What it costs to build a regulated technology company in London

The cost of building a regulated technology company in London is determined first by the activity and permission, then by the people and controls needed to operate it. The regulator’s application fee is visible, but it is rarely the largest pre-revenue cost. Salaries, legal and compliance work, security, insurance, cloud infrastructure and the time required to reach an acceptable product can consume much more cash.

A useful budget should therefore begin with the operating model, not a single average startup figure. A software supplier to banks, an authorised payment institution and a deposit-taking bank have different permissions, capital needs and governance. Founders should model a base case and a delay case, then preserve enough runway to reach evidence of customer demand without weakening essential controls.

This draft cannot yet give a defensible total or range for a representative company. The only current numeric range established here from an official source is the FCA application-fee range; current London salary and workspace evidence and comparable adviser, insurance, security and cloud quotes have not yet been collected. Until the publication-gate pricing work is complete, the article identifies cost categories and a method for estimating them rather than answering with a universal price.

The permission model sets the first boundary

The first question is whether the company will perform a regulated activity itself, act through an authorised partner or supply software without handling the regulated transaction. That decision changes the application, senior-management responsibilities, capital, safeguarding, reporting and assurance work.

FCA and PRA permissions apply to UK activities and legal entities, not to London alone. The specifically London-sensitive parts of the model are more likely to be pay, workspace and travel assumptions. Those inputs need separate, dated evidence rather than being inferred from the national regulatory requirements.

The FCA authorisation guidance should be read against the proposed customer journey and flow of money. A product description is not enough. Founders need to map which legal entity contracts with the customer, receives funds, makes a decision and bears a regulated responsibility. Specialist advice is valuable when it resolves that map, not when it produces a generic policy pack.

Application fees vary by permission and complexity. The FCA application-fee page, updated in July 2026, lists ten pricing categories from £280 to £225,170. A small payment institution sits in a different category from an authorised payment institution, and a bank also involves the Prudential Regulation Authority. The amount must be checked against the exact route at the time of application. It is non-refundable and separate from periodic fees.

Capital requirements and safeguarding resources are not ordinary expenses, but they still affect the cash a founder must secure. A regulated entity may need funds that cannot be spent like general working capital. The budget should therefore show regulatory capital, safeguarded customer money and operating cash as separate lines.

People usually cost more than the application

Regulation is delivered through accountable people. A credible plan may require leaders for compliance, risk, finance, information security, operations and the regulated activity, as well as engineers and product staff. Some roles can be fractional or outsourced in an early phase, but a supplier cannot outsource responsibility or the knowledge required to oversee the work.

The right comparison is not permanent hire versus free. It is permanent hire versus a defined external service, with scope, availability, knowledge transfer and escalation included. An adviser who helps design an application is not necessarily the person who will monitor customer outcomes after launch. A contractor who writes policies is not a substitute for managers who understand how the product behaves.

Founders should build a role plan month by month. Each role needs a start date, employment or supplier cost, recruitment cost and contingency for hiring delay. Employer National Insurance, pension contributions, equipment and specialist screening belong beside salary. A London office premium should not be hidden inside headcount.

Technology costs include evidence and resilience

Cloud spend often begins modestly, but a regulated or enterprise-facing company pays for more than compute. Identity management, logging, testing, vulnerability management, backups, incident response and data controls may arrive before volume. Customers can also require independent penetration testing, security questionnaires, business-continuity evidence and contract commitments before a pilot becomes paid work.

The FCA operational-resilience material helps explain why resilience is not a later-stage polish. A company should identify important services, dependencies and failure scenarios early enough that the architecture can support them. The exact formal duties depend on the firm, but institutional customers may apply similar expectations through procurement even when a startup is not directly in scope.

Data protection creates another operating line. The Information Commissioner’s Office data-protection fee guidance explains the statutory fee, but the larger cost is likely to be the work of mapping data, setting retention, controlling access and responding to rights or incidents. Those tasks should be owned and tested.

Insurance and professional work need defined assumptions

Professional indemnity, cyber and directors’ insurance depend on permissions, limits, customer contracts, geography and claims history. A broad online quote is not a reliable budget for a company moving money or making credit decisions. Founders should ask brokers for an indicative structure before promising contractual limits to a bank customer.

Legal work also varies by model. Company formation is inexpensive compared with shareholder agreements, regulated analysis, customer terms, employment, intellectual property, privacy, supplier contracts and a major enterprise negotiation. A budget should separate essential setup from work triggered by a specific customer or fundraising event.

Audit and accounting requirements can change with entity structure and permission. A group that creates a second regulated entity adds governance, accounts, tax and intercompany work. International expansion adds local advice and may duplicate controls rather than merely extending the London budget.

Workspace should follow the weekly work

A central office can shorten customer meetings and support a developing team, but an impressive address is not a regulatory control. Early founders should price remote-first work, flexible desks, a serviced office and a conventional lease on the same occupancy assumptions. Deposits, fit-out, rates, service charges, meeting rooms and unused capacity all matter.

The choice should follow the work that happens most often. A firm meeting City buyers several times a week may earn value from proximity. A product team with occasional customer workshops may preserve runway with flexible space. The budget can include travel and meeting-room use so the alternatives are compared honestly.

A useful cost model has three cases

The base case should show the planned permission, hiring sequence, product scope, customer path and month of first paid revenue. The delay case should move authorisation, procurement and hiring by realistic periods while retaining essential staff and controls. The partner case can show what changes if an authorised provider handles part of the regulated activity, including revenue share, integration and dependency.

Every assumption should have a source, owner and review date. Application fees can link to the regulator. Employment assumptions can come from named roles and current recruitment evidence. Adviser and insurance lines should use written scopes. Cloud and software should use a product architecture and expected usage, not a percentage of salary.

The resulting number will be a range, not a universal London cost. Its value is that it exposes the cash consequences of a decision. If the model works only when authorisation, hiring and a bank contract all arrive on their earliest dates, the company does not have a resilient plan.

Limits of a published cost estimate

Costs change with scope, timing and negotiating power. Salary surveys may mix seniority and total compensation. Supplier quotes can exclude later review, and regulatory requirements depend on the facts of a business. Workspace and insurance markets can move quickly. Any public worked example should therefore state its date, permissions, team, transaction volumes and tax treatment.

This draft does not provide a price for a particular company and is not legal or financial advice. Before publication, Shoreditch Talk should collect comparable, dated ranges from at least three founders and two specialist advisers for London pay, legal and compliance work, security, insurance, cloud infrastructure and workspace. It should publish the permission, team, usage and occupancy assumptions and avoid presenting a midpoint as the amount every regulated startup needs.