FCA vulnerable customers review 2025: needs recorded, then ignored

The FCA's vulnerable customers review is the regulator's evaluation, carried out in 2024, of how firms treat customers in vulnerable circumstances, published on 7 March 2025 with a good-practice report and followed on 12 April 2025 by a multi-firm review of how seven banks and building societies handle bereavement and power of attorney. It found that the Consumer Duty had driven a renewed focus on vulnerability and that many firms had made good progress; it decided not to revise its 2021 guidance, FG21/1, or add new requirements. But in banks it found needs recorded and then not checked, distressed customers not acknowledged, customers repeating themselves between teams, and management information that measured speed rather than whether needs were met. Its message to firms was blunt: "No firm can afford to be complacent in this area." Botminds' Vulnerable Customer Support is built around the step the review found failing, the one after a need is recorded: it applies each need to every channel, checks contacts against it and reports outcome gaps for people to act on.

This is a UK review of UK firms. No US federal rule requires a bank to record a customer's vulnerability; US banks can read the findings as an unusually detailed account of where good intentions break down. Product examples come from a fictional sample bank, Corvane Bank UK.

What did the FCA vulnerable customers review find?

It found progress at firm level that had not yet reached customers at national level. Many firms had taken positive action, and the Consumer Duty had driven a renewed focus on outcomes for customers in vulnerable circumstances. But "Some areas for improvement remain, particularly around products and services and outcomes monitoring." And the FCA's own national survey did not yet show the improvement: "Progress for individual firms shown in our multi-firm work is not yet showing in our UK-wide Financial Lives survey data", which suggested customers in vulnerable circumstances, especially those with several characteristics, may not consistently receive outcomes as good as others.

The good-practice report put numbers on the gaps. Most firms in the outcomes-monitoring work could not show how they effectively monitored and acted on outcomes for customers in vulnerable circumstances. Only 39% of surveyed firms had a formal governance body overseeing those outcomes. Only 4 in 10 consumers with characteristics of vulnerability had told any provider, and only 19% felt encouraged to. And just 29% of firms said they tested the impact of a product or service on customers with characteristics of vulnerability.

How the FCA ran the 2025 review

The FCA combined six strands of evidence, which is why its findings carry weight: interviews with experts from consumer organisations, trade associations and academia; consumer research including a survey of 1,500 people; analysis of its Financial Lives survey across 2020, 2022 and 2024; a voluntary survey answered by 725 firms; a follow-up on outcomes monitoring with 29 firms in 12 markets; and the bank-specific work on bereavement and power of attorney with seven banks and building societies.

It asked two questions. How are firms supporting customers in vulnerable circumstances? And does FG21/1 still fit now that the Consumer Duty exists? Stakeholders told it the guidance remained useful and important under the Duty, and asked mainly for more case studies, which is what the March 2025 good-practice report supplies.

Is FG21/1 being updated?

No. The FCA's conclusion was that the guidance "remains appropriate and helpful alongside the Consumer Duty", and it said plainly it is "not revising our Guidance now or introducing new requirements for firms." The review page's last update, on 3 December 2025, is marked as a system update with no content change.

There has been one small change since. On 22 July 2026 the FCA added a note to the FG21/1 page explaining that the guidance "includes references to historical publications which pre-date the Duty" and pointing firms to its Consumer Duty pages for its latest expectations on management information and good outcomes. The guidance itself, published on 23 February 2021, is unchanged; the Duty is now the lens through which it is read.

Four findings in the retail banks review

The bank-specific review examined how seven banks and building societies handled bereavement and power of attorney, two journeys where customers are almost always in vulnerable circumstances, through case reviews, governance, management information, training and outcome testing. It set out four findings, each with good practice and areas for improvement.

The rules behind each finding are worth noting because they are rules, not guidance. Finding 2 cites PRIN 2A.7.4G on helping staff identify vulnerability; finding 3 cites PRIN 2A.9.8R and 2A.9.10R on monitoring outcomes and comparing groups; finding 4 cites PRIN 2A.6.2R on designing support that meets customers' needs; and finding 1 cites PRIN 2A.6.5R, which requires the same level of support for an attorney as for the customer.

What poor practice did the FCA find in banks?

The FCA found failures at every desk that touches a bereaved customer or an attorney. The sharpest was staff who did not check, or did not act on, needs already recorded on the customer's profile. In some bereavement and power of attorney cases staff did not acknowledge customers who were plainly distressed, and some customers and their attorneys were left for long stretches without access to money for essential bills (FCA retail banks review, 2025; what a bank should check and change for attorneys is in dementia friendly banking).

Two findings deserve attention beyond the bank review. The FCA's good-practice report found "call handlers in some firms were not using their firm’s systems to check the information recorded on a customer’s circumstances or needs", and one firm that failed to get internal approval for engineering work to fix third-party account access, accepting a higher risk that both the customer and the third party would be locked out. The first is a habit; the second is a budget decision. Both leave a recorded need unused.

What good practice did the FCA find?

The FCA found that the firms doing best had made needs visible everywhere, built specialist routes for the hardest journeys and measured outcomes rather than activity. In the bank review it saw firms that had brought their records together so that staff in every business area and brand could see a customer's needs wherever they had first been told (FCA retail banks review, 2025; what that takes is in a vulnerable customer register every system reads). It reported that "Most firms had dedicated bereavement teams", with one firm using video calls with specialist advisers and another with a dedicated phone line for attorneys.

It also saw technology helping. Some firms used speech analytics that, in real time or after the call, highlighted when a customer had said something suggesting a characteristic of vulnerability, which helped firms reach customers whose needs had been missed. In the wider report, the FCA described firms that removed call-time targets for staff handling customers in vulnerable circumstances, and a bank that offered a customer with anxiety a courtesy call every three weeks from the same member of staff.

We observed some instances of staff failing to check or respond to support needs recorded on a customer’s profile.

FCA, Retail banks’ treatment of customers in vulnerable circumstances, April 2025

The step after recording

Read together, the 2025 findings point at one step: what happens after a need is recorded. Firms had systems to capture needs, training on how to ask and policies on what to do. The failures came when the need had to reach the next colleague, the next system or the next report. That is why a firm can pass a file test on its recording and still fail a customer: the record is right, and nothing reads it.

The sample shows how many such misses a bank can find once it looks. Over 30 days, checking 412,600 letters, calls, fees, sales and collections contacts against recorded needs found 61 that did not respect one; 54 were put right, on average 3 hours 40 minutes after detection. One was a bereaved customer's £8.00 returned payment fee on her late husband's direct debit; another a credit card upgrade call to a customer who had asked for no sales calls, because the dialer loaded its do-not-call list weekly.

Vulnerable Customer Support checking contacts against recorded needs, the step the review found failing

The specialist journey is the other half. Where the FCA found cases lost and documents resent, the sample bank's referral for a bereaved customer carries the need, the outstanding documents, the callback, an owner, a first-contact time and an escalation to the team manager and then the Consumer Duty manager. How the bank measures whether that works is set out in our guide to FCA vulnerable customer outcomes, and how a single record of needs reaches every system in our guide to the vulnerable customer register.

A bereavement referral with its steps, clock and checks

What the FCA has published since

Since the 2025 review the FCA has added three publications that extend its findings rather than change the rules. In July 2026 it published good practice on outcomes monitoring across sectors, which criticised firms that aggregated vulnerability MI rather than splitting it by driver, and described one whose tracker raised action on "missed vulnerability flags". In September 2026 it reviewed payments firms, finding some that had identified "very few, or in some cases no customers in vulnerable circumstances" despite customer bases where that was implausible.

In October 2026 it published good practice on AI in financial services, with a section on the Consumer Duty and consumers in vulnerable circumstances. It warned against trusting a large language model to spot vulnerability before it had been properly tested and safeguarded, and against relying on human review that had become a formality (FCA, AI good practice, 2026; see AI and vulnerable customers). FG21/1's definition of vulnerability also reaches beyond the Consumer Duty; the APP fraud reimbursement rules borrow it, as our sibling guide on the FCA and PSR merger explains.

What should firms do after the FCA review?

Firms should test the step after recording, and fix what they find at the cause. The FCA wrote to every firm in the bank review with its findings and expected next steps, and encouraged all firms to use the good-practice examples. A bank that was not in the sample can still run the same tests on itself.

For the attorney journey in particular, how a bank verifies attorneys and deputies is in our guide to dementia friendly banking. The product is described on the Vulnerable Customer Support page.

Questions people ask

How many firms did the FCA review?

725 firms answered its voluntary survey, 29 firms across 12 markets received a follow-up request on outcomes monitoring, and 7 banks and building societies were reviewed on bereavement and power of attorney journeys. The FCA also commissioned research with 1,500 consumers and analysed three waves of its Financial Lives survey.

What did the FCA say about bereavement and power of attorney?

That most firms had dedicated bereavement teams, but some staff did not acknowledge visibly distressed customers, customers repeated information and cases were delayed or lost between systems. Attorneys often had few channels and no online or app access, which the FCA linked to firms' investment decisions, and the Consumer Duty requires firms to give attorneys the same level of support as the customer.

What are the FCA expectations for vulnerable customers?

That firms understand the needs of their customers, equip staff to recognise and respond to them, take them into account in products, service and communications, and monitor whether customers in vulnerable circumstances get outcomes as good as others. FG21/1 sets these out as guidance; the Consumer Duty makes outcome monitoring and group comparison rules.

When was the FCA vulnerable customers review published?

The review and the good-practice report were first published on 7 March 2025; the retail banks multi-firm review on 12 April 2025. The FCA then added a note to the FG21/1 page on 22 July 2026 directing firms to its Consumer Duty pages for its latest expectations on management information.

Did the FCA take enforcement action in the review?

The review pages report findings and good practice, not enforcement. For the bank review the FCA wrote to every firm involved with its findings and expected next steps, and said no firm could afford to be complacent.