but before they can give a presentation to their board about the areas they are looking to go into, we have been designing a roadmap for them. That way they know what that looks like, cost, time, staffing requirement and what they need to do to get that off the ground. It works really well for startups and established firms.

Katipult: Sounds very helpful. So you basically talk to your clients or define if they are inside or outside of regulatory framework and then help them from there, if they want to go into it or move out.

Sophie: Yes, absolutely.

Katipult: If you are going for a direct authorization by the FCA, what are some of the most important things that you need to apply for? One thing that you are doing as well is that you are helping fill out these applications for the clients as well.

So what are the top three things that you see are always missing that people should consider as well?

Sophie: Regulatory business plan is absolutely key. I think Matt would agree as well. People often come to use with a business plan that is half a sheet of paper saying “This is what I do, this is what my model is”. We have to go in such a detail from a regulatory business plan perspective, so really making the FCA understand what your business is doing in relatively simple terms.

What we do is to draft that business plan, obviously they have to be very involved. We get involved from the regulatory aspect. Critically, the individuals who are managing the company are required to be in good financial standing, have a clear criminal history, good employment record and some level of knowledge and understanding of the market that they are going into. If not, some consultancy staff or some other non-executive to lean on.

Policies and procedures are huge. You need to have compliant network in place, but you must have your procedures. From what I see, why a lot of clients come to us as well, when they tried to do applications by themselves or they may have used a law firm of something else, often they come to us desperately needing help at the rounds of FCA questions. They often think that when they submit the application the job is done, but the FCA will start to look deep into that and anything they are unsure about, they will come back and question you. They ask evidence of policies and of procedures, evidence of people’s knowledge and experience and we have to jump in sometimes in last minute. Obviously with clients we have been from the start not so much, but will get heavily involved with those rounds of questions. Matt, do you want to add anything?

Matthew: You have to look at it on a very specific scale as well, there are a lot of core elements that need to be there, business plan as Sophie mentioned, financials, the individuals have to be appropriate and recently qualified for the positions that they are going to enter the market.

Looking at it on a specific scale, if we take lending as an example, you are going to need someone who is experienced and understands how to underwrite credit. Then you are going to need someone who is going to be able to manage a loan which is outstanding, whether it be a performing loan or a non-performing loan. If it goes into recovery and collections, someone who understands how that is one.

We can certainly help in terms of making sure that it complies with the requirements. I think that if we look at a different channel, cryptocurrencies and that sort of thing, you are looking at strong AML / KYC procedures so they can correctly debt and assess an individual before either they start participating on an exchange, or an ICO if they wanted to purchase some tokens.

Then, money for example, you are looking for someone who understands how to develop a system which is capable of issuing e-money and has the technology to do so. Operationally, what does that look like, as well as practical and not just theory as well.

I think these are the core elements and then there is for each business an additional set of requirements which needs to be met. The FCA will look at it as a whole picture. Obviously the core elements, but also anything supplementary that is particularly required for that particular business opportunity.

Katipult: Very helpful. So it seems like the earlier someone contacts you, the better, so you are not going in and salvaging a sinking ship.

Sophie: We save a lot of sinking ships!

Katipult: It is good that you can take it from there and not just take it from scratch, but actually go in and identify problems and help them with that. I think a lot of people need that. That was the direct authorization, let’s move a little bit more to representative model.

How do you leverage staff when we are dealing with the FCA?

Sophie: Typically you have your route to market which are directly authorized or appointed, sometimes we can do even an unregulated option to get the ball rolling for the clients. We have resolution compliance.

We are part of the principle firm and we are currently authorized by the FCA. Our whole mainline of business is to act as a compliance umbrella for firms. We are there just as a regulator or an incubator. What we are going to do is absolutely fantastic for firms who do not have any knowledge or experience in the market they are in currently. It is like a set of training wheels for compliance for your business.

When we start working with people we make sure that their business model can get the regulatory permission, we give them full framework how they must conduct their activity in line with those conditions, we give them suite of policies and procedures, we provide them with training, in person and online, they get a designated account manager and that person manages their whole onboarding process. They have to go through the same due diligence that you guys go through when you get directly authorized.

Once we get them signed off and approved we have to go through their platform, their KYC processes, their suitability assessment, their dashboard, framework, we get involved with every last detail. Then we get them up and running. We can get someone authorized anywhere from four weeks upwards and it is much faster with market compliance.

Katipult: I guess you guys are taking the whole liability of this business model as well?

Sophie: Correct.

Katipult: That’s perfect. Just before I move on, I would like to invite the audience to use the chat box. If you have any questions, we are going to go into a QA session in a few minutes. If you have any outstanding questions and you’d like to get answers about Thistle Innovation Hub, please feel free to submit your questions.

So, a bit of best practices in compliance. What kind of an advice would you give to if you had to do consumer protection for example, financial crime protection, effective governance arrangements? Basically best practices in compliance, anything you could share on that end? There is the general question of what you are supposed to do, but also can you tell us a bit about how Thistle Innovation Hub actually helps with this and provides the best practices as well?

Matthew: What we try to do and implement is sort of a compliance mindset and what I mean by that is, you are thinking about the end customer, not necessarily focusing on the commercial elements, but actually focusing on some of the risk elements as well. It is very important that the commercial goal is there at the end of the day because that is the purpose of the business, that is why it has been set up. If you add in elements of risk, then actually it really does help to build up strong business platform from which to work.

A lot of our early work is in that sector. Example being when you go through the customer journey, just making sure, let’s say it is an investment product, that the customer understands that there is a lot of risk associated with the product and making that clear in disclosing that to them. Also, making sure that their journey is as efficient and quick as possible for the customer with commercial mindset. It is really a good balancing act between the two. I definitely say that disclosures, financial promotions, any communication with the customer is something we focus on.

Another element is building out a strong governance structure so individuals in the firm understand that if there is an issue, let’s say that there are good escalation processes for example, that everybody understands that there is a director or a senior manager they report to. That way the process in the firm becomes a lot more fluid and quite liquid. It really does help structure the firm generally.

If we look at it a bit more negative, like if you get a complaint, it is how we address those complaints and how we deal with the customer, making sure one of us is compliant but also the customer’s gain the best out of the service and making sure it is reflective of what the process aims to be.

There is obviously a number of compliance elements and a number of structures the FCA put in place, making sure that certain things are reviewed and everything is as compliant as can be. One of the FCA’s buzzwords at the moment is conduct risk. It is actually looking at the structuring of the products themselves and making sure this is actually appropriate for the particular customer.

A good example is, again, back to lending, making sure that someone is potentially in bad debt or they have a number of dependencies, perhaps a lending product is not particular appropriate for them. Then if we look at the investment product, someone who is in debt or is struggling to save money, it is not really appropriate that that person goes on to invest. So, structuring a lot of these elements to make sure that what we’ve got is sound governance framework with good structures in place.

Katipult: Anything you want to add to that Sophie?

Sophie: In going over what Matt said, it is just so critically important to go over each step in this process. It is all about the end to end process, especially when applying to FCA. A lot of people can be stuck on only one set of policies being important, or just heir website being compliant.

It really comes down to end-to-end framework, the individuals, the managers, the customer journey, the complaint process, how you are dealing with your customers, how are you are responding to them, how you are reporting to FCA. Moving on from authorization, so how you are maintaining your business.

When you have an external company come in and audit you, how to make sure to stay on top of things. Have you changed your activity therefore needing a new permission, what issues are coming up on board meetings, are you addressing those accordingly, it really is a mindset that you have to get into once you become regulated.

Katipult: A lot of questions I get when I talk to clients not only from the UK, but all over the world, are about terms and conditions, their subscription agreement, how would they get that. I always refer them to either a lawyer or someone like yourself for example, so that is something that you help them as well.

How do you address something like that, if someone actually doesn’t have it? Do you just give them a template or do you actually go in and address their business needs and then write something up from scratch?

Sophie: We have a lot of different options for the client. If it is legal documentation, terms and conditions, fund structuring, legal opinions etc, we have a whole team of legal professionals who all fit in the dedicated space, they are all specialists in their area.

When it comes to policies procedures, we have some template documentation. Some clients prefer a cheaper option, especially when they are starting out. Sometimes they would say “Can we have template suite procedures for X activity?” and they are very happy with that we have more than capable compliant people on board, some of them just might do a review of their application, a little bit of an advice for other applications.

Some people want what we call all-service, so an end-to-end model, which is really drafting documentation, drafting policies, drafting application tax, preparing them for their FCA questions, training them…

We have given people a bit of an switch-on switch-off service. They can utilize us, they may look to go away and start pulling together their own regulatory business plan, some of them will want to draft it all from scratch. We have different options depending on their own capability within their teams.

Katipult: We’ve got a question from John. I’ll try to keep this not too specific, since if he needs a specific advice he should be talking to you outside of the webinar. John, you can always contact them or contact me and I will make the introductions if you want.

If you start something only using exemptions and then move to being appointed when you get revenue moving, do you have any thoughts or guidance on a model like that? You really should be in contact with the person asking me questions about it because there are so many nuances.

Sophie: There are so many different models and so many exemptions. So many grey areas and how we navigate those… To be specific we need to have a much more in-depth about the business model directly to be able to talk him through that.

Katipult: You know now John, if you don’t have their contact details, contact me and I will be happy to guide you there. Speaking about Article 52, it doesn’t really mean anything to me, but maybe it does to you, I’m guessing it is for exemptions.

Matthew: We deal with crowdfunding firms on a regular basis. 100% we will be able to sit down with you and have this discussion where you may potentially fall within and exemption or not.

I think if you are looking to deal with any sort of retail individual, you’ve got to be very careful and make sure you are structured completely within an exemption. It is best not to flirt with the gray area. John just get in contact with us and we’ll be more than happy to have a chat.

Katipult: Another audience question as well. What are the implications of non-regulated or regulated bank registers in another country, but still it works in the UK market. Are we speaking of implications of non-regulated or regulated banks that are registered in another country? Not in UK, but clearly working in the UK market?

Matthew: What sort of examples, could I ask for an example?

Katipult: For example, would you suggest going to Malta for a startup and what are the indications of non-regulated or regulated banks in another country that clearly work in the UK market?

Matthew: When it comes to banking, this has become a very hot topic, there are lots of people very interested into trying to structure something. I think with the likes of Monzo, Revolut going that way, the number of the challenges is really becoming a hot market.

I think what is very important is that, if you really do want to structure something like that, you really need to make sure that you have enough of capital to be able to enter that market. If it’s not something you need to structure, whether it be in the UK or elsewhere, if you do not have the initial capital to do so, then there are other alternatives.

Monzo and Revolut have picked up e-money issues so they can kind of resemble a bank and then from there they started to gather up speed. A banking license can take north of two years to obtain and to get trading as a fully fledged bank. The FCA will authorize you and once they have authorized you, then you have probation periods. You have a six month probation period before you even start to really scale up your business. You are limited in the amount of fund that you can take on.

Going back to the question, regulated versus non-regulated, there are options there, but I think it’s all about making sure you have enough initial capital, making sure you are entering the market with good governance procedures as we spoke about earlier, a good team and generally making sure to fall in the right regulations that you need to.

Katipult: OK, that answered the question. At the end of this webinar, do you have anything to say about timelines from, let’s say a company starts contacting you, and I know it depends on how far they are in the process already, but what’s the typical timeline for a company contacting Thistle Innovation Hub? With guidance and help and everything before they can actually become a directly authorized entity?

Sophie: Specifically a lot of it depends on how quickly the client can write it up. We will certainly do our best work in the time frame provided by the client. So typically we will have an initial free conversation. Free meeting with the client because we obviously want to make sure weaknesses are affirmed and they are doing something that would need our services.

At that point we engage with people and very quickly Matt and his team will have the initial meeting within the week and from that point, depending on what services they require we will start drafting up. Depending on the complexity of the model and on the readiness of the individual to move forward, from that point we can literally start drafting the FCA application, from that first or second week. We can start bringing the paperwork, the individual applications forms, drafting new business plans…

Depending on complexity and on IT hugely, it can take anywhere from two to four weeks up to three to six months, depending on how ready people are to move. If you are looking from the resolution standpoint (inaudible 36:50) based on the technology, the technology has to be ready, or nearly ready. (inaudible 37:12) anywhere from four months to twelve months if you are talking about banking licenses. Most of the time it will be four months up o twelve months, if it is direct authorization.

Katipult: Is that after the application has been submitted?

Sophie: Correct.

Katipult: So that is the total process time from the FCA.

Sophie: What is really important is that your app has to be tidy and concise and detailed without giving too much as possible. What we are trying to do is to reduce the amount of questions asked by the FCA, because the clock keeps stopping because of the question.

Matthew: Just to answer that, one of the FCA’s mandates for assessing an application is that the firm is ready, willing and organized. That is very important and standalone.

If you submit an application to the FCA saying “we are proposing to build a platform to do this” it is certainly not going to get approved. It will not get very far. Quite often the FCA will ask you to withdraw, go and build it and do what you need to do and then resubmit.

I think that is an important phrase to remember when approaching this base and I think I’ve mentioned it before, but it is very important that you make sure during the build as well, that you are engaging with, or if you have the knowledge yourself, if you are building a platform making sure you are engaged and have risk and client built into the development, because what you don’t want to do is build something and then go to market or go to the FCA with it and then be not compliant. Then you have to tear it apart and rebuild it which costs a lot of money and time as well.

Sophie: I think part of why the Innovation Hub has been working so well is, some of these people who do not have their technology ready or maybe they are 50% ready, we can do a lot of the background work. Prep them for their applications and then when their technology is ready you have a lot of the other processes, applications, forms and business plans in place, then just push the green button, which makes it a much smoother process.

Katipult: That is what I usually tell clients as well when they come to us. They say it will take a few months before they can get started and I say you want to do the application first. Usually that’s just to get the build started, we have a pretty decent UK framework, there is a lot of experience there, so we can definitely leverage all that.

Sophie: You know the market and that is a big checkbox for us, because in our line of business you need to work with people who know what they are doing in the market.

Katipult: Great to hear and thank you for that. I think we have been working together for quite a few years. It has been beneficial relationship we have here.

Any last things you want to educate me or the audience on, or anyone listening it later, before we end this webinar? We have about four minutes left.

Sophie: From my perspective, I speak to people very early sometimes, at the inception stage of their business. I think sometimes they try to get into the fight and they just keep getting knocked back because they don’t have a business model, they don’t have customer journey or a defined strategy. We are so happy to speak to those people and help them get that business model and strategy. That is why we launched Innovation Hub.

There are people with great ideas were just milling around the market without an idea when to get started and someone has to help these companies at some point. We can help them with their business model, we can help them get the meetings and partnerships. I think that having that conversation with somebody who is willing to help you at such an early stage has been such a rewarding process for us.

Katipult: Matt, do you have something to say as well?

Matthew: It is very important for firms to make sure you consider building things, consider yourselves and other elements as you go through the processes. It is a collective thing as you are building up. All knowledge and expertise and product from a number of sources so you don’t go off on yourself, build something and then have to repeat it. That is a very important point.

On top of that as well, before you go to market or come to anybody with the idea, make sure you’ve done the research, that you know who your competitors are and you understand where the marketplace is going, that you have relevant knowledge and experience.

The second point to add to that is that a lot of the time people wanted to become a Monzo or someone like that from the word go. A lot of the time there is a lot of consideration so when you start to approach these things it’s sometimes best to do it in the staged approach. Maybe start a bit smaller and then start to build up to something nuts. The end-goal may be in a few years time and that’s often something we will get, someone saying “I want to become a Monzo”.

In all practical advice and experience it is best to start smaller and work up to that. The FCA will be much more comfortable, they understand what your own goal is and are willing to work with you on those steps. That is something to bear in mind as well.

Katipult: Thank you for your insight.

Sophie: Walk before you can run.

Katipult: Exactly. I hear that a lot as well. Everyone wants to be number one from start, but you have to learn to walk before you run. So, Thistle Innovation Hub, could you go as far as saying that you are basically working as a sparring partner?

Sophie: Yes, we see it like a mental program basically. We are actively in with these companies, working with them day-in and day-out, final instructions, business plan and really making their commercial goal come to life. We really do see it as a mental program. We put them in touch with different partners, we help them get investments. It is really just getting their business off the ground. Even if they end up becoming unregulated, they still have a good understanding of what an unregulated model would look like in the market.

Katipult: Perfect. So, if you need someone to help you, now you know who to contact. I’ll be happy to facilitate the introductions if you can’t find it yourself. I just want to thank you Sophie and Matt for joining today and I hope everyone in the audience found this very useful.