Over the last couple of years, the conversation around vulnerable customers has (to some) felt like a tactical compliance task, a series of checks completed because they must. But is it time to shift this mindset as we move into the new year?
Perhaps 2026 should be the year that firms place duty of care at the absolute centre of their business strategy and culture- and start to see it as a primary business driver.
Identifying and supporting vulnerable customers has always been a core pillar of the Consumer Duty. However, the FCA’s finalisation of Policy Statement 25/19 in December 2025 has shifted the goalposts substantially.
Vulnerability identification is now a mandatory data requirement for complaints reporting. For the first time, starting in 2027 (with systems needing to be ready throughout 2026), firms must quantify:
1. All complaints where the customer was vulnerable.
2. All complaints where the root cause was the firm’s failure to consider or respond to that vulnerability.
This is big! The regulator is no longer just asking if you have a policy; they are asking for the data to prove your policy works. And of course, it’s not only important to understand who is vulnerable – it’s also just as important to prove who isn’t vulnerable too.
According to the FCA’s Financial Lives 2024 Survey (published May 2025), 49% of UK adults (that’s roughly 26.4 million people) display one or more characteristics of vulnerability at any time.
That means that 1 in 2 adults in the UK are considered vulnerable. So, if your firm is still reporting identification rates of 1% to 5%, you aren't looking at a low-risk portfolio. You are looking at a substantial detection gap. And this is also reflected in our data too (out of our 30,000 assessments per month). And this detection gap is where regulatory risk lives and breathes. As such, this is no longer a side-line project. Rather vulnerability has become your core business model. A ‘tactical’ approach can handle a small percentage of these vulnerable clients. But I would argue it cannot handle anywhere near the 50% we’re witnessing. Rather you need a strategic, scalable framework to manage that volume. And this is exactly why we must start thinking about duty of care strategically instead of tactically as we move into 2026.
For many years, vulnerability has been treated by many in financial services as a tactical checkbox, a data point to be captured, a box to be ticked, and perhaps (dare I say it) a file to be closed. But under the FCA’s Consumer Duty, the goalposts have moved. The regulator isn't just looking for a process; they are looking for good outcomes for all. But let’s be honest, if you treat vulnerability as a tactical impactor, you are always going to be playing catch-up. You will be reacting to problems rather than anticipating future needs. A tactical checkbox approach is fragile. It fails under pressure and leaves both the firm and the client exposed. No one wants this.
It’s time to treat duty of care as a strategic driver. When you bake identification and the support of vulnerable clients into your core strategy, good outcomes aren't just something you might hope for, they can become an everyday occurrence. The real fabric of your organisation. Trust will also increase. Clients will feel seen and protected, leading to long-term loyalty. Your employees will also feel reassured that you are doing the right thing and ingraining this within your business ethos. They will also reward you with their retention and loyalty. Your risk will also decrease too. This is because early identification prevents poor outcomes well before they happen. And, perhaps most importantly, you will have the consistent, robust evidence and data that the FCA demands.
Let’s be clear - the FCA is no longer satisfied with intent; they demand evidence. By elevating duty of care from a compliance requirement to a strategic driver, firms can leverage data to build a gold standard audit trail. This will not only demonstrate real-world value to clients but also satisfy regulatory rigor.
Ultimately, prioritising vulnerable customers shouldn’t be seen as an overhead – rather it should be seen as part of your growth strategy. It is time to stop viewing duty of care as a hurdle and start seeing it as your most significant competitive advantage and business enabler in 2026.
