Consumer Duty Was Never Just a Conduct Rule. For Financial Crime Teams, It Is Becoming the Standard They Get Measured Against

TrustSphere Network

19 hours ago

7 min read

FCA building and branding, representing UK financial regulation

The Consumer Duty is now three years old as a rulebook and has quietly become something financial crime teams cannot treat as somebody else's compliance obligation. Its three cross-cutting rules, that a firm must act in good faith, avoid causing foreseeable harm and enable customers to pursue their financial objectives, sit in the FCA Handbook at PRIN 2A and apply, in the regulator's own words, across the whole lifecycle of a product and every stage of the customer journey. A fraud check that freezes a genuine transaction, an account hold that runs for weeks without explanation, or a scam victim left to chase a call centre for updates: these are foreseeable harms, and they now sit inside the same rulebook as pricing and product design.

TrustSphere's house view is that this intersection will bite, and is already biting, harder than most financial crime functions have priced in. The FCA's December 2025 final notice fining Nationwide Building Society £44 million for historic anti-financial crime control failings, covering the period October 2016 to July 2021, was framed by the regulator explicitly around gaps in customer due diligence and transaction monitoring, the FCA's press release on the Nationwide penalty makes clear. But the direction of supervisory travel since then has been to read financial crime failings and Consumer Duty failings as two sides of the same coin: a firm that lets financial crime through has failed its customers, and a firm that stops financial crime clumsily, with excessive friction, unexplained holds or poor communication to victims, has also failed them.

This is not a comfortable message for financial crime teams who have spent a decade being told, correctly, to tighten controls and reduce false negatives. The Duty does not ask firms to weaken fraud controls. It asks them to run those controls in a way that does not itself become a source of harm, and it makes that an enforceable standard rather than a good-practice aspiration.

What is changing, and what is not

Nothing in the underlying legal architecture of financial crime prevention is changing. Firms are not being asked to relax customer due diligence, transaction monitoring or sanctions screening, and nothing in Consumer Duty guidance suggests otherwise. What has changed, and continues to sharpen through 2026, is the lens the FCA applies when it reviews how those controls are operated day to day.

The Duty's cross-cutting obligations under PRIN 2A.2 are settled rules, in force and enforceable, not proposals. What is genuinely still developing is the supervisory detail of how those obligations are being read against specific financial crime scenarios. The FCA has published good and poor practice findings on Consumer Duty implementation generally, including a September 2026 review of how payments firms deliver outcomes for vulnerable consumers, available on the FCA's Consumer Duty publications page, but firm-specific guidance narrowly focused on the intersection of fraud controls and Duty obligations remains something firms are inferring from general principles and enforcement outcomes rather than reading from a single dedicated rulebook. Institutions should treat that inference as directionally reliable but should not assume the FCA has finished setting out its full expectations; more specific guidance in this area over the next twelve to eighteen months is a reasonable expectation, not a confirmed fact.

The FCA's existing multi-firm review of romance fraud handling is a useful concrete marker of where this is already operational rather than theoretical. Its review of firms combating romance fraud sets out expectations for how firms should detect, prevent and support victims through the recovery process, including the standard of communication and follow-up owed to a customer once a scam has been identified. That is Consumer Duty logic applied directly to a financial crime typology, published by the regulator, not TrustSphere's inference.

Where the friction actually lives

The operational tension sits in three places, and each has a different shape.

The first is transaction-level friction: step-up authentication, payment delays and holds triggered by fraud and AML monitoring. These controls are necessary and, in the case of authorised push payment fraud, are themselves a regulatory expectation. The Consumer Duty question is not whether the friction exists but whether it is proportionate, explained and time-bound, and whether the customer is told what is happening and why, in language they can understand, rather than left with a declined payment and no context.

The second is the account freeze or hold during an ongoing investigation, often the most acute point of tension because the firm's legal obligations under money laundering regulations can genuinely constrain what it is allowed to tell the customer. A firm cannot always explain that an account is frozen because of a suspicious activity report without risking tipping off a suspect, and that constraint is real. What the Duty adds is scrutiny of everything the firm can control around that constraint: how quickly the investigation is progressed, whether the customer has a route to raise hardship caused by the freeze, and whether the firm's internal service standards treat these cases as urgent rather than letting them sit in a queue because the customer cannot easily complain their way to the front of it.

The third, and the one the FCA's romance fraud review addresses most directly, is the treatment of confirmed or likely scam victims after the fact. This is where good faith and avoiding foreseeable harm move from principle to specific, checkable practice: was the victim signposted to support, was the firm's language calibrated to someone who may be distressed or embarrassed, and did the firm's own process avoid compounding the harm through slow reimbursement decisions or repeated, insensitive requests for the victim to retell what happened.

What it means operationally

For financial crime operations teams, this means service level agreements for holds and freezes need to exist and be monitored as a Consumer Duty metric, not only as an operational efficiency measure. A hold that takes four weeks to resolve because of internal case backlog, rather than because the underlying investigation genuinely requires that long, is now a foreseeable harm the firm needs to be able to explain and defend, not simply an operational inconvenience.

For data and systems teams, the requirement is that fraud and AML alerting systems need to feed customer communication workflows, not just investigation workflows. A customer whose payment is blocked needs a timely, comprehensible explanation generated from the same event that triggered the block, which for many institutions means integrating fraud detection outputs into customer-facing channels in a way they were not originally built to do.

For governance and the second line, outcomes monitoring under the Duty needs a specific financial crime lens: tracking not just how many alerts were raised and how many were true positives, but how long genuine customers spent inconvenienced by false positives, how those customers were communicated with, and whether vulnerable customers experienced worse outcomes through the fraud journey than the general population. The FCA's own findings on outcomes monitoring, published in July 2026 and available on the FCA's good and poor practice page, make clear that generic, product-level monitoring without this kind of journey-specific detail is treated as an area for improvement rather than good practice.

What this means for each stakeholder

Tier 1 banks have the resourcing to build the customer communication and outcomes-monitoring infrastructure this requires, but they also carry the largest volume of fraud alerts and holds, and the Nationwide final notice is a direct signal that scale is not a defence against enforcement when the underlying controls or the customer treatment around them are found wanting.

Challenger banks and fintechs, often built around fast, low-friction onboarding and payments as a core value proposition, face the sharpest version of this tension. Their competitive advantage is speed, and speed is exactly what fraud controls and Duty-compliant communication both slow down; firms in this segment need to design the explanation and support layer into the product from the outset rather than retrofitting it once complaints volumes force the issue.

Payment service providers and acquirers sit in a genuinely difficult position because much of the friction a consumer experiences, a delayed payment, a blocked merchant, originates in a scheme rule or counterparty control the PSP does not fully own, which means the Duty's expectation of clear customer communication has to be met even where the PSP cannot fully control the underlying cause.

Consumers and scam victims are the clearest beneficiaries in principle, but only where firms move past treating Consumer Duty compliance as a documentation exercise; the practical experience of a customer whose account is frozen for six weeks with no explanation does not improve because a firm can point to a policy document describing how it should have gone.

Regulators and supervisors, for their part, are signalling a genuine and sustained direction of travel rather than a one-off enforcement action. The pairing of a record financial crime fine with an intensifying Consumer Duty supervisory programme in the same period is not coincidental, and firms should expect the FCA to keep testing this intersection through further multi-firm reviews rather than treating Nationwide as an isolated case closed.

Conclusion

The institutions that will do well out of this are the ones that stop treating financial crime controls and Consumer Duty compliance as two separate governance tracks reporting to two separate committees. The friction created by a fraud check is not a necessary evil to be minimised at all costs, nor is it something a firm can wave through on the grounds that it is legally required. It is a customer outcome like any other, and under PRIN 2A it now has to be designed, monitored and defended as one.

Suggested Next Steps

Set explicit service level standards for account holds and freezes, distinguishing genuine investigative necessity from internal case backlog, and monitor breaches as a Consumer Duty metric.

Build a direct feed from fraud and AML alerting systems into customer communication channels so blocked or delayed customers receive a timely, comprehensible explanation without compromising investigation integrity.

Extend outcomes monitoring beyond alert volumes and true-positive rates to capture how long genuine customers were inconvenienced and how vulnerable customers fared through the fraud journey specifically.

Review scam victim support processes against the FCA's romance fraud multi-firm review findings, including signposting, communication tone and reimbursement decision speed.

Sources: FCA Handbook, PRIN 2A, The Consumer Duty, FCA press release on the £44 million Nationwide penalty, FCA multi-firm review, combating romance fraud, FCA outcomes monitoring good and poor practice review, TrustSphere Risk Index, April 2026.