FCA Finds Payments Firms Must Strengthen Vulnerable Customer Support Under Consumer Duty

Key Takeaways

• The FCA published good and poor practice findings from its review of payments and e-money firms' support for consumers in vulnerable circumstances under the Consumer Duty.
• No new rules are introduced, but the FCA expects firms to evidence that they understand customer needs, provide appropriate support, and deliver good outcomes, and it warns of supervisory intervention where expectations are not met.
• Compliance teams should use the findings to benchmark and close gaps now.

Deep Dive

The FCA published good and poor practice findings from its review of payments and e-money firms' support for consumers in vulnerable circumstances under the Consumer Duty. No new rules are introduced, but the FCA expects firms to evidence that they understand customer needs, provide appropriate support, and deliver good outcomes, and it warns of supervisory intervention where expectations are not met. Compliance teams should use the findings to benchmark and close gaps now.

The findings cover five areas:

(1) Identification and recording: strong firms understand the scale and nature of vulnerability in their customer base, embed identification across online and automated journeys, record flags consistently, and test their processes through call listening, complaints monitoring and quality assurance. Weak firms had policies and training they could not show working in practice, identified few or no vulnerable customers despite reasonable expectations, and relied heavily on staff judgment.

(2) Support: support should be tailored, flexible and consistent, such as assisted onboarding, multilingual service and callback options. Weaker firms could not link identified vulnerabilities to tailored actions or outcomes.

(3) Communications: firms should tailor and test communications. Weaker firms relied on standard communications and did not assess whether customers understood them.

(4) Governance, MI and outcomes monitoring: boards need regular, quality MI on vulnerability prevalence and outcomes, not only annual Duty reporting or anecdotal cases. (

5) Intermediary oversight: firms need visibility of outcomes for customers served through third parties, including training, MI, challenge and off-boarding where necessary.

No deadlines or implementation dates are set. The FCA expects firms to consider the findings now when assessing their own arrangements. It also expects compliance with the Duty and the existing guidance on fair treatment of vulnerable customers, including its four drivers of vulnerability (health, life events, financial resilience and capability). It will continue to engage with firms and will use its full range of supervisory tools where firms fall short. Smaller firms may take a proportionate approach, including qualitative MI, but must still show they understand customer needs and that boards have enough insight to oversee outcomes. Recording sensitive personal information must also comply with data protection requirements.

Recommended actions:
- Perform a gap analysis against each good practice and improvement area.
- Profile vulnerability in the customer base and test whether low identification rates are plausible.
- Reduce reliance on individual staff judgment through system flags, prompts and data-driven signals.
- Build assurance testing that shows policies work in practice.
- Define outcome metrics for vulnerable customers and enhance board MI beyond annual reporting.
- Review intermediary agreements, training, data sharing and monitoring.
- Confirm data protection controls around vulnerability data.
- Document the analysis and board challenge as evidence.

Firms face supervisory and enforcement exposure, potential remediation, complaints and reputational harm if they cannot evidence outcomes. Distribution models, digital-only providers, and firms with unusually low vulnerability identification are likely to attract the most scrutiny.

Source: Financial Conduct Authority