Your guide to this week in regulation

This week, we lead with the Financial Conduct Authority’s (FCA) findings on how payments firms support customers in vulnerable circumstances, setting out where practice falls short of Consumer Duty expectations. Next, the FCA warns consumers to watch for red flags in debt advice, following action against firms steering people towards unsuitable fee-charging solutions.

Elsewhere, the FCA reports that firms are closing a rising number of suspected money mule accounts, though criminals continue to move funds through several accounts before cashing out. Meanwhile, the European Banking Authority (EBA) finalises guidelines on managing third-party risk for non-ICT services, giving firms a two-year transition to align with the wider digital operational resilience framework.

We conclude this week with the government and FCA’s response to the Treasury Committee’s report on the financial inclusion strategy, which commits to strengthening the evidence base but stops short of a formal implementation and accountability framework.

Vulnerable customer support in payments

The FCA has published findings on how payments firms support customers in vulnerable circumstances, following a review of a sample of firms against Consumer Duty expectations. The review looked at how firms identify vulnerability, provide support, communicate with customers and use management information to monitor outcomes.

The strongest firms understood the vulnerability characteristics most common in their customer base, embedded identification into online and automated journeys, and used board-level reporting to track outcomes and drive improvement. Weaker firms relied heavily on staff judgement, recorded few or no vulnerable customers despite an at-risk customer base, and gave boards little insight beyond annual Consumer Duty reporting. Oversight of intermediaries also varied, with some firms unable to show how vulnerability was managed further down the distribution chain.

Around half of UK adults show at least one characteristic of vulnerability, and payments failures can escalate quickly for those with limited resilience. The findings give every firm, not only those reviewed, a benchmark to test its own arrangements against before its next Consumer Duty board report.

Read more on payments firms and vulnerable consumers

Red flags in debt advice

The FCA has warned consumers seeking debt advice to watch for red flags, after finding some are steered towards fee-charging solutions that may not suit their needs. Warning signs include high pressure sales tactics, being coached to alter income or outgoings on an application, and contact from firms that fail to disclose free alternatives before offering a paid debt solution.

Free, impartial debt advice is available to everyone through MoneyHelper. The FCA has already acted where firms fell short of this standard, including stopping one debt advice firm from taking on new customers and banning a senior manager at another firm for a lack of honesty and integrity.

Consumers who suspect they have received poor advice can complain to the firm and then the Financial Ombudsman Service. Given the crossover with vulnerability and financial resilience, firms that provide or introduce customers to debt solutions should consider whether their sales and referral arrangements guard against these practices and explain free alternatives clearly.

Read more on spotting the red flags in debt advice

Firms crack down on money mules

Financial firms closed a record number of suspected money mule accounts last year, but organised crime groups continue to move funds through several accounts before cashing out, an FCA review has found. Firms shut down 238,396 suspected mule accounts in 2025, up from 184,935 in 2023, with the sharpest rise among customers aged 40 to 49.

The review found criminals typically cash out between the second and fifth account a payment passes through, by which point transfers are harder to detect and trace. Some accounts had been used repeatedly for both mule activity and fraud, pointing to established criminal infrastructure rather than isolated incidents. The National Crime Agency estimates more than £100bn is laundered through the UK or UK corporate structures each year.

The FCA is working with industry on an action plan to improve intelligence sharing on suspected mule activity. Repeated account use and rapid onward transfers are an early warning sign worth building into transaction monitoring now, ahead of the next stage of that work.

Read more on the FCA’s findings on money mules

EBA finalises third-party risk guidelines

The European Banking Authority has published final guidelines on the sound management of third-party risk relating to non-ICT services, replacing its 2019 outsourcing guidelines. The guidelines widen the perimeter beyond outsourcing to cover all third-party arrangements, with the fullest requirements reserved for those supporting critical or important functions.

The guidelines cover the whole lifecycle of a third-party arrangement, including risk assessment and due diligence, contracting, subcontracting, monitoring, documentation and exit strategies. They are designed to align with the Digital Operational Resilience Act and allow firms to use a single register for both ICT and non-ICT arrangements. A two-year transitional period will apply once the guidelines take effect, giving firms time to review existing arrangements and update their registers.

The guidelines are final but await translation into the official EU languages, with an application date yet to be confirmed. Groups with EU operations should start mapping which non-ICT arrangements support critical or important functions ahead of that transition window opening.

Read more on the FCA and MoD Defence, Security and Resilience Lab

Government responds to inclusion inquiry

The government and the FCA have published their responses to the Treasury Committee’s report on the financial inclusion strategy, addressing each of the committee’s recommendations in turn. The government agrees a stronger evidence base is needed but will rely on existing data sources, including an annual UK MoneyView survey and a more detailed FCA Financial Lives survey, rather than new firm-level reporting requirements.

The government also declined to commit to a formal implementation and accountability framework, arguing that the strategy already brings government, regulators, industry and consumer groups together by design. It will use the strategy’s planned two-year review to assess progress and next steps for each pilot and intervention. On access to banking services, ministers will use the Financial Services and Markets Bill to protect access if a current review supports intervention, without committing to new reserve powers.

The FCA’s next Financial Lives survey, due to carry more detail on digital exclusion, will be an early test of whether this data-led approach delivers for firms and consumers alike.

Read more on the government and FCA responses to the financial inclusion inquiry