What Is a Vulnerable Customer?

The FCA defines a vulnerable customer as someone who, due to their personal circumstances, is especially susceptible to harm, particularly when a firm is not acting with appropriate levels of care. Two points in that definition matter. First, vulnerability is about circumstances, not a fixed label: anyone can become vulnerable, and many people move in and out of vulnerability over time. Second, the definition links vulnerability to the firm’s own conduct. The question isn’t only whether a customer is vulnerable, but whether the firm’s products, processes and people respond to that vulnerability with the care it needs.

The FCA’s own research has consistently found that a large share of UK adults show one or more characteristics of vulnerability at any given time. For most retail firms, vulnerable customers are not a small edge case; they are a significant part of the customer base.

The Four Drivers of Vulnerability

The FCA groups the characteristics associated with vulnerability into four drivers. Firms are expected to understand how each applies to their own customers.

Characteristics often overlap. A customer facing a bereavement may also have reduced resilience and temporarily lower capability. Firms that treat vulnerability as a single tick-box category tend to miss those combinations.

FG21/1: The FCA’s Guidance on Vulnerable Customers

In 2021 the FCA published finalised guidance, FG21/1 on the fair treatment of vulnerable customers. It explains what the FCA expects firms to do to comply with the Principles for Businesses in relation to vulnerable customers. The guidance is organised around four areas:

• Understanding customers’ needs. Firms should understand the nature and scale of vulnerability in their target market and customer base, and the impact it could have on customers’ needs and experiences.
• Skills and capability of staff. Staff should have the skills and capability to recognise and respond to vulnerability, and to do so with appropriate care.
• Taking practical action. Firms should design products and services, customer service and communications so that they meet the needs of vulnerable customers.
• Monitoring and evaluation. Firms should monitor whether they are meeting vulnerable customers’ needs, and act where they are not.

The guidance makes clear that the aim is for vulnerable customers to experience outcomes as good as those of other customers. It is not about treating vulnerable customers less favourably or excluding them; it is about making sure the firm’s ordinary processes don’t fail them.

How the Consumer Duty Changes the Picture

The Consumer Duty, which applied to open products from July 2023 and closed products from July 2024, builds on FG21/1 and makes vulnerability part of the firm’s core obligations to retail customers. The Duty requires firms to deliver good outcomes for all retail customers, including those with characteristics of vulnerability, across its four outcomes: products and services, price and value, consumer understanding and consumer support. Our guide to the Consumer Duty for Senior Managers explains the outcomes in detail, and the FCA’s Consumer Duty pages set out the rules.

In practice, the Duty has raised the bar in three ways:

The FCA has continued to review how firms treat vulnerable customers since the Duty came in, and has published findings on good and poor practice. Firms should check the regulator’s latest publications, as its expectations on areas such as recording vulnerability data and measuring outcomes have continued to develop.

What Firms Need to Do in Practice

Turning the guidance into practice usually involves the following elements. The scale and sophistication should reflect the firm’s size, customer base and the harm its products could cause.

• Understand the customer base. Use data, research and frontline insight to understand how common each driver of vulnerability is among your customers, and how your products and processes could affect them.
• Train and support staff. Frontline staff need practical training to recognise signs of vulnerability and respond appropriately, with clear routes to specialist support. Staff wellbeing matters too, because difficult conversations take a toll.
• Design with vulnerability in mind. Product design, eligibility, charges, exit routes and processes should be tested for how they work for customers with characteristics of vulnerability.
• Make communications work. Use plain language, offer a range of channels, and adapt communications for customers who need them, for example larger print, phone contact or a trusted third party.
• Record needs appropriately. Where customers share information about their circumstances, record it so they don’t have to repeat it, with appropriate data protection safeguards.
• Monitor outcomes. Use management information to compare outcomes for vulnerable customers with others: complaints, arrears, cancellations, claims, call handling and so on.
• Act on what the data shows. Where outcomes are worse, change the product, process or communication, and record what was done.

Recording information about health and other personal circumstances raises data protection considerations, as some of it is likely to be special category data under UK GDPR. Firms should take advice on the lawful basis for recording it and on how it is used and shared.

Vulnerability by Sector

Sector experience matters when firms recruit compliance and conduct leaders, because the vulnerability issues in debt collection are very different from those in wealth management. Our pages on SMF recruitment for consumer credit firms and SMF recruitment in Leeds, where debt and credit firms are concentrated, cover this in more detail.

Governance and Accountability

Treating vulnerable customers fairly is a board-level responsibility, and under the SMCR it sits with named Senior Managers.

The board

The board sets the firm’s approach, reviews management information on vulnerable customer outcomes and, under the Consumer Duty, approves the annual assessment of outcomes. Boards should be able to answer simple questions: how many customers show characteristics of vulnerability, how their outcomes compare with others, and what the firm has changed as a result.

The Consumer Duty board champion

Most firms have appointed a board champion, usually a non-executive, to help the board challenge whether the Duty, including its vulnerability elements, is embedded. See our guide to the Consumer Duty board champion.

Senior Managers

Accountability for the Consumer Duty is often allocated to a specific Senior Manager, and the approach to vulnerable customers usually sits with that person, with operational ownership in the business areas that serve customers. Our guide to Consumer Duty and the SMF framework explains how firms allocate it. All Senior Managers are subject to the Duty of Responsibility in their areas, and staff are subject to the Consumer Duty Conduct Rule to act to deliver good outcomes for retail customers.

The compliance officer

The compliance officer, usually SMF16, provides second-line oversight: testing whether vulnerability policies work in practice through the compliance monitoring plan, reviewing outcomes data, challenging the business where outcomes for vulnerable customers are worse, and reporting to the board. In retail firms, vulnerability is now one of the main areas a compliance officer is judged on.

Common Failings

Hiring People With Vulnerability Experience

For retail firms, experience of vulnerable customers is now one of the most important things to test when hiring a compliance officer, head of conduct or customer outcomes lead. Good candidates can describe how they measured outcomes for vulnerable customers, what the data showed, and what changed as a result. They understand the firm’s sector-specific issues, from forbearance in collections to cognitive decline in wealth management, and they can explain vulnerability to a board in terms of evidence rather than intentions.

When we recruit for these roles, we ask candidates for specific examples: a product or process they changed because of vulnerable customer outcomes, a board report they wrote, a difficult case they handled. Our guide to the compliance officer experience that matters by firm type covers this further, and our page on compliance officer recruitment explains how we run the search. For definitions of the terms used in this guide, see our SMCR glossary.

Frequently Asked Questions

What is the FCA’s definition of a vulnerable customer?

Someone who, due to their personal circumstances, is especially susceptible to harm, particularly when a firm is not acting with appropriate levels of care.

What are the four drivers of vulnerability?

Health, life events, resilience and capability. Customers can show characteristics of more than one at the same time, and vulnerability can be temporary or long-term.

Is FG21/1 still relevant now the Consumer Duty applies?

Yes. FG21/1 remains the FCA’s guidance on the fair treatment of vulnerable customers, and the Consumer Duty builds on it by requiring firms to evidence good outcomes for all retail customers, including vulnerable customers.

Which Senior Manager is responsible for vulnerable customers?

Usually the Senior Manager allocated responsibility for the Consumer Duty, with second-line oversight from the compliance officer and challenge from the board and its Consumer Duty champion.

Does vulnerability only matter for retail firms?

The Consumer Duty applies to retail customers, so the main obligations sit with firms whose products and services reach consumers, directly or through distribution chains.