Most organisations can report on vulnerability, and that reporting is well established. They can show how many customers were identified, what type of vulnerability was recorded, and what action followed. These measures are built into regular MI and are used across risk, compliance, and operations.
But those measures do not show when vulnerability first became visible in the data, or how long it took to respond.
And with the FCA’s Financial Lives 2024 survey finding that 49% of UK adults (26.4 million people) show characteristics of vulnerability, the scale of the population firms are expected to identify, support, and evidence is significant. Most firms already have vulnerability to manage. What’s less clear is whether their MI shows when action is taken, and how early it happens.
In many cases, there is no clear record of when early indicators appeared or whether those indicators were acted on at the time. That part of the timeline sits outside standard reporting, even though it influences how each case develops.
As a result, two customers can move through the same process and reach the same outcome category, while the path they took to get there differs in a way that affects both experience and support. And that difference affects customer outcomes and the strength of the evidence behind each decision.
Key takeaways from this article:
|
Operational reporting focuses on outcomes, and in most organisations, reporting is mature. Most track volumes of vulnerable customers, the types of treatment applied, and how cases are resolved. These measures support oversight, governance, and regulatory reporting.
| Standard vulnerability tracks | Standard vulnerability does not track |
|
|
But they describe the end state of a case, rather than how it developed.
The FCA found that firms often find it challenging to monitor outcomes for customers in vulnerable circumstances, have underestimated the depth of monitoring required, or choose only to monitor readily available data. The tendency to track what’s easy to capture, rather than what’s most informative, is precisely what limits the evidential value of standard MI.
There is usually no consistent view of when early indicators first appeared in the data, or whether those indicators were acted on at the time. In many cases, there is also no way to compare how quickly different teams respond to the same type of signal. That creates blind spots in how performance is understood.
For example, two customers may both be recorded as vulnerable and receive similar support. In reporting, they appear consistent. What is not visible is the path taken to reach that point. One may have been identified when early signs of financial pressure first appeared. The other may only have been identified after arrears had already developed.
Those cases sit in the same category, but the timing behind them affects:
It also affects how decisions stand up to review. Without a clear view of timing, it is difficult to evidence whether intervention happened at the point it was needed, or only after the situation had progressed. That distinction does not always appear in standard MI, but it carries weight in both customer outcomes and regulatory assessment.
| What the FCA expects firms to track: Most firms currently use complaints data, staff feedback, and quality assurance findings, but fewer use customer feedback directly from vulnerable customers, behavioural insights data, and data on referral and take-up rates of additional support. Timing sits within that second, less-used category. |
↪ Further reading: What to look for in a vulnerability dashboard
In most operations, vulnerability is identified at defined points in the customer journey, and those points tend to be consistent across teams and systems.
They usually include:
These are the moments built into operational processes, so they are easy to track and straightforward to evidence. They also tend to occur once financial pressure is already established.
Looking earlier in the lifecycle, the view changes. Customer circumstances often change before those triggers are reached, and that change is already visible in the data. It shows up through indicators such as:
These indicators sit earlier in the timeline, but they are not always connected to the points where identification takes place.
| The FCA’s Financial Lives 2024 survey found that one in ten UK adults has no savings, and a further 21% have less than £1,000 to cover an emergency. These are not edge cases. They represent a large portion of any firm’s customer base already operating without financial headroom, and therefore already at risk of rapid deterioration before any formal trigger is reached. |
So, the indicators are already available, but they are not always used at the point they first become visible
Once you look at it this way, the impact becomes easier to see. For instance, cases identified at a later stage tend to begin with less flexibility. Support is introduced once financial pressure has built, and the range of available options is narrower. Identification at that point allows intervention while there is still room to influence the outcome.
Most reporting captures the point at which vulnerability is recorded. But it rarely shows how far that point sits from the first signs of change, or what that delay means for how the case develops.
↪Further reading: Why vulnerability detection must move earlier in the lifecycle
Consumer Duty sets expectations around customer outcomes, and most organisations have translated those into policy and oversight frameworks.
At an operational level, those expectations depend on when vulnerability is identified.
Intervention often begins once financial pressure is already established, which means earlier indicators were available but not used at the time. As a result, the opportunity to act before harm develops is reduced, even though the data supported earlier action.
When identification happens later, support begins at a point where circumstances are more complex. Fewer options remain, and the level of intervention required is higher from the outset.
Timing also affects consistency. Where identification depends on when a customer makes contact or misses a payment, similar customers enter the process under different conditions. Treatment may follow the same approach, but it is applied at different stages, which changes how outcomes are experienced.
| In 2024, the FCA issued three fines for unfair treatment of customers in financial difficulty. That enforcement activity reinforces the point that the consequences of poor timing are not limited to MI quality, they extend to regulatory action. |
This creates a difference between when vulnerability becomes visible and when it is recorded within the operation. Because most reporting shows that action was taken. But it does not show whether it was taken at the point it was needed, or how timing varied between cases. And that is where scrutiny tends to focus.
Variation appears across day-to-day operations, even where policies and frameworks are aligned.
It often depends on factors outside formal design, such as:
These differences rarely appear in reporting, but they still influence when and how vulnerability is identified. And, when you look more closely, the drivers tend to fall into a small number of areas.
| Driver | What happens | Impact on identification |
| Customer disclosure | Identification depends on when the customer makes contact | Timing varies based on behaviour rather than need |
| Data visibility | Behavioural vulnerability data is available in some systems but not others | Teams act on different levels of information |
| Data recency | Data reflects a previous position rather than current circumstances | Identification happens after conditions have already changed |
| Identity and matching | Customer records are incomplete or not consistently linked across systems | Early indicators are missed or not linked to the right individual |
| Workflow separation | Processes differ across teams and channels | Similar cases are handled at different stages |
The FCA found that some firms were not able to demonstrate how they use data to identify areas for improvement and to effectively escalate an issue where poor outcomes are identified. That failure of escalation is frequently a data visibility problem: the right information exists somewhere in the operation, but it is not reaching the right point in time for it to change what happens next.
Each of these drivers shapes what is available to the operation at the point a decision is made. That, in turn, affects when identification is possible. And once timing varies, inconsistency follows.
↪Further reading: Building a case for proactive vulnerability detection with alternative data
Earlier identification changes how teams engage with customers because it changes the point at which decisions are made. So, instead of responding once financial pressure is established, teams are working with earlier signals. That shapes how cases are handled from the outset.
It means:
That change in timing changes how the case develops.
| What good looks like: The FCA’s review highlighted one firm that used smart data analysis to spot customers experiencing income shocks: an approach that aligns directly with vulnerability indicators including loss of earnings and changes in employment status. That firm was able to evidence timely, targeted action because the data supported it. |
More current data brings forward visibility of income changes, borrowing behaviour, and early financial pressure. When that information is used at the point it becomes available, engagement happens sooner, and decisions are made with better context.
Firstly, start with live cases.
Look at a sample of recent cases and trace them back.
This shows whether identification reflects early indicators or later-stage events.
For those same cases, examine what information was available before the flag was recorded.
This shows whether timing is limited by visibility or by how data is used.
Consistency is rarely tested directly.
Differences here point to structural variation rather than policy issues.
Most organisations can show what action was taken. Fewer can show when the first indicator appeared or how long it took to act. Without that, timing is assumed rather than evidenced.
| Governance benchmark: An earlier FCA report found that 79% of respondent firms said their senior leadership had active involvement in reviewing governance arrangements and 70% said senior leadership was responsible for delivering good outcomes for vulnerable customers. Governance involvement is not the gap. The gap is in what those leaders are being shown, and whether the MI they receive includes timing. |
Most organisations can show that vulnerability has been identified, and that part of the process is well understood. What tends to be less clear is timing, because the recorded point of identification often reflects when the operation reacts, rather than when the situation first becomes visible.
The FCA’s 2025 vulnerability review found that many of the firms surveyed failed to properly monitor outcomes and provide appropriate support, and the timing delay is a significant reason why. If identification is reactive, the outcomes data that follows will be built on a foundation that starts too late.
From there, the focus moves to how early identification takes place and what happens between the first signal and the point of action. That is usually where the constraint sits. And this is where a more targeted review becomes useful, starting with live cases.
For teams looking to take this further, the focus usually turns to how vulnerability signals are linked to a confirmed, current view of the customer, so they can be acted on earlier and with greater confidence. That’s where approaches like KYVC are typically used, linking identity, contactability, and behavioural data so signals can be used as they become visible. Learn more.
Learn about how our products could benefit you.
Get in touch and find out about our solutions for Marketing, Verification and Trace.
© Copyright 2024 Data OD Ltd