What is conduct risk?

Conduct risk is the risk that the way a firm and its staff behave leads to poor outcomes for customers or harms the integrity of markets. Mis-selling, unfair charges, misleading information and ignoring a customer's circumstances are all conduct failures. Once AI agents talk to customers, conduct risk follows them: the agent's behaviour is the firm's behaviour.

Why does conduct risk matter once agents act?

A salesperson who pushes an unsuitable product harms one customer per conversation. An agent with the same flaw in its brief can do it thousands of times before anyone notices. Scale changes the stakes.

Agents also make conduct failures subtler. A person who is pressuring a customer usually sounds like it. An agent can steer gently and consistently: mentioning the premium product first, describing an exit fee only when asked, or answering a question about cancelling with an offer instead. No single message looks wrong. The pattern is the problem, and we argue that conduct risk moves when agents do the selling.

How do firms manage conduct risk in practice?

Through design, oversight and testing. Product governance decides who a product is for. Sales and service scripts set what may be said. Call and chat reviews check what was actually said. Complaints and outcome data show where customers are getting a bad deal. In the UK, the FCA's Consumer Duty makes good outcomes for retail customers an explicit obligation.

For agents, each of these needs an equivalent:

• Design: the agent's brief states what it may offer, to whom, and what it must disclose.
• Bounds: the agent cannot quote a product or price outside its role, whatever the customer asks.
• Review: a second-line compliance agent samples conversations, and reviewing customer calls for conduct risk is one of the most useful things it can do.
• Outcomes: track cancellations, complaints and switching for customers served by agents versus people.

An example from an insurer's retention line

Take a home insurer whose retention agent handles customers who want to cancel. Its goal is to keep customers where that is in their interest. Reviewing a month of conversations, a compliance analyst notices that when customers mention a cheaper quote elsewhere, the agent offers a discount, but when they mention a change in circumstances such as moving abroad, it still tries to retain them.

Each conversation is polite and accurate. Together, they show the agent retaining customers whose policy no longer suits them. The fix is a change to the brief, then recertification, not a scolding.

How is conduct risk different from operational risk?

Operational risk is the risk of loss from failed processes, people, systems or external events: an outage, a processing error, a fraud. It is measured mostly by losses to the firm.

Conduct risk is measured by harm to customers and markets, and can occur when every process runs exactly as designed. An agent that works perfectly to a badly designed brief is an operational success and a conduct failure. Firms often find conduct issues because an operational control worked too well.

Which terms sit next to conduct risk?

• Consumer Duty: the FCA's requirement to deliver good outcomes for retail customers.
• Mis-selling: selling a product unsuitable for the customer's needs.
• A customer risk rating measures financial crime risk a customer poses, not the risk the firm poses to the customer.