Three years of the Consumer Duty: the honest scorecard

Three years ago this month, Consumer Duty came into force. Nobody knew whether it would really change how firms treat customers or just become another reporting exercise. Three years on, we can answer that properly. 

The FCA marked the anniversary with a run of publications: a review of how firms design products under the Duty, refreshed examples of what good looks like, and its second Enforcement Watch newsletter. 

If your firm recognises itself where the FCA say work remains, that’s normal. (Nearly every firm the FCA surveyed did.) We’re not here to wag fingers. Every firm is on a different journey and has different struggles. 

Now that we’ve established that this is a judgement-free zone, let’s take an honest look at where firms have improved and what work remains to be done. 

Three years of the Consumer Duty: where firms have improved

The FCA’s products and services review, published this July, is unusually complimentary (in places). Three years into the Consumer Duty, firms are testing products with real customers before launch, instead of after receiving complaints. Distribution strategies are sharper. And target markets are defined with more care than they were in 2023.

One example is a firm that found, through complaints and feedback, that customers were confused by ATM withdrawal limits. It made the information clearer and more prominent in its app, and retrained its support teams on the rules. Complaints about ATM withdrawals fell by 45% within three months. 

But monitoring is the success story of the last three years. The FCA found many firms now watch behavioural indicators, such as usage trends and early cancellations, to catch poor outcomes before a customer ever picks up the phone. That’s prevention rather than response, which is exactly what the Duty was written to produce.

None of this happened by accident. Boards were made accountable for customer outcomes, and evidence started flowing upwards. Progress is real.

The Consumer Duty scorecard: three years in

The FCA surveyed 38 firms across banking, insurance, payments and consumer finance for its July review. Put its findings side by side and the picture is more balanced than either the optimists or the sceptics would like. 

You’ll probably recognise your own firm somewhere in both columns:

	Where firms have come furthest	Where the FCA says work remains
Product design	Firms research customer needs before designing, with some building detailed customer profiles to map products against.	Some target markets remain generic, and firms selling higher-risk products couldn’t always explain why their target market fits the risk.
Inclusive journeys	Voice control for customers with dexterity issues, sign language identity verification, and carer cards that protect against financial abuse.	Inclusive design panels risk becoming a tick-box exercise if they never seriously challenge the design.
Monitoring	Many firms now track behavioural indicators such as usage trends and early cancellations, catching poor outcomes before complaints arrive.	Some firms hold the data but never use it to trigger a review, and one relied almost entirely on complaint volumes.
Acting on findings	Real interventions with measured results, including a 45% drop in ATM withdrawal complaints after one firm clarified its limits.	Firms often changed products without validating whether customer outcomes actually improved.
Vulnerability	Identification has become standard, with flags, disclosure routes and signposting now widespread.	When asked how they meet the needs they’ve identified, some firms could only describe how they identify them.

Every row traces back to the FCA’s products and services review, published 10 July 2026. The final row deserves more attention than a table cell allows. That’s where the enforcement picture comes in.

If you’re keen to see where your firm is on the consumer duty curve, you’ll love our latest ebook.

What the regulator is saying

The good examples tell one side of the story. The FCA’s own language tells the other, and it has sharpened quite noticeably.

“These are encouraging steps, but firms should also consider how, once additional needs have been identified, they can meet those needs.”
— FCA, products and services review, July 2026

That sentence follows a finding that some firms, asked how they adapt products for customers in vulnerable circumstances, could only describe their identification processes. One firm pointed to its vulnerable customer flags. The FCA’s response amounts to a polite question: and then what?

The second edition of Enforcement Watch, published the same month, shows what happens when the answer isn’t good enough. Eleven Consumer Duty investigations are now open, up from six in the first edition. The FCA made 382 supervisory interventions last financial year, and around 30 skilled person reviews reference the Duty.

“Heightened and foreseeable harm”
— FCA, Enforcement Watch 2, July 2026

That phrase recurs across the open investigations, applied specifically to vulnerable customers. Foreseeable is the word to dwell on. It means the regulator believes the firm had enough information to see the harm coming. Whether your firm did have that information is now an evidential question, and the answer lives in your data.

The year four: Consumer duty checklist

If the first three years were about building processes, year four is about proving they work. The FCA’s July publications point to where that proof will be demanded. 

So what will the FCA ask to see? Six questions worth putting to your next board meeting:

1. Can you show how vulnerability information reaches frontline decisions? A flag on a system achieves nothing if the agent making tomorrow’s collections call never sees it, or sees it too late to change the conversation.
2. Does your MI include indicators that move before complaints do? The FCA praised firms watching usage trends and early cancellations, and criticised reliance on complaint volumes alone. Complaints tell you about harm that has already happened.
3. When your data flags a potential issue, does anything trigger? Several firms in the review held the right information but had no mechanism to turn it into a targeted review. Collecting evidence you never act on may be worse than not having it.
4. Can you evidence outcomes for the customers you’ve flagged? Identification numbers are easy to report. The harder question, and the one the FCA is now asking, is what changed for those customers afterwards.
5. Does your vulnerability picture update between reviews? Circumstances change in weeks. If your view of a customer refreshes annually, most of what happens to them happens out of sight.
6. When you change a product or journey, do you measure the impact? The review repeatedly found firms making sensible changes and then never validating whether outcomes improved. Good intentions without measurement won’t survive a supervisory conversation.

None of these questions is answerable with a policy document. Every one of them is answerable with data. That’s the direction of travel.

Year four will be judged on evidence

Three years in, the scorecard is genuinely mixed. Firms have built better products, better journeys and better monitoring than most predicted in 2023. The FCA has said so in writing, which is worth something.

But the regulator’s patience with process has run out. Eleven open investigations and a recurring focus on foreseeable harm point to where the Duty goes next. 

The encouraging part is that the information usually already exists. Most firms are closer than they think. 

Vulnerability moves faster than an annual review cycle, which is why we built Know Your Vulnerable Customer to detect it as it happens, across millions of records every month. If your board can’t yet answer the six questions above, that’s the place to start.

What is Know Your Vulnerable Customer (KYVC)?

KYVC combines multiple high-frequency data sources with bureau data in a single live environment, capturing vulnerability indicators across 15 million records every month.

Detect risk before it reaches the credit file. Route priority cases to the right team while support can still change the outcome. And evidence timely, proportionate interventions for Consumer Duty reporting.

See what your own data reveals →