Vulnerable Customers: FCA FG21/1 and the Consumer Duty

The FCA expects every regulated firm to understand vulnerability among its customers, train staff to recognise and respond to it, design products and services that take account of it, and monitor whether vulnerable customers get outcomes as good as other customers. The main guidance is FG21/1, now read alongside the Consumer Duty in PRIN 2A.

What is a vulnerable customer, according to the FCA?

The FCA defines a vulnerable customer as someone who, due to their personal circumstances, is especially susceptible to harm, particularly when a firm is not acting with appropriate levels of care. In FG21/1, it asks firms to think of vulnerability as a spectrum of risk. All customers are at risk of becoming vulnerable, and that risk increases with characteristics linked to four key drivers. The guidance suggests firms avoid using the label "vulnerable" with customers, and instead focus on the harm or disadvantage a customer may be vulnerable to and how the firm can respond.

The FCA stresses that not everyone with these characteristics will be vulnerable, but they may have additional or different needs that, if unmet, limit their ability to make decisions or represent their own interests.

What are the FCA's guidelines for vulnerable customers?

FG21/1, published on 23 February 2021 (see the FCA's FG21/1 page), is guidance under the Principles for Businesses. It is organised around four areas of action. The FCA's page was updated on 22 July 2026 with a note that the document refers to historical publications that pre-date the Consumer Duty, and directs firms to the Duty pages for current expectations on management information and outcomes.

1. Understand the needs of vulnerable customers. Know the nature and scale of characteristics of vulnerability in your target market and customer base, and how they affect the harms customers may suffer.
2. Ensure staff have the skills and capability. Train and support frontline staff to recognise and respond to vulnerability, including guidance on when to escalate.
3. Take practical action. Cover product and service design, customer service and communications. Offer multiple channels, make it easy to disclose needs, and keep communications comprehensible.
4. Monitor and evaluate. Assess where you have fallen short for vulnerable customers and review management information on outcomes.

FG21/1 also expects senior leaders to create and champion a culture that prioritises the fair treatment of vulnerable customers, and to make sure governance and processes support it. If you are applying for authorisation, the FCA's sample business plan separately asks how you will identify, and meet the needs of, customers in vulnerable circumstances. See our business plan guide.

How do the Consumer Duty and vulnerable customers fit together?

The Consumer Duty applies to new and existing open products from 31 July 2023 and to closed products from 31 July 2024, according to PS22/9. The FCA's Duty guidance, FG22/5, explains how the two sit together:

• The Duty raises the standard of care for all consumers, while FG21/1 sets out what firms should do so that customers in vulnerable circumstances experience outcomes as good as others. FG21/1 therefore remains relevant (FG22/5 paras 1.23 to 1.25).
• The Duty makes explicit reference to firms paying attention to the needs of customers with characteristics of vulnerability, and the FCA expects firms to identify when groups, including vulnerable customers, receive systematically poorer outcomes (paras 1.26 and 1.27).
• For product and service design, firms are not expected to track vulnerability customer by customer. They are expected to design for all groups in the target market, consider whether a feature could harm any group, encourage customers to share their needs, and support staff to spot signs of vulnerability (paras 6.27 to 6.29).

The rules that make this auditable are in PRIN 2A.9. Firms must regularly monitor outcomes for products, communications and customer support (PRIN 2A.9.8R). That monitoring must identify whether any group of retail customers is experiencing different outcomes from another group (PRIN 2A.9.10R), have processes to find root causes (PRIN 2A.9.11R), and lead to action where outcomes are poor (PRIN 2A.9.12R). The governing body must receive a report on those results and, at least annually, review and approve it and confirm whether it is satisfied the firm is complying with the Duty (PRIN 2A.8.3R to 2A.8.5R).

What does vulnerable customer reporting look like in practice?

PRIN 2A.9 does not name vulnerable customers specifically or prescribe a standalone vulnerability return. Its requirement to compare outcomes across customer groups is written generically, and it covers them. In practice firms build a vulnerability section into their consumer outcomes MI and board reporting. The FCA's good and poor practice publication from its 2025 review gives a view of what works:

• Define a good outcome for each product or service, including for customers with additional needs and at each stage of the journey.
• Use granular data that compares outcomes across customer groups. The FCA gives an example of a lender that found high automatic declines among customers with mobility needs and traced them to an auto-decisioning policy, which it then revised.
• Set escalation thresholds with a documented rationale, and escalate poor outcomes to senior leadership.
• Look beyond individual cases to whether one customer's problem points to a wider one.
• Check that actions worked by re-checking complaints or other indicators after changes.
• Hold outsourced activity to the same standard as in-house activity.

The same publication reports which data firms use: 79% used complaints data and 78% used staff feedback, while only 29% used referral and take-up rates of additional support, 36% used behavioural insights and 49% used feedback from vulnerable customers. A balanced set of measures is stronger than complaints data alone.

What did the FCA find in its 2025 review?

On 7 March 2025 the FCA published a review of firms' treatment of customers in vulnerable circumstances. It used a survey of 725 firms, outcomes-monitoring information requests to 29 firms across 12 markets, consumer research, and Financial Lives survey data. The headlines:

• Many firms had taken positive action and the Consumer Duty had driven a renewed focus, but areas for improvement remained, particularly products and services and outcomes monitoring.
• Financial Lives data does not yet show the progress seen at individual firms, and consumers with multiple characteristics of vulnerability may not consistently get outcomes as good as other consumers.
• The FCA is not revising FG21/1 or introducing new requirements. Stakeholders found the guidance useful and clear.

The good and poor practice document adds figures: 39% of firms had formal governance bodies or committees overseeing outcomes for these customers; 29% said they tested the impact of a product or service on customers with characteristics of vulnerability; and about four in ten consumers with characteristics of vulnerability had disclosed their circumstances to a provider, with only 19% saying their provider encouraged them to do so.

A practical checklist for firms

• Map vulnerability in your target market. Use the four drivers and your own data, then decide which characteristics are most likely and what harm they could cause.
• Make disclosure easy. Offer more than one channel, avoid forcing customers to repeat themselves, and record needs where staff will see them.
• Train and support frontline staff, including those in outsourced teams. Test competence, not just attendance.
• Test products and journeys against vulnerable customer scenarios, including digital-only journeys.
• Build MI. Report outcomes by customer group, with thresholds, owners and actions, and take it to the board.
• Review annually, in line with your Consumer Duty board report.

Consumer credit and collections teams should also apply the vulnerability thinking within the CONC rules. Our vulnerability assessment explainer and toolkit are practical aids.

How MEMA can help

MEMA helps firms embed vulnerability into governance, MI and customer journeys. Our vulnerability tool and Consumer Duty service are the best places to start.