FCA Consumer Duty Rules: What Fintech Startups Need to Know?

For fintech startups, regulatory compliance cannot be treated as something to fix after a product has launched.

Customer journeys, pricing models, automated decisions, payment processes, app interfaces and support systems can all influence whether a business meets the FCA’s Consumer Duty.

At the centre of the Duty are the consumer duty cross cutting rules, which establish how firms should behave when delivering products and services to retail customers.

The three rules require firms to:

1. Act In Good Faith Towards Retail Customers
2. Avoid Causing Foreseeable Harm
3. Enable And Support Retail Customers To Pursue Their Financial Objectives

For a fintech business, these requirements can affect everything from product development and onboarding to subscription cancellation, customer support, complaints and the use of behavioural data.

The Duty applies to firms’ retail market business where it falls within scope, including relevant firms operating in areas such as payments and e-money.

It came into force for open products and services on 31 July 2023 and expanded to closed products and services on 31 July 2024.

What Is The FCA Consumer Duty?

The Consumer Duty establishes a higher standard of protection for retail customers using regulated financial products and services.

Its structure can be understood in three layers.

Consumer Duty Element	What It Does	Practical Meaning For Fintech Startups
Principle 12	Requires firms to act to deliver good outcomes for retail customers	Sets the overall standard expected from the business
Three Cross-Cutting Rules	Explain how firms should behave to deliver those outcomes	Influence product design, customer journeys, support and commercial decisions
Four Outcomes	Focus on products and services, price and value, consumer understanding and consumer support	Provide key areas in which firms need to assess actual customer outcomes

This distinction matters because the FCA does not view Consumer Duty compliance as a collection of isolated disclosure requirements.

A fintech could have an apparently clear pricing page or customer-support policy and still have a wider problem if its overall business model causes foreseeable harm or frustrates customers trying to achieve reasonable financial objectives.

The FCA’s current overview describes the Duty as outcomes-focused rather than simply process-focused. FCA Consumer Duty overview

How Do Principle 12, The Cross-Cutting Rules And Four Outcomes Fit Together?

This is one of the most important technical points for regulated startups to understand.

Under PRIN 2A.2.26, the FCA says the cross-cutting obligations exhaust what is required under Principle 12. In practical terms, the three cross-cutting rules define what a firm must do to meet the behavioural requirement created by Principle 12.

The relationship with the four outcomes is different.

PRIN 2A.2.28 says that the outcomes rules help define what is required under Principle 12 and the cross-cutting obligations, but the outcomes rules do not exhaust those requirements.

That creates an important compliance lesson for founders.

A business should not assume that completing four outcome assessments automatically proves that every cross-cutting obligation has been satisfied. Firms still need to consider their wider conduct towards customers.

For example, a fintech could technically meet parts of its consumer-support framework but still create unnecessary cancellation friction that conflicts with the requirement to enable and support customers.

What Are The Three Consumer Duty Cross Cutting Rules?

The three rules apply across different parts of a financial product’s lifecycle rather than operating as isolated compliance tests.

Cross-Cutting Rule	What It Requires	What It Does Not Require
Act In Good Faith	Honest, fair and open dealing that reflects reasonable customer expectations	Giving up legitimate commercial interests or operating without profit
Avoid Causing Foreseeable Harm	Identifying reasonably predictable risks and taking appropriate action	Eliminating every inherent financial risk a customer knowingly accepts
Enable And Support Customers	Helping customers make informed decisions and pursue financial objectives	Providing advice where the firm’s business model and regulatory permissions do not require advice

Each rule needs to be interpreted according to the firm’s activities, products, target market and relationship with customers.

What Does Acting In Good Faith Mean For A Fintech Startup?

PRIN 2A.2 defines good faith through honesty, fair and open dealing and conduct consistent with the reasonable expectations of retail customers.

For fintech companies, this can reach much further than the wording of terms and conditions.

A business should consider whether the design of its app, pricing structure, marketing, onboarding process and customer communications create a fair relationship with users.

A fintech could create concerns where it makes an action that generates revenue extremely easy but makes a customer-benefiting action unnecessarily difficult.

An example would be enabling a customer to upgrade a paid account instantly while requiring multiple screens, telephone calls or unexplained delays before the same customer can downgrade or cancel.

The FCA also identifies exploiting behavioural biases and customer vulnerability as examples of conduct that may conflict with good faith.

For digital-first businesses, this means product teams should consider how interface design influences behaviour.

Countdown timers, confusing defaults, repeated prompts, visually dominant purchase buttons or deliberately obscured exit options may require scrutiny where their purpose or effect is to push customers towards decisions that are not in their interests.

What Changed In The FCA Handbook In June 2026?

The current wording of PRIN 2A.2.4 is dated 26 June 2026.

It confirms that acting in good faith does not stop a firm pursuing legitimate commercial interests or making a profit as long as it remains compliant with the Consumer Duty.

It also states that good faith does not require a firm to act in a fiduciary capacity where no such obligation already exists.

That distinction is useful for startups.

Consumer Duty does not mean every fintech must behave as a financial adviser or place itself under obligations belonging to a different legal relationship. It does mean commercial strategies need to operate within the standards established by the Duty.

A profitable product can therefore comply with the rules. A business model that depends on unfairly exploiting customer behaviour may not.

What Does Avoiding Foreseeable Harm Mean?

The second cross-cutting rule requires firms to avoid causing foreseeable harm to retail customers.

The FCA makes clear that harm can arise through both actions and omissions. It can also arise directly through a firm’s relationship with customers or through the firm’s role in a distribution chain.

For a fintech business, foreseeable harm could potentially arise from weak product design, confusing fees, inadequate fraud controls, poor support, unsuitable distribution, unreasonable exit barriers or failure to respond when customer data reveals a growing problem.

The relevant question is not simply whether harm has already happened.

Businesses need to consider what risks they could reasonably have identified based on their product, customer information, complaints, monitoring data and developments in the market.

Does The FCA Expect Firms To Prevent Every Financial Loss?

No.

The Duty does not make a regulated business responsible for eliminating every risk inherent in a financial product.

The FCA recognises that products can carry risks customers understand and accept. Investments, for example, can lose value because markets move.

However, the firm’s belief that customers understand those risks needs to be reasonable. Product design, communications, customer support and customer characteristics can all affect that assessment.

A risk disclosure therefore should not be treated as an automatic defence where the overall customer journey makes the risk difficult to understand.

Can A Fintech Be Responsible When Another Firm Also Caused The Harm?

Potentially, yes.

This is particularly important for fintech startups that rely heavily on third-party providers.

PRIN 2A.2.9 states that foreseeable harm may occur through a firm’s role in the distribution chain even where another firm in that chain also contributes to the harm.

A startup cannot automatically assume that responsibility transfers completely to a banking partner, payment provider, intermediary, distributor or technology partner.

The business should understand its own role and its ability to influence the customer outcome.

For example, a platform could distribute a product manufactured by another regulated company while controlling the app interface, marketing journey and customer communications.

Problems in those areas may still engage the platform’s own Consumer Duty responsibilities.

Startups operating around cryptoassets face an additional set of regulatory questions, making a clear understanding of crypto compliance requirements affecting small business startups particularly important where digital assets form part of the product or payment model.

Does Responsibility Change If The Customer Relationship Is Ongoing?

Yes.

The FCA distinguishes between firms maintaining ongoing customer relationships and firms involved only at a particular point.

A firm with an ongoing relationship relating to a product needs to consider foreseeable harm across that product’s lifecycle.

By contrast, a firm involved only at a single point in time and without an ongoing relationship does not need to prevent harm that only becomes foreseeable later.

This distinction can be particularly relevant to digital platforms.

A fintech operating a customer’s account continuously is in a different position from a business providing a one-off introduction or transaction.

The firm’s role therefore needs to be mapped carefully rather than assuming every participant in a financial-services chain has identical responsibilities.

What Does Enabling And Supporting Customers Mean?

The third rule requires firms to enable and support retail customers to pursue their financial objectives.

That does not mean every fintech company must become an advisory business.

For execution-only and non-advised services, the FCA says firms can generally assume that customers’ objectives are to purchase, use and obtain the benefits of the relevant product unless the firm knows, or reasonably should know, otherwise.

For advisory or discretionary services, firms can rely on objectives disclosed by customers unless the information is clearly outdated, inaccurate or incomplete.

For a digital business, enabling customers can include making sure information arrives at the right moment, important choices are understandable and customers can access the product’s intended benefits without unreasonable barriers.

The FCA specifically refers to allowing customers to switch or exit products without unreasonable barriers or delays.

This has direct relevance to app-based financial products.

Fast onboarding combined with an unnecessarily difficult cancellation journey may indicate that the customer experience has been optimised for acquisition rather than good customer outcomes.

Payment-focused startups should consider these requirements alongside the wider ways digital wallets are changing startup payment journeys, particularly where convenience, security and customer control are being built into the same product experience.

Do The Rules Apply To Individual Customers Or The Target Market?

They can apply at either level depending on the activity.

PRIN 2A.2.24 explains that where a firm is interacting directly with an individual retail customer or providing a bespoke service, the obligations apply to that specific interaction.

Where the business is making wider decisions without interacting with one particular customer, such as product design, pricing or communication design, the obligations normally apply at the target-market level.

Business Decision	Relevant Level
Designing A Savings App	Target Market
Setting Standard Subscription Fees	Target Market
Writing An Onboarding Journey	Target Market
Responding To An Individual Customer In Financial Difficulty	Individual Customer
Providing Bespoke Financial Advice	Individual Customer
Handling A Particular Vulnerable Customer’s Support Request	Individual Customer

For startups, this distinction helps clarify what customer information is realistically expected.

A product team designing a standard app does not necessarily need detailed information about every future customer. It does need enough evidence about its target market to understand likely needs, characteristics and risks.

Once a business is dealing with a specific customer and knows more about their circumstances, those facts can become relevant to how the Duty should be applied.

How Do Vulnerability And Behavioural Bias Affect All Three Rules?

Customer vulnerability should not be treated as a separate issue that only belongs in a support policy.

PRIN 2A.2.25 states that each cross-cutting obligation requires firms to understand and take account of cognitive and behavioural biases, customer vulnerability and lack of knowledge where these factors affect customer needs and decisions.

That means the issue can affect product design, pricing, communications, sales, ongoing support and remediation.

For example, a financial app aimed partly at people managing debt may need different design assumptions from an investment platform intended for experienced investors.

Firms should also avoid assuming vulnerability always means a permanent characteristic. Financial difficulty, bereavement, illness, digital exclusion or major life events can alter what support a customer needs.

Do Small Fintech Firms Have To Follow The Same Consumer Duty Rules?

Yes, but proportionality matters.

Small firms are expected to deliver the same good customer outcomes as larger firms. However, the FCA recognises that the implementation, evidence and processes used by a smaller firm can be proportionate to its size, customer base, products and complexity.

A five-person fintech is not automatically expected to reproduce every governance process used by a major retail bank.

That does not mean a startup can reduce the standard of customer outcomes.

Instead, the evidence supporting compliance might be simpler.

A smaller company might rely on concise management information, regular founder or board-level review, structured complaint analysis and clearly documented product decisions rather than multiple committees and large compliance departments.

The FCA has also published Consumer Duty board-report findings showing that useful practices can be found in firms with fewer than ten employees.

The practical principle is proportionate process, not weaker outcomes.

How Do The Cross-Cutting Rules Connect To The Four Consumer Outcomes?

The four outcomes turn the Duty into practical areas businesses can monitor.

Consumer Outcome	What A Fintech Startup Should Consider
Products And Services	Whether the product is designed for an identified target market and continues to meet its needs
Price And Value	Whether the total price customers pay is reasonable compared with the benefits they receive
Consumer Understanding	Whether communications allow customers to make informed decisions
Consumer Support	Whether customers can use, change, complain about or leave a product without unreasonable obstacles

The cross-cutting rules operate across all four.

Acting in good faith can affect pricing, product design and communications. Avoiding foreseeable harm can influence product governance and support. Enabling customers can affect communication, access, switching and cancellation.

A business should therefore avoid dividing Consumer Duty into disconnected workstreams.

What Should Fintech Startups Measure To Evidence Compliance?

The FCA requires firms to monitor the outcomes retail customers actually experience. The nature and frequency of monitoring can depend on the firm’s role, product and target market.

For a fintech startup, useful evidence could include:

Metric Or Evidence	What It May Reveal
Complaint Volumes And Root Causes	Recurring harm or confusing product features
Cancellation Completion Rates	Unreasonable exit friction
Support Waiting Times	Whether customers can obtain help when needed
Repeat Customer Contacts	Whether issues are being resolved effectively
Communication Testing	Whether users understand important information
Product Abandonment Rates	Unexpected friction within important journeys
Vulnerable Customer Outcomes	Whether particular groups experience poorer results
Refund And Redress Times	Whether identified harm is corrected promptly
Charges And Fee Incidence	Whether certain groups experience unexpected costs
Out-Of-Target-Market Sales	Weaknesses in distribution controls
Fraud And Scam Complaints	Emerging harm requiring product or support changes
Switching Failure Rates	Barriers preventing customers from moving products

There is no universal KPI dashboard suitable for every fintech.

A payments firm, lender and investment platform have different products and risks. Data should therefore be chosen because it helps management identify actual or emerging customer outcomes rather than because it creates a large compliance report.

The FCA’s review of payments firms is especially relevant to payment-led fintech businesses because it examines issues including target markets, fair value, customer understanding, support, governance and management information.

What Should A Startup Do When It Discovers Customer Harm?

Consumer Duty compliance does not end when a problem is detected.

PRIN 2A.2.5 requires firms that identify foreseeable harm resulting from their acts or omissions to take appropriate action, including redress where appropriate. The more detailed remediation requirements appear in PRIN 2A.10.

A practical remediation process is:

1. Investigate The Cause: Establish what happened, which customers may be affected and whether additional information is required.
2. Assess The Harm Fairly And Promptly: Determine the scale of the issue and whether another firm may share or hold responsibility.
3. Decide The Appropriate Remedy: This may involve changing the product, correcting information, refunding charges or providing financial redress.
4. Communicate Clearly With Customers: Explain the identified harm and what action the business intends to take.
5. Complete Accepted Redress Promptly: Once remedial action or redress has been accepted, the business should implement it without unnecessary delay.

The FCA’s rules also address situations where another firm in the distribution chain may have caused the harm. Where another firm is believed to be solely or jointly responsible, appropriate information about the issue should be passed to that firm.

For startups, root-cause analysis is particularly important.

Refunding one customer while leaving the underlying design problem unchanged may allow the same harm to continue across the wider customer base.

How Should Fintech Startups Implement The Cross-Cutting Rules?

Implementation should begin with the business model rather than the compliance manual.

Founders should map which regulated activities are carried out, which customers fall within scope, where the company sits within the distribution chain and how much influence it has over customer outcomes.

Product teams should then examine the entire customer journey, including acquisition, onboarding, pricing, transactions, communications, support, complaints, switching and exit.

Compliance documentation should record why significant product and commercial decisions are consistent with good customer outcomes.

Customer-facing testing is also valuable.

A company may believe its pricing or disclosures are simple because employees understand them. Testing with actual users can reveal whether customers interpret the information differently.

Governance should then ensure that customer outcomes remain visible as the company scales.

The FCA Handbook requires the Duty to be reflected in firms’ strategy, governance, leadership and people policies, including incentives.

That has particular significance for high-growth fintech businesses where teams may be rewarded heavily for customer acquisition, transaction volumes or upselling.

Growth incentives should not encourage behaviour that conflicts with customer outcomes.

What Is Changing Around Consumer Duty Proportionality In 2026?

There is another development fintech founders should monitor.

On 29 June 2026, the FCA opened consultation CP26/23 on Consumer Duty scope and proportionality. The consultation is scheduled to close on 18 September 2026.

The FCA is considering changes intended to provide greater clarity around issues including:

Consultation Area	Proposed Direction
Non-UK Customers	Possible changes to which overseas business falls within scope
Distribution Chains	Clearer guidance on when firms can rely on other businesses
Proportionality	Greater clarity on applying requirements according to a firm’s role
Product Governance	Clarification of how Consumer Duty interacts with other governance rules

These are consultation proposals, not final rules as of 7 September 2026.

Startups should therefore continue to comply with the rules currently in force while monitoring the FCA’s final response.

What Are The Consequences Of Getting Consumer Duty Wrong?

Weak Consumer Duty compliance can create more than a regulatory problem.

The FCA expects firms to demonstrate that they are acting to deliver good outcomes and has said its supervisory and enforcement response will be proportionate to actual or potential consumer harm.

Serious issues can lead to intervention, investigation or disciplinary action.For a fintech startup, the wider commercial effects can also be significant.

Regulatory weaknesses can make fundraising, banking relationships, partnerships and acquisition due diligence harder.

Recurring complaints or redress liabilities can increase operating costs. Customer trust can also deteriorate quickly where problems involve payments or access to money.

For that reason, Consumer Duty should be treated as part of product quality and business risk management rather than simply a legal sign-off exercise.

What Should Fintech Founders Take Away From The Rules?

The consumer duty cross cutting rules require fintech companies to think beyond whether a disclosure exists or a policy has been written.

The real question is whether the business can demonstrate through product design, customer data and decision-making that it is acting to deliver good outcomes.

For smaller firms, the FCA allows proportionality in how compliance is implemented. It does not create a lower standard of customer treatment.

The strongest approach is therefore to build Consumer Duty considerations into the product while the company is still small.

That makes it easier to understand where foreseeable harm could arise, remove unnecessary customer friction, create meaningful management information and establish a compliance culture before scale makes weaknesses more difficult and expensive to correct.

Frequently Asked Questions

What Are The Three FCA Consumer Duty Cross Cutting Rules?

The three rules require firms to act in good faith towards retail customers, avoid causing foreseeable harm and enable and support retail customers to pursue their financial objectives.

Do Consumer Duty Rules Apply To Small Fintech Startups?

Where the Consumer Duty applies to the firm’s activities, being small does not remove the requirement to deliver good customer outcomes. The FCA does, however, expect implementation and evidence to be proportionate to the firm’s size, activities and customer base.

Does Acting In Good Faith Mean A Fintech Cannot Make A Profit?

No. The current FCA Handbook expressly states that a firm can pursue legitimate commercial interests and seek profit provided it does so consistently with the Consumer Duty.

Does Consumer Duty Make Every Fintech A Fiduciary?

No. PRIN 2A.2.4 states that acting in good faith does not require a firm to operate in a fiduciary capacity where it was not already required to do so.

Can A Firm Comply With The Four Outcomes But Still Breach A Cross-Cutting Obligation?

Potentially. The FCA says the outcome rules help define the requirements of Principle 12 and the cross-cutting rules but do not exhaust those requirements. Firms therefore need to consider their wider conduct rather than treating the four outcomes as a complete checklist.

How Can A Startup Evidence That It Acts In Good Faith?

Evidence can come from product-governance decisions, pricing reviews, communication testing, complaint analysis, customer-outcome monitoring, staff incentives and records showing how customer interests were considered when significant decisions were made.

What KPIs Can Help Measure Foreseeable Harm?

Useful measures can include complaints, fraud losses, cancellations, failed customer journeys, unexpected charges, support waiting times, repeat contacts, vulnerable-customer outcomes and redress volumes. The right metrics depend on the product and target market.

How Should Consumer Duty Compliance Adapt For Vulnerable Customers?

Firms should consider vulnerability throughout product design and customer interaction. The FCA says each cross-cutting obligation requires firms to account for vulnerability, behavioural biases and lack of knowledge where these factors influence customer needs and decisions.

Does Consumer Duty Apply To Closed Products?

Yes. The Duty has applied to closed products and services since 31 July 2024, although some elements operate differently because those products are no longer being marketed or distributed.

Is A Startup Responsible For Harm Caused By A Business Partner?

Its responsibility depends on its role, but another firm’s involvement does not automatically remove liability. PRIN 2A.2.9 specifically recognises that foreseeable harm can arise through a distribution chain even when another firm also contributes to it.

Are The FCA’s 2026 Proportionality Proposals Already In Force?

No. CP26/23 is a consultation and is scheduled to close on 18 September 2026. Firms should distinguish those proposals from the Consumer Duty rules currently in force.