Under the Consumer Duty, the FCA expects firms to be able to identify when groups of customers, including those who share protected characteristics, “receive systematically poorer outcomes” (FG22/5, para 1.27). Where they find this, firms should investigate the causes (para 11.11).
In July 2026 the FCA’s review of firms’ outcomes monitoring found “limited evidence of how outcomes differ across customer groups, including people in vulnerable circumstances”.
Lenders generally do not collect protected-characteristic data such as ethnicity (CDEI, 2020), and the FCA does not require them to start collecting it (para 11.38). Age is different: most lenders already hold date of birth. This checklist covers where to start, one credit decision at a time.
1. Scope one decision
Pick one decision in one product: approve or decline at application, credit limit, or price tier. Write down the population, the period and what counts as a favourable outcome. A gap measured across a mixed population is hard to explain.
2. Use the characteristics you already hold
Start with age: date of birth gives you age at application, so you can compare age groups now. Some lenders record sex, and many record title, which is only a rough proxy for it. Some hold vulnerability indicators. Where you already collect protected-characteristic data, the FCA expects you to use it to monitor differences in outcomes “where possible” (para 11.38).
3. Plan for missing data
For characteristics you do not hold, the FCA lists ways to gain insight: research with particular groups, working with consumer organisations, customer-journey audits and, “in certain circumstances”, proxies such as name and postcode for ethnicity (para 11.42). It adds that firms “would need to carefully manage any risks and be mindful of their data protection obligations when using proxy data”. Record the method you used and its limits.
4. Agree the comparison and the trigger in advance
Name the reference group, the measure (for example, the approval-rate ratio or the percentage-point gap) and the size of gap that triggers a review. Set a minimum group size too: small groups produce unstable gaps. Agree all of this with risk and compliance before you look at results.
5. Treat a gap as a question, not a verdict
Compare like with like first, for example applicants in the same risk band. A remaining difference can come from applicant mix, policy rules, data quality or manual overrides, and some differences are lawful: for age, the Equality Act allows risk assessment in financial services that uses relevant information from a reliable source (Schedule 3, para 20A). Investigate before concluding, and record what you checked.
6. Keep sensitive data inside your controls
Racial or ethnic origin and health data are special category data (UK GDPR Art. 9(1)). Processing them needs a lawful basis under Article 6 and a separate condition under Article 9 (FG22/5 para 11.40). Ethnicity inferred on purpose, for example from name and postcode, is special category data however confident the inference (ICO), and is likely to need a data protection impact assessment. Running the analysis inside your own environment limits what has to leave it.
7. Write down what happens next
Record the owner, the action and the date of the next run, and feed the result into your annual Consumer Duty board report. Re-run after material changes to policy, models or data. The FCA expects firms “to be proactive when evidence emerges” that customers who share a protected characteristic are disproportionately experiencing harm (para 11.43).
Sources
- FCA, FG22/5, “Final non-Handbook Guidance for firms on the Consumer Duty” (July 2022), paras 1.27, 11.11, 11.38, 11.40, 11.42 and 11.43
- FCA, “Outcomes monitoring: good practice and areas for improvement” (27 July 2026)
- CDEI, “Review into bias in algorithmic decision-making” (2020)
- ICO, “What is special category data?”
- Equality Act 2010, Schedule 3, para 20A
This checklist is general information, not legal or regulatory advice. Equilens is independent of the FCA.