What Is Conduct Risk?

Conduct risk is the risk that the behaviour of an organization or its representatives produces unfair, inappropriate or harmful outcomes.

It may arise through:

• Strategy

• Governance

• Culture

• Incentives

• Product      design

• Pricing

• Sales

• Marketing

• Customer      service

• Operations

• Technology

• Outsourcing

• Complaint      handling

• Remediation

Conduct risk is broader than intentional misconduct.

Customer harm may occur even where employees acted honestly.

For example:

• A      product may be too complex for its target market.

• A      pricing structure may create unreasonable fees.

• An      automated system may incorrectly restrict customer accounts.

• A      customer-service process may make complaints difficult.

• A      vendor may provide misleading information.

• Performance      targets may encourage poor sales practices.

A strong conduct risk framework therefore examines systems and incentives as well as individual behaviour.

Consumer Protection vs Conduct Risk

Consumer protection and conduct risk overlap but are not identical.

Consumer Protection

Consumer protection generally focuses on the rights and interests of customers.

It may address:

• Disclosures

• Fair      treatment

• Product      suitability

• Complaint      rights

• Privacy

• Marketing

• Fees

• Contract      terms

• Access      to services

• Redress

Conduct Risk

Conduct risk focuses on how business decisions and behaviour may produce poor outcomes.

It considers:

• Culture

• Incentives

• Governance

• Product      design

• Distribution

• Conflicts      of interest

• Decision-making

• Customer      outcomes

Consumer protection obligations often form part of the conduct risk framework.

Conduct risk management helps the organization identify situations where technically compliant practices may still produce foreseeable harm.

Consumer Protection Governance

Consumer protection should be supported by clear governance and accountability.

The framework may define:

• Board      oversight

• Senior-management      responsibilities

• Product      ownership

• First-line      responsibilities

• Compliance      oversight

• Risk-management      responsibilities

• Legal      responsibilities

• Complaint      ownership

• Customer-remediation      authority

• Escalation

• Reporting

• Independent      assurance

Consumer protection should not belong exclusively to the compliance department.

Business functions influence customer outcomes through:

• Product      design

• Pricing

• Marketing

• Technology

• Operations

• Sales

• Customer      service

• Collections

• Fraud      management

Each function should understand how its decisions can affect customers.

Board Oversight

Boards should understand whether the organization is delivering appropriate customer outcomes.

Board oversight may include:

• Approving      conduct risk appetite

• Reviewing      customer-outcome reporting

• Challenging      product design

• Reviewing      significant complaints

• Monitoring      vulnerable-customer outcomes

• Overseeing      remediation

• Reviewing      incentive arrangements

• Monitoring      regulatory developments

• Assessing      customer-harm risks

• Ensuring      adequate resources

The board should receive information that explains actual outcomes rather than only confirming that required procedures exist.

For example, reporting should distinguish between:

• A      complaint procedure being documented

• Complaints      being resolved within required timeframes

• Complaints      being resolved fairly

• Root      causes being corrected

Conduct Risk Appetite

A conduct risk appetite defines the types and levels of customer-harm risk the organization is prepared to accept.

It may address:

• Misleading      communications

• Product      complexity

• Customer      complaints

• Pricing      and fees

• Account      restrictions

• Service      outages

• Sales      practices

• Vulnerable-customer      harm

• Remediation

• Product      exceptions

• Customer-support      delays

• Repeat      incidents

• Distribution      practices

• Conflicts      of interest

Organizations generally have little or no appetite for deliberate customer mistreatment.

However, measurable thresholds may still be required for:

• Complaint      volumes

• Processing      delays

• Customer-support      wait times

• Incorrect      charges

• Payment      failures

• Account      closures

• Fraud      reimbursement

• Service      availability

Threshold breaches should result in escalation and corrective action.

Conduct Risk Assessment

A conduct risk assessment identifies how the organization’s activities could produce poor customer outcomes.

The assessment may consider:

• Products

• Customer      segments

• Distribution      channels

• Sales      practices

• Fees

• Communications

• Technology

• Customer      support

• Complaints

• Outsourcing

• Incentives

• Vulnerable      customers

• Product      withdrawal

• Historical      incidents

A conduct risk assessment may document:

• Potential      harm

• Customers      affected

• Cause

• Existing      controls

• Likelihood

• Severity

• Control      effectiveness

• Residual      risk

• Required      action

• Responsible      owner

The assessment should consider both direct and indirect harm.

For example, a payment delay may create:

• A      late-payment fee

• Lost      access to goods

• Damage      to a customer relationship

• Financial      distress

• Reputational      harm

Customer Outcome Framework

A customer outcome framework defines what fair treatment means in practice.

Potential outcomes include:

• Products      meet identified customer needs.

• Pricing      is reasonable and transparent.

• Communications      support informed decisions.

• Customers      receive effective support.

• Complaints      are handled fairly.

• Vulnerable      customers receive appropriate assistance.

• Barriers      do not prevent customers from exercising rights.

• Poor      outcomes are identified and remediated.

The framework should establish:

• Desired      outcomes

• Relevant      indicators

• Data      sources

• Owners

• Thresholds

• Review      frequency

• Escalation

• Corrective      action

An outcome should be measurable.

Statements such as “customers are treated fairly” require supporting evidence.

Product Governance

Product governance is the process through which an organization designs, approves, distributes, monitors and withdraws products.

A product governance framework may include:

1. Product      proposal

2. Target-market      assessment

3. Customer-needs      analysis

4. Risk      assessment

5. Pricing      and value assessment

6. Legal      and compliance review

7. Operational      readiness

8. Approval

9. Distribution      strategy

10. Post-launch      monitoring

11. Periodic      review

12. Product      modification or withdrawal

Product governance should apply to:

• New      products

• Material      product changes

• New      fees

• New      distribution channels

• New      customer groups

• New      jurisdictions

• Product      migrations

• Product      closures

A product should not be approved solely because it is technically possible or commercially attractive.

The organization should understand:

• Who      the product is for

• Who      it is not for

• What      need it addresses

• What      risks it creates

• How      customers will understand it

• How      performance will be monitored

Target Market

A target market defines the customer group for whom the product has been designed.

The assessment may consider:

• Customer      needs

• Financial      circumstances

• Knowledge

• Experience

• Objectives

• Risk      profile

• Vulnerability

• Geographic      location

• Language

• Expected      use

The organization should also identify a negative target market.

This may include customers for whom the product is unlikely to be appropriate.

Distribution arrangements should be designed to reach the intended market and reduce sales outside it.

Product Approval

Product approval should involve appropriate functions.

Depending on the product, participants may include:

• Product

• Compliance

• Legal

• Risk

• Operations

• Technology

• Finance

• Fraud

• AML

• Privacy

• Customer      service

• Marketing

• Senior      management

Approval materials may include:

• Product      description

• Target      market

• Customer      need

• Conduct      risk assessment

• Financial      crime assessment

• Privacy      assessment

• Operational      risk assessment

• Pricing

• Customer      communications

• Complaint      arrangements

• Monitoring      plan

• Exit      strategy

Conditional approvals and exceptions should be documented and tracked.

Product Testing

Products and customer journeys should be tested before launch.

Testing may assess:

• Customer      understanding

• Disclosures

• Fees

• User      experience

• Accessibility

• Operational      processing

• Complaint      handling

• Fraud      controls

• Account      restrictions

• Cancellation

• Product      exit

Testing methods may include:

• User      testing

• Customer      research

• Scenario      testing

• Vulnerable-customer      testing

• Compliance      review

• Operational      simulation

• Pilot      programs

Testing should reflect realistic customer behaviour rather than only the organization’s intended process.

Product Monitoring

Product monitoring should determine whether the product continues to meet customer needs and produce appropriate outcomes.

Monitoring may include:

• Sales

• Customer      profiles

• Product      usage

• Fees

• Complaints

• Cancellations

• Refunds

• Account      closures

• Fraud      losses

• Support      requests

• Operational      incidents

• Customer      feedback

• Distribution      patterns

• Vulnerable-customer      outcomes

A product may require review where:

• Customers      use it differently than expected.

• Complaints      increase.

• Fees      disproportionately affect certain customers.

• The      target market changes.

• The      product no longer provides reasonable value.

• A      distributor sells outside the intended market.

• Operational      problems create recurring harm.

Product Withdrawal

Product withdrawal can itself create customer harm.

The withdrawal plan should consider:

• Advance      notice

• Existing      contractual rights

• Alternative      products

• Access      to funds

• Customer      support

• Complaints

• Vulnerable      customers

• Data      retention

• Regulatory      notification

• Distribution      partners

Organizations should avoid withdrawing products in a way that creates unreasonable barriers or leaves customers without practical alternatives.

Pricing and Fair Value

A product’s value depends on the relationship between:

• Price

• Fees

• Charges

• Benefits

• Service      quality

• Product      limitations

• Customer      support

• Expected      use

A product may provide poor value even where every fee is disclosed.

Potential concerns include:

• Excessive      transaction fees

• Large      foreign exchange spreads

• Inactivity      fees

• Hidden      intermediary charges

• High      cancellation costs

• Repeated      small charges

• Fees      for ineffective services

• Fees      disproportionate to cost or benefit

Fair-value assessments should consider:

• Total      customer cost

• Product      benefits

• Customer      segment

• Expected      usage

• Comparable      services

• Distribution      costs

• Limitations

• Service      quality

• Vulnerability

• Complaints

The assessment should be evidence-based rather than a conclusion that the price is acceptable because customers have agreed to it.

Foreign Exchange Pricing

Foreign exchange products can create specific conduct risks.

Customers may see:

• An      exchange rate

• A      transfer fee

• A      service charge

• An      intermediary-bank charge

• A      recipient deduction

• A      margin embedded in the rate

A transaction advertised as having “no fee” may still include a substantial exchange-rate margin.

Organizations should communicate:

• The      applicable rate

• How      the rate is determined

• The      amount the customer will pay

• The      amount expected to be received

• Known      charges

• Potential      third-party deductions

• When      the rate becomes binding

• Cancellation      rights

• Delays      or settlement conditions

Comparisons with market or reference rates should be accurate and not misleading.

Marketing and Financial Promotions

Marketing should be:

• Clear

• Fair

• Accurate

• Balanced

• Understandable

• Supported      by evidence

Potential concerns include:

• Prominent      benefits with hidden limitations

• Unrealistic      savings claims

• Misleading      “free” claims

• Unclear      eligibility

• Incomplete      risk disclosure

• Artificial      urgency

• Misleading      comparisons

• Testimonials      that are not representative

• Influencer      promotions without adequate control

The approval process should cover:

• Websites

• Social      media

• Emails

• Applications

• Advertisements

• Affiliates

• Influencers

• Comparison      sites

• Sales      scripts

In the United States, the FTC states that advertising claims must be truthful, must not be deceptive or unfair and should be supported by evidence where appropriate.

Customer Communications

Customer communications should help the intended audience understand:

• The      product

• The      price

• The      risks

• The      limitations

• The      customer’s responsibilities

• How      to obtain support

• How      to complain

• How      to cancel or exit

Communications may include:

• Terms      and conditions

• Fee      schedules

• Product      summaries

• Marketing

• Transaction      confirmations

• Payment      warnings

• Account      notices

• Complaint      responses

• Closure      notices

• Digital      prompts

A communication can be factually accurate but still ineffective if important information is:

• Buried

• Overly      technical

• Ambiguous

• Inconsistent

• Poorly      timed

• Difficult      to access

The organization should consider:

• Plain      language

• Structure

• Font      and presentation

• Timing

• Channel

• Language

• Accessibility

• Customer      knowledge

Customer Understanding

Providing information does not necessarily mean that customers understand it.

Customer-understanding testing may involve:

• Surveys

• Interviews

• Usability      testing

• Comprehension      testing

• Complaint      analysis

• Customer-support      data

• Behavioural      analysis

• A/B      testing

Questions may include:

• Do      customers understand the total price?

• Do      they understand when a rate is fixed?

• Do      they know how to cancel?

• Do      they understand product limitations?

• Can      they identify significant risks?

• Do      warnings influence decisions?

• Can      vulnerable customers access the information?

Testing should focus on material information rather than whether customers read every contractual provision.

Digital Customer Journeys

Digital journeys can create conduct risk through:

• Default      selections

• Pre-ticked      options

• Confusing      navigation

• Hidden      cancellation routes

• Excessive      steps

• Poorly      placed disclosures

• Manipulative      prompts

• Countdown      timers

• Repeated      pressure

• Inaccessible      design

These techniques are sometimes described as dark patterns when design is used to steer users toward choices that may not be in their interests.

Digital design should support informed and voluntary decisions.

The organization should assess:

• Choice      architecture

• Default      settings

• Button      labels

• Prominence

• Timing

• Confirmation      steps

• Cancellation

• Accessibility

• Data      consent

Sales Practices

Sales practices can create conduct risk when employees or intermediaries prioritize revenue over customer needs.

Potential risks include:

• Pressure      selling

• Misrepresentation

• Incomplete      disclosures

• Product      steering

• Inappropriate      cross-selling

• Failure      to assess needs

• Falsification      of information

• Discouraging      cancellation

• Exploiting      customer vulnerability

Controls may include:

• Training

• Sales      scripts

• Call      monitoring

• File      reviews

• Customer      confirmation

• Incentive      governance

• Quality      assurance

• Complaint      analysis

• Disciplinary      procedures

Sales performance should not be evaluated solely through volume or revenue.

Incentives and Remuneration

Incentives influence behaviour.

Problematic arrangements may reward:

• Sales      volume

• Product      profitability

• Customer      retention at any cost

• Complaint      suppression

• Rapid      processing

• Low      reimbursement

• Account      closures

Incentive design should consider:

• Customer      outcomes

• Compliance

• Quality

• Complaints

• Cancellations

• Vulnerable      customers

• Long-term      product performance

In Canada, the federal Financial Consumer Protection Framework includes requirements relevant to appropriate products and services and remuneration practices for banks. FCAC has issued guidance setting out expectations for implementing those requirements.

Distribution and Intermediaries

Products may be distributed through:

• Agents

• Brokers

• Affiliates

• Comparison      sites

• Payment      partners

• Embedded-finance      platforms

• Retail      locations

• Digital      marketplaces

The organization should oversee:

• Target-market      alignment

• Marketing

• Disclosures

• Sales      practices

• Training

• Complaints

• Customer      support

• Incentives

• Data      sharing

Outsourcing distribution does not necessarily transfer regulatory accountability.

Contracts should support:

• Information      sharing

• Monitoring

• Audit

• Corrective      action

• Complaint      escalation

• Termination

Customer Support

Effective customer support allows customers to:

• Obtain      information

• Complete      transactions

• Correct      errors

• Exercise      rights

• Report      fraud

• Resolve      problems

• Make      complaints

• Cancel      services

Potential support barriers include:

• Excessive      wait times

• Limited      contact channels

• Inadequate      staffing

• Poorly      trained employees

• Automated      systems without escalation

• Repeated      authentication failures

• Inaccessible      communications

• Unreasonable      documentation requests

Customer support should reflect the importance and complexity of the service.

Organizations should monitor whether customers who need support can actually obtain it.

Account Restrictions and Closures

Financial services firms may need to restrict or close accounts for:

• Fraud

• AML      concerns

• Sanctions

• Legal      requirements

• Contractual      breaches

• Risk      management

• Product      withdrawal

These decisions can cause significant customer harm.

Controls should consider:

• Authority

• Evidence

• Proportionality

• Duration

• Customer      communication

• Access      to funds

• Vulnerability

• Complaint      rights

• Escalation

• Review

The organization should distinguish between:

• A      temporary investigative restriction

• A      legal freeze

• A      commercial decision

• A      permanent closure

Customers may not be entitled to complete investigative details, but communications should be as clear and helpful as legal and security requirements permit.

Fraud and Scam Victims

Customers affected by fraud may require:

• Immediate      support

• Account      protection

• Transaction      review

• Payment      recall

• Reimbursement      assessment

• Clear      communication

• Complaint      rights

• Vulnerability      support

Conduct risks may arise when firms:

• Blame      victims without adequate investigation.

• Apply      inconsistent reimbursement standards.

• Delay      action.

• Fail      to explain decisions.

• Make      reporting difficult.

• Ignore      signs of coercion or manipulation.

Fraud controls and consumer protection should be coordinated.

A technically authorized payment may still involve customer deception or vulnerability.

Vulnerable Customers

Customer vulnerability may arise from:

• Health

• Disability

• Age

• Bereavement

• Financial      distress

• Cognitive      impairment

• Language      barriers

• Low      financial capability

• Domestic      abuse

• Digital      exclusion

• Major      life events

Vulnerability may be:

• Temporary

• Permanent

• Situational

• Intermittent

• Disclosed

• Undisclosed

A vulnerable-customer framework may include:

• Identification

• Recording

• Consent

• Additional      support

• Communication      adjustments

• Trusted      contacts

• Alternative      channels

• Staff      training

• Escalation

• Outcome      monitoring

The objective is not to label customers unnecessarily.

It is to identify where ordinary processes may create unfair barriers or harm.

Accessibility and Inclusion

Products and communications should consider customers who may have:

• Visual      impairments

• Hearing      impairments

• Mobility      limitations

• Cognitive      disabilities

• Language      needs

• Limited      digital access

• Limited      financial literacy

Accessibility arrangements may include:

• Alternative      formats

• Telephone      support

• Relay      services

• Larger      text

• Screen-reader      compatibility

• Plain-language      documents

• Translation

• Authorized      representatives

A digital-only process may create barriers for customers unable to use the required technology.

Financial Inclusion

Conduct risk frameworks should consider whether product design or controls unnecessarily exclude customers.

Potential exclusion may result from:

• Rigid      identity requirements

• Automated      risk models

• Geographic      restrictions

• Minimum      balances

• Technology      requirements

• Language

• Disability

• Lack      of credit history

• Excessive      documentation

This does not require organizations to accept risks outside their appetite.

It does require them to assess whether controls are proportionate and whether reasonable alternatives exist.

Complaints Management

Complaints provide important evidence about customer outcomes.

A complaint may reveal:

• Product      weakness

• Misleading      communication

• Unfair      fees

• Operational      failure

• Fraud-control      problems

• Sales      misconduct

• Vendor      failure

• Employee      behaviour

• Vulnerable-customer      harm

A complaint framework should include:

1. Complaint      identification

2. Recording

3. Acknowledgement

4. Investigation

5. Resolution

6. Communication

7. Escalation

8. External      complaint rights

9. Root-cause      analysis

10. Remediation

11. Reporting

Employees should understand that a customer does not need to use the word “complaint” for dissatisfaction to qualify under the organization’s procedures.

Complaint Investigations

Complaint investigations should be:

• Fair

• Evidence-based

• Timely

• Independent      where appropriate

• Clearly      documented

The investigator may review:

• Customer      communications

• Transactions

• Account      records

• Sales      calls

• System      data

• Terms

• Disclosures

• Employee      actions

• Vendor      records

• Similar      complaints

The investigation should address the substance of the concern rather than only determine whether a procedure was technically followed.

Complaint Responses

Complaint responses should explain:

• The      issue considered

• The      evidence reviewed

• The      decision

• The      reasoning

• Any      remedy

• External      escalation rights

• Relevant      deadlines

Responses should avoid:

• Excessive      legal language

• Generic      templates

• Unsupported      conclusions

• Blaming      the customer

• Failing      to address key issues

In Canada, banks are subject to complaint-handling requirements under the Bank Act and the Financial Consumer Protection Framework Regulations. FCAC’s revised 2026 guidance emphasizes documented procedures, prescribed resolution timelines and clear communication with consumers.

Root-Cause Analysis

Root-cause analysis should determine whether a complaint or incident reflects a broader problem.

Potential root causes include:

• Product      design

• Pricing

• Marketing

• Training

• Technology

• Staffing

• Incentives

• Vendor      performance

• Policy

• Control      design

• Governance

• Culture

A problem should not be treated as isolated merely because only one customer complained.

Other customers may have experienced the same harm without reporting it.

The organization should consider:

• Population      affected

• Time      period

• Financial      impact

• Customer      characteristics

• Required      remediation

• Control      changes

Customer Remediation

Customer remediation is the process of correcting harm and providing appropriate redress.

Remediation may involve:

• Refunds

• Fee      reversals

• Interest

• Compensation

• Corrected      records

• Account      restoration

• Contract      changes

• Apologies

• Additional      support

A remediation framework should define:

• Trigger      criteria

• Governance

• Affected      population

• Methodology

• Data

• Calculation

• Quality      assurance

• Customer      communication

• Complaints

• Regulatory      reporting

• Completion      validation

Remediation should address both:

• Individual      complaints

• Customers      who experienced similar harm but did not complain

Conduct Incidents

A conduct incident may involve:

• Misleading      communication

• Unfair      fees

• Product      mis-selling

• Inappropriate      advice

• Systematic      complaint failure

• Discrimination

• Customer-data      misuse

• Incentive      misconduct

• Unreasonable      account restrictions

• Vulnerable-customer      harm

The incident process should include:

• Detection

• Containment

• Customer      protection

• Escalation

• Legal      and regulatory assessment

• Root-cause      analysis

• Remediation

• Communication

• Control      improvement

Conduct incidents may overlap with:

• Operational      incidents

• Privacy      breaches

• Fraud

• Regulatory-reporting      failures

• Employee      misconduct

• Vendor      incidents

Consumer Protection and Technology

Technology can improve customer access and convenience.

It can also create:

• Automated      errors

• Unexplained      decisions

• Biased      outcomes

• Inaccessible      services

• Poor      escalation

• Data      misuse

• Large-scale      customer harm

Technology governance should consider customer outcomes during:

• System      design

• Testing

• Implementation

• Change      management

• Monitoring

• Incident      response

A technically functioning system may still create poor outcomes.

For example, an automated support tool may remain available while repeatedly giving customers inaccurate information.

Artificial Intelligence and Customer Outcomes

AI may support:

• Product      recommendations

• Fraud      detection

• Customer      service

• Complaint      triage

• Credit      decisions

• Marketing

• Pricing

• Account      monitoring

Potential conduct risks include:

• Discrimination

• Inaccurate      information

• Unexplained      decisions

• Excessive      account restrictions

• Manipulative      personalization

• Poor      human oversight

• Privacy      intrusion

AI-assisted customer decisions should be governed through:

• Use-case      approval

• Impact      assessment

• Data      governance

• Fairness      testing

• Human      oversight

• Customer      disclosure

• Appeals

• Monitoring

The organization remains accountable for outcomes produced through AI systems.

Consumer Protection and Privacy

Consumer protection and privacy are closely connected.

Customer harm may arise when information is:

• Collected      unnecessarily

• Used      unexpectedly

• Shared      inappropriately

• Retained      excessively

• Inaccurate

• Insecure

• Used      to manipulate decisions

Privacy notices should be:

• Clear

• Accurate

• Accessible

• Consistent      with actual practices

Consent should not be obtained through confusing or coercive design.

Consumer Protection and Operational Resilience

Service disruption can create serious customer harm.

Organizations should consider:

• Access      to funds

• Delayed      payments

• Failed      transactions

• Customer      communication

• Complaint      access

• Fraud      reporting

• Vulnerable      customers

• Fee      consequences

Operational resilience frameworks should prioritize services whose disruption could cause intolerable customer harm.

Continuity plans should include methods for:

• Supporting      customers

• Communicating      delays

• Reversing      incorrect fees

• Processing      urgent requests

• Identifying      affected customers

Consumer Protection and Financial Crime Controls

Financial crime controls can affect customer outcomes through:

• Onboarding      delays

• Additional      document requests

• Payment      delays

• Account      restrictions

• Account      closures

• False-positive      alerts

Organizations must meet AML and sanctions obligations.

They should also ensure that controls are:

• Risk-based

• Proportionate

• Consistently      applied

• Reviewed

• Supported      by clear escalation

Poorly calibrated controls may create unnecessary harm without meaningfully reducing financial crime.

Conduct risk should be considered when designing:

• Customer      due diligence

• Transaction      monitoring

• Sanctions      screening

• Customer      exits

• Payment      restrictions

Consumer Protection and Vendors

Vendors may influence customer outcomes through:

• Customer      service

• Identity      verification

• Payment      processing

• Fraud      monitoring

• Complaint      handling

• Collections

• Marketing

• Technology

Vendor oversight should consider:

• Customer      communications

• Service      standards

• Complaint      data

• Staff      training

• Accessibility

• Performance

• Incidents

• Remediation

• Subcontractors

The organization should not assume that customer harm is solely the vendor’s responsibility.

Consumer Protection in Canada

Canada’s federal consumer protection framework applies to federally regulated financial entities within its scope.

The Financial Consumer Agency of Canada supervises federally regulated financial entities, external complaint bodies and payment card network operators for compliance with applicable consumer-protection measures, public commitments and codes of conduct.

The modernized federal Financial Consumer Protection Framework took effect on June 30, 2022 and includes protections addressing matters such as:

• Appropriate      products and services

• Remuneration

• Complaints

• Disclosures

• Electronic      alerts

• Business      practices

• Consumer      consent

The specific obligations that apply depend on:

• Entity      type

• Product

• Jurisdiction

• Customer

• Distribution      model

Organizations not directly regulated by FCAC may still be subject to:

• Provincial      consumer-protection laws

• Privacy      laws

• Payments      requirements

• Securities      requirements

• Contract      law

• Industry      codes

• Banking-partner      expectations

A Canadian consumer protection framework should therefore begin with a documented regulatory applicability analysis.

Consumer Protection in the United Kingdom

The FCA Consumer Duty establishes higher and clearer standards of consumer protection and requires firms within scope to focus on customer needs and outcomes.

The Duty includes a Consumer Principle requiring firms to act to deliver good outcomes for retail customers. It is supported by cross-cutting rules and four outcome areas concerning:

• Products      and services

• Price      and value

• Consumer      understanding

• Consumer      support

The Consumer Duty does not replace other FCA requirements.

It operates alongside requirements involving:

• Principles      for Businesses

• Product      governance

• Complaints

• Financial      promotions

• Vulnerable      customers

• Senior-management      accountability

• Operational      resilience

• Financial      crime

The FCA continues to publish observations, focus areas and proposed refinements concerning the Duty. Firms should therefore monitor current publications rather than treating implementation as a completed one-time exercise.

Consumer Protection in the United States

The United States applies consumer protection through a combination of:

• Federal      laws

• State      laws

• Sector-specific      rules

• Licensing      conditions

• Supervisory      expectations

• Enforcement      authority

The Consumer Financial Protection Bureau’s work includes identifying unfair, deceptive or abusive acts or practices, enforcing federal consumer financial laws, addressing discrimination and collecting consumer complaints.

The Federal Trade Commission has authority concerning unfair or deceptive acts or practices in commerce and applies consumer protection principles to many non-bank businesses and financial-services activities within its jurisdiction.

A U.S. consumer protection assessment may need to consider:

• UDAAP      or UDAP requirements

• Fair      lending

• Advertising

• Credit      reporting

• Electronic      payments

• Money      transmission

• Debt      collection

• Privacy

• State      consumer-protection laws

• State      licensing requirements

Organizations operating across multiple states should maintain a jurisdiction-specific obligations inventory.

Unfair, Deceptive or Abusive Practices

An unfair, deceptive or abusive act or practice may arise through:

• Product      design

• Marketing

• Sales

• Pricing

• Contract      terms

• Servicing

• Collections

• Complaint      handling

• Account      closure

• Remediation

A practice may create risk where it:

• Causes      substantial customer harm

• Misleads      customers

• Omits      material information

• Interferes      with customer understanding

• Takes      unreasonable advantage of customers

• Makes      rights difficult to exercise

The CFPB’s examination procedures are designed to support assessment of whether consumer financial practices may be unfair, deceptive or abusive.

Organizations should assess the complete customer journey rather than review individual disclosures in isolation.

Conduct Risk Indicators

Potential indicators include:

• Complaint      volumes

• Complaint      themes

• Complaint      uphold rates

• Remediation      values

• Product      cancellations

• Refunds

• Fee      reversals

• Customer-support      wait times

• Abandoned      calls

• Payment      failures

• Account      restrictions

• Account      closures

• Fraud      complaints

• Vulnerable-customer      outcomes

• Sales      outside the target market

• Employee      overrides

• Product      exceptions

• Regulatory      findings

Indicators should be:

• Clearly      defined

• Supported      by reliable data

• Assigned      to owners

• Subject      to thresholds

• Reviewed      periodically

• Escalated      when necessary

The organization should avoid relying on averages that conceal harm to smaller customer groups.

Customer Outcome Testing

Customer outcome testing determines whether products and processes work fairly in practice.

Testing may include:

• File      reviews

• Transaction      analysis

• Call      listening

• Complaint      sampling

• Fee      analysis

• Customer      research

• Journey      testing

• Data      analytics

• Vulnerable-customer      reviews

• Distribution      reviews

Testing should determine:

• What      outcome occurred

• Which      customers experienced it

• Whether      the outcome was expected

• Whether      harm occurred

• Whether      controls worked

• Whether      remediation is required

Testing documentation should support clear conclusions and corrective action.

Management Information

Conduct management information may include:

• Product      outcomes

• Value      assessments

• Complaint      themes

• Customer-support      performance

• Vulnerable-customer      data

• Marketing      breaches

• Sales      quality

• Remediation

• Distribution      performance

• Operational      incidents

• Account      restrictions

• Regulatory      developments

Management information should support decisions.

Large dashboards are not effective if they do not identify:

• Poor      outcomes

• Causes

• Responsible      owners

• Required      action

• Completion      dates

Compliance Monitoring

The compliance monitoring plan may assess:

• Product      governance

• Customer      communications

• Pricing

• Marketing

• Sales

• Distribution

• Complaints

• Vulnerability

• Customer      support

• Account      restrictions

• Remediation

• Vendor      performance

Monitoring should test both:

• Control      design

• Operating      effectiveness

For example, a review should not merely confirm that a complaint policy exists.

It should test whether:

• Complaints      are identified.

• Investigations      are fair.

• Responses      are clear.

• Deadlines      are met.

• Root      causes are corrected.

• Remediation      is complete.

Independent Review

An independent consumer protection or conduct risk review may assess:

• Governance

• Risk      appetite

• Product      governance

• Target      markets

• Pricing

• Communications

• Sales

• Incentives

• Distribution

• Customer      support

• Vulnerable      customers

• Complaints

• Remediation

• Monitoring

• Management      reporting

Independent assurance should examine actual customer outcomes and underlying data.

A framework can appear well designed while operating poorly in practice.