Consumer Duty Three Years On: What Actually Changed at File Level?

When did the Consumer Duty take effect, and what phased in first?

The FCA published its final rules and guidance for the Consumer Duty on 27 July 2022, and implementation ran in phases, with the Duty taking effect from July 2023. FG22/5, the final non-Handbook guidance, sits alongside the rules and sets out the standards the FCA expects. The FCA's Consumer Duty hub collects the rules and guidance in one place.

Regarding implementation dates, the phasing matters for file reviews. A suitability report written before the Duty was already governed by COBS 9.2.1R, which requires a personal recommendation to be suitable for the client. The Duty did not replace that rule. The Duty added outcome obligations around it: products and services (PRIN 2A.1), price and value (PRIN 2A.4), consumer understanding (PRIN 2A.3), and consumer support (PRIN 2A.5).

File-level change followed the phasing. Reports that once closed with a suitability letter now carry the weight of four outcomes on top of the recommendation itself.

Rules set the standard; the file proves it. (Source: FCA FG22/5)

What actually changed inside a suitability report?

Regarding suitability reports, the visible change sits in what the document must demonstrate rather than what it must say. COBS 9.2.1R still governs suitability. Consumer understanding under PRIN 2A.3 shifted attention to whether the file shows the client could understand the recommendation and act on it. Price and value under PRIN 2A.4 pulled fair value frameworks (PRIN 2A.2) and PROD 3.3 product checks into the evidence trail.

Three years on, a reviewer reads a report and asks different questions. Does the rationale trace to the client's objectives and circumstances? Does the file record what the client was told and how understanding was checked? Does the price and value reasoning appear anywhere, or does the recommendation rest on product-level work the file never references?

Reports written to the old standard often pass the suitability test and fail the outcomes test. The gap between the two is where three years of supervision attention has concentrated.

Understanding is evidenced in the file, not asserted in the cover letter. (Source: FCA PRIN 2A.3)

How did the November 2025 requirements review change the picture?

Regarding the requirements review, November 2025 marked the inflection point between building the Duty and living with it. The FCA reviewed the Duty's requirements and confirmed the fundamentals are unchanged, while targeting areas of unnecessary cost and complexity. Commentary from KPMG framed the same message: the Duty stays; the friction gets addressed.

CP26/23, the FCA's consultation published in June 2026, carried the proportionality theme into specific proposals. The evidence requirement stands. The proportionality work addresses the cost and complexity of producing the evidence, not the requirement to produce it.

Three years of implementation produced the evidence base. The review decided which parts of the machinery earn their keep. Files sit at the junction of the two: the record of what the firm did, and the first thing supervision reads.

The fundamentals held; the file is where firms feel the Duty. (Source: FCA CP26/23)

Which outcome is hardest to evidence three years on?

Regarding consumer support, the FCA's own review work points to PRIN 2A.5 as the outcome firms find hardest to evidence three years in. Consumer support generates the thinnest document trail of the four outcomes. A suitability report evidences the recommendation. A fair value framework evidences price and value. Support lives in service delivery: calls made, reviews completed, issues resolved.

Ongoing service carries the sharpest file-level test. PRIN 2A.6 sets the ongoing service outcome, and TR24/1 para 1.40 addressed how firms evidence it. A file that promises a review every year and cannot show the reviews happened fails the record test, whatever the report says.

Three years of supervision has concentrated on the gap between promise and record. Overdue reviews, missed service elements, and unlogged client contact are the findings that surface when files are sampled.

Supervision tests records, not intentions. (Source: FCA TR24/1)

What does the file need to show on vulnerability?

Regarding vulnerability evidence, FG21/1 has governed this space since February 2021, and the FCA's multi-firm review of vulnerable customers in March 2025 kept the pressure on. The guidance expects firms to recognise vulnerability, record it, and adapt service accordingly. The file is where each of those steps shows up or fails to.

A vulnerability entry that records a health issue and nothing else does little work. The record that supervision reads shows what the firm did next: the adjustment made to the communication, the extra time allowed for a decision, the follow-up scheduled. The vulnerable customers and Consumer Duty hub covers the file-level detail in depth.

Three years on, the difference between a policy and a practice is visible in the log. Firms with policies describe their approach; firms with practices produce entries.

Vulnerability evidence lives in the log, not in the policy document. (Source: FCA FG21/1)

What does a three-year file review test?

Regarding file sampling, a review at the three-year mark tests the record against each outcome, not the report against a checklist. The table sets out the shift.

Table: File-level evidence expectations at implementation compared with three years on.

Scoring follows the same shape whether the review runs on paper or on tooling: each element marked pass, amber, or fail, with a citation to the rule behind it — COBS 9.2.1R for suitability, PROD 3.3 for product value, PRIN 2A for the outcomes, FG21/1 for vulnerability. The file reviews and suitability hub carries the rubric detail. The FCA's publications and resources page collects the source material behind each of those tests.

A file review scores the record, and the record is the evidence. (Source: FCA FG22/5)

About the Author: Nick Thorp is the founder of Proven Duty, where he built AI compliance tooling for UK advice firms. He writes about what Consumer Duty means at file level for 1–5 adviser firms.