11 · Decision gate

Record the governance decision

Record a proportionate, evidence-based decision. There is no automatically correct option; the decision must follow from the evidence and say what remains uncertain.

LEGAL AND REGULATORY TOUCHPOINTS

Points to raise with specialists

UK GDPR and the Data Protection Act 2018: lawful basis, transparency and rules on automated decisions with significant effects. Check the current position after the Data (Use and Access) Act 2025.
FCA Consumer Duty: avoiding foreseeable harm and supporting customers, including those in vulnerable circumstances.
Payment Services Regulations 2017: obligations when a payment is refused, including telling the customer.
Senior Managers and Certification Regime: clear senior accountability for the risk.
Operational resilience and outsourcing expectations for a material third-party supplier.
These are pointers for discussion, not legal advice. The obligations that apply depend on the firm and how the system is used.

Governance Decision Record

This leads your report.

Recommendation

Reasoning (150–250 words)

Balance the benefit, the harm to affected people, the evidence available and the uncertainty that remains.

Evidence the decision relies on

What did you see, not merely what you were told?

What remains uncertain

Assumptions and evidence gaps that could change the decision

Conditions, restrictions and stop conditions

What must be true for the decision to stand?

Monitoring after the decision

Measures, thresholds, review cadence and owners

Who approves

Accountable role with authority

Review date

When the decision will be revisited

Answers save automatically and sync to your account when you are signed in.