Citizen’s Advice says ‘policy failure’ by regulator means companies secured a windfall of almost £4bn