Consumer Duty Is Not a Warnings Obligation. It Is a Prevention Obligation.
Consumer Duty Is Not a Warnings Obligation. It Is a Prevention Obligation.
The FCA’s Consumer Duty sets an outcomes standard, not a process standard. A payment-screen warning is a process. The outcome standard is whether foreseeable harm was avoided. Where manipulation completes before bank visibility, the warning fires after the customer’s decision is already made and “we have warnings in place” becomes a process answer to an outcome question.
- Consumer Duty is an outcomes framework. Its cross-cutting rule requires firms to avoid causing foreseeable harm, not to warn about it.
- The FCA’s own Dear CEO letter of October 2024 identifies “inadequate systems to detect and prevent scams” as an explicit example of foreseeable harm under the Duty.
- Payment warnings address the transaction layer. The kill chain established in Article 2 shows that manipulation typically completes across Stages 1 to 5, before any bank warning fires.
- The FCA published its first Enforcement Watch in January 2026, confirming six open Consumer Duty investigations. The Duty has moved from implementation to evidencing.
- APP fraud losses rose to £576.4 million in 2025, a 19 per cent increase, according to UK Finance’s Annual Fraud Report 2026 published this week. Warning controls were in place throughout that period.
- The CFO argument in one sentence: reimbursement discharges liability after harm occurs; prevention eliminates it before harm occurs.
From Detection Gap to Compliance Question
What the preceding articles established
Article 3 established a structural ceiling on detection: AI has systematically degraded the linguistic and infrastructure signals on which content-dependent detection depends, and no further investment in that detection layer resolves the underlying signal problem. The pre-session window (the period across kill chain Stages 1 to 5 before a banking session opens) remains architecturally outside bank visibility. That gap is now documented, not theoretical.
Where a gap is documented and upstream detection is architecturally available, the regulatory question changes. It is no longer sufficient to ask whether a firm has fraud controls. The question under Consumer Duty is whether those controls constitute adequate steps to avoid foreseeable harm.
This article (article 4) delivers that regulatory argument. It does not restate what APP fraud is, how the kill chain works, or what AI has done to phishing signals. Those arguments are established. This article addresses what follows from them.
Why the compliance frame matters now
UK Finance’s Annual Fraud Report 2026, published 15 June 2026, reports APP fraud losses in 2025 reached £576.4 million; a 19 per cent increase on 2024.1 The trajectory matters for the compliance argument: losses rose in a year when payment warning controls were already in place across the sector. A process that exists but does not prevent an outcome is, by definition, insufficient as a primary mechanism under an outcomes framework.
Consumer Duty: What the Framework Actually Requires
An outcomes standard, not a process standard
The Consumer Duty, which came into force on 31 July 2023, sets a higher standard of care than the prior rules-based regime. Its cross-cutting rules require firms to act in good faith, to enable customers to pursue their financial objectives, and – critically for this argument – to avoid causing foreseeable harm to retail customers.2
The distinction between a process standard and an outcomes standard is not semantic. Under a process standard, deploying a warning message satisfies the obligation. Under an outcomes standard, the question is whether the harm was avoided. If the answer is no – if customers continued to be victimised at scale despite warnings being in place – then the process alone cannot constitute evidence of compliance.
Consumer Duty asks firms to demonstrate good outcomes for retail customers. An institution that logs warning message deployments but cannot demonstrate harm reduction has documented a process, not an outcome. In 2026, the FCA is distinguishing between the two.
What “foreseeable harm” means for APP fraud
The FCA has not left this question abstract. In its Dear CEO letter of 7 October 2024, Emad Aladhal, Director of Retail Banking Supervision, set out the FCA’s expectations directly. The letter addresses APP fraud reimbursement and Consumer Duty in the same document (which is itself significant).
“Under the Consumer Duty, firms must avoid causing foreseeable harm. An example of foreseeable harm would include a consumer becoming victim to a scam relating to a firm’s financial products due to the firm’s inadequate systems to detect and prevent scams, or inadequate processes to design, test, tailor and monitor the effectiveness of scam warning messages presented to customers.”
Two obligations are named in that paragraph: adequate systems to detect and prevent scams, and adequate processes for warning messages. They are listed as parallel requirements, not alternatives. A firm that has addressed only warning message design has satisfied half of what the Director of Retail Banking Supervision has explicitly identified as foreseeable harm.
The Timing Problem: Why Warnings Fire Too Late
The kill chain and the intervention gap
The APP fraud kill chain established in Article 2 runs across seven stages. Stages 1 to 5 (initial contact, credential phishing, trust-building, social engineering, and instruction preparation) complete in the pre-session window, before any bank visibility begins. The payment warning fires at Stage 6 or 7, when the customer initiates the transaction.
By Stage 6, the customer’s decision to pay has already been formed. Social engineering does not manipulate at the payment screen. It manipulates over hours, days, or weeks, through the mechanisms described in Article 3: AI-enhanced pretexting, fabricated urgency, and credential verification that bypasses linguistic signals entirely. The warning is presented to someone whose decision architecture has already been reshaped by the time they see it.
The Consumer Duty obligation begins at Stage 1, not Stage 6
The Consumer Duty’s foreseeable harm obligation does not attach to the transaction. It attaches to the harm. Where an institution can establish (as the sector can, given the documented kill chain and the prevalence of digital origination) that manipulation begins upstream of its visibility, the question of adequate systems is not answered by what happens at Stage 6.
The FCA’s multi-firm review of November 2023 described payment journey warnings as a tool that “can be effective to help customers consider whether the payment they are making is to a genuine payee.”4 That characterisation is accurate in the right context. The problem is that for the customer cohort most subject to extended pre-session manipulation, the warning arrives after the psychological work is done. Effectiveness at the transaction layer is not the same as avoidance of foreseeable harm at the point where harm became foreseeable.
Where Enforcement Is Heading in 2026
From implementation to evidencing
The FCA published its first Enforcement Watch newsletter on 28 January 2026.5 The disclosure is significant in two respects. First, it confirms six open Consumer Duty investigations – evidence that the Duty has moved from a guidance-and-implementation phase to active enforcement scrutiny. Second, the FCA used supervisory tools including own-initiative requirements to restrict firms during investigations, before those investigations concluded. The compliance cost is no longer theoretical.
The FCA is no longer asking whether Consumer Duty frameworks are in place. It is testing whether outcomes evidence exists. Institutions that can produce process documentation but not outcomes data are in a materially weaker position than they were twelve months ago.
The evidencing requirement
Consumer Duty requires firms not only to act to deliver good outcomes but to monitor, assess, and evidence those outcomes on an ongoing basis. PRIN 2A.9 sets out the monitoring requirements directly. An institution that can demonstrate warning message deployments but cannot demonstrate harm reduction has a monitoring record, not an outcomes record. In 2026, the FCA is distinguishing between the two.
The FCA’s review of Consumer Duty board reports, published February 2026, found that the best-performing firms had clearly articulated what good customer outcomes looked like, had MI to monitor delivery against those outcomes, and took action when outcomes fell short. The review noted that “where appropriate, reports included consideration of Financial Ombudsman Service decisions and feedback when assessing foreseeable harm.”6 Firms that cannot point to proactive harm prevention data face a gap in their board reporting as much as their operational controls.
The multi-firm review and its limits
The FCA’s November 2023 multi-firm review found that firms could do more to strengthen their systems designed to detect and prevent fraud, and noted insufficient focus on consumer outcomes in some cases.4 The same review described warnings as potentially effective. Those two findings are not in tension: a warning can be effective in certain contexts and simultaneously insufficient as a primary mechanism under an outcomes standard. The question is not whether warnings work. It is whether warnings alone are adequate when harm is foreseeable at a point the warning cannot reach.
The Consumer Duty Outcomes Test Applied to APP Fraud
Three questions the framework asks
The Consumer Duty’s outcomes test for foreseeable harm in an APP fraud context reduces to three sequential questions. An institution that cannot answer all three affirmatively with evidence is not in the position it may believe itself to be.
The CFO Argument
Reimbursement is not prevention
The PSR’s mandatory reimbursement requirement, in force since 7 October 2024, produced £173 million reimbursed to APP fraud victims in its first full year of operation.7 That figure represents harm that occurred and was subsequently compensated. It does not represent harm that was avoided.
The reimbursement liability exists because the fraud completed. Institutions that reimburse efficiently are discharging a liability after harm has occurred. An institution that prevents the fraud eliminates the liability before it arises. These are not equivalent commercial positions.
£173 million reimbursed in year one of mandatory rules. £576.4 million lost to APP fraud in 2025, up 19 per cent. The gap between what is reimbursed and what is lost represents harm that has occurred, liability that has been discharged, and an outcome that Consumer Duty requires institutions to have been trying to avoid – not just compensate.
What prevention changes for the balance sheet
The reimbursement requirement imposes a 50:50 cost split between sending and receiving payment service providers. That split creates a direct, quantifiable P&L exposure for every APP fraud case that reaches the payment stage. The Consumer Duty argument and the commercial argument are, in this respect, the same argument: the earlier the intervention, the lower the liability. Prevention upstream of the transaction eliminates costs that reimbursement can only discharge downstream of harm.
What This Means for Institutions in 2026
The compliance posture question
The convergence of three developments in 2025 and 2026 changes the compliance posture question materially. APP fraud losses rose 19 per cent in 2025 despite existing warning controls. The FCA published its first Enforcement Watch confirming Consumer Duty investigations are active. And the UK Finance Annual Fraud Report 2026 confirms that two-thirds of APP fraud continues to originate online – precisely the channel where upstream, pre-session detection is architecturally possible.
In that context, the compliance question is not whether an institution has a Consumer Duty framework. It is whether that framework, assessed against the outcomes it has produced, constitutes adequate steps to avoid foreseeable harm. Where the harm is documented, where the timing gap is established, and where upstream detection is available, a framework built primarily on payment-screen warnings is increasingly difficult to present as sufficient.
The forward regulatory direction
Consumer Duty obligations apply across a broader range of institutions than PSR reimbursement liability, including many building societies, savings institutions and credit unions for whom reimbursement may not be the primary regulatory hook. The implications of an outcomes-based framework for those institutions – and why upstream fraud intelligence matters independently of reimbursement liability – are the subject of the next article in this series.
- Consumer Duty is an outcomes framework. Its cross-cutting rule requires firms to avoid causing foreseeable harm, not to warn customers that harm may occur.
- The FCA’s Dear CEO letter of October 2024 explicitly names “inadequate systems to detect and prevent scams” as foreseeable harm – a parallel obligation to warning message adequacy, not a subset of it.
- APP fraud manipulation completes across kill chain Stages 1 to 5, before bank visibility. A warning at Stage 6 is structurally late for the cohort that has already had its decision architecture reshaped.
- The FCA published six open Consumer Duty investigations in January 2026. The Duty is in an enforcement phase, not an implementation phase. Process documentation is no longer sufficient evidence.
- APP fraud losses rose to £576.4 million in 2025, up 19 per cent, with warning controls in place sector-wide. That trajectory is a direct challenge to warning-as-primary-mechanism under an outcomes framework.
- £173 million was reimbursed in the first year of mandatory PSR rules. Reimbursement discharges liability after harm; prevention eliminates it before.
Has the FCA said that payment warnings are non-compliant with Consumer Duty?
No. The FCA’s multi-firm review of November 2023 described payment journey warnings as a tool that “can be effective.” The argument in this article is different: that warnings, even where effective in certain contexts, do not on their own satisfy an outcomes framework whose standard is avoiding foreseeable harm. The FCA’s Dear CEO letter of October 2024 names both scam detection systems and warning message adequacy as separate obligations under Consumer Duty foreseeable harm. The compliance question is whether institutions have addressed both, not whether warnings exist.
What does “foreseeable harm” mean in practice for APP fraud?
The FCA’s Dear CEO letter of October 2024 provides the clearest definition in the context of APP fraud: foreseeable harm includes a consumer becoming victim to a scam due to a firm’s inadequate systems to detect and prevent scams, or inadequate processes to design, test, tailor and monitor warning message effectiveness. The harm is foreseeable because the kill chain is documented, online origination data is in the public domain, and the sector has known about the pre-session detection gap for several years.
What are the six Consumer Duty investigations the FCA disclosed in January 2026?
The FCA’s Enforcement Watch Issue 1, published 28 January 2026, confirmed six open investigations into potential Consumer Duty breaches, described as relating to fair value. Two involve insurers in the home and travel markets. The investigations are not specifically into APP fraud or scam detection. Their significance for this article is that they confirm the Duty has entered an active enforcement phase, and that the FCA is using supervisory tools including own-initiative requirements to restrict firm activity while investigations are ongoing – before those investigations conclude.
Does Consumer Duty apply to building societies and credit unions as well as retail banks?
Consumer Duty applies to all FCA-regulated firms carrying out regulated activities in relation to retail customers. This includes building societies and credit unions. The PSR’s mandatory reimbursement requirement applies specifically to sending and receiving payment service providers under Faster Payments, which captures a different and narrower set of institutions. For firms that are subject to Consumer Duty but not to PSR reimbursement liability, the foreseeable harm obligation under the Duty is the primary regulatory hook for APP fraud prevention. That argument is developed in the next article in this series.
What does Consumer Duty require for ongoing monitoring of fraud outcomes?
PRIN 2A.9 of the FCA’s Consumer Duty rules sets out the monitoring requirements. Firms must regularly review and monitor whether they are delivering good outcomes for retail customers, and take action where they are not. The FCA’s review of Consumer Duty board reports, published February 2026, found that the best-performing firms had MI to monitor delivery against articulated outcome standards and took remedial action when outcomes fell short. For APP fraud, this means institutions need data on harm reduction, not just process deployment.
Why did APP fraud losses increase in 2025 if warnings were in place?
UK Finance’s Annual Fraud Report 2026, published 15 June 2026, reports APP fraud losses rose 19 per cent to £576.4 million in 2025. Articles 2 and 3 in this series establish the structural reason: manipulation completes in the pre-session window before any bank warning fires, and AI-enhanced pretexting has removed the linguistic and infrastructure signals on which content-dependent detection depends. A warning at the payment screen arrives after the customer’s decision architecture has already been reshaped. That timing problem is not resolved by improving the warning itself.
What is the relationship between the PSR reimbursement requirement and Consumer Duty?
The PSR’s mandatory reimbursement requirement and Consumer Duty are parallel frameworks with different scopes and mechanisms. The PSR regime requires reimbursement of in-scope APP fraud victims under Faster Payments. Consumer Duty requires firms to avoid causing foreseeable harm. The FCA’s Dear CEO letter of October 2024 addressed both in the same document, which is itself a signal of how the FCA views the relationship: reimbursement is the downstream consequence of harm; Consumer Duty is the upstream obligation to prevent it. An institution that reimburses promptly is compliant with PSR requirements. An institution that cannot demonstrate it took adequate steps to prevent the harm may still face Consumer Duty exposure.
What does the £173 million reimbursement figure tell us about the scale of the problem?
The PSR dashboard reported £173 million reimbursed to APP fraud victims between 7 October 2024 and 30 September 2025, covering in-scope claims under the Faster Payments mandatory reimbursement requirement. UK Finance reported total APP fraud losses in 2025 of £576.4 million across a wider range of payment types and account categories. The gap between the two figures reflects the scope difference between the PSR regime and the full fraud picture. For institutions, the commercial point is that £173 million in reimbursed losses represents harm that occurred and was compensated after the fact. Prevention eliminates that liability before it arises.
- UK Finance. Annual Fraud Report 2026. Published 15 June 2026. Available at: ukfinance.org.uk/news-and-insight/press-release/fraud-report-2026-press-release.
- Financial Conduct Authority. PRIN 2A The Consumer Duty. FCA Handbook. Available at: handbook.fca.org.uk/handbook/prin2a. Updated 9 December 2025.
- Financial Conduct Authority. Dear CEO Letter: FCA Expectations on Authorised Push Payments (APP) Fraud Reimbursement. 7 October 2024. Signed: Emad Aladhal, Director, Retail Banking Supervision. Available at: fca.org.uk/publication/correspondence/dear-ceo-letter-expectations-app-fraud-reimbursement-banks-building-societies.pdf. (Accessed: 17 June 2026).
- Financial Conduct Authority. Anti-fraud controls and complaint handling in firms (with a focus on APP Fraud). Multi-firm review. Published 7 November 2023. Available at: fca.org.uk/publications/multi-firm-reviews/anti-fraud-controls-complaint-handling-firms-focus-app-fraud.
- Financial Conduct Authority. Enforcement Watch 1. Published 28 January 2026. Available at: fca.org.uk/publications/newsletters/enforcement-watch-1.
- Financial Conduct Authority. Consumer Duty board reports: good practice and areas for improvement. Published February 2026. Available at: fca.org.uk/publications/good-and-poor-practice/consumer-duty-board-reports-good-practice-areas-improvement.
- Payment Systems Regulator. APP Scams Reimbursement Dashboard: Q3 2025. Data covering 7 October 2024 to 30 September 2025. Available at: psr.org.uk/information-for-consumers/app-scams-reimbursement-dashboard/.
SENGUARD works with UK retail banking institutions on pre-transaction fraud detection. This series examines the fraud policy and technology landscape facing UK banks: the regulatory frameworks shaping detection obligations, the threat environment evolving around them and the detection architectures being developed in response.