Authorisation variation: what the decision maker looks at
A request to change an existing authorisation is judged against the same question the original licence answered: can this firm run the business it now describes, safely and on an ongoing basis. The decision maker checks whether the change shifts risk, governance or the scope of regulated activity enough to warrant a fresh look, rather than a routine update to the file.
What the review actually tests
A variation request is not paperwork housekeeping. Every change is measured against three questions: does it enlarge the activities the firm is permitted to carry out, does it alter who controls or manages the firm, and does it change the risk profile the original authorisation was built around. A firm adding a new service line answers "yes" to the first question. A firm replacing a director answers "yes" to the second. Either answer moves the file from a light update to a substantive assessment.
The practical effect is timing. A light update is checked against a completeness standard and confirmed. A substantive change is assessed against the same criteria the original application faced, only narrower in scope. The decision maker does not re-open matters the change does not touch, but it will re-test anything the change does touch.
What the file needs to contain
The documentary standard scales with the size of the change. A file describing a new activity needs to show the firm can run that activity: policies, resourcing, and a description of how existing controls extend to cover it. A file describing a change of control needs to show who the new controller is and why that person or entity meets the same standard the original owners met.
| Type of change | Typical scrutiny | What the file must show |
|---|---|---|
| Administrative update (address, contact person) | Low — completeness check only | Confirmation of the new detail, no supporting policy documents |
| New service or activity within scope | Medium to high | Policies, resourcing, and how existing controls extend to the new activity |
| Change of qualifying shareholder or controller | High — treated close to a fresh assessment | Identity, source of funds, and suitability of the new controller |
| Change of a key function holder | Medium | Fitness and experience of the incoming person |
Where the change touches ongoing risk monitoring, the supporting file often resembles the records a firm keeps for a different purpose entirely — see how a similar documentary standard is built for a Register of incidents step by step. The overlap is not accidental: a decision maker reviewing a variation will ask to see how incidents and control failures are logged, whether or not the variation itself concerns security.
Stages of the review
- Notify. The firm submits the variation with a description of the change and the reason for it.
- Completeness check. The decision maker confirms the file contains what its own checklist requires before substantive work starts.
- Assessment. The change is tested against the criteria set out above, with follow-up questions where the file is thin.
- Decision. The authorisation is varied, varied with conditions, or the request is refused.
- Register update. The public record is updated to reflect the new scope or the new controlling persons.
Who decides, and on what clock
The competent authority that issued the original authorisation is the body that decides the variation. It sets its own internal clock from the point the file is complete, not from the point it was first submitted — an incomplete file simply pauses the process rather than starting it. This is the same mechanism that governs how any register keeps and updates its public record: the record only changes once the deciding body is satisfied, which is why a register entry can lag behind an internal decision by some margin. A comparable pattern appears where Biotech and life sciences — when an agency keeps the underlying files separately from what the public register shows.
In practice, the process runs on the scale of weeks for administrative updates and on the scale of months for anything touching control or a new activity. The exact length depends on how complete the file is on first submission and how many follow-up questions the assessment generates.
Where the assessment tightens
If the variation only changes an address or a contact person, expect a completeness check and a short confirmation. If it changes who controls the firm, expect the same depth of scrutiny the original authorisation required, applied only to the incoming person. If it adds an activity the firm was not previously licensed for, expect the decision maker to test whether existing controls genuinely extend to the new activity, or whether they were only ever built for the narrower scope.
A useful comparison is how a decision maker tests whether a claimed distinctive feature has actually been earned through use rather than asserted on paper — the same scepticism about self-reported evidence runs through Evidence of acquired distinctiveness step by step. A variation file that asserts a control works, without showing it has been tested, meets the same scepticism.
The point of no return
Once a variation is formally submitted and accepted as complete, it starts a clock that is difficult to pause without cost. Withdrawing a submitted request and re-filing later is possible, but it resets the assessment and, in some cases, draws attention to why the first attempt was withdrawn. A firm that is not confident the file is ready should hold it back rather than submit and hope the gaps go unnoticed — a decision maker's request for further information after submission is a normal part of the process, but a withdrawal after a negative signal is not.
What this page does not cover
This page describes the general shape of a variation review. It does not set out fixed deadlines, fee levels, or country-specific forms, because those details sit with the specific competent authority and change over time. It also does not cover surrendering an authorisation entirely, which follows a different logic — see Surrender of a permission step by step for that separate procedure.
Verified
This page reflects the general pattern followed by competent authorities across the authorisations our team has worked on, cross-checked against publicly available regulatory guidance. It is reviewed periodically as practice develops and is not a substitute for a check against the specific authority's current published requirements.
FAQ
How long does authorisation variation take in practice?
An administrative update is usually confirmed within weeks. A substantive change — new activity, new controller — typically takes several months, and the clock only starts once the file is complete.
Which documents are needed to start?
At minimum: a description of the change, the reason for it, and evidence that existing controls or personnel meet the same standard the original authorisation required. Anything beyond an administrative update also needs supporting policy documents.
What happens if the other side does not respond?
If the decision maker raises follow-up questions and the firm does not respond within the period given, the file is typically treated as incomplete and the review pauses rather than proceeds. Persistent non-response can lead to the request lapsing or being refused for want of information.
Related publications
For the opposite move — closing a permission rather than changing it — the relevant procedure is Surrender of a permission step by step.
If the underlying issue is a dispute over who actually created or issued an asset, rather than a question of authorisation scope, that is a different starting point — see When the creator disputes the mint.