CoFI Fair Conduct Programme Insights Report: good job, but don't rest on your laurels

The Financial Markets (Conduct of Institutions) Amendment Act 2022 (CoFI) came into effect on 31 March 2025. CoFI introduces a regime that captures “financial institutions” including licensed insurers, registered banks, and licensed non-bank deposit takers and their intermediaries. The CoFI regime requires financial institutions to establish, implement, maintain and comply with an effective fair conduct programme (FCP). A FCP should include policies, processes, systems and controls that are designed to ensure the financial institution’s compliance with the fair conduct principle that financial institutions must treat consumers fairly. A summary of the FCP should be available on the financial institution's website.

Within the first week of CoFI coming into effect, the Financial Markets Authority (FMA) has released a report (Report) that provides insights from its review of FCPs submitted by financial institutions ahead of the CoFI regime’s commencement. The review sets out the FMA’s expectations, observations, findings of good practice and recommendations in respect of the following aspects of FCPs:

• fair conduct principle: explaining how the financial institution will comply with the fair conduct principle and integrate it into their policies, processes, systems and controls (PPSCs);
• relevance: making the FCP relevant to the financial institution’s business;
• ease of use: structuring the FCP in a clear manner and using plain language to ensure that it is easily understood by the financial institution’s staff;
• products and services: addressing the appropriateness of products and services to suit consumers’ needs;
• consumers: addressing different types of consumers, particularly vulnerable consumers;
• distribution: methods of distributing products and services and the use of intermediaries;
• employee training: training should be relevant and proportionate to the nature and size of the business, and tailored based on employees’ roles;
• complaints: providing a transparent, timely complaints process and how the financial institution utilises information from complaints to identify issues that need to be addressed;
• conduct risk: how these risks are identified, monitored and managed, with clear roles and accountabilities;
• governance: processes and assurance to assess the effectiveness of the FCP; and
• evolving risk: how this is addressed in the FCP.

Notably, the Report highlights that consideration of evolving risks remains limited across the FCPs reviewed. While some institutions referenced risks such as digitalisation and AI, few addressed areas like cyber risk, scams and fraud, financial inclusion, or the pressures of the economic environment. The FMA has clearly signalled that a “set-and-forget” approach will not suffice, and expects financial institutions to actively scan for, and respond to, emerging risks that may impact fair treatment of consumers.

The FMA has signalled that it intends to take an “educative and collaborative” regulatory approach in the early years of the CoFI regime. This is reflected in the tone of the Report, which is positive overall.

The FMA highlights several examples of how financial institutions have satisfied and, in some cases, exceeded their obligations.

However, the Report also sets down a clear expectation that financial institutions will continuously improve their FCPs and approach to fair consumer treatment. The FMA has signalled that down the line it intends to conduct a “more in-depth review” of FCPs and how the programmes have functioned in action.

The Report is a retrospective review of the FCPs of financial institutions that have already been granted CoFI licences by the FMA.

Institutions that demonstrated a culture of going beyond compliance – embedding the fair conduct principle into product design, distribution oversight and customer engagement – were highlighted as exemplars. As the regime matures, the FMA is likely to focus more on outcomes and how FCPs operate in practice, rather than just the quality of documentation.

We recommend that the findings of this Report are kept in mind when looking ahead. FCPs are not static and should be kept under review. As businesses change or if new risks are identified, consideration should be given to whether the FCP should be refreshed.

If you have any questions on FCPs or other elements of the CoFI regime, we would be happy to discuss them with you.