A vulnerable customer is someone who, due to their personal circumstances, is especially susceptible to harm, particularly when a firm is not acting with appropriate care. The FCA's guidance (FG21/1) sets out four drivers of vulnerability: health, life events, resilience, and capability. Under the Consumer Duty, firms must not just identify vulnerable customers but evidence that the outcomes those customers receive are as good as everyone else's. Vulnerability is often temporary, invisible, and something any client can experience.
Key takeaways
- The FCA's four drivers of vulnerability are health, life events, resilience, and capability.
- Vulnerability can be temporary and hidden, a bereavement, a diagnosis, a sudden income shock, and can affect anyone, including sophisticated, wealthy clients.
- The Consumer Duty raises the bar: firms must monitor and evidence that vulnerable customers receive outcomes as good as other customers.
- Good practice runs through the whole client journey, identification, recording (with a lawful basis), staff capability, tailored support, and outcome monitoring.
- The biggest gap in most firms is evidence: identifying vulnerability but not demonstrating the resulting outcomes.
What does the FCA mean by a "vulnerable customer"?
The FCA deliberately defines vulnerability broadly. It is not a fixed label attached to a minority of clients; it is a state that can arise for anyone when their circumstances make them more susceptible to harm. The regulator's central message is that firms should treat vulnerable customers so they achieve outcomes as good as those of other customers, which requires understanding the drivers and building support around them.
The four drivers of vulnerability
1. Health. Physical or mental health conditions or illnesses that affect the ability to carry out day-to-day tasks, cognitive decline, serious illness, mental-health conditions, addiction.
2. Life events. Major changes such as bereavement, divorce, redundancy, retirement, or becoming a carer. These are common in advice work and are frequently the reason a client is seeking advice at all.
3. Resilience. Low ability to withstand financial or emotional shocks, limited savings, high debt, or income volatility.
4. Capability. Low knowledge or confidence in financial matters, poor literacy or numeracy, or difficulty using digital channels.
A single client can sit across several drivers, and drivers interact, a bereavement (life event) may reduce emotional resilience and, temporarily, capability.
How the Consumer Duty changed the expectation
Before the Duty, identifying and treating vulnerable customers fairly was already expected. The Duty made it measurable. Firms are now expected to monitor outcomes for vulnerable customers specifically and compare them to other customers, and to act where there is a gap. It is no longer enough to have a vulnerability policy; you must be able to show it works in practice, using data.
Practical steps for advice firms
- Enable identification. Train advisers to recognise signs across all four drivers, and create natural opportunities in conversations for clients to disclose. Note that clients often won't self-identify.
- Record appropriately. Capture vulnerability information with a lawful basis under UK GDPR, much of it is special category data (health) requiring extra protection, and only what's necessary.
- Adapt communications and support. Offer flexibility in format, pace and channel; check understanding; involve a trusted person where the client wishes.
- Reassess. Because vulnerability is often temporary, revisit it rather than treating an old flag as permanent.
- Monitor outcomes. Track suitability, complaints, and service outcomes for vulnerable clients as a segment, and evidence that they are being treated fairly.
Where firms most often fall short
- Under-identification. Relying on clients to volunteer vulnerability, so most cases are missed.
- Recording without acting. A flag on the file that changes nothing about the service.
- No outcome evidence. Unable to show, with data, that vulnerable clients get outcomes as good as others, precisely what the Duty asks for.
- Data protection slips. Holding sensitive vulnerability data without the right lawful basis or safeguards.
Frequently asked questions
What are the four drivers of vulnerability?
Health, life events, resilience, and capability, as set out in FCA guidance (FG21/1).
Does the Consumer Duty require firms to monitor vulnerable-customer outcomes?
Yes. Firms are expected to monitor and evidence that vulnerable customers achieve outcomes as good as those of other customers, and to act on any gap.
Is vulnerability permanent?
Often not. Many drivers, such as a bereavement or a temporary health issue, are transient, so firms should reassess rather than assume a past flag still applies.
Can wealthy or sophisticated clients be vulnerable?
Yes. Vulnerability is about susceptibility to harm in the circumstances, not wealth or financial knowledge. A life event or health issue can make any client vulnerable.
How should vulnerability information be stored under GDPR?
With a lawful basis, and, because health information is special category data, an additional Article 9 condition and appropriate safeguards. Record only what is necessary.