This section focuses on how firms treat customers, manage misconduct, and respond when harm occurs. The developments covered include APP fraud reimbursement, proposed changes to the Consumer Duty, complaints and redress, safeguarding assurance, and how firms treat customers in vulnerable circumstances. Proposed reforms to the redress system may also change how firms identify systemic issues, notify regulators and provide proactive redress.
Developments covered
🟧 Important, uncertain timing/impact
APP scams reimbursement: Expected policy consultation
The PSR plans to consult on changes to the APP scams reimbursement policy after the first independent evaluation of the regime.
The PSR plans to consult on changes to the APP scams reimbursement policy after the first independent evaluation of the regime.
The PSR has published a policy roadmap setting out planned changes to its APP scams reimbursement policy, which came into force in October 2024. The roadmap follows Frontier Economics' independent evaluation of the PSR's APP scam policies, published on 1 July 2026, and stakeholder engagement over the summer. Frontier found that the value of APP fraud has fallen since the policy was introduced, and that the reimbursement requirement appears to have been a key driver of that fall.
The December consultation is expected to cover three areas:
- Policy parameters, including claims that cannot be resolved within 35 business days and how returns from investment are treated
- Data, including a possible new annual collection of data on the platforms and services fraudsters most often use, and changes to the fraud performance and compliance data regimes
- Consistency of outcomes, including guidance on the consumer standard of caution, civil disputes and me-to-me transactions
The PSR has said the scope remains under review and may change in light of feedback. Summer engagement also covered some investment scams and the 13-month reporting requirement, but it is not yet confirmed whether these will feature in the consultation.
Key dates
- December 2026 (expected): Formal consultation on policy proposals and any amendments to the relevant legal instruments
- December 2026 (expected): PSR report on the platforms and services most used by fraudsters, covering 2024 and 2025 data
- May 2027 (expected): Decision and revised legal directions published, with implementation date confirmed
- Within six months of the May 2027 decision: Changes take effect
Operational impact
- No new obligations arise until the decision. The existing reimbursement requirements remain fully in force
Next steps
- Diarise the December consultation and engage with the TPA’s consultation response (pending confirmation)
- Review claims-handling processes against the areas flagged for change, particularly cases running past 35 business days, investment-scam returns and the standard of caution
- Assess your ability to report data on the platforms and services used to target victims
- Monitor the PSR’s final decision and confirmed implementation timetable before scheduling changes.
🟧 Important, uncertain timing/impact
Consumer Duty—scope and proportionality policy statement expected
The FCA is consulting on changes to the Consumer Duty’s scope and application, including proposed exclusions for certain merchant acquiring, indirect access and safeguarding activities. Final rules are expected in Q1 2027.
The FCA is proposing targeted changes to the Consumer Duty rules (PRIN 2A) and will replace FG22/5 with revised non-Handbook guidance. The package delivers a commitment the FCA made to the Chancellor after the 2025 Mansion House speech, to address how the Duty applies to wholesale firms. This follows CP26/23 which closed on 18 September 2026.
The proposals would limit the Duty to retail customers "usually resident" in the UK. They would move the scope provisions into a new PRIN 3A, delete PRIN 3.2.8R, and replace "co-manufacturing" with principal and secondary manufacturers. Firms would be responsible only for their own role and could reasonably rely on other firms in the chain. They would notify the FCA only of material concerns about another firm, and would not need a stand-alone Duty board report. Expectations on vulnerability, monitoring and information-gathering would scale to each firm's role.
For payments, there are new exclusions for merchant acquiring where neither payer nor payee is a retail customer. Where the firm does not deal directly with retail customers, there are also exclusions for sponsored or indirect access to UK payment systems and for credit institutions providing safeguarding accounts to PIs and EMIs. PIs and EMIs that design retail payment services remain in scope. Agents, distributors, PISPs and account providers may also be in scope, depending on their role.
Key dates
- 18 September 2026: Consultation closed
- Q1 2027 (expected): Policy statement and final rules
- Date TBC: Final rules come into force. The draft instrument leaves the commencement date blank, and the FCA has asked whether manufacturer written agreements need a longer implementation period or should apply only to new or materially amended agreements
Potential impact
Nothing changes until final rules are made. PRIN 2A and FG22/5 apply in full, so scaling back Duty processes early carries breach risk. The FCA does say it will prioritise serious, impactful non-compliance over technical elements
Next steps
- Treat the current Duty rules and FG22/5 as fully in force until the policy statement
- Test the draft exclusions against each business line, especially whether any customer-facing activity would take the firm back into scope:
- acquirers: the make-up of the merchant book
- sponsor banks and indirect access providers: any direct retail interaction
- safeguarding banks: any direct retail interaction
- PIs and EMIs with partners, agents or co-designed products: map who has substantive control over design and operation. Review whether existing agreements document roles and responsibilities
- Firms with non-UK customers: check that residence data and distribution strategies can support the "usually resident" test
- Track the Q1 2027 policy statement for the commencement date and any transitional arrangements
🟧 Important, uncertain timing/impact
Expected policy statement on modernising the redress system
Following a consultation paper in May, the FCA and the Financial Ombudsman is expected to publish a policy statement in late 2026
Following consultation, the proposals aim to improve the consistency and effectiveness of the UK’s redress framework by encouraging earlier identification of consumer harm, clearer expectations for proactive redress, and closer coordination between the FCA and the Financial Ombudsman Service. They also propose changes to complaint handling, notification of systemic issues, the operation of the Financial Ombudsman and FSCS, and the way complaints are assessed, with the aim of delivering faster, more predictable outcomes for firms and consumers.
Key dates
- 2026: FCA and Financial Ombudsman policy statement expected
Potential impact
The proposals could increase regulatory expectations around identifying systemic issues, notifying the FCA and providing proactive redress. Firms may need to review their complaint-handling and governance arrangements to ensure they can respond effectively once the final policy is published.
Next steps
- Review the consultation proposals and assess the potential impact on complaints handling and redress processes.
- Consider whether governance and SUP 15 notification procedures would need updating.
- Monitor publication of the final policy statement and plan implementation where required.
🟧 Important, uncertain timing/impact
Safeguarding: FRC exposure draft on a dedicated safeguarding assurance standard
The Financial Reporting Council is developing a permanent safeguarding assurance standard to support audits of payment and e-money firms under the FCA’s new safeguarding regime.
The Financial Reporting Council is developing a permanent safeguarding assurance standard to support audits of payment and e-money firms under the FCA’s new safeguarding regime.
Following the introduction of the FCA’s Supplementary Regime in May 2026, the FRC is developing a dedicated safeguarding assurance standard to replace its interim guidance. The new standard will form part of the existing CASS Assurance Standard and establish the assurance approach auditors will use for safeguarding reviews under the new regime.
Key dates
- Winter 2026 (expected): FRC consultation on the draft safeguarding assurance standard
- Spring 2027: Final safeguarding assurance standard expected
- Q4 2027 (earliest): FCA consultation on the Post-Repeal Regime
Legal issue/risk
Until the new standard is finalised, firms and auditors will continue to rely on interim guidance, creating the potential for differing audit approaches during the transition to the permanent safeguarding regime.
Next steps
- Monitor the FRC consultation and consider responding, particularly on scope and proportionality.
- Engage with your safeguarding auditor to understand how the interim guidance is being applied.
- Use findings from the first audit cycle to strengthen safeguarding controls ahead of the permanent assurance standard.
🟩 Long-term/indicative
Payments firms: Delivering good outcomes for consumers in vulnerable circumstances
The FCA's findings on how payments and e-money firms identify, support and monitor outcomes for consumers in vulnerable circumstances under the Consumer Duty.
The FCA reviewed a sample of payments firms to assess how they support consumers in vulnerable circumstances and whether they are delivering good outcomes under the Consumer Duty. The publication covers good practice and areas for improvement across five areas: identifying and recording vulnerability; support; communications; governance and management information (MI); and oversight of intermediaries. Stronger firms understood the scale and drivers of vulnerability in their customer base. They built identification into digital and automated journeys, recorded it consistently, and used MI and board reporting to test outcomes and drive improvement. The weaknesses the FCA found were:
- Policies and training that firms could not show were working in practice
- Very low or nil identification rates despite customer bases where vulnerability would reasonably be expected
- Heavy reliance on staff judgement
- Limited board MI beyond annual Duty reporting
- Weak visibility of outcomes for customers served through intermediaries
The FCA notes that around half of UK adults show at least one characteristic of vulnerability. The publication introduces no new requirements and includes proportionality considerations for smaller firms. It is aimed at payments and e-money firms serving retail customers (including micro-enterprises and small charities), firms distributing payments, e-money and open banking products through intermediaries, and retail banks.
Key dates
- 17 September 2026: Findings published
- No forward firm-facing date
Potential impact
- No new obligations. The expectations come from the Consumer Duty and the FCA's existing guidance on the fair treatment of vulnerable customers, both already in force.
- The FCA says it will intervene using its full range of supervisory tools where firms are not meeting expectations
Next steps
- Benchmark current arrangements against the findings in each of the five areas. Prioritise testing and assurance that show policies are working in practice, not just that they exist
- Assess the scale and nature of vulnerability in your customer base against the FCA’s four drivers: health, life events, resilience and capability.
- Review how vulnerability is identified, flagged and shared across customer journeys, including online and automated channels. Confirm the lawful basis and data protection controls for recording it