Skip to content
COSA
Book a demo

Vulnerable customers

Vulnerable customers, noticed on every call you monitor

COSA's vulnerability rules read each finished, in-scope call for signs across FG21/1's four drivers, quote the moment, assess whether the adviser adapted and send flags to your reviewers. Your people make the final call.
Book a demoExplore the platform
  • FG21/1 · vulnerable customers
  • PRIN 2A.6 · consumer support
  • Health · life events · resilience · capability

FG21/1

What the FCA means by a vulnerable customer

The FCA's guidance for firms on the fair treatment of vulnerable customers, FG21/1, defines a vulnerable customer as someone who, due to their personal circumstances, is especially susceptible to harm, particularly when a firm is not acting with appropriate levels of care. It groups the drivers of vulnerability into four areas.

  1. 01

    Health

    Examples in FG21/1

    Physical disability; severe or long-term illness; hearing or visual impairment; mental health conditions; addiction; low mental capacity or cognitive disability.

  2. 02

    Life events

    Examples in FG21/1

    Bereavement; relationship breakdown; retirement; income shock; caring responsibilities; domestic abuse, including economic control.

  3. 03

    Resilience

    Examples in FG21/1

    Inadequate or erratic income; over-indebtedness; low savings; low emotional resilience.

  4. 04

    Capability

    Examples in FG21/1

    Low knowledge or confidence in managing finances; poor literacy or numeracy; poor English language skills; poor digital skills; learning difficulties; no or low access to help or support.

Vulnerability is about circumstances, not a type of person. A customer can be affected by more than one driver, and the FCA has described vulnerability as something that can be temporary, sporadic or permanent.

FG21/1's four drivers, and how each sounds on a call

Why calls

Calls are where vulnerability shows up

Most vulnerable customers never say the word. Signs surface in passing: a bereavement mentioned halfway through a fact find, a hesitation over numbers, a relative answering on someone's behalf.

  1. 01

    Most customers don't tell you

    In consumer research the FCA published with its 2025 review, only about 4 in 10 customers in vulnerable circumstances had told a financial services provider about their circumstances. FG21/1 says staff should encourage disclosure where they see clear indicators of vulnerability.

  2. 02

    The cues are in the conversation

    Signs FG21/1 suggests staff look out for include “shortness of breath or signs of agitation, asking for repetition, signs that the consumer has not understood or signs of confusion, mention of medication”. Keyword lists miss signals expressed indirectly, and flag harmless ones such as answers to a lender's health questions.

  3. 03

    A sample hears a fraction

    Signs are spotted only on the calls someone happens to hear. Compare Retirement moved from manually sampling around 26% of calls to oversight of every client interaction.

How COSA helps

How COSA's vulnerability rules work

COSA assesses finished calls against the rules your compliance team writes. Vulnerability detection is one of those rule types.

Vulnerability detection

Signs across all four drivers, judged in context

You choose the call types a vulnerability rule applies to. On each in-scope call, COSA reads the whole conversation for signs of health, life-event, resilience or capability vulnerability, and assesses whether the adviser noticed and adapted.
  • Bereavement, illness, difficulty understanding, or someone answering for the client
  • Signs judged in context, not by keyword
  • Whether the adviser adapted — pace, support, involving others

Vulnerability signals

FG21/1 drivers
  • Health“I get muddled with numbers since my stroke.”
  • Life events“Since my husband passed in March…”
  • Resilience“We're behind on a couple of bills.”
  • CapabilitySon answering questions on his mother's behalf
Each signal is judged in context — including whether the adviser noticed and adapted. Answers to a lender's health questionnaire aren't treated as signs on their own.

Evidence and alerts

Every flag shows its working

Each verdict — Passed, Needs review or Failed — comes with a written explanation, the quoted evidence from the transcript and a confidence level, with the call recording on the same page. Flags go to your review queue.
  • The customer's words, quoted, beside the reasoning
  • Alert triggers for vulnerability rules, for every adviser or named ones
  • When a rule fails, an email with the passage, a summary and recommended next steps

Detailed rule results

9/12 passed
  • Call recording disclosure givenPassed
  • Vulnerability identified and handled2 EvidenceNeeds review

    The client disclosed a recent bereavement. The adviser acknowledged it but continued without checking they were comfortable to proceed or offering to involve a family member.

    I've not slept properly since my husband passed in March.

    Client · 05:26 · Fact Find, 24 Sep 2026

    Confidence
    High
  • Interest roll-up explainedPassed
  • Independent legal advice recommendedFailed

Reviewer decisions

Your reviewers make the final call

Authorised reviewers can override any result. The original verdict is kept for audit, and automatic re-runs never replace a reviewer's decision, so the record shows both what COSA found and what your people decided.
Assessments
1,284
last 30 days
Compliance rate
91%
↗ 4 pp vs prior
Needs review
37
3% of calls

1 result on this check was manually overridden by an authorised reviewer. The original verdict is retained for audit purposes.

Client Pack · Margaret Hughes

Every report, transcript and summary in one ZIP

Prepare pack
  • compliance/
  • transcriptions/
  • summaries/

MI

Call evidence for your outcomes monitoring

In its 2025 review, the FCA found that most firms were unable to effectively monitor outcomes for customers in vulnerable circumstances. COSA adds the call evidence: vulnerability flags sit in the same MI as your other rules, with compliance rate, results by call type and by adviser, and the most-failed rules. Call results show how calls were handled, not the outcome on their own: comparing outcomes for these customers with everyone else's also needs your wider outcome data.
Ask the COSA Assistant about a client's calls

Assessments over time

WeekMonth
PassedNeeds reviewFailed

Outcomes by agent

  • James Porter88%
  • Priya Shah81%
  • Tom Fielding72%

Judgement

Why people, not models, make the final call

AI can read every in-scope call for signals, so nothing relies on someone happening to hear the right one. What it shouldn't do is decide what support a customer needs. That judgement, and the conversation that follows, belongs to your people.

In its March 2025 good and poor practice page, Delivering good outcomes for customers in vulnerable circumstances, the FCA described one firm using an AI tool to review call recordings for mentions of potential characteristics of vulnerability, with management then reviewing those cases to check that appropriate support had been provided. That is one firm's approach, not a requirement.

COSA's assessments support professional compliance review; they aren't regulatory advice or a compliance decision.

FAQ

What firms ask about vulnerability monitoring

What are the four drivers of vulnerability?

The FCA's guidance FG21/1 groups them as health, life events, resilience and capability. A customer can be affected by more than one, and the FCA has described vulnerability as something that can be temporary, sporadic or permanent.

Do firms have to use software to identify vulnerable customers?

No. In FS21/4, its feedback statement on FG21/1, the FCA said firms are not required to use data analytics to identify vulnerability proactively, other than where existing rules already require it. FG21/1 says staff should be able to recognise and respond to needs where a customer has told the firm, where there are clear indicators of vulnerability, or where relevant information is on the customer's file, and should encourage disclosure where they see clear indicators.

How does COSA identify vulnerable customers on calls?

Vulnerability detection is one of COSA's rule types. On each in-scope call, it reads the whole conversation for signs of health, life-event, resilience or capability vulnerability, assesses whether the adviser noticed and adapted, and gives a verdict of Passed, Needs review or Failed, with a written explanation, the quoted evidence and a confidence level.

Does COSA decide whether a customer is vulnerable?

No. It flags signs and assesses the adviser's response for a person to review, and deciding what support a customer needs stays with your people. Authorised reviewers can override any result; the original verdict is kept for audit, and automatic re-runs never replace a reviewer's decision.

Does COSA listen to live calls?

No. COSA assesses calls after they finish: they arrive from your dialler when they end, or are uploaded from any recording system. It never joins or interrupts an adviser's call, so it supports review and follow-up rather than prompting advisers in real time.

See how COSA would flag vulnerability on your calls

In a 30-minute walkthrough we'll show you how COSA's vulnerability rules would assess calls like yours, and what your reviewers would see.

Book your demoCalculate your ROI
  • Tailored to your call types
  • No obligation
  • Reply within 24 hours