Consumer Duty board reports: the 12-cell evidence grid

In April 2026 the FCA published its observations on Year-2 Consumer Duty board reports. The two failure modes it called out most often were inadequate documented challenge and weak cross-cutting-rules evidence. Most firms reading this have one of them. A fair few have both.

The Duty has been in force nearly three years, so the Year-1 grace of "we're embedding the regime" is over. The regulator's question is no longer have you implemented it? but prove it, case by case. The board report is where you answer that.

A board report isn't a marketing summary of the year. It's the board's documented assessment of whether retail customers actually got good outcomes, the monitoring and data behind that judgement, the challenge the board raised, and what the firm did where outcomes fell short. (For what the Duty itself is and who it applies to, see our Consumer Duty pillar.)

The report has to speak to both layers of the Duty, so it helps to hold them in one view.

The four outcomes are what the Duty covers: products and services, price and value, consumer understanding, and consumer support. They map to operational controls firm by firm; our Consumer Duty pillar walks through each one.

The three cross-cutting rules are the standard underneath every outcome: act in good faith, avoid foreseeable harm, and enable customers to pursue their financial objectives. Each is a different test, and each is evidenced differently. The cross-cutting rules guide breaks them down in full.

The reason the board report is hard is what happens when you lay one layer across the other.

Each of the four outcomes needs evidence against each of the three cross-cutting rules. That is twelve evidence cells, not four.

Take consumer understanding alone. It has to show good-faith evidence (how were the communications designed?), foreseeable-harm evidence (what behavioural patterns suggest comprehension is failing?), and outcome evidence (do customers actually demonstrate understanding?). Three cells, one outcome. Do that across all four outcomes and you have twelve.

Most Year-2 reports show four-cell evidence stacked across the outcomes. The FCA's expectation, increasingly, is twelve.

The grid also exposes where a firm is unbalanced. Strong on good faith but weak on foreseeable harm reads as ethics-of-intent without an operational detection layer. Strong on outcomes but weak on good faith looks results-driven without the customer-first reasoning underneath. The FCA increasingly diagnoses board reports by where the evidence clusters, and where it doesn't.

Three rules, three evidence shapes: process, pattern, outcome. Fuse them and you produce a report the FCA reads as evidencing none of them.

Here's the part the framework documents don't say out loud: all of this lives at the case level.

The board report aggregates upward. The MI dashboards aggregate upward. But every claim about good faith, foreseeable harm, or enabling customers is only as strong as the case-level evidence underneath it. When the FCA's Year-2 review said firms must move from "we have implemented the Duty" to "we are living and breathing it," the operational layer is what it meant.

At case level the three rules map to three artefacts a firm should be able to produce on demand:

• Good faith maps to the case decision record: who decided, on what basis, with what challenge documented.
• Foreseeable harm maps to the case-level review trail: patterns aggregated across cases, with rectification logged where they surface.
• Enabling customers maps to the outcome data: suitability tied to stated objectives, and observed behaviour against those objectives over the product life.

A supervisory request for the evidence pack on one case from fourteen months ago used to be a one-off. In 2026 it's routine. Curvestone now runs compliance checks across roughly a quarter of UK mortgage-network advice volume, and the most consistent Year-2 pattern we see is firms strong on good-faith records but weaker on foreseeable-harm detection, because that pattern layer is exactly what manual sampling misses. Firms that can produce a case evidence pack in under an hour are in a different conversation with the regulator than firms that can't.

The FCA's April 2026 observations name the failures by frequency. Three patterns dominate.

Reporting compliance when the FCA asked for outcomes. Year-1 leaned on process completion: "100% of cases had a suitability review run." Year-2 was meant to evidence what happened after the process ran, whether the recommendation matched the customer's stated objective. Reports that still count activity read as evading the question.

Light board minutes. Reports approved cleanly, with minutes that capture the approval and not the challenge. The FCA has flagged this directly: a board sign-off with no documented dissent reads as a red flag, not a green light. Minutes now need the questions asked, the challenge raised, and the follow-up requested.

Vulnerability bolted on at year-end. The 2026 focus areas embed vulnerability inside the outcomes framework, and the joint ICO and FCA guidance raised the bar on the data-handling side. Vulnerability evidence has to run through the year, not get retrofitted in June.

A Compliance Director at a UK mortgage network put it plainly earlier this year: the difference between Year-1 and Year-2 prep is the difference between writing the report and rebuilding the evidence stack underneath it. Year-2 is the latter. Year-3 will be more so.