What the FCA Is Expecting to See — and Where Firms Still Fall Short
Vulnerability has been a regulatory priority for several years, but in 2026 the FCA’s expectations are sharper and far less forgiving. Firms are no longer judged on whether they have a vulnerability policy, but on whether vulnerable customers actually experience better outcomes as a result of it.
For the Financial Conduct Authority (FCA), vulnerability is now a live conduct risk indicator. How firms identify, support and monitor vulnerable customers is increasingly used as a proxy for the strength of their Consumer Duty culture particularly in consumer credit, where financial pressure and life events often overlap.
Why vulnerability remains front and centre
Consumer credit firms deal with customers at moments of financial stress. That makes vulnerability more common, more fluid and more difficult to define than in many other sectors. The FCA recognises this, but it also expects firms to respond accordingly.
Economic pressure, rising living costs and post-Christmas financial strain have all increased the likelihood that customers will move in and out of vulnerability. In January especially, firms often see vulnerability emerge quickly through missed payments, contact with collections teams or complaints.
From the FCA’s perspective, this is not exceptional. It is foreseeable and therefore something firms must be prepared for.
From static definitions to dynamic identification
One of the FCA’s clearest messages is that vulnerability cannot be treated as a static category. Customers do not neatly self-identify, and many will never explicitly disclose their circumstances.
Supervisors are increasingly challenging firms that rely too heavily on disclosure or narrow vulnerability flags. Instead, they expect firms to use a broader range of indicators, including changes in behaviour, payment patterns, contact frequency and tone of customer communications.
This is particularly important in digital journeys and collections, where early signs of distress are often visible before any formal declaration is made. Firms that fail to recognise these signals risk providing inappropriate responses — and poor outcomes.
Vulnerability and Consumer Duty outcomes
Under Consumer Duty, vulnerability cuts across all four outcomes. Fair value must still apply. Communications must remain clear and accessible. Products must perform as expected. And customer support must adapt to individual needs.
The FCA is increasingly testing whether firms can demonstrate this in practice. That means showing how vulnerable customers are treated differently, how support is tailored, and how outcomes are monitored over time.
Generic assurances that “vulnerable customers receive extra care” are no longer sufficient. Supervisors want to see evidence: MI, case reviews, outcomes analysis and examples of learning.
Where firms continue to struggle
Despite widespread awareness, the FCA continues to see similar weaknesses across the market.
One common issue is inconsistency. Vulnerability frameworks may work well in one area of the business but fail elsewhere. A customer identified as vulnerable in collections may receive a very different experience when interacting through digital channels or complaints.
Another recurring problem is lack of empowerment. Frontline staff may recognise vulnerability but lack the authority, training or confidence to act. Where escalation routes are unclear or rigid, opportunities to support customers are missed.
The FCA is also concerned where firms treat vulnerability as a compliance obligation rather than a conduct issue. In those cases, processes exist but outcomes do not improve.
Distribution chains and vulnerability risk
Vulnerability risk does not stop at the firm’s front door. Distribution chains play a significant role in shaping customer outcomes.
Brokers, introducers and affiliates may engage customers at moments of heightened stress, particularly where credit is marketed as a solution to short-term financial difficulty. The FCA expects firms to understand how vulnerability is addressed — or ignored — across these channels.
Where vulnerable customers are disproportionately represented in complaints, arrears or remediation linked to particular introducers, firms are expected to intervene. Failure to do so is increasingly viewed as a governance failure.
Governance, MI and Board oversight
As with other Consumer Duty priorities, vulnerability is now firmly a governance issue. The FCA expects Boards to have visibility over how vulnerable customers are identified, supported and monitored.
That requires meaningful MI, not just headline statistics. Firms should be able to explain trends, differences by product or channel, and what actions have been taken in response. Where vulnerability-related issues recur, Boards are expected to challenge and drive change.
In supervision, the FCA increasingly tests this by asking not only what the firm’s framework says, but what the Board has actually done with the information it receives.
What good looks like in 2026
Firms that manage vulnerability well take a proactive, joined-up approach. They recognise vulnerability early, empower staff to act, adapt communications and support, and monitor outcomes over time.
Crucially, they treat vulnerability as part of the customer journey, not a separate process. Insights from collections, complaints and customer contact are fed back into product design, underwriting and distribution decisions.
This aligns closely with the FCA’s broader message: good outcomes for vulnerable customers are a core test of whether Consumer Duty is working.
How ALPH supports firms on vulnerability and Consumer Duty
ALPH Legal & Compliance supports consumer credit firms in reviewing and strengthening vulnerability frameworks, from identification and training through to MI, governance and outcomes testing. We help firms move beyond policy to practice — and to evidence that practice to the FCA.
In 2026, vulnerability is no longer a secondary consideration. It is central to how the FCA judges firms. Those who take it seriously, and embed it properly, will be far better placed to meet regulatory expectations and protect customers.