This guide explains how UK fintech MVPs are commonly structured. It is not legal advice; regulated activities depend on the details of your product, so confirm your position with a regulatory lawyer before launch.
The Short Answer
How do you build a fintech MVP in the UK?
Work out which regulated activities your product involves, such as holding money, making payments, lending or investing. Then build the MVP on an authorised partner's infrastructure, or as their agent or appointed representative, so you can test demand without your own authorisation. Apply for your own authorisation, or the FCA Regulatory Sandbox, once demand is proven.
The reason is time. The FCA has up to six months to decide a complete authorisation application, and up to twelve if it is incomplete. An MVP is meant to answer a question in weeks. Building on a partner lets you do that while your own application, if you need one, runs in parallel.
Regulation Follows the Activity
“Fintech” is not a regulated category; activities are. A budgeting app that only reads data you type in may not be regulated at all. The same app reading bank accounts directly, or moving money, is. So the first job is to list precisely what your product does with money and financial data.
| If your product… | Usual regime | Usual MVP route |
|---|---|---|
| Holds customer money, issues balances or cards | Electronic Money Regulations 2011 or banking rules | Partner with an authorised e-money institution or bank |
| Makes or receives payments for others | Payment Services Regulations 2017 | Authorised payment provider, or agent of one |
| Reads customers’ bank data | Account information services, Payment Services Regulations 2017 | Connect through an authorised open banking provider |
| Lends or brokers consumer credit | Consumer credit permissions under FSMA | Partner lender, or apply for authorisation |
| Arranges or advises on investments | Investment permissions under FSMA | Appointed representative of an authorised firm |
| Exchanges or holds cryptoassets | FCA registration under the Money Laundering Regulations | Registered partner |
| Sells software to regulated firms | Usually not regulated itself | Build directly; expect client due diligence |
Marketing is regulated too. Communicating a financial promotion is restricted unless it is made or approved by an authorised firm, or an exemption applies, so even the landing page of an unregulated startup can be caught. Consumer-facing firms also need to meet the FCA's Consumer Duty, which requires them to put customers' needs first and has applied to products open for sale since 31 July 2023 (FCA).
Map Your Activities
Tick what your MVP will do. Take the result to your first conversation with a regulatory lawyer.
Interactive tool
What will your fintech MVP actually do?
Tick every activity that applies. The result lists the regimes to raise with a regulatory lawyer, and the usual MVP route. It is a starting point, not legal advice.
Tick at least one activity.
Three Routes to a Regulated MVP
| Build on a partner | Agent or appointed representative | Own authorisation | |
|---|---|---|---|
| Who holds the permission | The partner | The principal firm, which takes responsibility for you | You |
| Time to launch | Weeks, after partner onboarding | Weeks to months, depending on the principal | Up to 6 months after a complete application |
| Control | Limited by the partner’s products and rules | Limited by the principal’s oversight | Full |
| Best for | Testing demand quickly | Advice, arranging and payments businesses | Proven products ready to scale |
Mondo is the best-known UK example of the first route. In October 2015, while applying for a banking licence, it gave a first wave of 500 alpha testers a prepaid debit card and an iPhone app, planning 3,000 cards in total. The company was not yet regulated, but its customers could use the product with real money, and the team learned from real behaviour while its licence application ran.
The trade-off is dependence. A partner can change pricing, product rules or its appetite for your sector. Design your product so the partner sits behind a clear interface in your code, which makes a later switch to another partner, or to your own licence, a project rather than a rewrite.
The FCA Regulatory Sandbox
What is the FCA Regulatory Sandbox?
A service that lets firms test new financial products with real consumers on a small, time-limited basis. Unauthorised firms seeking authorisation can apply, and the FCA can offer restricted authorisation limited to the test, individual guidance, rule waivers and no enforcement action letters. It is not an exemption from regulation.
The Regulatory Sandbox accepts applications on a rolling basis from firms of any size. It is designed for tests with a clear objective and a positive expected impact on consumers. The FCA's wider innovation services also include Innovation Pathways, for help understanding how regulation applies to a new proposition, and a Digital Sandbox offering synthetic data sets to build and test against before you touch real customer data.
For most MVPs, the partner route is faster. The sandbox suits products no partner can support, or where the innovation itself is in how the regulated activity is carried out.
What to Build Differently
A fintech MVP should still be small. But some things that are optional in other MVPs are not optional here, because your partner, your regulator and your customers will check them.
- Access control and audit trails. Broken access control is first in the OWASP Top 10:2025. Every action on money or financial data should be permission-checked and logged.
- Identity checks through your partner. Customer due diligence and anti-money laundering checks usually run through the partner's approved provider. Build the flow around it, not your own.
- Never store card details yourself. Use your payment provider's hosted fields or pages so card data never touches your servers.
- Data protection from day one. Pay the ICO data protection fee (£52 a year for the smallest tier under SI 2025/63) and keep a record of what personal data you hold and why.
- A clean partner interface. Keep the partner's API behind your own service layer, so changing partner is possible later.
- Customer communications you can evidence. Under the Consumer Duty, you need to show customers understood what they signed up for. Keep versioned copies of terms and key screens.
These are the same foundations covered in security and compliance basics and SaaS MVP development, applied more strictly.
A Practical Sequence
- 1
List every activity
Write down exactly what the product does with money, credit, investments and financial data. Use the tool above as a checklist.
- 2
Get a regulatory view
A short engagement with a regulatory lawyer to confirm which permissions apply. It is far cheaper than building the wrong structure.
- 3
Choose a partner
Compare regulated partners on sector appetite, onboarding time, fees and how easy their API is to wrap.
- 4
Scope the MVP around one flow
One customer type, one money movement, one platform. Use the partner’s compliance flows rather than building your own.
- 5
Launch to a small group
An invite-only alpha, as Mondo did, gives real behaviour with limited exposure.
- 6
Decide on your own permissions
Once demand is proven, decide whether to stay on the partner, become an agent or appointed representative, or apply for authorisation.
For scoping that first flow, see how to scope an MVP. Loomstrat builds fintech and billing products on a fixed price with full code ownership: see fintech and billing software or MVP development.
Frequently Asked Questions
Do I need FCA authorisation to launch a fintech MVP?
Not always. It depends on the activities your product carries out. Many fintech MVPs launch on an authorised partner’s infrastructure, or as an agent or appointed representative of an authorised firm, and seek their own authorisation once demand is proven. Confirm your position with a regulatory lawyer.
How long does FCA authorisation take?
The FCA must decide an application within 6 months of receiving it complete, or within 12 months if it is incomplete. It reports targeting 98% of applications within those timeframes. Preparing a complete application takes time on top.
What is the FCA Regulatory Sandbox?
A service for testing new financial products with real consumers on a small, time-limited basis. It can offer restricted authorisation, individual guidance, waivers and no enforcement action letters. Applications are accepted on a rolling basis, and it is not an exemption from regulation.
How did Monzo launch before it had a banking licence?
As Mondo, it gave 500 alpha testers a prepaid debit card and an iPhone app in October 2015 while it applied for its licence, planning around 3,000 cards over three months.
Can a fintech MVP use open banking?
Yes. Reading bank data is a regulated account information service, so most MVPs connect through an FCA-authorised open banking provider instead of registering themselves at the start.
Does marketing a fintech product need approval?
Financial promotions are restricted unless made or approved by an authorised firm, or an exemption applies. Check this before publishing a landing page or running ads, even for a waiting list.
Test demand on someone else's licence, build the parts that make you different, and apply for your own permissions once you know the product deserves them.