Conduct Risk Framework

A conduct risk framework is the structure through which a financial firm identifies, assesses, controls and reports the risk that its actions, or those of its staff, will cause harm to customers, damage the integrity of markets or undermine effective competition. It brings together governance, risk appetite, policies, indicators, controls and reporting for this category of risk.

Conduct risk has no single statutory definition. It covers mis-selling, unfair treatment, poor product design, misleading communications, conflicts of interest, market abuse and manipulation of benchmarks. The concept came to prominence in the United Kingdom after the creation of the Financial Conduct Authority (FCA) in 2013, and it is now used by regulators and firms internationally. It reflects the approach of conduct supervision, which looks at outcomes for customers and markets and not only at compliance with detailed rules.

The scale of misconduct costs after the financial crisis of 2007 to 2009 made conduct a first-order risk. Banks paid very large sums in fines and redress for the mis-selling of payment protection insurance, the manipulation of interest rate and foreign exchange benchmarks, the sale of mortgage securities and other failings. These losses were large enough to affect capital, and supervisors began to include misconduct costs in stress tests.

Conduct risk is usually treated as part of operational risk or as a principal risk in its own right. Either way, firms found that existing frameworks, built around processes and loss events, did not capture harm to customers that might surface years later. A dedicated framework was the response.

A typical framework contains the following elements:

• Definition and taxonomy. The firm states what conduct risk means for its business and breaks it into categories across the product and customer lifecycle.
• Governance. Responsibilities are allocated to the board, committees and named executives. In the United Kingdom, this is reinforced by the Senior Managers Regime.
• Risk appetite. The risk appetite statement sets out the level of conduct risk the board accepts, usually expressed as very low tolerance, with measurable limits.
• Risk identification and assessment. Each business assesses where its strategy, products, sales channels and incentives could produce poor outcomes.
• Policies and controls. These cover product governance, suitability, disclosure, complaints, conflicts, inducements, personal dealing and treatment of vulnerable customers.
• Indicators and reporting. Management information is collected and escalated.
• Assurance. The framework is tested by compliance and internal audit.

Frameworks are often organised around the stages at which harm can arise. At the design stage, the firm identifies a target market and tests whether the product meets a real need and offers fair value. At the sales stage, controls address advice, suitability, clear information and the effect of sales incentives. After the sale, the firm monitors service quality, the handling of complaints and claims, barriers to switching or exit, and the treatment of customers in financial difficulty.

In wholesale markets, the emphasis falls on conflicts of interest, handling of confidential information, order handling and best execution, benchmark submissions and the prevention of insider trading and manipulation. Controls include information barriers, the conflicts of interest register and market abuse surveillance.

Because conduct outcomes are hard to quantify, firms build a set of indicators. Common examples are complaint volumes and root causes, cancellation and early lapse rates, claims declined, the share of sales to customers outside the target market, results of file reviews and mystery shopping, breaches and near misses, whistleblowing reports, staff turnover in sales teams, and the proportion of pay that depends on sales volume. Indicators are compared with thresholds linked to risk appetite, and breaches are escalated.

Reports go to executive risk committees and to the board risk committee. Testing is carried out through the compliance monitoring programme, and serious matters are notified to the regulator through regulatory breach reporting.

The FCA has encouraged firms to manage conduct risk through a small set of questions about how they identify the risks inherent in their business, who is responsible, what support staff receive, how the board oversees conduct and whether other activities undermine the approach. Its Consumer Duty, in force for open products since July 2023, raised the standard for retail business by requiring firms to act to deliver good outcomes for customers and to evidence them, which has pushed frameworks towards outcome monitoring.

Every framework depends on behaviour. Rules on remuneration link variable pay to conduct, with reduction or recovery of awards where misconduct occurs. Speaking up is supported by the whistleblowing framework, and the model of responsibility follows the three lines model, with business management owning the risk.

The limits are well recognised. Conduct standards are often principles applied with hindsight, so a firm may not know that a practice will later be judged unfair. Indicators tend to lag the harm they measure. A framework can become a reporting exercise detached from decisions about products and targets. For these reasons, supervisors treat the framework as necessary but not sufficient, and look at whether the firm's compliance culture leads staff to raise and resolve concerns before customers are affected.

• Financial Conduct Authority