The CMA retail banking investigation and the remedies it created

The Competition and Markets Authority (CMA) carried out a full investigation into the UK retail banking market and, in 2017, imposed a package of remedies through the Retail Banking Market Investigation Order 2017. The investigation itself was set in motion by Parliament: the Parliamentary Commission on Banking Standards recommended that "the Competition and Markets Authority immediately commence a market study of the retail and SME banking sector, with a full public consultation on the extent of competition and its impact on consumers", and that a formal market investigation reference should follow "before the end of 2015" if the CMA so decided¹. The remedies that came out of that process still shape everyday banking: open banking, which now has over 7 million active users in the UK²; free payment transaction histories when you close an account³; and published service quality information that lets you compare banks on how they treat customers⁴.

This page explains what the investigation found, how each remedy works in practice, which of them still apply, and where the CMA's role stops when it comes to your own complaint about your bank. The CMA itself was created by the Enterprise and Regulatory Reform Act 2013, replacing the Office of Fair Trading and the Competition Commission⁵, and it sits alongside the financial regulators covered on who regulates what.

What the CMA retail banking investigation found

The investigation's roots lie in the Parliamentary Commission on Banking Standards, which reported after the financial crisis and concluded that competition in retail banking needed independent scrutiny. Its recommendation was unambiguous: the CMA should "immediately commence a market study of the retail and SME banking sector, with a full public consultation on the extent of competition and its impact on consumers"¹. The Commission also set a timetable, urging a formal market investigation reference "before the end of 2015"¹. That is what happened, and the resulting order in 2017 imposed remedies on the largest personal and business current account providers.

The Commission's thinking went beyond current accounts. It recommended that "the merits of requiring the large banks to relinquish ownership of the payments system be examined and the Government report to Parliament on its conclusions before the end of 2013"¹⁰, and it pointed towards "bringing payments systems under economic regulation" with "a new competition-focused, utility-style regulator for retail payments systems"¹⁰. Those ideas fed directly into the payments landscape that followed: the Payment Systems Regulator was created, and open banking was designed to let new providers compete with the large banks rather than depending on them.

The remedies also pulled other regulators into follow-up work. The FCA noted that on overdrafts it aimed "to consult in May on measures to promote competition and consumer engagement following the Competition" and Markets Authority's investigation¹¹. That consultation fed into the overdraft changes covered on the high-cost credit review page. The pattern across the remedies is consistent: the CMA identified where competition was not working for customers, and the tools it created, from data sharing to published service information, were designed to make it easier for people to compare, switch and challenge their banks.

How open banking works: sharing data through regulated apps

Open banking is, in the FCA's words, "a secure and regulated way for people and businesses to share access to payments data from their bank account with trusted apps and services"¹². Instead of giving an app your password or a screenshot of your statement, you approve a connection through your own bank, and the app receives only the data you have agreed to share. The Payment Systems Regulator describes the effect: open banking "allows people and businesses to link their accounts with third parties offering payment services", providing what it calls "a secure and cost-effective alternative to using card networks"¹³.

The system is supervised jointly. The Joint Regulatory Oversight Committee that steers open banking brings together "the Competition and Markets Authority (CMA), the Financial Conduct Authority (FCA) and the Treasury" alongside the PSR¹³. The technical side is written into the FCA's rulebook: firms subject to article 13 of the Retail Banking Market Investigation Order 2017 must "use the Open Banking FCA Service Metrics API Specification v.1.0.0, or a substantially similar API, to make information" available⁴. In plain terms, the order forced the big banks to build standard, secure connections that regulated apps can plug into, which is why a budgeting app or a payment service can connect to accounts across the market rather than one bank at a time.

The scale has grown quickly. The PSR reports "over 7 million active open banking users in the UK"². If you are weighing open banking against the wider idea of sharing other financial data, such as savings or pensions, the comparison is set out on open banking and open finance.

Paying by bank: what open banking payments can do

As well as reading data, open banking lets you pay directly from your bank account through a regulated provider. The PSR frames this as the point of the exercise: open banking provides "a secure and cost-effective alternative to using card networks"¹³. When you check out with a merchant that offers "pay by bank", you are redirected to your own bank's app or website to approve the payment, and the money moves from your account to the merchant without a card being involved.

The Financial Services Consumer Panel has set out what it expects the arrangement to deliver: "Open Banking payments must offer a competitive alternative to card payments-in particular, in terms of charges paid by merchants", and must be "safe, trusted and underpinned by comprehensive rules, liability and redress regimes". That last part matters most for a consumer: if an open banking payment goes wrong, there need to be clear rules about who is liable and how you get your money back, in the same way card payments have.

One point of clarity comes from how government bodies describe the process. HMRC's privacy notice states: "This policy only relates to the Open Banking payment initiation process. It does not relate to other payment methods, such as bank transfer or credit or debit card payments"¹⁴. In other words, choosing to pay by bank through open banking is a distinct route with its own rules, not simply a bank transfer you have made yourself.

Cancelling is where open banking payments differ most from cards. With a continuous payment authority on a credit or debit card, "your bank or card provider must cancel the payment authority" when you ask¹⁵. A one-off open banking payment you have already approved does not work that way: once authorised and sent, it is not a recurring authority you can switch off. If a payment was unauthorised, different rules apply, and in most circumstances your bank must refund you⁶. The differences between payment types, and the protections attached to each, are compared on buy now pay later or credit card.

Sharing your data is a choice, not a condition of banking

Nothing in open banking obliges you to use it. The connection only exists because you approve it, and the approval happens in your own bank's app or website, which is what stops an app helping itself to your data. The wider rulebook reinforces that banks must deal with you transparently whether or not you ever touch open banking. Under BCOBS, "A firm must provide or make available to a banking customer appropriate information about a retail banking service and any deposit made in relation to that retail banking service", in good time, in an appropriate medium, and "in easily understandable language and in a clear and comprehensible form; so that the banking customer can make decisions on an informed basis"¹⁶.

Your ordinary banking rights carry on regardless. A firm "must provide or make available to a banking customer on paper or in another durable medium such regular statements of account as are appropriate to the type of retail banking service provided"¹⁷, and each statement should indicate the rate or rates of interest that apply to the service¹⁷. If you ask for statements more frequently than the rules require, a firm and customer may agree a charge for it, and "any such charge must reasonably correspond to the firm's actual costs"¹⁸. The detail of that is covered on paper statements.

The Consumer Duty sits behind all of this. It "applies in relation to a firm's retail market business or where the firm communicates or approves financial promotions which are addressed to, or disseminated in such a way that they are likely to be received by, a retail customer"¹⁹. That means a bank or an open banking provider must act to deliver good outcomes for retail customers, not merely follow the letter of the data sharing rules. If you share data and something goes wrong, the duty is part of the framework the Financial Conduct Authority and the Financial Ombudsman Service will look at.

Security and fraud protection when you use open banking

Open banking was designed with security at its centre: you approve access through your own bank, and data goes only to the regulated app you chose. But the backdrop is a serious fraud problem, and the official statistics show it. The Crime Survey for England and Wales recorded "a 23% increase in consumer and retail fraud (to around 1.1 million incidents)" in the year ending March 2025²⁰. Earlier survey data showed that 81% of consumer and retail fraud in England and Wales in the year ending September 2017 was cyber-dependent or cyber-enabled²¹, and the more recent figures show consumer and retail fraud at 68% of the fraud and computer misuse incidents captured by the survey²⁰.

The practical protections work on two levels. First, only authorised firms may provide open banking services, so checking the provider is the single most useful step you can take. MoneyHelper's guidance on scams is direct: "Check you're using a legitimate loan provider by searching the FCA Firm Checker and using the contact details listed there", not the ones given to you²². The same discipline applies to any app asking for access to your bank account: verify the firm on the FCA Register, and use the contact details the register gives, not ones in a message or advert.

Second, if a payment you did not authorise leaves your account, the rules are on your side. The Bank of England and FCA guidance states: "In most circumstances, your bank must refund you for any unauthorised payments"⁶. That protection applies to unauthorised transactions, which is a different situation from a scam where you were tricked into approving a payment yourself; the current rules on scam refunds are set out on the Payment Systems Regulator page and in the scams and fraud guide.

The CMA has also looked at how firms treat people in difficult circumstances. Its paper on consumer vulnerability sets out "the CMA's key findings from its programme of work on vulnerable consumers"²³, which is part of the wider regulatory expectation that banks and other firms adjust how they deal with customers whose circumstances make them more exposed to harm.

Service quality data: comparing banks on how they treat customers

One of the investigation's remedies was to make banks publish information about the quality of their service, so that customers could compare banks on something more meaningful than headline rates. The mechanism is written into the FCA's rulebook: firms subject to article 13 of the Retail Banking Market Investigation Order 2017 must "use the Open Banking FCA Service Metrics API Specification v.1.0.0, or a substantially similar API, to make information" available⁴. That is the technical route by which service quality and performance information is published in a standard, comparable form across the big current account providers.

For an ordinary customer, the effect is that the largest banks must publish comparable service information on a recurring cycle, covering how quickly they answer the phone, how reliable their app and online banking are, and how customers rate their service. This is the origin of the service quality survey data you now see quoted when banks advertise their current accounts. Before the order, there was no standard, independently comparable picture of which banks actually served customers well; the remedy created one.

The published data is not a recommendation of any bank, and it does not tell you which account suits your circumstances. What it does is remove one of the information gaps the investigation identified: you can now weigh a bank's service record alongside its fees and features before you switch. The current accounts guide covers how to use that information when comparing accounts, and the complaints data page explains how firms' complaint figures are published and what they show.

Current account rules that help you switch and complain

The order created specific rights around closing and switching accounts. Part 5 of the Retail Banking Order "requires Personal Current Account (PCA) and Business Current Account (BCA) providers to provide a payment transaction history to account holders on account closure, free of charge"³. That matters if you are moving banks or shutting an account: you are entitled to your history of transactions on the way out, at no cost, which stops a bank from making it awkward to leave.

Other rules support access and fair treatment. Banks "can't discriminate against retail customers based on characteristics outlined in the Payment Accounts Regulations 2015"²⁴, and the largest UK banks are obliged to offer basic bank accounts to retail customers, though not business customers²⁴, a point covered in more detail on basic accounts and refusal. The FCA also requires firms to report "the number of refusals of applications for switching and of applications for basic bank accounts"²⁵, which puts refusals on the record. Separately, the FCA's cash access rules trigger reviews when "a branch, cash machine or Post Office closes or changes its opening hours"²⁶, as explained on the cash access rules page.

Complaints volume shows how much this matters in practice. The Financial Ombudsman Service received 32,900 complaints about current accounts in 2025/26⁷. Quarterly, the figures were 7,800 new complaints in Q1 2025/26²⁷, rising to 8,945 in Q1 2026/27²⁸, with business current account complaints at 795 in Q1 2025/26²⁹ and 993 in Q1 2026/27²⁸. An earlier quarter showed the trend can move both ways, with complaints "down from 8,800 in the same period reported in 2024/25"³⁰.

The route is fixed: complain to your bank first, and if you are not satisfied with its final response, the Financial Ombudsman Service can look at it. The choice between the ombudsman and court is compared on Financial Ombudsman or court.

How the CMA enforces the remedies on banks

The CMA does not just publish the order and hope banks follow it. It has shown it will act when a bank falls short. In 2022 it "issued Directions to Monzo Bank, designed to ensure ongoing compliance with Part 5 of the Order", the part covering free transaction histories on account closure³. Directions are a formal legal instrument: the bank must take the steps set out, and continued non-compliance is itself a breach.

The enforcement toolkit has also grown. The Digital Markets, Competition and Consumers Act gives the CMA "new powers in respect of infringements of certain consumer protection laws, breach of undertakings and non-compliance with CMA directions, including powers to impose monetary penalties"³³. Before that act, the Commons Library described the change as the CMA being "empowered (for the first time outside the competition space) to directly enforce consumer law through the imposition of monetary penalties"³⁴. The scale of the penalties is significant: "If a company infringes consumer protection law, the CMA can fine them up to 10% of their global turnover (or £300,000 where this is higher than the 10% figure)"⁸.

Two features of the regime are worth knowing. First, there is no fixed clock: "There is no legal deadline by which consumer investigations must be completed under the Digital Markets, Competition and Consumers Act"³⁵. Second, the CMA's own approach document sets out "How the Competition and Markets Authority (CMA) will help grow the economy, by promoting consumer trust and confidence, and deterring poor corporate practices"³⁶, which is the strategy behind its enforcement choices. How the FCA enforces against firms it supervises, a separate but related system, is covered on how the FCA acts against firms.

Where the CMA stops: your own complaint about your bank

The CMA's powers are aimed at markets and firms, not at individual disputes. It cannot step in on your complaint about your bank, award you compensation, or order a bank to pay you. The same boundary applies to the FCA in its own domain: "The FCA cannot pay compensation or order a claims management company to compensate you, even if you've received poor service"⁹. The body that can look at your individual complaint and order redress is the Financial Ombudsman Service, which is why the complaint route in the diagram above runs from your bank to the ombudsman, not to the CMA.

There are other limits on the CMA's reach worth knowing. Under the legislation governing its digital markets work, "the CMA cannot require an individual outside the United Kingdom to answer questions in relation to a digital markets investigation"⁵. And when a bank itself is investigating a suspicion of financial crime, "Section 333A of the Proceeds of Crime Act 2002 makes it an offence for the bank to tell anyone (even the customer concerned) that such an investigation is taking place if doing so may affect the investigation"²⁴, which explains why banks sometimes go quiet in ways that look like poor service but have a legal cause.

If you have a complaint about a current account, the practical sequence is: raise it with your bank, ask for its final response, and then take it to the Financial Ombudsman Service. If the issue is about a firm's conduct rather than your own dispute, the FCA takes reports about firms, and the complaining about the FCA page covers what to do if the regulator itself is the problem. For wider context on the rules that protect you across financial services, see consumer protection in UK financial services and the regulation policy section.