What we doAdvisory & ConsultancyConduct & Consumer Protection
Fair treatment you can show, not only a policy that promises it.
The G20/OECD High-Level Principles on Financial Consumer Protection, revised by the OECD Council in December 2022, expect providers to oversee products through their life cycle, to avoid conflicts created by remuneration and incentives, to pay special attention to consumers experiencing vulnerability, and to offer accessible, fair complaints handling. Most banks have a conduct policy. Fewer can show that products are approved against a defined target market, that incentives do not reward the wrong sale, or that complaints change anything. Conduct is judged by outcomes, and outcomes need evidence.
Where this begins
Three conversations this practice usually starts with.
Products approved once and never looked at again
The product committee approves new products against a checklist, but nobody reviews whether existing products still suit the customers who hold them, whether fees and features deliver the value promised, or whether a product sold through a new channel is reaching people it was never meant for.
Incentives that pay for volume
Sales targets and bonus schemes reward accounts opened, cards issued and loans booked. Complaints and cancellations sit in another department’s report. The board has never seen the two side by side, and nobody can say whether the scheme encourages the sale the customer needed or the one that paid best.
Complaints counted, not understood
Complaints are logged, resolved within the deadline and reported as a number. The same issues return each quarter because no one traces them to the product, process or incentive that caused them, and the board sees volumes rather than causes.
What we deliver
Every product governed, every outcome evidenced.
A conduct engagement leaves the bank able to show how it treats customers, not only to state it: the framework reviewed, products governed through their life cycle, incentives tested, complaints analysed for causes, vulnerable customers identified and supported, and the board given conduct information it can act on. The deliverables are working documents, prepared with your compliance, product, retail and audit teams.
Conduct risk framework review
Conduct risk appetite, policies, roles across the three lines of defence and escalation routes reviewed against the G20/OECD Principles and international best practice, with the gaps between what the policy says and what the bank does made explicit.
Product governance and approval
The product approval and review process assessed end to end — target market definition, testing before launch, distribution controls, value assessment and periodic review through the product life cycle — and the governance documented so that each decision has an owner and a record.
Sales incentive review
Remuneration and incentive schemes for sales staff and intermediaries reviewed for the conflicts of interest they create, set against complaints, cancellations and product-holding data, with options to rebalance them towards fair treatment and appropriate outcomes.
Complaints handling and root-cause analysis
The complaints process reviewed for accessibility, fairness and timeliness, and a root-cause discipline that traces recurring complaints to the product, process, channel or incentive behind them — with the fixes tracked to closure.
Vulnerable customers
How the bank identifies customers who may be experiencing vulnerability — from personal circumstances, economic situations or market conditions — and how products, service, collections and complaints handling adapt for them, reviewed with practical guidance for front-line staff.
Fair-treatment outcome testing and board conduct MI
Outcome tests that check what customers actually experienced — file reviews, product performance, complaint themes and sales patterns — and a board conduct dashboard that shows causes and trends rather than counts.
How the engagement runs
Assess. Test. Redesign. Report.
Assess
Framework, product governance, incentives, complaints and vulnerability arrangements reviewed against the G20/OECD Principles and peer benchmarks — delivered in weeks, with the gaps ranked by customer impact.
Test
Outcome testing on selected products and journeys, so the findings rest on what customers experienced rather than on what procedures say.
Redesign
Approval and review processes, incentive structures, root-cause routines and vulnerability guidance revised with your teams and documented.
Report
Board conduct MI agreed and the first cycle reported — then ownership handed over.
Perimeter and fee are fixed at the diagnostic — engagements are scoped to a defined end: a conduct framework the bank can evidence to its board and its supervisor.
Questions we are asked
Before the first conversation.
What is conduct risk?
Conduct risk is the risk that the way a bank designs, sells and services its products, or handles its customers, leads to unfair outcomes for those customers — and, in turn, to complaints, redress, supervisory action and loss of trust. It sits across product, sales, operations and culture, which is why it is managed through governance and evidence rather than a single policy.
What do the G20/OECD Principles expect since the 2022 revision?
The High-Level Principles on Financial Consumer Protection were first endorsed by G20 Leaders in 2011, adopted by the OECD Council in 2012 and revised by the Council in December 2022. The revision brought in cross-cutting themes of digitalisation, financial well-being and sustainable finance, and the Principles cover, among other things, fair treatment of consumers, quality financial products with product oversight and governance, responsible business conduct including the management of incentive-driven conflicts, and complaints handling and redress.
How do you test whether customers are treated fairly?
By looking at outcomes rather than procedures: reviewing customer files against the needs and situation recorded, comparing who holds a product with the target market it was approved for, reading complaint themes against product and sales data, and checking how vulnerable customers were handled. The tests are scoped with the bank and the findings are evidenced case by case.
What counts as a vulnerable customer?
There is no single list. The G20/OECD Principles note that vulnerability can manifest differently in different circumstances and may result from a combination of personal characteristics, economic situations and market conditions. In practice a bank needs ways to recognise it, staff able to respond, and products, collections and complaints processes that adapt.
What should the board see on conduct?
Causes and trends, not counts alone: complaint root causes and repeat issues, products whose holders fall outside the target market, sales patterns set against incentives, outcomes for vulnerable customers, and progress on remediation. The board conduct MI is agreed with the board and the first cycle reported before the engagement closes.
The Capability Arc™
This practice is one point on the arc.
Most conduct clients pair the engagement with the programmes that build the internal bench — Consumer Protection & Conduct Risk, the Ethics in Banking Masterclass and Professional Compliance & Risk Management — because fair treatment is delivered by the people who design, sell and service the products.
Learn it · Training
Consumer Protection & Conduct Risk
Two days following a product from approval to complaint — governance, disclosure, sales, incentives and what the board sees — for compliance, product, retail banking and audit teams.
Fix it · Advisory
Risk Appetite & Enterprise Risk Governance
When conduct risk has to sit inside the board’s risk appetite, with indicators, limits and named owners.
Automate it · Smart IT
Reporting Automation & Dashboards
When conduct MI — complaints, product performance and sales patterns — needs to reach the board from the systems rather than from manual compilation.
The ask
Ask for a confidential conduct review.
A senior practitioner reads your conduct policy, your product approval records, your incentive schemes and the complaints information your board receives — and tells you, in a private working session, where customer outcomes are most at risk, what the evidence currently shows, and what would need to change first.
Confidential by default; under NDA on request. A senior practitioner replies within two working days.
Conduct & Consumer Protection
Leave the question with us.
Two lines on the mandate is enough — a senior practitioner replies within one business day.