Your guide to this week in regulation

This week, the centrality of the Consumer Duty to the Financial Conduct Authority’s (FCA) regulatory strategy is underlined by its latest feedback of good and bad practice, including for smaller firms.

Next up, the FCA has set out its clear expectations of firms when managing conflicts of interest in vertically integrated insurance, following its direct engagement with those whose business models carry greater risk.

Elsewhere, the European Banking Authority (EBA) has opened four consultations under the revised Deposit Guarantee Schemes Directive, covering depositor information, information exchange, client funds and how deposit guarantee schemes invest their funds.

We conclude this week with a joint reflection from the FCA and Prudential Regulation Authority (PRA) on the early stages of the new oversight regime for Critical Third Parties, including regulators’ expectations that firms consider how they identify, test and manage dependencies on critical services.

Outcomes monitoring under the Consumer Duty

The FCA has published findings from a year-long review of how firms monitor outcomes under the Consumer Duty. The strongest firms build structured, evidence-based frameworks that link signals from the customer journey to measurable indicators, then test whether interventions actually improve outcomes. Smaller firms do not need complex systems: several used a small number of well-chosen indicators to identify harm effectively.

The FCA observed that weaker firms relied on high-level management information without a clear link to decisions or action, and some lacked indicators for foreseeable harm such as customer vulnerability. Governance has strengthened since earlier reviews, but boards should show more evidence of genuine challenge rather than simply reviewing reports. Firms should also strengthen oversight of third parties and distribution partners, since customers experience a service as a whole rather than distinguishing between the firms behind it.

A monitoring framework that shows a clear link between data, decisions and improved outcomes, particularly for vulnerable customers, will matter increasingly as scrutiny of the Duty continues.

Read more on outcomes monitoring under the Consumer Duty

Conflicts of interest in insurance

The FCA has set out its expectations for firms with vertically integrated business models in general insurance. These arrangements span underwriting, distribution, premium finance and other services within one group, or link firms through ownership or financing relationships that may not be publicly visible. The regulator says such structures can create conflicts of interest that shape decisions in ways that do not serve the customer, and it has previously taken enforcement action where this occurred.

Having a conflict of interest does not make a business model unacceptable, but firms must actively identify, manage and evidence it. Disclosure to customers alone is not sufficient. The FCA has already written to some firms whose models it considers carry heightened risk, and expects the wider market to review product design, remuneration structures and customer communications accordingly.

This recent communication sets clear expectations for assessing how arrangements deliver good outcomes for customers, notifying the FCA of material changes affecting conflicts of interest, and simplifying overly complex structures where these are difficult to supervise.

Read more on managing conflicts of interest in insurance

EBA consults on depositor protection

The EBA has opened four consultations on technical standards and guidelines under the revised Deposit Guarantee Schemes Directive. The proposals are the first of twelve mandates the EBA must deliver under the directive, and aim to strengthen depositor protection, support financial stability and further harmonise standards across the EU.

Specifically, the EBA is seeking stakeholders’ feedback on:

• Implementing Technical Standards (ITS) on depositor information

• ITS on information exchange between credit institutions, deposit guarantee schemes (DGSs) and other relevant authorities

• Regulatory Technical Standards (RTS) on the treatment of client funds protection across the EU, and

• Guidelines on how DGSs should invest funds collected from industry.

The proposals also support DGSs’ ability to mobilise funds quickly; not only to reimburse depositors but for resolution and other interventions.

Firms with EU deposit-taking operations are encouraged to review the proposals against their own depositor communications and reporting arrangements, and to respond before the consultations close on 23 October 2026.

Read more on the EBA’s depositor protection consultations

Strengthening resilience across the system

The FCA and PRA have jointly reflected on the initial stages of the Critical Third Parties (CTP) regime, which recently began live oversight of major cloud and technology providers. The regulators say operational resilience can no longer be judged firm by firm, since banks, insurers, payment firms and financial market infrastructures increasingly rely on a small number of common providers.

In 2025, 27% of incidents reported to the FCA were attributed to a third party, over a third of them cyber-related. Recent disruption at major technology and retail organisations showed how a single provider failure can affect many organisations simultaneously. The CTP regime adds system-wide oversight without replacing firms’ own responsibility for managing outsourcing and third-party risk.

Continuing to identify, test and manage dependencies on critical services remains important for firms, while designated CTPs are expected to engage openly with regulators and firms, including through joint testing and information-sharing, particularly during incidents.

Read more on strengthening resilience across an interconnected system