Vulnerable Customers: FCA Expectations Explained

How the FCA defines a vulnerable customer

The FCA defines a vulnerable consumer as "someone who, due to their personal circumstances, is especially susceptible to harm, particularly when a firm is not acting with appropriate levels of care". Two things stand out in that wording. Vulnerability is driven by personal circumstances, which can change over time, and the risk of harm is amplified when a firm falls short on care.

Crucially, the FCA frames vulnerability as a spectrum of risk. All consumers are at risk of becoming vulnerable, and that risk rises where someone displays characteristics under one or more of the four drivers. This means a customer who looks entirely capable today may become vulnerable after a bereavement, a diagnosis or a sudden change in income. Firms cannot rely on a fixed list of vulnerable customers; they need processes that respond to circumstances as they arise.

Because vulnerability is situational, the FCA does not expect firms to label customers permanently. It expects them to recognise the signs, respond to needs flexibly, and avoid causing foreseeable harm. That distinction shapes everything that follows in FG21/1.

It also matters that vulnerability can be temporary, sporadic or permanent. A customer recovering from a short illness has different needs from someone managing a long-term condition, and both differ from a customer navigating a sudden bereavement. FG21/1 is deliberately outcome-focused rather than prescriptive on this point, so firms are expected to build judgement into their processes rather than force every customer into a rigid category. The test the FCA applies is whether vulnerable customers experience outcomes as good as those of everyone else.

The four drivers of vulnerability

FG21/1 groups the characteristics that increase vulnerability risk into four drivers: health, life events, resilience and capability. These are not mutually exclusive. A single life event, such as a job loss, can quickly erode financial resilience and trigger poor mental health, so a customer may sit across several drivers at once.

Understanding the drivers is the starting point for any vulnerability strategy. They give firms a common language to identify needs in their target market, to train staff, and to design products and communications that do not disadvantage customers who display these characteristics.

The drivers also help firms think about harm rather than just labels. Two customers can share the same characteristic yet face very different levels of harm depending on the product they hold and the point they have reached in their journey. A customer with low capability taking out a simple savings account is exposed to less potential harm than the same customer entering a complex, long-term commitment. FG21/1 asks firms to connect the characteristics present in their customer base to the specific harms their products and services could cause, and to prioritise action accordingly.

How many customers are affected: the Financial Lives figures

The scale of vulnerability is set out in the FCA's Financial Lives May 2024 survey. It found that 26.4 million UK adults, or 49% of the adult population, showed one or more characteristics of vulnerability. That was a decrease of 0.9 million since the May 2022 survey, when the figure stood at 27.3 million (52%).

The survey also breaks the population down by driver. As a proportion of all UK adults in May 2024, resilience-related characteristics were the most common, followed by negative life events, then capability, then health. On a narrower measure, 13.1 million adults (24%) had low financial resilience, meaning they would struggle to withstand even a short loss of income or a modest rise in essential costs.

These are not marginal numbers. When close to half the adult population sits within scope, firms cannot treat vulnerability as a rare edge case. It has to be built into the core of how products are designed and services are delivered, which is exactly the standard the Consumer Duty now expects.

How vulnerability links to the Consumer Duty

FG21/1 was written under the FCA's Principles for Businesses, which require firms to treat customers fairly. The Consumer Duty, set out in PRIN 2A, raised the bar and made the connection to vulnerability explicit. The Duty's cross-cutting rules require firms to act in good faith, to avoid causing foreseeable harm, and to enable and support retail customers to pursue their financial objectives.

Each of those cross-cutting obligations requires firms to understand and take account of the impact of characteristics of vulnerability, alongside behavioural biases, on customers' needs and decisions. In practice this means vulnerability cannot be handled in a standalone policy that sits away from the business. It must run through the four Consumer Duty outcomes covering products and services, price and value, consumer understanding and consumer support.

The Duty also shifts the emphasis from process to outcomes. It is no longer enough to show that a vulnerability policy exists. Firms must be able to evidence that customers in vulnerable circumstances are achieving outcomes as good as those of other customers, and that any gaps are identified and closed. Embedding vulnerability into your control framework is central to that, and our control platform helps firms map these obligations to concrete monitoring.

This outcomes lens changes what good governance looks like. Boards and senior managers are expected to receive management information that shows how vulnerable customers are faring across the customer journey, from the clarity of communications to the ease of getting support and the fairness of the price they pay. Where the data shows a gap, the Duty expects the firm to act. Vulnerability is therefore not a compliance sub-topic to be delegated and forgotten; it is a live input into product governance, distribution decisions and the annual assessment of consumer outcomes that senior managers must sign off.

The FCA's practical expectations for firms

FG21/1 sets out four areas where firms are expected to take action. The first is understanding the needs of the target market and customer base, including the nature and scale of vulnerability characteristics that exist within it, so the firm can anticipate the harms its customers are most exposed to.

The second is staff skills and capability. Frontline staff should have the skills to recognise and respond to a range of vulnerability characteristics, supported by training that translates into better outcomes rather than tick-box completion. The third is taking practical action across product and service design, flexible customer service and communications, so that customers with these characteristics are not disadvantaged at any stage of the journey.

The fourth is monitoring and evaluation. Firms should assess whether they are meeting the needs of vulnerable customers and make improvements where they are not. The FCA is clear that management information should extend beyond complaints data and feed into governance and product decisions. In practice, that requires a structured way to record support needs, evidence that training has landed, and track vulnerable-customer outcomes over time rather than at a single moment.

Common pitfalls and how to avoid them

The most frequent failing is treating vulnerability as a static register rather than a live risk. Because vulnerability is situational, a customer who was capable at onboarding may need support months later. Firms that only capture vulnerability at a single point miss the majority of cases that emerge through life events, illness or financial shocks.

A second pitfall is training that does not change behaviour. Completing an e-learning module is not the same as equipping staff to spot and respond to a disclosure of poor health or bereavement. The FCA looks for evidence that training improves outcomes, which means role-relevant scenarios, refreshers and feedback loops rather than a one-off course.

A third is relying on complaints as the primary measure of success. Vulnerable customers are often the least likely to complain, so an absence of complaints can hide harm. Effective monitoring compares outcomes across customer groups, uses recorded support needs, and reviews whether communications are actually understood. Getting this right depends on capable, well-supported people, and firms often find that fair treatment of vulnerable customers goes hand in hand with fair, transparent treatment of their own staff, an area where a well-run pay and reward approach reinforces the right culture.

Conclusion

Vulnerability is not an edge case. With 26.4 million UK adults, almost half the population, showing one or more characteristics of vulnerability, the FCA expects firms to treat fair treatment of vulnerable customers as core business. FG21/1 sets the standard, and the Consumer Duty gives it teeth by requiring firms to evidence good outcomes rather than good intentions.

The firms that cope best are those that treat vulnerability as a live risk running through every outcome, not a policy filed away for inspection. That means understanding your customer base, building genuine staff capability, designing products and services that do not disadvantage vulnerable customers, and monitoring outcomes with data that goes well beyond complaints. Do that consistently, and you meet the FCA's expectations while serving your customers better.

Frequently asked questions