FCA Vulnerable Customers: What Firms Must Do

The FCA's definition is one sentence: "A vulnerable customer is someone who, due to their personal circumstances, is especially susceptible to harm - particularly when a firm is not acting with appropriate levels of care."

That definition sits in FG21/1, the finalised guidance on the fair treatment of vulnerable customers, and it applies to your firm whatever its size. The FCA is explicit: "our Guidance is relevant to firms serving retail customers, including some business customers, regardless of the firm's size or sector." A two-adviser IFA is as much in scope as a national network.

This guide covers what the FCA actually expects, the distinction that most summaries skip — the guidance is not binding, the Principles behind it are — and what a proportionate approach looks like at a small firm.

The distinction that changes how you read all of this

FG21/1 is guidance, not rules. The FCA states the position directly: "While firms are not bound to adopt or follow any of the specific actions described in this Guidance, they must meet the standards set by our Principles and treat customers fairly."

Read that carefully, because it cuts both ways.

The comfortable half is that you do not have to implement every example in a 57-page document written with larger firms in mind. There is no checklist you can be marked against line by line.

The uncomfortable half is that you cannot discharge the obligation by adopting a policy either. The binding standard is the outcome — fair treatment under the Principles — and the guidance is the FCA telling you, in advance and in detail, what it thinks getting there looks like. A firm that ignores the guidance and achieves poor outcomes has no defence in the fact that the guidance was not binding.

In practice this means a small firm should treat FG21/1 as the map rather than the exam. Do the things that make sense at your scale, be able to say why you did them, and be able to show the outcome.

The four drivers of vulnerability

The FCA frames vulnerability as a spectrum rather than a category: "Firms should think about vulnerability as a spectrum of risk. All customers are at risk of becoming vulnerable and this risk is increased by characteristics of vulnerability related to 4 key drivers."

Those characteristics sit under four drivers. The FCA's own summary describes them as "poor health, such as cognitive impairment, life events such as new caring responsibilities, low resilience to cope with financial or emotional shocks and low capability, such as poor literacy or numeracy skills."

Driver	What it looks like in a client file
Health	Cognitive impairment, a serious diagnosis, a condition affecting day-to-day tasks, mental-health conditions affecting decision-making
Life events	Bereavement, divorce, job loss, new caring responsibilities, retirement itself
Resilience	Low ability to absorb a financial or emotional shock — thin savings, high fixed commitments, sole income
Capability	Low financial knowledge or confidence, and low capability in adjacent areas such as literacy, numeracy or digital skills

FG21/1 puts life events plainly: "Life events – life events such as bereavement, job loss or relationship breakdown."

For a retail advice firm, the significance of this framing is that vulnerability is not a small subset of your client bank. Retirement is a life event. Bereavement drives a large share of the reasons people seek advice at all. A firm whose vulnerable-client register has two names on it out of two hundred has almost certainly not been looking properly.

A dated figure, dated deliberately: the FCA's page cites its Financial Lives coronavirus panel survey from October 2020, which "demonstrates that more consumers find themselves in vulnerable circumstances due to the pandemic, with 53% of adults displaying a characteristic of vulnerability." That is a pandemic-era measurement and should not be quoted as today's number — but as an order of magnitude it makes the point that this is a majority-adjacent population, not an edge case.

The four actions the FCA expects

The regulator sets out what firms should do to achieve good outcomes for vulnerable customers:

"understand the needs of their target market/customer base"
"make sure staff have the right skills and capability to recognise and respond to the needs of vulnerable customers"
"respond to customer needs throughout product design, flexible customer service provision and communications"
"monitor and assess whether they are meeting and responding to the needs of customers with characteristics of vulnerability, and make improvements where this is not happening"

Here is what each looks like at a firm of three to fifteen people, without pretending you have a vulnerability team.

1. Understand your customer base

Not the general population — yours. If you advise on decumulation, your client base skews toward health and life-event drivers. If you do mortgages for first-time buyers, resilience and capability dominate. Write down the two or three drivers that are actually likely in your book and why. Half a page, reviewed annually, beats a generic list of every possible characteristic.

2. Skills and capability of staff

This is a training obligation, and it interlocks with the wider competence framework rather than sitting apart from it — our guide to the FCA's training and competence requirements covers the machinery. What is specific here is recognition: staff need to be able to notice a characteristic in a conversation and know what to do next.

The most useful thing a small firm can produce is not a course certificate. It is an agreed, written answer to "what do we do when we notice?" — who gets told, what gets recorded, what changes about how we deal with that client, and who reviews it.

3. Practical action

Product design is usually not in scope for a small advice firm. Communications and service flexibility are, and that is where the work is:

Communications: can a client get your suitability report in large print, or by post, or read to them? Do your standard letters assume digital access?
Flexibility: can someone have a longer appointment, bring a family member, or take a decision away and return to it?
Third parties: do you have a workable process for a power of attorney or a trusted person, and does your file record consent properly?
Recording: the adjustment you made needs to be on the file. An adjustment nobody recorded is, on review, an adjustment that did not happen.

4. Monitoring and evaluation

This is the action small firms most often skip, and the one the FCA singled out for attention when, in March 2025, it "published findings from our review of firms' treatment of customers in vulnerable circumstances, as well as good practice and areas for improvement to support firms in delivering good outcomes for customers."

Proportionate monitoring at a small firm is a small number of honest questions asked annually: how many clients did we identify as having a characteristic of vulnerability, what did we do differently for them, did any of them complain, and did their outcomes look like everyone else's? Build it into the compliance monitoring plan rather than running it as a separate exercise.

How this connects to the Consumer Duty

FG21/1 predates the Consumer Duty, and the FCA has flagged this on the guidance page itself: "July 2026 update: FG21/1 includes references to historical publications which pre-date the Duty. See our Consumer Duty pages for our latest expectations on use of management information and guidance on delivering good outcomes for retail customers."

The practical reading is that the vulnerability guidance is still the reference for who is vulnerable and what to do, while the Duty sets the outcome standard and the expectations around management information. They are not two programmes. In particular:

The Duty's consumer understanding outcome and the vulnerability guidance's communications actions are the same work.
The Duty's consumer support outcome and the guidance's service-flexibility actions are the same work.
The Duty's annual board report is the natural home for the monitoring under action 4.

Our Consumer Duty guide sets out the four outcomes and three cross-cutting rules the Duty runs on.

And how it connects to the conduct rules

The FCA's guide for solo-regulated firms states individual conduct rule 4 as "You must pay due regard to the interests of customers and treat them fairly". Individual conduct rule 6 was added by the Consumer Duty, and FG22/5 explains it at paragraph 10.22: it "reflects the new, higher standard of the Duty, and the behaviour we expect of all conduct staff. It requires all conduct rules staff to 'act to deliver good outcomes for retail customers' where the activities of the firm fall within the scope of the Duty." Vulnerability is where those rules stop being abstract — the same interaction that would be fine with a resilient, financially confident client can fall short with a client who is recently bereaved.

That has a documentation consequence worth naming. If a conduct concern is raised about how a client was treated, the file either shows that the firm noticed the vulnerability and adjusted, or it does not. Our individual conduct rules guide covers the rules themselves, and the COCON Conduct Rules Self-Assessment helps map which rules apply to which staff.

What a proportionate small-firm approach looks like

A defensible position at a small firm is roughly six things:

A short vulnerability policy naming the drivers relevant to your client base and what staff do when they notice one.
A recording convention — a consistent place on the file, so it is retrievable rather than buried in a note.
Trained staff who can recognise and respond, with the training evidenced.
A small set of standing adjustments you can offer without escalation: longer appointments, alternative formats, a third party present, a cooling-off pause.
Annual monitoring with real numbers in it, feeding the Consumer Duty board report.
A review trigger so the policy is revisited when your client base changes, not only on the anniversary.

Common mistakes

1. Treating vulnerability as a permanent label. It is a spectrum, and it moves. A client who was vulnerable during a bereavement may not be two years later; a client who was not may become so overnight. A register written once and never revisited misrepresents both.

2. Assuming small firms are out of scope. The guidance is explicitly relevant "regardless of the firm's size or sector".

3. Confusing having a policy with meeting the standard. The Principles bind; the guidance does not. A policy nobody applies fails the binding half and passes the non-binding one.

4. Skipping monitoring because the numbers are small. Four clients is a small enough number to look at each one properly, which is an advantage rather than an excuse.

Summary

A vulnerable customer is "someone who, due to their personal circumstances, is especially susceptible to harm - particularly when a firm is not acting with appropriate levels of care."
Vulnerability is a spectrum, driven by health, life events, resilience and capability — and all customers are at risk of becoming vulnerable.
The guidance applies "regardless of the firm's size or sector".
FG21/1 is not binding; the Principles are. You need not follow every specific action, but you must meet the standard and treat customers fairly.
Four expected actions: understand your customer base, equip staff to recognise and respond, act on communications and service flexibility, and monitor whether it is working.
The Consumer Duty sets the outcome standard over the top; the FCA's July 2026 note points firms to the Duty pages for its latest expectations on management information.
The commonest small-firm failure is not a missing policy. It is a policy with no recording convention and no monitoring behind it.

Last reviewed: 29 September 2026. This guide explains the FCA's expectations on the fair treatment of vulnerable customers for small regulated firms. It is general information, not regulatory or legal advice, and it does not describe a ConductLog product feature — ConductLog is validating demand for a tool that helps small FCA-regulated firms handle conduct and misconduct processes. For your firm's specific obligations, read FG21/1 in full alongside the FCA's Consumer Duty pages, and consider professional advice.