The most vulnerable still over-paying. More action is required by the regulator.