FCA Consumer Duty: What Your Board Report Must Cover and How to Evidence It

Regulatory compliance is not getting simpler. For financial institutions, the volume of obligations — and the expectation that every one of them is evidenced, attributed and audit-ready — continues to grow. This article addresses what institutions need to understand and act on now.

The current regulatory landscape

Regulators across every major jurisdiction have increased both the scope and the specificity of their expectations. The era of principle-based regulation — where "do the right thing" was considered adequate — has given way to a more prescriptive, evidence-based regime. Regulators now expect not just compliance, but demonstrable compliance: the ability to show, at any moment, what your obligations are, who owns them, what evidence satisfies them, and who signed off.

This shift has significant operational implications. It means compliance cannot be managed ad hoc. It means evidence cannot be assembled retrospectively. And it means the compliance function — however well-resourced — cannot absorb the additional workload without better tools.

What institutions need to address

There are several common gaps that regulators and internal audit functions consistently identify across institutions of all sizes. The first is obligation identification: many institutions do not have a complete, current inventory of every regulatory obligation that applies to them across all jurisdictions and business lines. Without this foundation, everything downstream is uncertain.

The second gap is ownership. Even where obligations are identified, accountability is often unclear. Which business function is responsible for which obligation? Who signs off on evidence? What happens when a person moves role? These questions need systematic answers, not informal arrangements.

The third gap — and the one that most often generates regulatory concern — is evidence. Institutions frequently cannot demonstrate, to the required standard, that they have satisfied specific obligations during a specific period. The evidence exists somewhere, but it was not collected against the obligation at the time, and reconstructing it is slow, expensive and unconvincing to a regulator.

A systematic approach

The institutions that manage regulatory compliance most effectively share a common approach: they treat compliance as an operational discipline, not an episodic exercise. They maintain a current, complete obligation register. They have clear ownership at the individual level. They collect evidence contemporaneously. And they are able to produce audit-ready reports without significant additional effort.

The technology to support this approach now exists. AI-powered document ingestion can extract and classify obligations from regulatory text faster and more consistently than manual review. Workflow engines can route obligations to the right people and track progress. Evidence can be collected from existing systems without requiring staff to change their tools. And reports can be generated on demand from an immutable activity trail.

Practical next steps

For compliance leaders considering how to address these challenges, the most productive starting point is an honest assessment of current capability. Where are your obligation gaps? Where is evidence most fragile? Where does your current process break down under scrutiny? The answers will define your priorities.

The technology investment required to address these gaps is significantly lower than the cost of the regulatory actions, remediation programmes and reputational damage that arise from not addressing them. The business case for systematic compliance infrastructure is increasingly straightforward.