Most vulnerable customers never say the word. Vulnerability surfaces in passing — a bereavement mentioned halfway through a fact find, a hesitation over numbers, a relative answering on someone's behalf. Whether it gets noticed depends on whether anyone was listening at that moment.
What FG21/1 means by a vulnerable customer
The FCA's guidance for firms on the fair treatment of vulnerable customers (FG21/1) defines a vulnerable customer as someone who, due to their personal circumstances, is especially susceptible to harm, particularly when a firm is not acting with appropriate levels of care.
Two points in that definition matter for advice firms. First, vulnerability is about circumstances, not a type of person. FG21/1 asks firms to think of it as a spectrum of risk that all customers are exposed to, and the FCA has described vulnerability as something that can be temporary, sporadic or permanent. Second, the harm depends on the firm: the same customer can get a good outcome from an adviser who notices and adapts, and a poor one from an adviser who doesn't. In the FCA's Financial Lives survey, 49% of UK adults (26.4 million) showed one or more characteristics of vulnerability in May 2024, so this is not an edge case. The wider framework is covered in our practical guide to the Consumer Duty for advice firms.
The four drivers — and how they sound on a call
| Driver | Examples in FG21/1 | How it can surface | What good handling sounds like |
|---|---|---|---|
| Health | Physical disability; severe or long-term illness; hearing or visual impairment; mental health conditions; addiction; low mental capacity or cognitive disability. | "I get muddled with numbers since my stroke." Repeated requests to go back over a point. Tiredness late in a long call. | Slowing down, breaking information into smaller pieces, offering a written summary or a second call, checking understanding. |
| Life events | Bereavement; relationship breakdown; retirement; income shock; caring responsibilities; domestic abuse, including economic control. | "I've not slept properly since my husband passed in March." A decision being made in a hurry after a change in circumstances. | Acknowledging it, checking the customer is comfortable to continue, and not letting the timetable be driven by the event. |
| Resilience | Inadequate or erratic income; over-indebtedness; low savings; low emotional resilience. | "We're behind on a couple of bills." Anxiety about a payment date. No savings buffer. | Exploring affordability properly, signposting free debt help such as MoneyHelper where relevant, and taking pressure off the decision. |
| Capability | Low knowledge or confidence in managing finances; poor literacy or numeracy; poor English language skills; poor digital skills; learning difficulties; no or low access to help or support. | A son answering questions on his mother's behalf. "I don't really understand these things — you decide." | Plain language, confirming who is making the decision (and on what authority), and checking understanding in the customer's own words. |
FG21/1 also lists cues staff could look out for, all of which can come through on a call: "shortness of breath or signs of agitation, asking for repetition, signs that the consumer has not understood or signs of confusion, mention of medication".
Why keyword spotting isn't enough
It is tempting to search transcripts for words like "died", "hospital" or "debt". In practice, keyword lists fail in both directions:
- They miss real signals. Vulnerability is often expressed indirectly — "it's been a hard year", "my daughter usually deals with this" — or shows up as behaviour, such as repeatedly asking for figures to be explained again.
- They flag harmless ones. Answers to a lender's health and lifestyle questions, asked to qualify for enhanced terms, are part of the process and aren't a sign of vulnerability on their own. "My father passed the business to me" is not a bereavement.
- They say nothing about the response. The most important question is not whether a signal appeared, but whether the adviser noticed and adapted.
That is why effective monitoring reads the whole conversation: the signal in context, and what happened next.
What good evidence looks like
For each vulnerability signal, a defensible record answers three questions:
- What was said? The customer's words, quoted, with where they came in the call.
- How did the adviser respond? Did they acknowledge it, adjust the pace, check the customer was comfortable to continue, offer to involve someone they trust, or follow up in writing?
- What happened next? The support or adjustment put in place, and the outcome.
Aggregated, those records become the MI the Consumer Duty expects: how often signs of vulnerability appear, how consistently they are handled, and whether outcomes for those customers match everyone else's. Our guide to compliance MI for boards covers how to present it.
What the FCA's 2025 review of vulnerable customers found
On 7 March 2025 the FCA published its review of firms' treatment of customers in vulnerable circumstances, with a companion page of good practice and areas for improvement, Delivering good outcomes for customers in vulnerable circumstances. The review set out findings and examples rather than new rules, and the FCA concluded that FG21/1 remains appropriate and helpful alongside the Consumer Duty, so it is not updating the guidance. These are the findings most relevant to firms that advise by phone:
- Area for improvement: monitoring outcomes. The FCA found that most firms were unable to effectively monitor outcomes for customers in vulnerable circumstances.
- Area for improvement: process data in place of outcome data. Firms often monitored the outputs of processes, such as call metrics, the time taken to transfer funds in bereavement cases and staff training records, and some looked only at readily available data such as whether staff followed call-handling procedures. The FCA said "this alone may not give a full understanding of the outcomes for customers in vulnerable circumstances".
- Area for improvement: governance. Only 39% of firms had formal governance bodies or committees that oversee and influence outcomes for customers in vulnerable circumstances.
- Good practice: call QA in governance MI. One mortgage intermediary's management dashboards, reviewed at monthly and quarterly governance meetings, included telephone call and appointment quality assurance data, and post-application QA reviews of whether the support needs of customers with characteristics of vulnerability had been met, alongside customer feedback, complaints data and staff training results.
- Good practice: technology with a person checking the response. On the same good-practice page, the FCA described one firm whose real-time speech analytics prompted frontline staff when a customer said a word or phrase that could indicate a potential characteristic of vulnerability, and another that used an AI tool to review call recordings for mentions of potential characteristics of vulnerability. Management then reviewed those cases to check that appropriate support had been provided and, where it had not, the firm contacted the customer and coached the call handler. These are individual firms' approaches, not requirements: in FS21/4, its feedback statement on FG21/1, the FCA said firms are not required to use data analytics to identify vulnerability proactively, other than where existing rules already require it.
- The customer's view. FCA survey data showed that 44% of customers in vulnerable circumstances reported a negative experience with a financial services firm, against 33% of other customers. Only about 4 in 10 had told any of their financial services providers about their circumstances. Of those who had, 74% said staff asked the right questions to understand their situation, and 58% said their firm took action to provide the support they needed.
The FCA has kept returning to the theme. In September 2026 it published a similar review of payments firms, which found that some firms could not always show how their vulnerability policies and training were working in practice, and in some cases had limited testing or assurance of how effectively policies were being implemented. That review is specific to payments firms, but it shows the FCA checking whether policies work, not just whether they exist.
What this means for call monitoring
Counting flags, calls reviewed or training completed describes the process, not the outcome. Call evidence starts to show outcomes when each flag records how the adviser responded and what happened next (the three questions above), and when results for customers with characteristics of vulnerability can be compared with other customers'. The Consumer Duty's monitoring rules in PRIN 2A.9 require monitoring that lets a firm identify whether any group of retail customers is getting different outcomes from another group of customers of the same product. Because, in the FCA's consumer research, most customers in vulnerable circumstances had not told any of their providers, that evidence depends on advisers picking up signals customers never label as vulnerability, and on someone checking the response. Our guides to Consumer Duty outcomes monitoring and the consumer support outcome cover the wider framework, and Consumer Duty board reports covers taking the evidence to governance.
Where AI helps — and where people must decide
AI changes the economics of listening. Instead of hoping a sample happens to include the call where a bereavement was mentioned, every in-scope call can be read for signals across all four drivers, with the quote attached and an assessment of whether the adviser responded appropriately. Flags go to a person for review.
What AI shouldn't do is decide what support a customer needs. That judgement — and the conversation that follows — belongs to your people. A good system makes it easy for them: the evidence in one place, the ability to agree or override, and a record of the decision.
A practical workflow
- Make vulnerability a rule on every call type, not just fact finds. Signals appear on follow-ups and short calls too. For equity release, this compliance checklist for every fact find shows where the vulnerability checks sit.
- Assess every in-scope call so nothing depends on sampling.
- Review flags quickly — ideally within a day — while there's still time to follow up.
- Record the adjustment: a slower second call, a written summary, a family member involved with the customer's agreement.
- Report trends: signals per hundred calls by driver, handling rates, and outcomes compared with other customers.
- Coach with real examples: the quoted moment and what good would have sounded like.
COSA's vulnerability detection rules listen for signs across all four drivers on every in-scope call, with the quoted evidence and a written explanation behind each flag for a person to review. See how COSA handles vulnerable customers and how it supports the Consumer Duty, or ask the COSA Assistant "Were there any signs of vulnerability?" and hear the moment it came from.
This article is general information, not legal or regulatory advice.
