In the UK, the design of a financial app's screens is a regulatory matter. The FCA's Consumer Duty expects firms to show that customers understand products, get fair value and can get support, and when the regulator reviewed digital credit journeys it named pre-selected defaults, journeys marketed on speed and fees shown too late as areas for improvement. For a fintech startup that means the product backlog and the compliance plan are the same document.
This guide is for founders and product teams building payments, e-money, open banking, lending or savings apps for UK consumers. It covers how to find your regulatory route, how Consumer Duty translates into features, and the 2026 changes to safeguarding and open banking that affect what you build. It is not legal or regulatory advice and it does not cover crypto-assets, insurance or how to prepare an FCA application. For global cost tiers and PCI DSS, KYC and US rules, see our fintech app development cost and compliance guide.
What does FCA Consumer Duty mean for a fintech app?
Consumer Duty requires FCA-regulated firms to deliver good outcomes for retail customers in four areas: products and services, price and value, consumer understanding and consumer support. For a fintech app that means journeys designed for the target market, clear and timely fees, tested comprehension, vulnerable customer support, and data that proves outcomes.
The Duty came into force for open products on 31 July 2023 and for closed products on 31 July 2024 (FCA PS22/9). The FCA has continued to publish good and poor practice, including reviews of outcomes monitoring in July 2026.
Do you need FCA authorisation?
The answer depends on what your app does with money and data, not on what you call it. Most UK fintech startups reach market through one of these routes.
| What your app does | Usual regulatory route | What it means for the build |
|---|---|---|
| Shows users their accounts from other banks | Registration as an account information service provider, or operating as an agent of one | Consent journeys, token handling, re-authentication, data minimisation |
| Initiates payments from users' bank accounts | Authorisation as a payment institution with payment initiation permission, or using an authorised provider | Payment consent screens, confirmation, fraud controls |
| Holds customer balances in a wallet | E-money institution authorisation or registration, or partnering with an EMI | Ledger, safeguarding reconciliation, redemption flows |
| Moves money between users | Payment institution authorisation, or a regulated partner | Payee checks, fraud monitoring, complaints handling |
| Lends to consumers | FCA consumer credit authorisation, or a regulated lending partner | Affordability checks, disclosure, forbearance journeys |
| Provides software to a regulated firm only | Often no authorisation for you; the firm's obligations flow into your contract | Evidence, audit logs and outcome data the client can use |
Check any partner on the FCA Financial Services Register and have counsel confirm your route before design starts. Partnering with a regulated firm is usually faster, but your app then has to meet that firm's Consumer Duty, safeguarding and fraud requirements, and its compliance team will review what you build.
Consumer Duty outcomes turned into app features
| Outcome | What the FCA expects | Features and evidence to build |
|---|---|---|
| Products and services | Designed for the needs of an identified target market | Eligibility checks, journeys adapted to customer groups, flags for customers outside the target market |
| Price and value | Fair value; key costs clear | Fee summaries before commitment, total cost displays, fee and usage data for value assessments |
| Consumer understanding | Communications customers understand, at the right time | Plain-language copy, comprehension testing, key information before the decision point |
| Consumer support | Support that meets needs, including for vulnerable customers, without unreasonable barriers | Easy disclosure of vulnerability, human support routes, cancellation and complaints as easy as sign-up |
| Cross-cutting | Act in good faith, avoid foreseeable harm, enable customers to pursue their objectives | No pre-ticked options, no manipulative urgency, outcome dashboards reviewed by the board |
What the FCA found in digital customer journeys
In July 2025 the FCA published a review of how consumer credit firms acquire customers through apps and websites (FCA: Digital design in customers' online journeys). The findings relate to credit providers, but the FCA says they may interest any firm with a digital presence. Good practice included:
- Designing journeys for the different customer groups in the target market.
- Using positive friction to help customers take time over decisions.
- Clear layouts that show key features and the steps of a journey up front.
- Plain English, short sentences and visual explanations.
- Involving frontline staff in journey design and testing for good outcomes.
Areas for improvement included journeys that made it hard to disclose vulnerability, layouts and pre-selected defaults that nudged customers toward particular choices, fees and charges not presented clearly or in time, and marketing journeys on how quickly they could be completed. Each of those is a design decision your team makes in Figma long before compliance sees it. The general patterns in our mobile UX best practices guide apply, with friction deliberately added where decisions carry financial risk.
2026 changes that affect what you build
Safeguarding for payments and e-money firms
The FCA's supplementary safeguarding regime came into force on 7 May 2026 for authorised payment institutions (other than those providing only payment initiation or account information services), authorised and small e-money institutions, and credit unions issuing e-money (FCA PS25/12). It strengthens record keeping, reconciliation, reporting and monitoring. For engineers the consequence is concrete: an accurate internal ledger, automated reconciliation against safeguarding accounts every business day, and reporting that can be produced without spreadsheets.
Commercial variable recurring payments
The UK Payments Initiative launched the first commercial variable recurring payments scheme on 2 June 2026, and the FCA said it would consult on a long-term regulatory framework for open banking by the end of 2026, subject to legislation (FCA statement, 2 June 2026). If your app collects recurring payments, cVRP may become an alternative to cards or Direct Debit in the sectors the scheme covers. Build payment methods behind an abstraction so adding it later is a configuration job rather than a rewrite.
Authorised push payment fraud
Since October 2024, payment firms have had to reimburse eligible victims of authorised push payment scams, with a maximum of £85,000 per claim and costs split between sending and receiving firms (PSR PS24/7). Any app that sends Faster Payments needs scam warnings at the right moment, payee checks, velocity rules and a claims workflow. The government has announced that the PSR's functions will move to the FCA, so watch for rule changes as that happens.
How to build a UK fintech app that passes partner and FCA scrutiny
- Confirm your regulatory route and the partner, if any, before choosing a stack. Get the partner's requirements in writing.
- Define the target market and customer groups, including characteristics of vulnerability, and design journeys for each.
- Design the ledger and reconciliation first. Integer amounts, double entry, daily automated reconciliation.
- Write the key information screens with fees, risks and terms before the decision point, in plain English.
- Test comprehension with real users from the target market and keep the results as evidence.
- Build support and exit routes as carefully as onboarding: vulnerability disclosure, human contact, cancellation and complaints.
- Add fraud controls: scam warnings, payee checks, monitoring and a case workflow.
- Instrument outcomes. Drop-off, complaints, vulnerability flags, fee events and support contacts, in a dashboard leadership reviews.
- Secure the platform and the supply chain: penetration testing, Cyber Essentials as a baseline, and controlled access for any outsourced engineers.
If your build uses an offshore or outsourced team, keep real customer financial data out of development and follow the access controls in our guide to offshore development and UK GDPR transfers. If your app makes automated credit decisions, the safeguards in our Data (Use and Access) Act guide apply too.
Frequently asked questions
Does Consumer Duty apply to fintech startups?
It applies to FCA-regulated firms in their dealings with retail customers, whatever their size. A startup that is authorised or registered, or acting as an agent or appointed representative, is in scope for those activities. A technology provider that is not regulated itself will still feel the Duty through its regulated partner, which must evidence good outcomes across the whole customer journey.
Do I need FCA authorisation to launch a fintech app?
Not always. Many UK fintech apps launch by partnering with an authorised payment institution, e-money institution or lender, or by acting as its agent. Account information services need registration, and holding balances, initiating payments or lending usually needs authorisation or a regulated partner. Confirm your route with counsel and check partners on the FCA register.
How does Consumer Duty affect app design?
It makes design choices evidence of compliance. Fees and risks must be clear before decisions, journeys must suit the target market, vulnerable customers must be able to get support, and cancelling or complaining should not be harder than signing up. The FCA has flagged pre-selected defaults, speed-focused marketing and late fee information as areas for improvement.
What changed in UK safeguarding rules in 2026?
The FCA's supplementary safeguarding regime for payments and e-money firms came into force on 7 May 2026 under PS25/12. It strengthens record keeping, reconciliation, reporting and monitoring of customer funds. Apps that hold or move customer money need an accurate ledger and automated daily reconciliation to support it.
What is commercial VRP?
Commercial variable recurring payments let customers authorise a business to collect payments from their bank account within agreed limits, using open banking. The UK Payments Initiative launched the first commercial scheme on 2 June 2026, starting with selected sectors, and the FCA plans to consult on a long-term open banking framework by the end of 2026.
Key takeaways
- Your regulatory route, direct authorisation or a regulated partner, shapes the architecture and must be settled before design.
- Consumer Duty turns fee display, friction, vulnerability support and exit journeys into regulated design decisions.
- The FCA has flagged pre-selected defaults, speed-led marketing and late fee information in digital journeys.
- Safeguarding rules tightened on 7 May 2026; build the ledger and daily reconciliation first.
- Commercial VRP launched on 2 June 2026 and APP fraud reimbursement is capped at £85,000; design payments and fraud controls with both in mind.
Build a fintech app your partner bank will approve
If you are planning a UK payments, wallet, open banking or lending app, send us your product outline and your partner or licence plan. You will contract with our UK company and work with us from our London office at 2-7 Clerkenwell Green, EC1R 0DE, and we will return a written build plan that maps each feature to Consumer Duty evidence, safeguarding and fraud controls, with a cost range in pounds. We built escrow-protected payments for Car Block, and our fintech and custom software practice builds what your counsel and partner need to see.
Sources
- FCA: PS22/9 A new Consumer Duty
- FCA: Digital design in customers' online journeys (July 2025, updated December 2025)
- FCA: PS25/12 Changes to the safeguarding regime for payments and e-money firms
- FCA: Open banking takes next step forward with launch of UK Payments Initiative scheme (2 June 2026)
- PSR: PS24/7 APP scams reimbursement, maximum level
- FCA: Consumer Duty hub
- FCA Financial Services Register