Authorisation variation: stages and deadlines
Authorisation variation: stages and deadlines. A licensed provider that wants to change the scope, structure or key personnel behind its authorisation must run a formal variation procedure with the competent authority. The process has a fixed sequence — notification, assessment, and decision — but the exact calendar depends on the type of change and on how complete the file is when it is filed.
What changes once you file
Filing a variation request does not suspend the existing authorisation. The current scope of activity stays valid while the authority reviews the request, unless the change itself requires the provider to stop an activity immediately — for example where a key function is removed before a replacement is in place. The clock for the authority's review starts only once the file is treated as complete, not on the date of the first submission.
This distinction matters for planning. A provider that submits an incomplete file and receives a request for further information effectively resets its own timeline. The practical risk is not the variation itself — it is the gap between when the business believes the change is approved and when the authority actually confirms it in writing.
Stages in practice
| Stage | What happens | What moves it forward |
|---|---|---|
| Pre-notification | The provider identifies the change and checks whether it falls under the variation regime or under a lighter notification track. | Internal sign-off and a first draft of supporting documents. |
| Filing | The request is submitted with the documents the authority requires for that category of change. | Confirmation of receipt from the authority. |
| Completeness check | The authority checks whether the file has everything needed to start the substantive review. | Either an acknowledgement of completeness, or a request for missing items. |
| Substantive review | The authority assesses the change against its criteria for that type of variation. | Internal assessment, sometimes with a request for clarification. |
| Decision | The authority issues a written decision — approval, approval with conditions, or refusal. | Formal notification to the provider. |
The review period itself is set by the authority and stated in its acknowledgement of a complete file. It is not a fixed number published in advance for every case — it depends on the category of change and on whether the authority needs a clarification round. A change to key personnel is typically reviewed faster than a change to the core service model, because the second type reopens questions the authority already answered at initial authorisation.
Steps to take
- Compliance officer: classify the change against the authority's published categories before drafting anything.
- Compliance officer: assemble the documents the category requires — this usually includes an updated description of the activity, updated policies, and evidence for any new key person.
- Legal counsel: check whether the change also triggers a separate notification, for example where it affects data handling or an incident-reporting channel.
- Authorised signatory: file the request and keep the receipt confirmation — it is the reference point for every later deadline.
- Compliance officer: respond to any completeness request within the window the authority sets, since the review clock does not start until then.
- Management: hold the current scope of activity unchanged until the written decision arrives, unless the change requires an earlier stop.
Who decides and by when
The decision sits with the same authority that granted the original authorisation. There is no separate forum for a variation — it runs through the same supervisory unit, using the file the authority already holds. The authority confirms receipt, then confirms completeness, and only then opens the substantive review. Each of those three confirmations is a separate written communication, and each one is worth keeping on file.
If the change is significant enough — a new type of service, a new outsourcing arrangement, a change of controlling shareholder — the authority may ask for a meeting before the decision. This is not an appeal stage and does not extend the provider's rights; it is simply part of how the substantive review is carried out for larger changes.
If your situation differs
If the change only affects internal governance and does not touch the licensed activity itself, a lighter notification may apply instead of a full variation — check the category before filing the heavier procedure by default.
If the change involves crypto-asset services specifically, the same variation logic applies, but the file has to address how the change affects client asset segregation and any onward transfer arrangements; see Crypto services — when the buyer of a token for how ownership questions are treated separately from the authorisation itself.
If the trigger for the variation is an operational incident rather than a planned business change, the notification for the incident runs on its own track and does not replace the variation file — see Register of incidents step by step for how that separate process is assessed.
If part of the file rests on jointly held rights in the underlying technology or brand, that ownership question is resolved on its own terms before it can support the variation file; see Joint ownership in ownership of results.
What this page does not cover
This page describes the procedural sequence and the mechanism that sets the review period. It does not set out the substantive criteria the authority applies to a specific type of change, and it does not predict how long a particular file will take — that depends on the category and on the completeness of the submission. It also does not cover the withdrawal of an authorisation, which follows a different procedure; see Surrender of a permission step by step for that separate route. Where the change touches a trade-mark-based claim within the service description, evidentiary standards follow their own track, described in Evidence of acquired distinctiveness step by step.
Verified
Checked against current supervisory practice as published by the competent authority. This page describes procedure only — no article numbers or instrument names are cited here, since the applicable national instruments are not part of the source set used for this page.
FAQ
How long does authorisation variation take in practice?
There is no single published figure. The review period starts only once the authority confirms the file is complete, and the length depends on the category of change. A personnel change usually moves faster than a change to the service model.
Which documents are needed to start?
At minimum, an updated description of the activity affected by the change and, where relevant, updated internal policies and evidence for any new key person. The authority's own checklist for the specific category should be followed rather than a generic list.
What happens if the authority does not respond?
Silence is not approval. If no acknowledgement or completeness confirmation arrives within a reasonable period, the provider should follow up in writing and keep a record of every exchange — this record is what supports any later escalation.