The FCA has closed the data protection excuse on vulnerability sharing

The FCA’s July review of products and services surveyed 38 firms across banking, insurance, payments and consumer credit, and kept landing on the same finding: Firms manage their own operation well. But once a product or account moves to a third party, that oversight stops.

In other words, poor outcomes go undetected for longer than they should. The originator no longer sees the account. The new firm doesn’t have the history behind it. Neither side has the full picture, so a problem that would have been caught early runs on unnoticed.

For debt sale, this is the clearest example. Vulnerability flagged by the originator won’t make it onto the new servicer’s file. So instead, the account moves forward without it. The one thing that would have caught a problem early doesn’t come with it.

Key takeaways from this article:

• Vulnerability data is treated as account metadata, and not something that transfers with legal ownership
• Limited visibility in a distribution chain doesn’t just obscure poor outcomes. It lets them run for longer before anyone acts
• The debt and its conduct obligations transfer to the buyer. The vulnerability context usually doesn’t
• The FCA and ICO have set out what they expect firms to do about this, and ruled out data protection as a reason not to
• Buyers without that context restart identification from zero, on accounts already in difficulty
• Good sharing arrangements already exist. The FCA’s review documents one

 

Vulnerability data in debt sale: what transfers, and what doesn’t

A debt purchaser is under the same conduct standard as the originating lender, including the duty at CONC 2.10, the FCA’s mental capacity guidance for firms dealing with vulnerable customers. That duty applies to the buyer from the moment they take on the account. However, the history behind it doesn’t.

Here’s a quick look at what transfers over and what doesn’t:

What transfers	What doesn’t
The obligation to treat the customer fairly under CONC 2.10	The history of why that obligation applies
Legal ownership of the debt	Any prior vulnerability indicators recorded against it
Responsibility from day one of ownership	The record of what triggered the original flag

So even when a buyer meets every standard the FCA sets out, they’re often meeting it on a customer they know almost nothing about. As a result, the FCA’s Financial Lives 2024 survey found that 49% of UK adults, 26.4 million people, show characteristics of vulnerability, so on any sold portfolio of a decent size, this isn’t a small pocket of accounts. It’s close to half the book! 

The duty and the evidence behind it are meant to move together. Instead, only one of them does.

 

FCA and ICO vulnerability data sharing expectations for 2026 

The March 2026 joint statement also sets out a working expectation, and it’s worth reading closely. Why? Because manufacturers, such as lenders and payment networks, and distributors, such as intermediaries and financial advisers, are expected to work collaboratively and share relevant vulnerability-related information where necessary to avoid foreseeable harm. The instruction centres on data minimisation and purpose limitation: share what’s needed to prevent harm, calibrated to that purpose. 

Similar to a lot of joint regulatory output, the statement is the product of collaboration through the Digital Regulation Cooperation Forum and the UK Regulators Network, which signals a coordinated position both regulators are prepared to supervise against. 

Talking of supervision, the FCA intends to do further work on how Consumer Duty applies through distribution chains during 2026. This expectation is still developing.

The key insights here:

• The bar is “necessary to avoid foreseeable harm,” calibrated by data minimisation and purpose limitation. Firms share what the purpose requires.
• Both sides of the chain carry the expectation. Manufacturers and distributors are named jointly, so responsibility for closing this off sits with both.
• This is joint, coordinated regulatory intent. The DRCF and UKRN collaboration behind it means both the FCA and the ICO are positioned to act on it.
• More is coming. The FCA’s 2026 work programme on distribution chains means this expectation will likely sharpen over the year.

 

Firms waiting for a final version of this expectation will be waiting through at least one more round of FCA scrutiny.

“We couldn’t share it for data protection reasons” is no longer an excuse The regulators have confirmed that data protection legislation does not prevent firms from identifying and supporting vulnerable customers, and that extends directly to sharing what’s needed across a chain. The mechanics were set out in the last section. This is the consequence: that line of defence is gone.

What a buyer inherits when the data doesn’t move 

The FCA expects firms to take all reasonable steps to avoid, or mitigate, foreseeable harm. A buyer who never received the context behind an account had no basis to identify that harm as foreseeable. 

And that creates two specific problems for buyers:

• They can’t evidence a decision they never had the information to make. Asked to demonstrate reasonable steps, an originator points to their own records. A buyer can show what they did once the account reached them. They can’t show why they didn’t act sooner, because the indicators that would have prompted earlier action were never passed to them.
• They’re pricing risk that was never disclosed. Portfolios are priced against arrears history, recovery rates, and credit performance. Vulnerability risk sitting behind the account rarely enters that calculation, because it isn’t disclosed at the point of sale. Buyers pay a price built on incomplete information, then inherit conduct obligations they have no way to discharge properly.

 

Neither problem can be fixed through better collections practice after the account arrives. Both are set before the buyer ever takes ownership of it. So, what does it look like when a chain gets this right? The FCA’s own review already has an answer.

What good vulnerability data sharing looks like across a debt sale

Set against everything a buyer stands to inherit, the FCA’s own review shows this problem already has a working answer.

In its own review, one smaller firm:

• Established clear data-sharing expectations with its distributors
• Set out the type of information required from third parties to understand if their activities continue to support good customer outcomes
• Defined the standards that information should meet

 

Elsewhere in the same review, a distributor provided complaints data on a weekly basis, and the manufacturer retained the ability to request other Consumer Duty-related compliance documents as needed. 

That’s documented working practice, already sitting in the same review as the debt sale problem this piece has been building towards. Most distribution chains still rely on complaints data and contractual boilerplate, rather than the specific, structured expectations this smaller firm put in place.

But look closely at what this example actually covers. Both cases are about ongoing conduct monitoring: is the distributor selling within the target market, servicing the product as intended, generating complaints worth escalating. Neither is built around vulnerability data specifically, and neither assumes the relationship between manufacturer and distributor ends. Debt sale is the one point in a distribution chain where the relationship doesn’t continue. Once the sale completes, the seller has no ongoing commercial exposure to what happens next, and therefore no ongoing incentive to keep information flowing, even informally. The FCA’s examples assume an incentive structure that debt sale removes entirely.

Where vulnerability identification has to come from instead

If the relationship can’t be relied on to carry the data across, the buyer needs a way to identify vulnerability that doesn’t depend on anyone having agreed to share anything. This is what Know Your Vulnerable Customer (KYVC), Data On Demand’s vulnerability identification solution, is built to do:

• It combines the UK’s most comprehensive vulnerability data sources to identify, understand, and act on vulnerability signals in real time, matched to the individual customer rather than sourced from whichever firm held the account last
• A buyer can run a full portfolio through bulk enhancement within 24 hours of taking ownership, or match individual accounts in real time via API, independent of whether the seller ever compiled or passed on anything at all 
• Vulnerability identification becomes something the buyer can generate on day one, instead of something they’re dependent on inheriting

 

The FCA has shown what good distributor engagement looks like when the relationship survives the transaction. Debt sale is the test case where it doesn’t, and where the account needs a source of vulnerability data that doesn’t rely on anyone having agreed to share it in the first place.

The fix? Vulnerability data that moves with the account

None of this needs another policy layer. The FCA and ICO have already set out what’s expected. What’s missing is execution: whether vulnerability can be identified independently of the account’s history, rather than depending on whoever happened to service it last.

That’s the point this piece has been building towards. Identity and vulnerability signals tied to the customer, generated fresh by whoever holds the account today, instead of it being inherited from whoever held it before. For firms buying or servicing debt portfolios, that means being able to run an independent vulnerability check the moment an account changes hands, without waiting on anyone else’s records. See how KYVC does this. 

Further reading:

• What your current collections data isn’t telling you about your customers 
• New guide: The collections data advantage 
• Why investing in better vulnerability data pays off for customers and for business