The first thing a case officer does with a business plan is check whether it matches the permissions requested. If the narrative describes an execution only broker passing all flow to a liquidity provider, and the application asks to deal on own account, one of the two documents is wrong. That mismatch is the single most common reason a file goes back with questions, and it costs weeks.
What supervisors call a programme of operations, a business plan or a regulatory business plan is a description of a machine. It has to show what the firm does, who does it, where the money goes, what can break and what happens when it does. Growth is a minor part of it. Most of the document is about control.
Start with the flow of money and orders
The section that carries the most weight describes the life of a client order and the life of a client deposit, end to end. Where does a deposit land. Is it a client money account, who is the bank, and how is it segregated from the firm's own funds. Which entity receives the order, does the firm act as principal or agent, is the position hedged, with whom, on what terms, and what happens to the residual risk that is not hedged. Whose balance sheet carries a losing client position.
Write it as a sequence, not as an assertion. A supervisor reading "we operate a hybrid model with prudent risk management" learns nothing. A supervisor reading that flow below a stated notional threshold is internalised, that the net exposure per symbol is capped, that breaching the cap triggers an automatic hedge with a named category of counterparty, and that the dealing desk cannot override it without a logged approval, learns whether the firm has thought about it. Our note on A book and B book models covers the underlying choice, and the controls that sit on top of it are ordinary dealing desk risk management.
Projections without invented precision
Financial projections normally cover three years and include a base case and a stressed case. The numbers matter less than their internal consistency. Client acquisition cost multiplied by expected clients has to reconcile with the marketing budget. Revenue per client has to reconcile with the spread and commission model described earlier in the same document. Headcount has to reconcile with the org chart. If the plan claims a small team can support a large client base, the supervisor will ask how, and the answer has to be the technology, described concretely.
The stressed case is where applications are won or lost. A credible plan shows what happens if volumes come in materially below target, states the point at which regulatory capital would be threatened, and identifies the funding that covers it. Owners' letters of support are common, and they get tested: the regulator will ask whether the person signing it has the personal financial capacity, which links straight back to the fit and proper assessment of shareholders. Capital itself scales with the permissions applied for and the model chosen, a point developed in capital requirements for brokers.
Do not put a figure in the plan you cannot defend in a meeting. Supervisors ask where a number came from, and the honest answer, a stated assumption with a source, is stronger than a precise looking figure with nothing behind it.
People, outsourcing and the things you do not do yourself
The organisational section names individuals against functions and shows reporting lines. Control functions report to the board, not to the commercial director. Where a role is part time or shared with another group company, say so and explain how conflicts are handled, because concealing it is worse than declaring it.
Every trading firm outsources something. The platform, the CRM, the KYC provider, the payment processors, hosting, sometimes the dealing support desk. Regulators do not object to outsourcing, they object to outsourcing responsibility. The plan needs a register of material arrangements, the due diligence performed on each provider, the exit route if a provider fails, and confirmation that the firm retains access to its own data and records. A firm whose entire client base sits inside a vendor system it cannot export from has a real continuity problem, and supervisors have learned to ask about it. The mechanics are set out in outsourcing rules for regulated firms.
The wind down plan nobody wants to write
Several regimes now require a documented wind down or recovery plan with the application, and the ones that do not require it still ask about orderly cessation. The question is simple: if the board decided tomorrow to stop, could clients be repaid in full, positions closed in an orderly way, records preserved for the statutory retention period, and the regulator notified, without the firm running out of money halfway through. That last part is the point. Winding down costs money, and a plan that assumes the firm will have cash at the moment it fails is not a plan. Client money has to be returnable in full at that moment, which is why the calculation is run against the stressed case rather than the base case.
Consistency is the whole test
Read the finished document once as an adversary. The permissions, the model description, the projections, the org chart, the risk framework, the marketing approach and the target markets have to describe one firm. Plans fall apart when sections are written by different people and pasted together: the model section says agency, the revenue section assumes dealing spread, the marketing section targets a jurisdiction the licence will not reach. Matching the model to the licence in the first place is the subject of matching your business model to a licence.
This is descriptive, not advice. Content requirements differ by regime and change over time, and any firm preparing an application should work with counsel in the jurisdiction concerned and read the regulator's own published application guidance in full.
"Write the plan as if a supervisor will read it back to you in two years and ask why you did the opposite. That is exactly what happens."
— Roman Onta, Executive Director, SINGUARD
Key Takeaways
- The plan has to describe the same firm as the permissions applied for, and mismatches between the two are the most common cause of delay
- Describe the order and money flow as a sequence with named controls and limits, not as a claim about prudence
- Projections are judged on internal consistency and on the stressed case, not on how large the base case is
- Material outsourcing needs a register, due diligence, an exit route and continued access to the firm's own data
Frequently Asked Questions
How long should a regulatory business plan be?
Length is set by the model, not by a target. A single permission agency broker can be covered in far fewer pages than a firm holding client money and dealing on own account across several asset classes. Completeness against the regulator's published application guidance matters, padding does not.
Can the same deck be used for investors and for the regulator?
No. An investor deck argues upside. A regulatory plan has to describe controls, conflicts, capital under stress and orderly closure, including material that no founder would put in a fundraising document.
What happens if the business changes after approval?
Material changes to the model, permissions, controllers or key functions normally require notification and often prior approval. Operating outside the plan the licence was granted on is treated as a breach in most regimes.
About the Author
Roman Onta is an Executive Director at SINGUARD. He builds the Prop Firm CRM, the Broker CRM, Scalegram and CopySignals side by side with his brother Alex Onta, and he helped on the design of eTrader, the division Alex built and leads. His ground is worldwide payment processing, AML compliance and the corporate structures brokers are built on, work the two of them carry together, shaped by executive roles in the UAE and international corporates. He lives and works in Dubai for most of the year. Meet the executive duo leading Singuard's five divisions.