The FCA's drivers of vulnerability: a practical guide

The FCA's four drivers of vulnerability are poor health, negative life events, low resilience and low capability. They describe the circumstances that raise the risk that a customer will be harmed, and the FCA expects firms to show how they treat vulnerable customers fairly. The drivers are a classification lens for your data, your journeys and your fair value work, not a box to tick at onboarding. For the four outcomes in general, see our FCA Consumer Duty overview.

Where the four drivers come from

The FCA's guidance on the fair treatment of vulnerable customers describes four characteristics that increase the risk of a customer becoming vulnerable:

• Health: poor health, such as cognitive impairment.
• Life events: events such as new caring responsibilities.
• Resilience: a low ability to cope with financial or emotional shocks.
• Capability: low capability, such as poor literacy or numeracy skills.

The FCA's later reviews use the same four, and refer to them as "the 4 drivers of vulnerability". The FCA's 2025 review of vulnerability work draws on Financial Lives survey data for the same set of drivers.

That guidance is not a rule in PRIN 2A. The obligations sit in the rules. Under PRIN 2A.4.8R, firms assessing fair value must consider the characteristics of vulnerability among the target market and their effect on the likelihood of not receiving fair value. Under PRIN 2A.6.2R, customer support must be designed and delivered to meet customer needs, including vulnerability, and to avoid unreasonable barriers. That is why the drivers appear in product governance and in customer support, not only in a vulnerability policy.

What the FCA found about identification

Most of the FCA's findings on vulnerability are about the front end: whether firms identify customers and whether customers tell them. The FCA's 2025 review of delivering good outcomes for customers in vulnerable circumstances drew on a multiple-choice survey of 725 firms, outcomes monitoring work with 29 firms, and consumer research with 1500 consumers.

Identification and disclosure were the hardest parts. The FCA reports that only 4 in 10 consumers with vulnerability characteristics had disclosed them to any provider. Some call handlers did not check what the firm already held, so customers had to repeat themselves. Legacy and fragmented systems caused delays and repeated document requests.

The gaps on the firm side are just as telling. Only 39% of firms had formal governance bodies overseeing outcomes for these customers, and only 29% said they tested the impact a product or service has on customers with characteristics of vulnerability. A firm that identifies almost no vulnerable customers should treat that as a question to answer, not as evidence of low risk.

Using the drivers in your data

The drivers only help if they reach the MI. Record a driver where it is identified, not as a single yes or no flag, so that you can tell which kind of customer is being harmed. In its outcomes monitoring review, the FCA found that vulnerability MI was often aggregated rather than broken down by drivers such as health, financial resilience or life events.

The table below is a starting point for your own fields. The signals are examples for designing MI, not findings from the FCA.

The FCA's good practice examples show what this looks like in use. One firm used real-time speech analytics to prompt frontline staff when a customer mentioned a possible vulnerability characteristic. Another used AI to review call recordings, with management checks and coaching where support fell short. A bank made check-in calls every three weeks with the same member of staff, which built customer trust.

What the 2026 payments review adds

The FCA's 2026 review of payments firms says that around half of UK adults show "at least 1 characteristic of vulnerability". Its findings are a useful check on how the drivers are used in practice. Some firms had policies and training in place but were not always able to show how these worked in practice. Some firms identified very few or no customers in vulnerable circumstances, despite customer bases where vulnerability could be expected. Communications were often standard, with limited tailoring or testing.

The payments review also records positive practice. Firms that understood the scale and nature of vulnerability in their customer base designed support around identified needs, and offered flexibility in time, channels and communication formats. The drivers are the vocabulary for that understanding. The outcomes side is covered in our guide to Consumer Duty outcomes testing.

Keep the requests proportionate

Asking more questions does not make a firm safer. PRIN 2A.6.3G says that barriers are unreasonable where they cause customers to take excess steps, such as burdensome or hard-to-understand processes, or requests for unnecessary information. Record what you need for the support you will give and no more. Where a customer has disclosed a driver, use the information to change how you deal with them rather than asking for it again.

How MEMA can help

MEMA Consultants helps firms map the four drivers into their processes, MI and product reviews, so that vulnerability is evidenced rather than asserted. Start with our Consumer Duty service. If you want a structured starting point, our vulnerability assessment guide sets out what to check first.