For many financial institutions, consumer vulnerability has traditionally been viewed as a Treating Customers Fairly (TCF) consideration or a matter relevant to complaints handling and customer service. However, as the financial sector continues to prepare for the implementation of the Conduct of Financial Institutions (COFI) framework, organisations may need to rethink that approach.
The Financial Sector Conduct Authority’s (FSCA) Statement on Consumer Vulnerability, published in 2024, highlighted the importance of understanding the circumstances that may place customers at greater risk of financial harm. While the publication was positioned as an awareness and policy discussion document, it provided an important indication of the direction in which market conduct regulation is moving.
What has become increasingly clear since then is that consumer vulnerability is not a standalone regulatory topic. It is closely connected to the outcomes-based philosophy underpinning COFI.
Under an outcomes-focused regulatory environment, firms will increasingly be expected to demonstrate not only that policies, processes and disclosures exist, but that customers are achieving fair outcomes in practice. This requires organisations to recognise that not all customers have the same needs, capabilities, financial resilience or ability to engage with financial products and services.
The FSCA’s 2026 Regulatory Actions Report provides a useful indication of how regulatory thinking is developing. The report identifies misconduct affecting vulnerable consumers as an area receiving specific enforcement attention. It further confirms that cases with the greatest impact on financial customers, particularly those involving vulnerable individuals, continue to be prioritised by the regulator.
Importantly, the report links increasing levels of financial distress, high unemployment, lower levels of financial literacy and the cost-of-living crisis to greater consumer vulnerability and increased exposure to fraud and financial harm. The FSCA’s focus on online scams, misrepresentation, misleading marketing practices and unauthorised financial services further demonstrates how vulnerable consumers may be disproportionately affected when firms fail to place customer outcomes at the centre of their conduct frameworks.
For firms preparing for COFI, vulnerability should therefore not be viewed merely as a compliance exercise. It should be considered across the entire customer journey.
What could this look like in practice?
Consider a policyholder who recently lost a spouse and needs to submit a life insurance claim. From a traditional compliance perspective, the insurer may be able to demonstrate that all required disclosures were provided, the necessary claim forms were supplied, and the claim was processed in accordance with documented procedures.
However, an outcomes-based approach requires a broader consideration of the customer’s circumstances. The customer may be dealing with emotional strain, reduced financial resilience, unfamiliarity with insurance processes and an urgent need for funds. In these circumstances, fair customer outcomes may depend not only on the technical accuracy of the process, but also on factors such as the clarity of communication, the level of support provided, the ease of submitting documentation and the timeliness of claim decisions.
The same principle applies across the financial sector. A customer facing retrenchment, a small business experiencing financial distress, an elderly client with limited digital skills or a consumer targeted by sophisticated online scams may all require additional support to achieve outcomes comparable to those of other customers. The ability to recognise and appropriately respond to these situations is becoming an increasingly important conduct consideration and aligns closely with the outcomes-focused principles that underpin COFI.
Identifying vulnerability throughout the customer journey
One of the challenges financial institutions face is that vulnerability is not always visible. Customers do not typically disclose that they are vulnerable, and in many cases they may not consider themselves vulnerable at all. Vulnerability often emerges through interactions with customers and may change over time as their circumstances change.
For this reason, firms should consider incorporating vulnerability awareness into staff training, customer engagement processes and monitoring activities across the customer lifecycle.
While the indicators will differ between organisations, staff should be trained to recognise potential signs of vulnerability such as:
- A customer repeatedly expressing confusion about information or processes.
- Difficulty understanding product features, risks or documentation.
- Significant life events such as bereavement, divorce, illness, disability or retrenchment.
- Indications of financial distress or an inability to meet financial commitments.
- Reluctance to engage through digital channels due to limited digital literacy.
- Evidence that a customer may be particularly susceptible to scams, fraud or financial abuse.
- Customers who become unusually distressed during claims, complaints or collections processes.
- Repeated requests for assistance to complete forms, understand communications or navigate digital platforms.
Importantly, the purpose is not to label customers, but rather to identify situations where additional support may be required to achieve fair outcomes.
Once potential vulnerability has been identified, staff should understand how and when to activate the organisation’s vulnerable customer process or standard operating procedure (SOP). This may include escalating the matter to a specialist team, adapting communication methods, providing additional explanations, increasing oversight of the interaction, extending reasonable timeframes or introducing accommodations that better support the customer’s circumstances.
Under COFI, the question may not be whether a vulnerable customer process exists on paper. The question is whether frontline staff can consistently recognise vulnerability, know when to activate the process and provide appropriate support that results in fair customer outcomes.
Questions firms should be asking
Boards and management teams should consider whether they can confidently answer questions such as:
- Can we identify customers who may be vulnerable?
- Do our staff understand how to recognise signs of vulnerability?
- Are our products designed with the needs of different customer groups in mind?
- Do our communication methods support customers with varying levels of financial and digital literacy?
- Are vulnerable customers receiving appropriate support during key life events such as bereavement, illness, retrenchment or financial hardship?
- Is vulnerability considered when handling complaints, claims and customer exits?
- Can we demonstrate that vulnerable customers are achieving outcomes comparable to those of the broader customer base?
- What management information is provided to the board regarding vulnerable customer outcomes?
- How do we test whether our vulnerable customer framework is working in practice?
These are no longer purely customer service questions. Increasingly, they are governance, product oversight, distribution, claims, complaints, operational and risk management questions.
In many respects, consumer vulnerability provides one of the clearest practical examples of what an outcomes-based regulatory framework looks like. A firm may have fully documented policies, technically compliant disclosures and well-designed processes, but if vulnerable customers consistently experience poorer outcomes, the regulator may legitimately question whether the firm’s conduct framework is achieving its intended purpose.
For many firms, the greatest test of customer outcomes will not occur during a sales process. It will occur when customers are experiencing a significant life event, financial hardship or personal crisis and need the organisation’s products, services and support the most.
While the FSCA has not yet introduced a dedicated Conduct Standard dealing specifically with consumer vulnerability, the direction of travel is becoming increasingly apparent. Financial institutions that begin embedding vulnerability considerations into their governance structures, product design processes, customer interactions, staff training programmes and monitoring frameworks today are likely to be better positioned for the expectations that COFI will bring.
Ultimately, the question is no longer whether vulnerable consumers exist within a firm’s customer base. The more important question is whether the firm can identify them, support them appropriately and demonstrate that they are receiving fair outcomes. Under COFI, that distinction may become increasingly important.