Consumer Duty vulnerable customers: which payments firms are in scope
In short: Consumer Duty vulnerable customers obligations apply to a payment service provider or an e-money institution carrying on retail market business under PRIN 3.2.6R, and they apply whether or not the customer is that firm’s own client. The Financial Conduct Authority published good and poor practice findings for payments firms on 17 September 2026.
A payment institution that deals with its customers almost entirely through an app is held to the same standard as a high street bank when one of those customers cannot access their money. On 17 September 2026 the Financial Conduct Authority (FCA) set out what it found when it examined how payments firms support consumers in vulnerable circumstances, and for a number of firms the finding was that written policies existed while evidence that those policies worked did not. Before a payment service provider (PSP) reads those findings against its own arrangements, it needs to know whether the Consumer Duty applies to it, and the answer is in the FCA Handbook Glossary definition of retail market business.
The Consumer Duty in plain English
The Consumer Duty is a standard of conduct, not a disclosure exercise. It has applied to open products and services since 31 July 2023 and to closed books since 31 July 2024. It requires a firm to act to deliver good outcomes for retail customers, which is a higher standard than treating them fairly, and it asks the firm to show that the outcomes actually arrived rather than that the right processes exist.
Three cross-cutting obligations sit under that standard. A firm must act in good faith towards retail customers, must avoid causing them foreseeable harm, and must enable them to pursue their financial objectives. Four outcome rules then cover the product or service itself, the price and the value it delivers, whether customers understand what they are being told, and the support they get when they need help.
The Duty does not change the nature of a firm’s relationship with a customer. It creates no fiduciary relationship where none existed, and it does not require a firm to give advice or to carry on any other regulated activity it would not otherwise have carried on. What it does require is evidence: that the firm knows who its customers are, knows what they need, and can show what happened to them.
Key points
- The Consumer Duty applies to a firm’s retail market business, and the FCA Handbook Glossary definition of retail market business names payment services and issuing electronic money expressly. Source: PRIN 3.2.6R(1) and the FCA Handbook Glossary.
- Around half of UK adults show at least one characteristic of vulnerability. Source: FCA, 17 September 2026.
- The four drivers of vulnerability are health, life events, financial resilience and financial capability. Source: FG21/1, first published 23 February 2021, last updated 22 July 2026.
- A PSP owes the Duty to a retail customer who is not its client, limited to what it determines or materially influences. Source: PRIN 2A.1.13G, limb (2)(f) of the definition of retail customer, and PRIN 3.2.7R.
- For payment services, limb (2)(a) of the definition of retail customer gives a banking customer: a consumer, a micro-enterprise, a qualifying charity or a trustee acting outside business purposes. Source: FCA Handbook Glossary, “retail customer” limb (2)(a) and “banking customer”, and BCOBS 1.1.1A; see also the Payment Services Regulations 2017 (PSRs 2017), reg 40(7) and reg 63(5).
- The 17 September 2026 publication introduces no new requirements and prescribes no particular way of meeting the FCA’s expectations. Source: FCA, 17 September 2026.
| Area the FCA examined | What the strongest firms did | Where the FCA found room to improve |
|---|---|---|
| Identifying and recording vulnerability | Embedded identification across customer journeys, including online and automated channels, and recorded it consistently using system flags | Identified very few or no customers in vulnerable circumstances despite customer bases where such characteristics could reasonably be expected |
| Supporting consumers | Designed support around identified needs, offered alternative channels and formats, and applied support consistently rather than case by case | Relied on approaches applied inconsistently across the customer journey, with limited evidence linking identified characteristics to tailored support |
| Communications and consumer understanding | Tested communications with customers in vulnerable circumstances and sought feedback from consumer panels and advocacy groups | Relied primarily on standard communications, with limited tailoring and limited assessment of whether those communications were understood |
| Governance, management information and outcomes monitoring | Reported to boards on the prevalence of vulnerability characteristics and on outcomes, aligned to the four Duty outcomes | Gave boards limited insight beyond annual Duty reporting, and relied on individual examples rather than analysis of outcomes and trends |
| Overseeing intermediaries | Monitored complaints and outcomes for customers served through intermediaries, trained intermediary staff and acted on what the data showed | Had limited visibility of vulnerability among customer groups served by intermediaries |
Which payments firms the Consumer Duty applies to
A payment service provider or an electronic money institution (EMI) is subject to the Consumer Duty where it carries on retail market business, under PRIN 3.2.6R(1) of the Principles for Businesses (PRIN) in the FCA Handbook. The route is not obvious, because the Duty is written in the language of regulated activities and neither providing payment services nor issuing electronic money is, in the ordinary case, a regulated activity at all.
The FCA Handbook Glossary defines retail market business to include payment services, issuing electronic money, and activities connected to either, carried on by a firm in a distribution chain which involves a retail customer. Under PRIN 2A.1.7R, every reference to regulated activities in the Consumer Duty chapter, and in the Glossary definitions that chapter uses, includes payment services and issuing electronic money. Under PRIN 3.2.1BR the Principles for Businesses apply to a firm’s provision of payment services and issuing of electronic money unless the firm is a credit union, and a credit union is excluded from the Duty for those same activities under PRIN 3.2.6R(3).
Under PRIN 3.2.8R, and subject to PRIN 3.2.7R, the Consumer Duty does not apply to activities to the extent that they are not included in a rule setting out the scope of the protections offered to retail customers by COBS, ICOBS, MCOB, BCOBS, CMCOB, FPCOB, PROD or CONC. Under BCOBS 1.1.1A, Chapter 2 of the Banking: Conduct of Business sourcebook (BCOBS) applies to a firm other than a credit union, an EMI, a payment institution and a registered account information service provider in respect of payment services and the issuance or redemption of electronic money carried on from an establishment maintained by it or its agent in the United Kingdom. BCOBS 1.1.3R then disapplies the sourcebook to payment services where Parts 6 and 7 of the PSRs 2017 apply, except as BCOBS 1.1.4R provides, and BCOBS 1.1.4R(1) applies Chapters 2, 2A, 5 and 6 to exactly those services. Chapter 2 therefore applies on both sides of that line. Those two rules are not coextensive. BCOBS 1.1.1A depends on the UK establishment alone, while Parts 6 and 7 add conditions about where each payment service provider is located and what currency the transaction is in. A transaction falling outside Parts 6 and 7 is not therefore outside the Duty, because Chapter 2 of BCOBS will usually still apply to it. The firm with something genuinely to argue is the one carrying on payment services or issuing electronic money otherwise than from a UK establishment, where Chapter 2 of BCOBS has to be tested directly rather than inferred from the PSRs 2017.
Micro-enterprises and small charities are retail customers too
A PSP that serves only business customers may still be carrying on retail market business. The FCA addressed the 17 September 2026 publication to payments and e-money firms serving retail customers, and said in terms that this includes micro-enterprises and small charities. Because Chapter 2 of BCOBS applies to a payment institution’s payment services and to an EMI’s issuance and redemption of electronic money, those are activities to which BCOBS applies within limb (2)(a) of the FCA Handbook Glossary definition of retail customer, and limb (2)(a) rather than the residual limb (2)(e) is the one engaged. Limb (2)(a) gives a banking customer, which the Glossary defines, in PRIN and BCOBS, as a consumer, a micro-enterprise, or a charity with an annual income of less than one million pounds, and also as a natural person acting as trustee for purposes outside a trade, business or profession. A firm serving customers of those descriptions is serving retail customers, whatever its own classification says.
A micro-enterprise, on the same Glossary definition, employs fewer than ten people and has a turnover or annual balance sheet not exceeding two million euros. That includes a great many of the small businesses a payments firm would describe internally as commercial accounts. Parliament drew the same line in the PSRs 2017. Under regulation 40(7), a PSP and its customer may agree to disapply the Part 6 information requirements only where the payment service user is neither a consumer, nor a micro-enterprise, nor a charity, and regulation 63(5) protects those same three categories against contracting out of an enumerated list of Part 7 rights, among them the unauthorised transaction liability rules and the direct debit refund rights. A book classified entirely as business-to-business may still hold customers in all three categories. The FCA’s own example in the 17 September 2026 publication was a firm providing payment services to small businesses which identified limited IT literacy as a vulnerability and arranged call-back support.
How the Consumer Duty applies once a firm is in scope
A PSP in scope must act to deliver good outcomes for retail customers, under Principle 12 at PRIN 2.1.1R. Three cross-cutting obligations in PRIN 2A.2 require the firm to act in good faith, to avoid causing foreseeable harm and to enable customers to pursue their financial objectives, and PRIN 2A.2.26G records that those rules exhaust what Principle 12 requires. Four outcome rules then govern products and services, price and value, consumer understanding and consumer support. The FCA has published guidance on the Duty in FG22/5, which PRIN 2A.1.12G identifies as the FCA’s view of how the Duty might be complied with.
The FCA’s Guidance for firms on the fair treatment of vulnerable customers (FG21/1), first published on 23 February 2021, sets out the four drivers of vulnerability: health, life events, financial resilience and financial capability. The FCA issued FG21/1 as guidance; the Duty’s own rules are in PRIN 2A. The FCA updated the FG21/1 page on 22 July 2026 to record that the guidance cites publications which pre-date the Duty and to point firms to its Consumer Duty material for its current expectations on management information. A PSP reading FG21/1 today is therefore reading a document the FCA has told it to read against something else.
The Duty is owed to people who are not the firm’s clients. Limb (2)(f) of the definition of retail customer brings within that term any person who is, or would be, the end retail customer in a distribution chain but is not a direct client of the firm, and PRIN 2A.1.13G records that the Consumer Duty applies irrespective of whether the customer is a client of the firm. PRIN 3.2.7R then limits the obligation to the extent that the firm is responsible for determining or materially influencing retail customer outcomes, and PRIN 2A.1.14G requires obligations on firms in a distribution chain to be interpreted reasonably, reflecting the firm’s role and the degree of influence it has. An EMI issuing through a distributor, or a PSP whose product is distributed to consumers through an agent network, owes the Duty to those consumers directly, scaled to what it actually controls.
What the FCA found on 17 September 2026
The FCA reviewed a sample of payments firms and found many examples of positive practice alongside a consistent weakness in evidence. It did not state how many firms it examined or over what period. Its cross-sector good and poor practice publication of 7 March 2025 did, drawing on 725 firms, multi-firm work with 29 firms on outcomes monitoring and research with 1,500 consumers, and the September 2026 publication is the payments instalment of that earlier exercise.
The firms with room to improve had policies and training but could not show the FCA how either worked in practice. Some identified very few customers in vulnerable circumstances, or none, despite customer bases where the FCA considered such characteristics could reasonably be expected. Others relied heavily on staff judgement with little supporting process, and board reporting in some cases gave limited insight beyond annual Duty reporting.
On smaller firms the FCA was explicit that effective support does not require complex systems or extensive processes, but that a firm should be able to show its approach is proportionate to its business model, customer base and the potential risk of harm. On intermediaries, the FCA expects a firm distributing through third parties to take reasonable steps to understand how those arrangements affect customer outcomes. Alison Russell, the FCA’s Head of cross-cutting delivery, wrote the same day that the firms getting the best outcomes were taking simple steps to understand customers and design support around them.
Commercial and operational implications for payments firms
The immediate exposure is evidential. A PSP that can produce a vulnerability policy but not the testing and outcomes data behind it is in the position the FCA described, and the FCA has said it will intervene using its full range of supervisory tools where firms do not meet its expectations. That is the same gap the FCA identified in its cross-sector products and services review of 10 July 2026, a qualitative survey of 38 firms across seven sectors including payments and electronic money, which is published here and set out in detail here. The FCA has now made the same finding twice in just over two months, once across sectors and once in payments alone.
A firm that records vulnerability data takes on a second exposure, which the FCA flagged without developing. The FCA stated that it expects firms recording sensitive personal information about customers in vulnerable circumstances to comply with applicable data protection requirements. A system flag recording that a customer has low financial resilience or limited digital capability is ordinary personal data. A flag recording the health driver is data concerning health, which is special category personal data under Article 9 of the UK General Data Protection Regulation (UK GDPR), and a UK data controller needs both a lawful basis under Article 6 and a separate condition under Article 9(2), several of which require a corresponding condition in Schedule 1 to the Data Protection Act 2018. A single vulnerability flag covering all four drivers is therefore one field that sometimes holds special category data and sometimes does not, and both the lawful basis analysis and the access controls for that field have to account for the difference.
For firms distributing through intermediaries the operational question is contractual. The Duty obligation on the manufacturer is owed directly to the end customer under limb (2)(f) of the definition of retail customer, scaled by PRIN 3.2.7R, and it cannot be delegated to the distributor by agreement. Where a distribution agreement says nothing about vulnerability data, complaints visibility and training, the manufacturer has no route to the information it needs to discharge an obligation it holds either way. Where a firm is assessing whether a product or a distribution model falls inside the perimeter in the first place, our regulatory perimeter and market entry page covers the scope of that work. The broader Duty and safeguarding position for payments firms is set out on our safeguarding and Consumer Duty page.
Viewpoint
The perimeter point is the more useful half of this publication. The findings themselves are close to the cross-sector findings the FCA published on 7 March 2025 and to its payments products and services findings of 10 July 2026, and a firm that acted on either has most of the answer already.
Scope is where to look first. The FCA found that some firms identified very few customers in vulnerable circumstances, or none, despite customer bases where such characteristics could reasonably be expected, and that finding is as consistent with a firm having drawn its Duty perimeter too narrowly as with a firm having supported its customers badly. The Glossary definition of retail market business has named payment services and electronic money since the Duty came into force for open products on 31 July 2023, and a PSP that treated the Duty as a retail banking and investments regime at authorisation would have no reason to revisit that view as its customer base changed.
Frequently asked questions
Does the Consumer Duty apply to payment institutions and e-money institutions?
Yes, where the firm carries on retail market business. PRIN 3.2.6R(1) applies the Consumer Duty to a firm’s retail market business, and the FCA Handbook Glossary defines retail market business to include payment services, issuing electronic money and activities connected to either, carried on by a firm in a distribution chain which involves a retail customer. PRIN 3.2.6R(3) takes credit unions out of the Duty for those activities.
Are micro-enterprises and small charities retail customers for the Consumer Duty?
Yes. BCOBS 1.1.1A of the Financial Conduct Authority’s Banking: Conduct of Business sourcebook applies Chapter 2 to a payment institution’s payment services and to an electronic money institution’s issuance and redemption of electronic money. That engages limb (2)(a) of the FCA Handbook Glossary definition of retail customer, which for those activities gives a banking customer. A banking customer, for the Principles for Businesses and for that sourcebook, means a consumer; a micro-enterprise, being an enterprise with fewer than ten staff and turnover or a balance sheet of no more than two million euros; a charity whose annual income is below one million pounds; or a trustee acting outside a trade, business or profession. A firm in a distribution chain may owe the Duty to an end customer who is not its client under a separate limb of the same definition.
Does a payments firm owe the Consumer Duty to customers it does not contract with?
Yes. Limb (2)(f) of the FCA Handbook Glossary definition of retail customer brings the end retail customer in a distribution chain within that term even where that person is not the firm’s direct client, and PRIN 2A.1.13G records that the Consumer Duty applies irrespective of whether the customer is a client of the firm. PRIN 3.2.7R limits the obligation to what the firm determines or materially influences, and PRIN 2A.1.14G requires a reading that reflects the firm’s role in the chain.
What are the four drivers of vulnerability?
Health, life events, financial resilience and financial capability, as set out in FG21/1, the FCA’s Guidance for firms on the fair treatment of vulnerable customers, first published on 23 February 2021 and last updated on 22 July 2026. The FCA found that the strongest payments firms focused on the drivers most relevant to their own customer base while remaining flexible enough to support customers with other needs.
Did the FCA introduce new requirements on 17 September 2026?
No. The FCA stated that the publication does not introduce new requirements or prescribe a particular way to meet its expectations, and that firms have flexibility provided they can show they understand their customers’ needs, provide appropriate support and deliver good outcomes. The FCA also said it will continue to engage with firms and will intervene using its full range of supervisory tools where firms do not meet expectations.
If you are testing whether the Consumer Duty applies to a payment or e-money product, or reviewing a distribution arrangement against the 17 September 2026 findings, Bratby Law advises payment institutions, e-money institutions and fintechs on the Duty perimeter as part of its payments regulation practice. Contact Rob Bratby.
