As the Financial Conduct Authority (FCA) continues to embed its Consumer Duty and Vulnerability Guidance (FG21/1), one theme stands out: customer vulnerability is no longer just a compliance box to tick — it’s a defining factor of commercial success.
Why Vulnerability Still Matters
The FCA expects firms to understand the nature and scale of vulnerability in their customer base. This isn’t about spotting individual cases; it’s about developing an informed, data-driven understanding of where vulnerability exists, how it manifests, and what firms can do to support those customers more effectively.
At the PIMFA Wealth Vulnerability Event last year, the FCA’s Graeme Reynolds reminded firms that you can’t begin to deal with vulnerability until you’ve identified which clients might be vulnerable and why. This is the foundation on which a credible vulnerable customer strategy must be built.
Where Firms Are Falling Short
Research by the Chartered Insurance Institute (CII) in 2024, and repeated in 2025, revealed that many insurers and financial firms are struggling to evidence their understanding of vulnerability.
-
- One in five firms couldn’t provide the FCA with any meaningful vulnerability data.
- Another 26% relied on “stop-gap” or incomplete datasets.
This lack of credible evidence undermines Consumer Duty compliance and hinders firms from developing informed strategies to improve outcomes.
The FCA’s Vulnerability Review findings published in March 2025, revealed that many organisations are likely to discover that their foundations are not as strong as they thought. It is likely that supervisory visits will focus on this shortfall.
From Supportive Guidance to Enforcement
In December 2024, the FCA announced that in H1 2025 it will begin providing specific firm feedback and taking regulatory action where necessary.
Polling by the Consumer Duty Alliance showed that 74% of firms expect the regulator to crack down on how businesses treat vulnerable customers. The message is clear: enforcement is on the horizon, and firms need to show their work.
The FCA’s intent to focus more on Vulnerability and Consumer Duty implementation was reiterated in October of this year when speaking at the Next Steps for Consumer Duty Conference, the FCA Cross-cutting Policy and Strategy Director, Charlotte Calrk, said the next step of the regulations, will be a “deliberate move” from “prescription to principles with proof”. This will entail fewer rigid templates and more evidence of better outcomes“.
Top-Down vs Bottom-Up: Getting the Approach Right
One of the most common missteps is confusing understanding vulnerability with identifying it.
- Top-down understanding is strategic — it’s about measuring the prevalence and characteristics of vulnerability across a representative customer base.
- Bottom-up identification happens operationally, as staff record vulnerabilities observed in individual interactions.
Firms that rely solely on bottom-up methods tend to underreport vulnerability, often showing rates in single digits. By contrast, the FCA’s Financial Lives survey suggests that nearly 49% of UK adults experience at least one form of vulnerability.
Without a top-down view, firms risk misunderstanding their customers and misdirecting resources.
AI Tools: Helpful but Not Enough
AI-driven tools are increasingly being used to detect vulnerability during customer conversations — for example, flagging signs of financial stress or confusion. While helpful, they only capture a fraction of the picture.
However, these tools only “scratch the surface” by identifying only the issues customers verbalise. They don’t uncover unspoken vulnerabilities like poor financial literacy, health conditions, or recent life changes that may influence behaviour.
Avoiding One-Dimensional Thinking
The FCA has criticised sectors that approach vulnerability too narrowly. Wealth managers, for instance, often focus solely on financial resilience, while some insurers prioritise claims processes at the expense of wider needs.
A robust framework must consider the four core drivers of vulnerability — health, financial capability, financial resilience, and life events — and understand how they overlap. Failing to do so not only risks compliance breaches but also alienates customers who need support most.
The Commercial Upside
Getting vulnerability right isn’t just the ethical thing to do — it makes business sense.
KPMG’s analysis shows that firms who align fully with FCA expectations are seeing improvements in customer retention, satisfaction, and innovation. Those that don’t risk being categorised as “Naïve” or “Maverick” — well-intentioned but ultimately misaligned with regulatory and customer expectations.
As the FCA’s Nisha Arora put it, “Getting it right for consumers means higher standards and healthier competition. The prize is huge if we can get this right.”
Final Thoughts
For insurers and financial firms, 2026 will be a defining year.
Firms that invest now in credible, inclusive, and measurable vulnerability strategies will not only meet regulatory expectations but also earn the trust — and loyalty — of their customers.
After all, understanding vulnerability isn’t just about compliance; it’s about building stronger, fairer, and more resilient relationships that benefit both customers and the business.