Consumer Duty. Complaints. Vulnerability. Most firms understand each of them. The harder question is whether they understand what happens when you connect them.
Because the customer does not experience Consumer Duty, DISP and Vulnerability as separate regulatory frameworks. Neither does harm.
And increasingly, neither should Conduct oversight.
The numbers already tell us something
show characteristics of vulnerability. Vulnerability is not an edge case. It is part of the mainstream customer population.
were received by UK financial services firms in H2 2025. 55.5% of closed complaints were upheld and £236m of redress was paid.
were already using AI. Median AI use cases were expected to rise from 9 to 21 within three years.
These are not three separate stories. They describe a financial system with more vulnerable customers, more regulatory evidence, more AI and more interdependency, all arriving at the same time.
The connection is already being built
Complaints reporting is changing
From 1 January 2027, the FCA’s new unified complaints return changes the structure of complaints reporting and explicitly requires data relating to customers in vulnerable circumstances.
The connection between DISP and Vulnerability is moving from good practice into regulatory data architecture.
Connected analysis is already good practice
The FCA is also already highlighting connected analysis as good practice. In its work on complaints and root-cause analysis, it described a firm linking complaint volumes, complaint outcomes, FOS complaints, quality assurance and vulnerable-customer outcomes back to Consumer Duty outcomes, enabling deeper analysis and heatmapping.
That matters because it shows the direction of travel. The stronger operating model is not simply more MI. It is more connected evidence.
The risk is in the space between the data
Everything appears controlled. Now connect the evidence.
- Complaints relating to one product are beginning to rise.
- They cluster around one point in the customer journey.
- A particular customer cohort is disproportionately represented.
- Customers in vulnerable circumstances appear more frequently within that population.
- Repeat contact is increasing at the same point.
No individual metric has breached tolerance. But the customer outcome has changed.
Each individual dashboard can be correct, and the overall conclusion can still be wrong.
Connected Conduct changes the question
The traditional question is: “Are our measures within tolerance?” The connected questions go further:
- What is changing?
- Who is experiencing it?
- Where in the journey is it happening?
- What else changed at the same time?
- Is this isolated, or becoming systemic?
- Are our interventions actually improving the outcome?
AI can read across the seams
The wrong use case
AI should not decide whether a firm is compliant. That is the wrong use case.
The right use case
Its more valuable role is to interrogate relationships across information firms already hold: complaints, products, customer journeys, cohorts, vulnerability indicators, outcomes, interactions and interventions. AI can look beyond the threshold a dashboard was designed to measure. It can:
- Surface changing patterns before a formal threshold is breached.
- Identify cohorts experiencing materially different outcomes.
- Connect complaint themes back to journeys, products and regulatory obligations.
- Distinguish isolated noise from the early signs of something systemic.
- Help humans investigate faster, with better evidence.
of surveyed firms expected to extend AI into regulatory compliance and reporting; 31% expected further use in fraud detection.
AI also creates new interdependency
A third of current AI use cases in the same survey were third-party implementations. In risk and compliance, 64% of implementations were third-party.
AI is not simply solving regulatory complexity. It is creating new regulatory interdependency at the same time.
The firms that get this right will build it into their DNA
Connected intelligence becomes strategically valuable when it enters everyday decision-making: product design, customer journeys, service changes, transformation, third parties, investment, management action and Board oversight.
This is the dividing line between reporting and intelligence. One explains what happened. The other helps a firm decide what to do next.
Conduct is only the first connection
A customer outcome can deteriorate without a Conduct control failing. For example:
- A payment service goes down.
- A contact centre becomes unavailable.
- A critical supplier fails.
- A digital journey stops working.
The firm may initially classify that as an operational event. The customer experiences the failed journey, the delay, the inability to access money, the repeat contact, and potentially the harm.
were reported by nine major UK banks and building societies between January 2023 and February 2025, representing 803 hours (more than 33 days) of unplanned outage.
Operational Resilience is therefore not adjacent to Conduct. It can be causal to it.
The FCA itself frames operational resilience around preventing intolerable harm to consumers when important business services are disrupted. Connect the datasets and entirely new questions become possible:
- Which customers were affected by the disruption?
- Which products and journeys?
- Were vulnerable customers affected differently?
- Did complaint themes change?
- Did an operational incident become a Conduct issue?
- Did we see it early enough to act?
And it doesn’t stop there
Financial Crime ultimately joins the same picture. Fraud, AML, sanctions, bribery, tax-evasion facilitation, customer risk, transactional risk and control effectiveness all intersect with products, customers, channels, operations and third parties.
in the UK in 2025. APP fraud alone reached £576.4m, up 19%, across 248,070 cases.
Again, the point is not that every dataset belongs in one giant system. The point is that the relationships between these risks increasingly matter more than the silos used to manage them.
Regulatory capacity is becoming growth capacity
Put those three perspectives together and regulation stops being viewed simply as a constraint on the business. It starts to tell the business where it has the capacity to move.
The firms that understand regulatory capacity in real time can move faster with confidence. They can make better decisions about where to launch, where to invest, what to change, which controls to strengthen and where risk genuinely constrains growth.
The alternative is increasingly expensive: firms discover the connections afterwards, through complaints, remediation, outages, fraud losses, control reviews and regulatory intervention. Those that cannot connect it will increasingly carry regulation as structural drag.
Not better regulatory reporting. Not another dashboard. Not AI for AI’s sake.
A firm that understands its regulatory position well enough to know where it can move, where it needs to strengthen and where it can grow. At lower operating cost. With better evidence. With greater confidence.
- FCA, Financial Lives Survey 2024: key findings
- FCA, Aggregate complaints data 2025 H2
- FCA, Reporting complaints: new complaints return effective 1 January 2027
- FCA, Complaints and root cause analysis: good practice and areas for improvement
- FCA, Outcomes monitoring: why understanding consumer experience matters
- Bank of England / FCA, Artificial Intelligence in UK Financial Services 2024
- UK Parliament Treasury Committee, major bank and building society IT failures
- FCA, Operational resilience: insights and observations
- UK Finance, Fraud Report 2026
