5 critical warning signs your vulnerability data is lagging

Many firms know how many customers have a vulnerability flag. Fewer know how many of those flags changed in the last three months. That’s where static vulnerability data stops being useful, because a record that describes someone’s circumstances a year ago won’t help the agent speaking to them today.

The reality is, financial difficulty moves quickly. Someone can go from managing to struggling in weeks, yet the systems meant to catch that often run on a slower cycle than the people they are watching.

Here are five warning signs your data has fallen behind, and what to check in each case.

This article covers: Why vulnerability data is under increasing pressure Five signs your customer view may be out of date Practical checks you can run against your own portfolio Where reporting cycles and single-source assessments create risk What stronger vulnerability monitoring and audit trails look like How high-frequency data can support earlier identification

The growing pressure on vulnerability data

It’s safe to say household costs are moving in one direction. Ofgem confirmed in August that a typical household paying by direct debit would pay £1,723 a year for gas and electricity from 1 October, up from £1,663.

Chances are you’re already seeing what that does to a book.

The arrears figures back it up. Ofgem recorded £4.79 billion of energy debt in its Q1 2026 data, a record, and up 15% in a year. Insolvency has moved the same way. One in 360 adults in England and Wales entered insolvency in the twelve months to July 2026, compared with one in 412 a year earlier.

Meanwhile, in December 2025, the FCA confirmed it would not revise FG21/1 or introduce new requirements, having concluded the guidance still works well alongside the Consumer Duty. Customer pressure is rising, and the standard firms are held to is now fixed and well understood. 

So what separates firms is how quickly they can see a change in someone’s circumstances, and evidence what they did about it. (BTW, this is exactly what KYVC was built for.) 

5 warning signs your vulnerability insights are too slow

Here are five signs vulnerability insights are coming too late to act upon. Each one comes with a check you can run against your own numbers this week.

1. Your vulnerability flags get set once and aren’t updated enough

Circumstances move quickly. Someone flagged for a health condition 18 months ago might be back at work and managing well. While someone with no flag at all might have lost a partner, dropped to part-time hours, and started using credit to cover the weekly shop. 

Anyone who’s worked a collections floor will recognise this scenario. The agent follows the record, and the customer gets a conversation designed for a version of them that no longer exists.

The FCA found the same thing when it reviewed how firms monitor outcomes in July 2026. Some firms were tracking vulnerable customers separately but reporting it all as one number, rather than splitting it by drivers such as health, financial resilience, or life events. Aggregated like that, it becomes hard to see whether different groups have different needs or hit different barriers.

[Snippet taken from FCA 2026]

The same review found firms leaning on lagging indicators, with few forward-looking measures to balance them.

For debt purchasers, there’s a second version of this. A purchased portfolio comes with flags set by the originator, sometimes years earlier, under a different disclosure process and a different definition of what counted. Essentially, you’ve inherited someone else’s snapshot, and it’s already out of date.

↪ Related reading: The hidden risk inside every purchased portfolio

The check: how many vulnerability records on your book changed status in the last 90 days? If the number is close to zero, your flags are recording history.

2. Collections decisions are run on the last reporting cycle

Credit file data updates on a cycle. Anything that changed after the last submission stays invisible until the next one has been processed. That’s fine for a lending decision made once. It’s harder to work with when a dialler is running today, on a book where circumstances are moving weekly.

Everyone knows this, yet teams still treat the file as a live view of where someone is right now.

Help is coming, though not on the timeline most people expect. The FCA’s credit information market study set out a package of remedies to improve the coverage, quality and consistency of credit information. In February 2026, the regulator consulted on how to implement them, proposing that the new regime commences 12 months after the policy statement is published, with a further six months for first-time providers. The consultation closed on 1 May 2026. Work through the timetable, and any firm waiting on those remedies is waiting well into 2027 at the earliest.

They are intended to fix coverage, quality, and consistency. All of which are valuable and needed. Frequency is a separate problem, and it will still be there afterwards. Which leaves each firm to decide what covers the interval between one reporting cycle and the next.

The check: take ten accounts that went into arrears last month. How many days passed between the customer’s circumstances changing and anything in your systems showing it?

3. Affordability rests on one source with nothing to check it against

An income and expenditure assessment describes the week it was completed. Nothing in it knows what happens next. Take an arrangement agreed in August, built on a set of household costs that made sense then. From 1 October, those costs change. The assessment doesn’t, and neither does the arrangement built on top of it.

Most teams already suspect this is happening. Proving it is the hard part, because a single source has nothing to be checked against. If the income figure is wrong, the expenditure is understated, or something changes the week after, there’s no second view to catch it.

The size of the problem is visible in the arrears data. Ofgem’s figures put average arrears at £1,876 for electricity and £1,623 for gas in Q1 2026 among customers with no arrangement to repay, up 9% on the year for both.

There’s a detail in that data worth pausing on. Ofgem updates it quarterly, and it counts customers who have been in debt for more than three months. So the regulator’s own view of energy arrears is a quarterly picture of debt that is already 90 days old by the time it appears.

If that’s the standard for market-level reporting, it’s a reasonable prompt to ask what the standard is for a single customer file.

The check: pick twenty arrangements agreed six months ago. How many were reviewed against anything other than the customer telling you something had changed?

4. Delayed breathing space notifications and operational disconnects

Breathing space notifications drop in, but whether they reach the dialler, the letter cycle, and the outsourced agent before the next contact attempt is a separate issue entirely.

Volumes are steady. There were 5,248 breathing spaces registered in July 2026, of which 5,098 were standard, and 150 were mental health crisis registrations.

Government guidance for creditors is clear that, on being notified, creditors must stop enforcement action, pause contact and freeze most interest and charges. Protections apply from the date set out in the notification. Essentially, a creditor who has appointed an agent to recover the debt has to tell that agent to stop.

Get it wrong, and any enforcement action taken is invalid, and the creditor may be liable for the debtor’s costs.

Here’s where it gets awkward for anyone running an outsourced model. The FCA was direct about this in its July 2026 outcomes monitoring review: firms using third parties to deliver part of their services are still responsible for their customers’ outcomes.

So a notification landing in a creditor’s inbox on Monday and reaching the agent’s dialler on Thursday is three days of contact attempts the creditor is accountable for.

The check: how long, in hours, between a breathing space notification arriving and every system that could contact that customer being updated? If nobody owns that number, nobody is measuring it.

5. Inadequate audit trails for regulatory compliance reporting

Evidence of a working approach is: something was identified, a decision followed, an action happened, and the outcome was checked. Most firms can produce the first and the third. Yet too often the chain falls apart because the acting and the recording happened in different places, months apart, by different teams.

The FCA put numbers behind this. Its outcomes monitoring review, published in July 2026, drew on board reports and a survey of 56 firms. It found firms relying on lagging indicators, without clear thresholds or forward-looking measures, and without complete audit trails running from identifying an issue through to action and outcome.

The stronger examples showed exactly that chain, including how MI translated into decisions, actions, and improved outcomes.

The review also had something to say about boards. They’re given regular updates and described as central to oversight, but in many cases they focus on reviewing and approving reports rather than challenging them or pushing for further action.

That will be familiar to anyone who has sat through one of those meetings. The pack is thorough, the discussion is short, and everyone moves to the next item.

The opening line of the review is the one to take away. Collecting data and reporting MI will not, by itself, show whether customers are getting good outcomes.

The check: pick one vulnerable customer who received support in the last quarter. Can you produce a dated record of what you knew, when you knew it, what you did and whether it worked? If assembling that takes more than an afternoon, it isn’t an audit trail.

Implementing a high-frequency vulnerability data setup

The five checks above all come back to timing. A vulnerability flag can be accurate when it’s added, an affordability assessment can be sound when it’s completed, and a collections decision can be appropriate when it’s made. The risk grows when that information stays unchanged while the customer’s circumstances move on.

That becomes particularly important with non-disclosed vulnerability. In its December 2025 review, the FCA noted that firms wanted more guidance on supporting customers who don’t disclose vulnerability, including those they have little or no direct contact with. For those customers, waiting for disclosure will only ever reveal part of the picture.

More frequent external data gives firms another way to understand what may have changed. It can help teams identify changes in financial resilience, health and life circumstances earlier, check existing information against additional sources, and retain a dated record of what was known when a decision was made.

That doesn’t mean replacing the data or processes firms already trust. KYVC works alongside them, bringing multiple high-frequency data sources together across around 15 million records a month to provide a more current view between existing updates.

Run the five checks against your own portfolio. If they reveal long periods between a customer’s circumstances changing and your systems recognising it, that’s a useful place to start.

See what your own data reveals when combined with KYVC.

About Know Your Vulnerable Customer

KYVC brings multiple high-frequency data sources together in a single live environment, covering around 15 million records a month. It works alongside credit bureau data rather than replacing it, adding speed and verification to the view a firm already has.