The FCA wants to know how you use vulnerability data. Do you have a good answer?

Data only matters when it drives different outcomes. 

Identifying vulnerable customers is only the beginning. What matters is what happens next. If your vulnerability data is not driving different outcomes, it is not doing its job. 

Many firms in financial services have invested heavily in identifying vulnerable customers. Flags are recorded. Disclosures are logged. Identification rates are tracked and reported. On paper, the firm knows who its vulnerable customers are. 

But the FCA is increasingly asking a harder question: what are you doing with that information? Identification without action is not a vulnerability strategy. It is a data collection exercise that’s also a GDPR breach. 

The identification trap

There is a pattern we see across financial services. A firm builds a good identification process. Colleagues are trained to recognise vulnerability. A flag is added to the customer record. The firm can report that a certain percentage of its base has been identified as vulnerable. 

The problem is what happens after the flag. In too many firms, nothing changes. The customer continues through the same journey. The same letters are sent. The same collections process applies. The same digital-only channel is offered. The flag exists, but it does not trigger a different experience. 

FCA vulnerability guidance, including FG21/1, makes it clear that firms must go beyond identification. They must understand the needs of vulnerable customers and respond to those needs in ways that lead to good customer outcomes. Reducing vulnerability risk means designing journeys that adapt when vulnerability is present, not simply recording its existence. 

This matters at the individual and systemic levels. An individual flag that does not lead to a different outcome is a missed opportunity. Thousands of flags that do not lead to different outcomes is a systemic failure that regulators will increasingly scrutinise. 

What the data should be doing

Vulnerability data has three jobs. First, it should change what happens for the individual customer. A flag should route the customer differently, adjust the communication, extend a deadline, or connect them to a support service. If the flag does not lead to a tangible difference in the customer’s experience, it is not serving its purpose. 

Second, vulnerability data should inform how you design and improve your services. When you aggregate the data, patterns emerge. You can see which journeys create the most difficulty for vulnerable customers, which touchpoints generate the most repeat contacts, and where foreseeable harm is most likely to occur. This is the foundation of vulnerability-led service design: using the evidence to redesign services around the customers who find them hardest to use. 

Third, vulnerability data should feed your governance. It should give your board a clear view of whether vulnerable customers are receiving good outcomes, where the gaps are, and what is being done about them. This is what good vulnerability governance looks like in practice: data that drives decisions, not data that fills a report. 

The data quality question

None of this works if the data itself is unreliable. We often find that firms have invested in identification but not in the quality of what is being recorded. Vulnerability flags are binary when they should capture nuance. Categories are too broad to be actionable. Records are not updated when circumstances change and instead reflect characteristics of vulnerability rather than actionable needs. 

There is also the question of what you are not capturing. Solicited and unsolicited insights from colleagues, from customer feedback, from journey data, and from repeat contact patterns all contribute to a fuller picture of vulnerability across your customer base. If your data strategy relies solely on what customers disclose, you are missing the customers whose vulnerability is never stated but clearly visible in how they interact with your service. 

The best firms combine disclosure data with behavioural signals. They look for patterns in how vulnerable customers use their services, not just whether they have been flagged. Repeat contacts, journey abandonment, late payments following a life event: these are all indicators that vulnerability may be present, even where no disclosure has been made. 

From data to accountability

The firms that use vulnerability data well treat it as an operational tool, not a reporting metric. They connect identification to action at the individual level, use aggregate data to prioritise service improvements, and build vulnerability into their governance frameworks so that accountability sits at the right level. 

This is not about collecting more data. It is about making the data you already have work harder. If your vulnerability data can answer three questions, you are in a strong position: what did we do differently for this customer, what does the data tell us about where our journeys fail vulnerable customers, and what are we doing about it? 

If it cannot answer those questions, the data is not the problem. The connection between data and action is. 

Let’s talk

If you want to understand whether your vulnerability data is driving the right outcomes, a Vulnerability Review will assess how identification, data, and action connect across your vulnerable customer journeys. We work across financial services and beyond, from retail banking and insurance to lending and wealth management. 

hello@delehantyconsulting.co.uk

The post The FCA wants to know how you use vulnerability data. Do you have a good answer?  appeared first on Delehanty Consulting.

Your Consumer Duty Board Report: beyond the checkbox

Can you show what’s changed for customers, not just what’s been done? 

The Consumer Duty Board Report was meant to be a moment of honest reflection. For too many firms, it has become a compliance exercise. Here is what the FCA actually wants to see. perience has not changed?

Every firm subject to Consumer Duty is expected to produce an annual board report reviewing the outcomes their customers are receiving. For firms with vulnerable customers in their base, and that is most firms, the report needs to demonstrate more than activity. It needs to show impact. 

We have reviewed Consumer Duty Board Reports across financial services and the pattern is remarkably consistent. Firms describe what they have done. Training delivered. Policies updated. Identification rates reported. But very few answer the question the FCA is actually asking: are your vulnerable customers getting good outcomes? 

What the FCA expects

FG21/1 set out clear expectations for the treatment of vulnerable customers in financial services. Consumer Duty raised the bar further by requiring firms to evidence that they are delivering good customer outcomes across four areas: products and services, price and value, consumer understanding, and consumer support. 

For vulnerable customers, these outcomes take on a sharper edge. A product designed without consideration of foreseeable harm to vulnerable customers fails the test, regardless of how it performs for the broader population. A support model that works for most customers but creates barriers for those in vulnerable circumstances is not delivering good outcomes. 

The Consumer Duty Board Report is where firms are expected to bring this together. Not as a regulatory document prepared for an audience of one, but as a genuine assessment of whether the firm is meeting its obligations to all customers, including those who are most at risk of harm. 

Where most reports fall short

The most common gap we see is the difference between activity and outcomes. Firms report what they have done rather than what has changed. The report lists the number of colleagues trained, the number of vulnerability flags recorded, the number of complaints closed within SLA. These are inputs and outputs. They are not outcomes. 

An outcome is what the customer experienced. Did the vulnerable customer who disclosed a health condition receive a meaningfully different service? Did the customer in financial difficulty get access to support before their situation escalated? Did the customer who struggled with a digital-only journey find an alternative that worked for them? 

If your Consumer Duty Board Report cannot answer these questions with evidence, it is reporting on effort, not on effect. 

Another common weakness is the absence of vulnerable customer voice. Reports draw heavily on internal MI but rarely include evidence from the people the Duty is designed to protect. Without solicited and unsolicited insights from vulnerable customers, the report tells the board what the firm measured, not what customers experienced. 

What good looks like

The strongest reports we have seen share several characteristics. They draw on solicited and unsolicited insights, not just complaint volumes. They triangulate what vulnerable customers say with what colleagues observe and what the data shows. They are honest about where the gaps sit. 

They also connect vulnerability to commercial and operational reality. Consumer Duty implementation is not only a regulatory matter. A firm that understands where vulnerability creates risk in its customer journeys is better placed to reduce conduct risk, lower complaint volumes, and improve outcomes for all customers, not only those in vulnerable circumstances. 

We bring bad news when it is there and highlight good practice when we see it. The best firms do the same in their own reporting. They acknowledge what is working, explain where it is not, and set out a plan to close the gap. This is what vulnerability governance looks like when it is taken seriously at board level. 

Beyond the annual cycle

The real value of the Consumer Duty Board Report is not the document itself. It is the discipline it creates. Firms that treat it as an annual checkbox produce a report and move on. Firms that treat it as a governance tool use it to drive decisions, allocate resources, and hold themselves accountable for improving vulnerable customer outcomes throughout the year. 

The board report should not be the only time vulnerability reaches the boardroom. The firms that embed vulnerability into their governance frameworks, that track customer outcomes continuously rather than annually, are the ones whose reports tell a genuine story of progress. 

If your board report currently describes activity, the question is not whether it satisfies the regulator. The question is whether it tells you anything useful about how your vulnerable customers are actually being served. 

Let’s talk

If your Consumer Duty Board Report needs to shift from activity to outcomes, a Vulnerability Review can help you assess whether your vulnerable customer journeys are receiving adequate scrutiny and what needs to change. We work across financial services and beyond, from banking and insurance to lending and wealth management. 

hello@delehantyconsulting.co.uk

The post Your Consumer Duty Board Report: beyond the checkbox  appeared first on Delehanty Consulting.