The FCA’s review urges payments firms to demonstrate how they identify vulnerable customers, tailor support and use data to improve outcomes under the Consumer Duty.
Payments are a fundamental part of the modern economy and of people’s day-to-day lives. If payments fail or funds cannot be accessed, customers in vulnerable circumstances may be disproportionately impacted. That is the starting point for the FCA’s recent review of how payments firms address vulnerable customers.
The FCA records that around half of UK adults show at least one ‘characteristic of vulnerability’ at any given time. The FCA’s approach is that any customer may be at risk of vulnerability at any time. It views vulnerability as having four underlying drivers: health, life events, resilience and capability. Where customers demonstrate ‘characteristics of vulnerability’ arising from these drivers, then firms are within reason and in a manner that is proportionate to their size and complexity, expected to act to identify and manage the heightened risk of poor outcomes for those customers.
The FCA’s evolving expectations in this area are particularly important for payments firms facing retail clients, not least because of the pace of technological change and the increasing use of agentic AI solutions. Whilst the review does not introduce new requirements, it does set out the FCA’s expectations. This will, in turn, inform the kinds of questions firms may be asked in supervisory interactions with the regulator and its enforcement priorities.
In summary, the review shows a shift in FCA focus from simply having a vulnerability framework to proving, through customer data, testing, and remedial action, that it delivers good outcomes.
FCA conclusions
The FCA concluded that firms that most closely adhered to its expectations understood vulnerability within their own customer base (rather than as an abstract concept). These firms had built identification of vulnerability into online and automated journeys, recorded it consistently and used management information (MI) to conduct ‘root cause’ analysis that allowed them to identify issues and make improvements. Good practice observed by the FCA also included online application questions about support needs (rather than asking customers directly about vulnerability, which might result in misleading responses), pilots of chat-analysis tools that route customers who may be in vulnerable circumstances to a human agent, multilingual support and tailored support for customers with issues understanding the English language or limited IT skills.
However, whilst some firms had policies and training, they were not always able to show that they worked in practice. Some identified very few, or no, vulnerable customers despite customer bases where vulnerability would reasonably be expected. Others relied heavily on individual staff judgements, used standard communications with little tailoring, gave their boards little meaningful MI beyond annual Consumer Duty reporting, or had limited visibility of customers served through intermediaries.
From the FCA’s perspective, a firm that has identified no vulnerable customers has not necessarily demonstrated the absence of such customers, but may instead have raised questions about its own processes.
Parallel changes to the scope of the Consumer Duty
The review sits alongside the FCA’s consultation paper CP26/23, which proposes changes to recalibrate the scope and proportionality of the Consumer Duty. Any new rules and guidance arising from this consultation are expected in Q1 2027. The consultation arose because the then Chancellor identified that the Consumer Duty might be operating too broadly, particularly affecting wholesale firms and stifling economic growth. The proposed new rules and guidance would focus on applying the Consumer Duty proportionately and only to firms that have a meaningful impact on retail customer outcomes.
For retail customer-facing payments firms, the Consumer Duty would continue to apply as usual, along with the FCA’s new expectations on vulnerability (identified above). The Consumer Duty consultation is clear that firms closest to the customer carry more direct responsibility for identifying and responding to individual needs. It also confirms that payments and e-money firms remain responsible for their agents and distributors under the Payment Services Regulations and Electronic Money Regulations.
The direction of travel
A recent freedom of information request illustrates the FCA’s direction of travel: FCA investigations arising from suspected Consumer Duty breaches increased from none in 2023/24, to one in 2024/25 and ten in 2025/26. Plainly, investigations arising from a breach of the Consumer Duty remain rare, but the FCA is now prepared to take action. That may reflect the regulator’s view that the Consumer Duty has been in place long enough for firms to understand and embed it.
The focus on vulnerability is also not confined to sectors of the market, like payments, where one would expect to consider characteristics of vulnerability in the customer base. For example, the FCA recently published its findings from a review of how the Consumer Duty is applied by UK contracts for difference (CFD) providers. Amongst other things, the review emphasised the need for CFD providers to embed vulnerability assessments in their onboarding processes and to understand the extent to which their target clients may have vulnerability characteristics.
Although good and poor practice publications, such as the FCA’s vulnerability review, do not create new rules, they do give firms a clear indication of the FCA’s direction of travel. This may in turn inform the kinds of questions raised during supervisory interactions and (in serious cases) decisions about bringing enforcement proceedings.
