Walking the Tightrope – fighting first party fraudulent conduct while meeting consumer duty expectations

The new Consumer Duty rules for retail financial services, which came into force in July 2023, marked a considerable shift in the regulatory expectations on firms as regards consumer protection. As noted by the Financial Conduct Authority (FCA), who will supervise firms for compliance, the Consumer Duty “sets higher and clearer standards of consumer protection across financial services and requires firms to put their customers’ needs first”.  

Since coming into force there have been myriad commentaries about how this new duty – with its strong focus on consumer access to services – marries up with another of the FCA’s significant regulatory focus areas in the retail financial services sector – that of tackling financial crime. An integral part of tackling financial crime is effectively managing customer risk, which in some instances will naturally necessitate account closures and customer exits. 

While balancing these requirements has been a source of industry consternation over the past year, arguably there are areas where translating the Consumer Duty principles into financial crime compliance processes is a less complex exercise. 

For example, it is easy to envisage how a firm’s anti-financial crime policy intersects with the Consumer Duty when responding to innocent and law-abiding customers who fall victim to financial fraud. In its November 2023 review of anti-fraud controls, the FCA made its expectations clear and explicit:  

“Firms must put the needs of their customers first and deliver consistently good outcomes for them. This includes helping customers understand what fraud is and how to identify it, making it easy for customers to report fraud and setting out what they can expect from the firm when they do report it.” 

Furthermore, the FCA already recognises that risk-based automated fraud warning messages and controls – already standard across the much of the industry – are a way in which firms can comply with the Consumer Duty requirement to ‘avoid foreseeable harm’. 

Beyond this, from an anti-money laundering perspective, it is clearly important to ensure that Know Your Customer processes are not over-zealous to the point of excluding innocent parties, particularly those from groups with ‘characteristics of vulnerability’, as required by the new rules.  

However, there is one area where a clear fault line has emerged between the two realms of regulatory expectation; that of how the consumer duty intersects with institutions’ responsibility to tackle first party fraudulent conduct.   

Let’s be clear, this isn’t a small-scale issue. Although much of the public debate on financial sector fraud over the past few years has related to organised scams, fraud first party fraudulent conduct is growing. At Cifas, we have seen year-on-year growth in reports of first party fraudulent conduct recorded to the National Fraud Database.  

While the squeeze on personal finances has undoubtably been a contributing factor to this, our research with consumers shows that a large part of this problem is driven by the perception of first party fraudulent conduct as an acceptable behaviour. Our recent fraud behaviours report revealed that 1 in 8 adults admit to some form of first party fraudulent conduct in the last 12 months.  

Despite the clear growth of the problem and the challenges of public perceptions, it is here where the Consumer Duty comes into conflict with institutions’ financial crime duties, as well as a general fiduciary duty to protect their reserves.   

There is a clear expectation set out in the Consumer Duty that “firms who reject customers have to explain alternatives and provide access to appropriate products”. Indeed, the Chief Executive of the FCA made clear in a recent speech that, while not a statutory objective, financial inclusion is a key priority for the regulator.  

Furthermore, even in cases where a firm’s risk appetite is not yet at the level of off-boarding a customer for first party fraud concerns, its ability to manage the immediate risk – and linked AML responsibilities – via measures such as account freezing, put the institution into potential conflict with the new rules. For example, in the FCA’s ‘Dear CEO’ letter from February 2023 regarding compliance with the Consumer Duty, it noted that, in its view, firms “freeze a disproportionate number of accounts, for too long, and without adequate explanation”, and sets out a clear expectation that account freezing activity should happen less often and be less protracted.  

In summary, whereas government and regulators are clearly not easing up the pressure on the industry to tackle economic crime, the industry is also under pressure to prioritise consumer outcomes and financial inclusion. This leaves the industry somewhere between a rock and a hard place when it comes to managing first party fraud risk against their own business.  

At this stage there is a lack of guidance from the regulator around how firms should balance these competing priorities, and the rules are too new to have revealed specific cases which adequately highlight the flashpoints in the debate. What is clear to us however is that building up a multi-sector picture of customer risk can help firms to provide a strong evidence base for a particular course of action, whether than be closer account monitoring or, ultimately, client off-boarding.  

In the end, however, with the current absence of cross-cutting guidance on the balance between these two objectives, firms will have to continue to walk the tightrope between financial crime, financial inclusion and wider Consumer Duty requirements. With multi-sector data and intelligence-sharing a firm part of controls, at least they don’t have to walk alone. 

A longer version of this piece first appeared in Credit Connect.