Why complaints and disclosure aren't enough to measure vulnerability

Financial services firms received 1.87 million complaints in the second half of 2025 alone. That’s the dataset most firms lean on to understand how their customers are doing.

But there’s a caveat. 

The FCA’s July review of products and services looked at what firms actually do with data like that, and found one relying almost entirely on complaint volumes to understand customer outcomes. Meanwhile, a few pages later, it praised the opposite approach. Firms tracking product usage trends. Firms watching for spikes in early cancellations.

The FCA criticised the first. It praised the second. In other words, this is the clearest signal yet that behavioural data belongs at the centre of vulnerability MI, alongside complaints and disclosure rather than behind them.

Key takeaways from this article: Complaints are a lagging measure. By the time one lands, the harm has usually already happened Disclosure depends on the customer volunteering something. Most people who meet the FCA’s own characteristics of vulnerability never do Both measures undercount in the same direction. They only capture the vulnerability someone else decided to surface The FCA’s July review shows what it’s actually rewarding instead: usage trends, cancellation spikes, behavioural signals ahead of any complaint or disclosure A forward-looking data approach means acting on indicators before they become a complaint or require a disclosure

 

Why complaint data undercounts vulnerable customers 

Only 57% of consumers who disclosed their vulnerability felt that their provider cared, and 58% said their provider made changes as a result, according to the FCA’s March 2025 review.

Disclosure is also uneven in a way that compounds the problem. Not every vulnerability is equally easy to say out loud. The FCA’s own July newsletter highlighted the charity Money and Mental Health’s work with firms tackling gambling-related harm through its Gambling Harms Action Lab, one of the clearer examples of a vulnerability that carries real social stigma. A customer struggling with debt from a bereavement or an illness will often mention it without much prompting. Far fewer will volunteer that gambling is behind their arrears, even when it’s actively shaping every payment decision they make.

Complaints fare no better, for two separate reasons.

The first is the more obvious one. The FCA’s July review found a smaller firm relying almost entirely on complaint volumes as an indicator of customer outcomes, which risked limited visibility of issues that never generated a complaint but still led to poor outcomes. Complaints only capture the customers who complained.

The second is harder to spot, and more common. Even where complaints data exists, it’s often not built to address the most pressing issues. For instance, the FCA’s separate complaints and root cause analysis review, covering 40 firms and refreshed this July, found that firms capturing complaints MI often couldn’t break it down by customer type granular enough to show outcomes for those with characteristics of vulnerability.

Put those two findings together, and the real weakness comes into view:

• Complaints don’t just miss the harm that never became a complaint
• Even the complaints that do land often can’t tell a firm whether the customer behind them was vulnerable in the first place

 

A firm can show a board a clean, low complaints rate for its vulnerable customer population and be reporting an MI gap rather than a genuine outcome. Without the granularity to separate that cohort out, “no complaints” and “no harm” become indistinguishable, and a governance report built on that data is reassuring the board about something it can’t actually see.

What the FCA is actually pointing towards

Only 36% of firms use behavioural insights data to understand how customers in vulnerable circumstances are actually faring, according to the FCA’s own survey of the market. Compare that with 49% relying on direct customer feedback and 29% on referral and take-up rates for additional support, and behavioural data comes out as the least-used source of the three, despite being the one that doesn’t depend on the customer saying anything at all.

That’s what the July review is pointing firms towards closing. It names two specific indicators directly:

• Monitoring product usage, and reminding customers of benefits they weren’t using

• Tracking spikes in early cancellations, a signal that a customer didn’t understand what they’d bought

 

Both arrive earlier than a complaint or a disclosure ever could, and neither requires the customer to do anything except behave as they normally would.

The FCA’s review backs this with a concrete example: one firm introduced a self-serve option for rearranging loan repayment dates and amounts, based on customer feedback and competitor research. A product response built around a behavioural pattern, rather than something waiting on a complaint or a disclosure to reach the business first.

Firms doing this well treat behaviour as the earliest available evidence, ahead of anything the customer says or complains about. Right now, that’s still the minority approach.

What a forward-looking data approach involves

For collections and credit risk teams specifically, this means building MI on continuous behavioural signals rather than periodic snapshots triggered by a complaint or a disclosure event. A quarterly vulnerability review, however thorough, only ever captures a point in time. Meanwhile, the customer’s circumstances have often moved on well before the next one.

The categories that count for this audience are specific:

• Usage and engagement patterns across products and channels
• Early repayment or arrears behaviour, ahead of formal default
• Contactability changes, a disconnected number or a returned letter, often the first sign something has changed
• Life-event indicators that show up in data before they show up in a conversation

 

Collecting the right categories doesn’t achieve much on its own if that data sits apart from where decisions actually get made. The FCA’s own review found that many firms had already started collating complaints, feedback, and query trends into single “Voice of the Customer” dashboards, giving product governance one clear view of customer trends instead of several disconnected reports. Take this a step further, and the firms it praised had folded behavioural data into that same view, instead of tracking it separately in a system nobody at governance level was routinely looking at.

That’s what firms should take from this: build behavioural categories into the same governance dashboard as complaints and feedback, so a board reviewing customer outcomes sees behavioural signals alongside everything else, instead of having to go looking for them in a separate report.

Each of these categories is available well before a customer complains or discloses anything. As a result, reactive vulnerability management responds once a customer has already reached out, fallen behind, or made a formal complaint. Proactive identification, meanwhile, acts on what the data is already showing, before any of that happens.

That’s the direction the regulator has consistently pointed towards across its recent publications, and the standard the better firms in its own reviews are already meeting.

Complaints and disclosure alone can’t catch vulnerability early

Complaints and disclosure will always play a role. Neither should be dropped. But the FCA’s own review confirms neither was designed to catch vulnerability early. The firms it praised had built behavioural monitoring alongside complaints and disclosure.

Here’s why that’s worth weighing carefully. A firm can be doing everything the regulator asks of complaints handling and disclosure encouragement, and still always be late, because both routes depend on the customer reaching a point where they choose to speak up. Instead, behavioural data removes that dependency entirely. And that’s the difference between an MI framework that reports what customers have already decided to tell you, and one that tells you something is changing regardless of whether they ever do.

Talking of behavioural data, this is where Know Your Vulnerable Customer (KYVC), Data On Demand’s vulnerability identification solution, fits. It draws on continuous behavioural and alternative data signals to surface vulnerability earlier, catching the same customers sooner, while their circumstances are still easier to support. Learn more about KYVC.