Every serious regulator asks for roughly the same pack. The names differ, the emphasis differs, and the depth differs a great deal, but the underlying request is consistent: prove who owns this, prove who runs it, prove they are suitable, prove the business model is viable and lawful, prove you have the money to do it, and prove you have written down how you will operate before you start.
What separates an application that moves from one that sits is not the volume of paper. It is whether the documents describe one business consistently. Reviewers read the business plan, then the financial projections, then the compliance manual, and they notice when the plan says three markets and the projections assume ten, or when the manual describes controls for a product the plan does not mention.
The ownership and people file
This is where applications most often stall, and it is entirely within the applicant's control. Regulators want the ownership chain traced to natural persons, not to another company, which means constitutional documents and register extracts for every entity in the chain until a human appears. Nominee arrangements and layered holdings extend this work considerably and invite questions about why the structure exists, which is the point of offshore nominee directors.
For each controller and each proposed senior manager, the pack usually includes a personal questionnaire, identification, proof of address, a detailed employment history with no unexplained gaps, professional and academic evidence, criminal record certificates from the relevant countries, regulatory references, and disclosure of past regulatory action, bankruptcies, disqualifications and civil litigation. This is the fit and proper assessment, and its purpose is to establish honesty, competence and financial soundness for the specific role applied for.
Two things sink this section. Non-disclosure of something the regulator finds independently, which is treated as a character issue rather than an administrative one, and proposing a compliance officer or money laundering reporting officer with no relevant experience who is plainly a name on a form. The role and what the regulator expects from it are described in the AML officer and MLRO role.
The regulatory business plan
This is not an investor deck. It is a description of the regulated activity as the regulator classifies it: which permissions are sought, which instruments, which client types, which countries clients will be accepted from and how that is enforced, how clients are acquired, how orders are executed and where they go, who provides liquidity, whether the firm takes principal risk, and how client money is held if it is held at all.
Financial projections attach to it and must be consistent with it. Regulators test whether the firm can meet its capital requirement under the plan and under a stress case, and whether the funding to reach that point actually exists with evidence of its source. Where capital is contributed by a shareholder, source of wealth evidence for that person is usually part of the file.
Requirements vary by regulator and change. This is a general description of what application packs contain, not advice on any regime, and no article can substitute for regulatory counsel in the jurisdiction you are applying in.
The policy set
Applicants underestimate this and then buy a template pack, which reviewers recognise immediately. A policy that names the wrong regulator, describes a product the firm does not offer or references a system the firm has not bought is worse than a short honest one, because it tells the reviewer the applicant will not follow its own procedures.
The usual set covers anti money laundering and counter terrorist financing with a documented risk assessment behind it, client onboarding and verification, sanctions and politically exposed persons screening, best execution and order handling, conflicts of interest, complaints handling, client categorisation where the regime uses it, risk management, outsourcing, business continuity, record keeping, data protection and financial promotions. Each should describe what the firm will actually do, with named roles and real thresholds.
The anti money laundering risk assessment deserves separate attention because it drives the rest. It should reflect the firm's own client geography, products and payment channels rather than a generic list, and the customer due diligence tiers should follow from it. Our note on KYC verification levels covers how those tiers are usually built.
Systems, outsourcing and premises
Regulators ask what technology the firm will run, who supplies it, and what happens if that supplier fails. Trading platform, back office, client portal, KYC provider, payment providers and hosting all appear. Draft agreements or signed contracts are commonly required, along with evidence that the firm can access its own records if a supplier relationship ends. Where technology is licensed rather than built, that is normal and expected, and it needs to be documented rather than obscured. SINGUARD supplies software under those contracts and holds no financial services licence of any kind, which is exactly the distinction an outsourcing schedule is meant to record.
Substance sits alongside it: an office, staff who are actually there, directors who are resident where the regime requires it, and a governance structure that meets rather than exists on paper. Substance expectations have tightened across most regimes, and applications that propose a two person structure running a large cross-border operation get slow, detailed questions. The licence application timeline is driven almost entirely by how many of those question rounds an application generates.
One more practical note. Regulators frequently ask applicants to explain a document in a meeting, and the person who has to answer is the proposed senior manager rather than the consultant who drafted it. A director who cannot describe the firm's own client acceptance rule or its capital position from memory damages the file more than a missing annex, because the regime is built on the idea that named individuals are accountable for the activity.
The applications that get through are the boring ones. One business, described the same way in every document, with real people in real roles who can answer a question about their own file without asking a consultant.
"Regulators are not trying to catch you out. They are checking whether the same business appears in every document, and a surprising number of applications fail that test on page one."
— Roman Onta, Executive Director, SINGUARD
Key Takeaways
- Trace ownership to natural persons and disclose everything in the fit and proper file, because an undisclosed item is treated as a character problem.
- The regulatory business plan and the financial projections must describe the same firm, including client geography and how it is enforced.
- Template policy packs are recognisable and damaging; policies should name real roles, real thresholds and the systems actually contracted.
- Outsourcing agreements, exit arrangements and genuine substance are examined, and weak answers there generate the question rounds that stretch timelines.
Frequently Asked Questions
What is a fit and proper assessment?
It is the regulator's review of whether each controller and senior manager is honest, competent and financially sound for the role applied for. It usually covers employment history, qualifications, criminal record certificates, regulatory references and disclosure of past regulatory, insolvency or litigation matters.
Can I use template compliance policies for an application?
Templates are a starting point at best. Reviewers regularly see manuals naming the wrong regulator or describing products the applicant does not offer, and that undermines the whole file. Policies have to describe what the firm will actually do, with named roles and real thresholds.
Why do licence applications take so long?
Most of the elapsed time is question rounds rather than assessment. Each incomplete or inconsistent answer produces another request, and applications with clean ownership evidence, a consistent business plan and firm-specific policies simply generate fewer of them.
About the Author
Roman Onta is an Executive Director at SINGUARD. He builds the Prop Firm CRM, the Broker CRM, Scalegram and CopySignals side by side with his brother Alex Onta, and he helped on the design of eTrader, the division Alex built and leads. His ground is worldwide payment processing, AML compliance and the corporate structures brokers are built on, work the two of them carry together, shaped by executive roles in the UAE and international corporates. He lives and works in Dubai for most of the year. Meet the executive duo leading Singuard's five divisions.