The Consumer Duty, the FCA's FG21/1 guidance on vulnerable customers and the Economic Crime and Corporate Transparency Act (ECCTA) now work together to create a comprehensive consumer protection regime that demands more from financial services firms than ever before.

This isn't simply about adding new policies to your compliance library. These frameworks require enterprise risk teams to demonstrate that consumer protection is genuinely embedded in how your organization operates, that you're measuring real customer outcomes and that you're actively identifying and remediating harm before regulators discover it.

What is the FCA Consumer Duty?

The FCA Consumer Duty (the Duty) sets the standard of care that firms should give to retail consumers, and it requires firms to put their customers' needs first. It consists of a consumer principle, three cross-cutting rules and four outcomes. The principle, Principle 12 in the FCA's Principles for Businesses, reads: "A firm must act to deliver good outcomes for retail customers."

The Duty came into force for open products and services on July 31, 2023 and for closed products and services on July 31, 2024. It applies to all firms with a key role in delivering retail customer outcomes, including those with no direct customer relationship.

Three cross-cutting rules and four outcomes

The cross-cutting rules explain how firms should act to deliver good outcomes. Firms must act in good faith towards customers, avoid causing foreseeable harm and enable and support customers to pursue their financial objectives. The four outcomes set more detailed expectations for products and services, price and value, consumer understanding and consumer support.

From treating customers fairly to proving good outcomes

Under treating customers fairly, firms could largely demonstrate compliance by showing they followed appropriate processes. Consumer Duty flips this approach entirely. The FCA now expects firms to prove they're delivering good outcomes rather than simply implementing good processes. You need evidence that customers actually understand your communications, that your products deliver fair value and that customer service genuinely supports rather than hinders customers in achieving their goals.

For enterprise risk teams, this creates a challenge. You can no longer build your assurance program around checking that policies exist and processes are documented. Instead, you need frameworks that test whether those policies and processes actually work in practice and whether customers benefit from them.

FG21/1 and vulnerable customers

FG21/1 is the FCA's finalized guidance on the fair treatment of vulnerable customers. It defines a vulnerable customer as someone who, "due to their personal circumstances, is especially susceptible to harm, particularly when a firm is not acting with appropriate levels of care." The guidance recognizes that vulnerability can arise from health conditions, life events, resilience factors or capability issues, and the FCA treats it as a spectrum of risk in which all customers are at risk of becoming vulnerable.

The regulatory expectation goes well beyond simply flagging customers as vulnerable. Firms should understand the specific needs that arise from different vulnerability drivers, ensure staff can recognize vulnerability indicators during interactions, adapt products and services to meet vulnerable customers' needs and monitor whether vulnerable customers achieve good outcomes.

The Duty reinforces this, because its cross-cutting rules require firms to take account of the impact of characteristics of vulnerability in all aspects of customer interaction. For background, see Ideagen's earlier post on the FCA vulnerable customers guidance.

Enterprise risk teams need robust frameworks for testing whether vulnerable customer identification actually happens, whether the support provided is appropriate and whether outcomes data shows these customers are being treated fairly. This requires deep engagement with frontline operations, sophisticated data analysis and willingness to challenge business practices that might disadvantage vulnerable customers.

ECCTA and the failure to prevent fraud offence

The Economic Crime and Corporate Transparency Act 2023 extends beyond consumer protection into broader financial crime territory. Its failure to prevent fraud offence came into effect on September 1, 2025. A large organization can be criminally liable where an associated person commits fraud intending to benefit the organization, unless it had reasonable fraud prevention procedures in place. Large means meeting two of three criteria: more than 250 employees, more than £36 million in turnover or more than £18 million in total assets.

Firms also need to prevent becoming vehicles for economic crime, which matters for consumer protection because fraud prevention controls can sometimes create friction that harms legitimate customers. Enterprise risk teams need to ensure that strong financial crime controls don't inadvertently cause poor outcomes for customers trying to access services or resolve issues.

What changes for enterprise risk teams

These regimes together create a regulatory environment where enterprise risk teams must operate very differently than they did even five years ago. Several fundamental shifts affect how you build assurance programs and interact with the business.

Outcomes over processes

Previously, you might review a customer communication process and confirm that templates were approved, staff were trained and quality assurance sampling occurred. Under the new regime, you need evidence that customers actually understood the communications and acted on them appropriately. You need data showing whether communications led to good customer outcomes or created confusion that caused harm.

Continuous monitoring replaces periodic reviews

Consumer Duty explicitly requires firms to monitor customer outcomes on an ongoing basis and act when outcomes deteriorate. This makes annual policy reviews and periodic assurance testing insufficient. Enterprise risk teams need frameworks that generate regular management information about customer outcomes, flag emerging issues quickly and track whether remediation actually improves outcomes.

Cross-functional collaboration becomes essential

The evidence regulators want to see sits across customer service, product development, data analytics, technology and operations. Enterprise risk teams cannot prepare for inspections by working in isolation. Success requires orchestrating evidence gathering across multiple business functions and ensuring that everyone understands regulatory expectations well enough to provide what inspectors need.

Demonstrable culture matters more than ever

Regulators increasingly test whether consumer protection is genuinely embedded in how firms operate or merely a compliance exercise. They interview frontline staff to assess understanding of consumer outcomes. They review board papers to see whether customer outcomes feature in strategic discussions. They examine remuneration structures to understand whether incentives support good outcomes.

Practical steps: outcome measures, vulnerable customer testing and inspection evidence

Build outcome measurement frameworks

  • Identifying the right metrics for different products and customer segments
  • Establishing data collection processes that capture outcome information
  • Creating analytical approaches that identify when outcomes are deteriorating
  • Developing governance processes that ensure action when problems are identified

Many firms struggle with this because outcome data often doesn't exist in readily accessible form. Customer satisfaction scores might be tracked, but do they actually measure whether customers achieved their financial objectives? Product uptake data exists, but does it show whether products delivered fair value? Complaint volumes are monitored, but do they reveal whether vulnerable customers received appropriate support?

Test vulnerable customer processes

This presents particular challenges because vulnerability is contextual and changes over time. You cannot simply check whether customers are flagged as vulnerable and move on. You need to understand whether:

  • Vulnerability indicators are recognized during different interaction types
  • The support provided matches the specific vulnerability drivers
  • Customers receive consistent treatment across channels
  • Vulnerable customers achieve outcomes comparable to non-vulnerable customers

This requires sophisticated testing methodologies that go beyond typical control testing. You might review recorded customer service calls to assess whether staff recognize vulnerability indicators. You might analyze customer journey data to identify friction points that disproportionately affect vulnerable customers. You might conduct detailed case studies of vulnerable customer experiences to understand whether processes work in practice.

Prepare for inspections

Inspections now require evidence that demonstrates operational effectiveness rather than policy completeness. When regulators arrive, they want to see:

  • Outcome data showing you're monitoring customer results
  • Documentation of actions taken when outcomes deteriorated
  • Evidence that remediation actually improved outcomes
  • Staff who can explain how consumer protection works in practice

Enterprise risk teams need to think like inspectors when building evidence libraries. What questions would regulators ask? What evidence would convince them that consumer protection is genuinely embedded? What gaps in evidence would raise concerns?

Boards, vulnerable customers and fraud controls all need the same proof of good outcomes

Consumer Duty, vulnerable customer guidance and economic crime requirements collectively define what regulators expect. The Duty asks boards to review and approve a report on customer outcomes at least annually, FG21/1 expects firms to monitor whether vulnerable customers are treated well and ECCTA gives large organizations a defense only if they can show reasonable fraud prevention procedures. For enterprise risk teams, the practical step is to build the outcome data, vulnerable customer testing and evidence library that a board or regulator can read without asking for more.