Vulnerable Customers in Payments: What the FCA's Consumer Duty Review Found
On 17 September 2026 the Financial Conduct Authority (FCA) published its findings on how payments firms support consumers in vulnerable circumstances under the Consumer Duty. The publication creates no new rules and sets no deadline, but it is clear about what the FCA expects to see: firms that understand the scale and nature of vulnerability in their own customer base, can show that their policies work in practice, and give their boards enough information to oversee outcomes. The most common weakness was not a missing policy but missing evidence that the policy was working.
The publication, Payments firms: delivering good outcomes for consumers in vulnerable circumstances, sets out good practice and areas for improvement from a sample of payments firms and is aimed at payments and e-money firms serving retail customers (including micro-enterprises and small charities), firms distributing payments, e-money and open banking products through intermediaries, and retail banks. The FCA notes that around half of UK adults show at least one characteristic of vulnerability, and that payment failures can leave these customers unable to access funds or meet essential payments. As the FCA has said it will intervene where firms fall short, the findings are best used now as a benchmark for self-assessment.
What Did the FCA Review and What Status Do the Findings Have?
The FCA has not published its sample size, review period or methodology, so the findings are qualitative examples, not a measure of how widespread any practice is.
The binding obligations are those of the Consumer Duty (Principle 12 and the rules in PRIN 2A), which has applied to open products and services since 31 July 2023 and to closed products since 31 July 2024. The FCA's guidance for firms on the fair treatment of vulnerable customers (FG21/1), published in February 2021, is guidance rather than rules; in July 2026 the FCA noted on its webpage that FG21/1 refers to publications pre-dating the Duty. The new publication is a set of observations: the FCA states that it introduces no new requirements, prescribes no particular approach and that not every example will suit every firm.
Whatever approach a firm takes, the FCA expects it to be able to show that it:
understands its customers' needs
provides appropriate support
delivers good outcomes in practice
The strongest firms took account of the four drivers of vulnerability in FG21/1 (health, life events, financial resilience and financial capability), focusing on those most relevant to their customers while staying flexible enough to support other needs.
The FCA's Key Findings
The FCA grouped its findings under five headings, pairing good practice with areas for improvement and adding considerations for smaller firms in each:
identifying and recording consumers in vulnerable circumstances
supporting consumers in vulnerable circumstances
consumer understanding and communications
governance, management information (MI) and outcomes monitoring
overseeing intermediaries
Identifying and Recording Vulnerability
Firms delivering good outcomes understood vulnerability in their customer base, embedded identification across customer journeys including online and automated channels, and recorded vulnerability consistently using system flags.
The FCA's examples include online application questions about support needs rather than vulnerability itself, call handlers trained to spot indicators such as limited English or hearing difficulties, testing through call listening and quality assurance, and pilot tools that analyse chat language and route customers to human agents. Recording this information must comply with data protection requirements.
Some firms could not show their policies and training were working, relied heavily on staff judgement, or could not evidence how vulnerability information was recorded and shared. Most strikingly, some firms identified very few, or no, customers in vulnerable circumstances despite customer bases where vulnerability could reasonably be expected. In our view a near-zero figure should be treated as a finding in its own right, prompting the question of whether identification is working, rather than as reassurance.
Designing and Delivering Support
Support should reflect the firm's activities, role in the customer journey, level of customer interaction and risk of harm. Stronger firms designed support around the needs they had identified, offered flexibility in time, channels and formats, and made sure support did not depend on which member of staff a customer reached. Examples include assisted onboarding for customers with limited IT skills, and a money remitter offering support in relevant languages.
Where firms fell short, they could not evidence that support achieved good outcomes, applied it inconsistently, or focused on particular characteristics without explaining how those reflected their customer base. The FCA's smaller-firm example shows what proportionate looks like: a firm serving small businesses identified limited IT literacy as a key vulnerability and arranged callback support for account set-up.
Communications and Consumer Understanding
Stronger firms tailored and tested communications, used different formats and channels, and sought feedback from consumer panels and advocacy groups. Weaker practice meant relying on standard communications, not checking whether customers understood them, and offering limited ways to contact the firm. For smaller firms, the FCA points to simple language, alternative channels and reasonable adjustments.
Governance, Management Information and Outcomes Monitoring
Stronger firms defined good outcomes for customers with different needs, collected MI on the number and characteristics of vulnerable customers and their outcomes, reported regularly to boards and used the data for root-cause analysis. Some included vulnerability metrics and case examples within their Consumer Duty MI, aligned to the four outcomes.
Other firms relied on individual examples rather than analysis of trends, recorded vulnerability and outcomes data inconsistently, and in some cases gave boards limited insight beyond annual Consumer Duty reporting. Smaller firms may use more qualitative reporting, but boards must still receive enough insight to oversee outcomes. This echoes the FCA's wider findings on Consumer Duty outcomes monitoring.
Overseeing Intermediaries
Where products are distributed through intermediaries, the FCA expects firms to take reasonable steps to understand how those arrangements affect customer outcomes and to maintain appropriate oversight of matters relevant to their own products and Duty obligations. Firms with effective oversight monitored complaints and outcomes, trained intermediaries' staff and collected MI on intermediary performance; others had limited visibility of vulnerability among customers served through third parties. Both providers and intermediaries have responsibilities under the Duty, and some smaller firms off-boarded intermediaries that fell short.
What Are the Key Themes for Payments Firms?
In an accompanying FCA blog, Alison Russell, Head of cross-cutting delivery, observes that almost every firm reviewed could point to policies, training materials or procedures, but that these alone do not guarantee good outcomes. Read with the publication, that points to three broader messages:
Evidence, not documentation. The firms that stood out checked whether their arrangements were working in practice and changed them when they were not.
Consistency, not individual judgement. Several weaknesses concerned support that depended on the staff member involved. Prompts, system flags and quality assurance turn good intentions into consistent treatment.
Proportionality with a floor. Smaller firms do not need complex systems, but every firm must understand its customers and give its board enough insight to oversee outcomes.
What Should Firms Do Now
The FCA asks firms to consider the findings against their own arrangements. For most firms that means a focused review against the five finding areas rather than a rebuild. A proportionate response would include the following steps:
Confirm where the Consumer Duty applies, including micro-enterprise and small charity customers and any distribution through intermediaries.
Test the credibility of your vulnerability figures against what your customer base would reasonably suggest, and investigate a low or nil count.
Review identification points, communications and contact routes in digital journeys, particularly for customers with limited English or low digital capability, and check how flags are recorded and shared lawfully.
Sample calls, chats and complaints to test whether support is applied consistently.
Extend board MI to the number and types of vulnerability, outcomes and complaints, reported more often than the annual Consumer Duty board report.
Strengthen intermediary oversight through MI, complaints monitoring, training and clear escalation.
Allocate ownership, add vulnerability testing to the compliance monitoring plan, and minute the board's conclusions, including any decision that current arrangements remain adequate.
Frequently Asked Questions
Does the FCA's review of payments firms and vulnerable customers create new rules?
No. The FCA states that the publication introduces no new requirements and does not prescribe how firms should meet its expectations. The obligations come from the Consumer Duty, alongside the FCA's guidance on the fair treatment of vulnerable customers (FG21/1).
Which firms does the FCA's payments vulnerability review apply to?
The FCA says the findings will interest payments and e-money firms serving retail customers, including micro-enterprises and small charities, firms distributing payments, e-money and open banking products through intermediaries, and retail banks. What is appropriate depends on each firm's business model, customer base and target market.
What should a payments firm do if it has identified very few vulnerable customers?
Test whether the figure is credible. The FCA found that some firms identified very few, or no, vulnerable customers despite customer bases where vulnerability could reasonably be expected. As the FCA notes that around half of UK adults show at least one characteristic of vulnerability, a low count usually points to weak identification or recording.
Do smaller payments and e-money firms need complex systems to support vulnerable customers?
No. The FCA says smaller firms do not necessarily need complex systems or extensive processes, and may use more qualitative board reporting. They must still understand their customers' needs, identify where extra support is needed, respond to individual circumstances and show that their approach is proportionate to their business model, customer base and risk of harm.
What management information on vulnerable customers should a payments firm's board receive?
The FCA observed that stronger firms reported regularly to senior management and boards on the number and characteristics of vulnerable customers and the outcomes they experienced. Some built vulnerability metrics and case examples into their Consumer Duty MI, aligned to the four outcomes. At some firms, boards saw little beyond annual Consumer Duty reporting.
How Compliance Angle Can Help
We support payments, e-money and open banking firms with work tied directly to the FCA's findings, including:
Consumer Duty support, including reviews of how vulnerability is identified, supported and evidenced.
Compliance health checks and gap analyses scoped against the FCA's five finding areas.
Compliance frameworks and policies, including vulnerability policies and compliance monitoring plans.
Risk management and governance support, including board MI on vulnerability and outcomes.
Compliance training for staff on recognising and responding to vulnerability.
Ongoing compliance support, including oversight of intermediaries.
Our support is proportionate to each firm's business model, permissions, size and regulatory risk. To discuss how the FCA's findings apply to your firm, contact us at info@complianceangle.co.uk.
Source: Financial Conduct Authority, Payments firms: delivering good outcomes for consumers in vulnerable circumstances, good and poor practice, published 17 September 2026.
