Vulnerability Complaints Data: Recording the right Information?
New FCA complaints reporting requirements take effect from 1 January 2027.
This change is very much in line with the FCA’s general direction of travel, placing the focus of vulnerability recording and reporting firmly on the outcomes that vulnerable customers receive. The requirements mean that firms will need not just to identify vulnerable customers, but to record information that demonstrates whether their needs have been understood, addressed and reflected in the outcomes they receive.
More data does not automatically mean better outcomes
FCA regulated firms have spent considerable time developing their approaches to identifying customers in vulnerable circumstances. Staff receive training, policies define the characteristics of vulnerability and systems have been amended to include flags and dedicated fields to record relevant information.
The new reporting requirements mean we need to take this a step further and ensure that we’re recording information that actually helps us to make better decisions and identify where customers may be experiencing harm.
The new arrangements will require firms to capture two distinct data points relating to vulnerability:
Complaints involving customers identified as being in vulnerable circumstances;
Complaints relating to, or caused by, a firm’s failure to consider or respond to a customer’s vulnerability.
These are related, but importantly are aiming to identify two very separate things. One will provide the FCA with information about customers involved in a complaint, the other highlights a potential failure in the firm’s treatment of its customers.
This distinction has implications beyond regulatory reporting and means an audit of the firm’s approach to identifying and recording harm to vulnerable customers is required. We’ll need to think about the quality of existing records, the effectiveness of staff prompts, the design of complaints processes and the extent to which vulnerability information informs decisions in practice.
The FCA’s policy statement confirms the changes and the first reporting period, which will run from 1 January to 30 June 2027. Firms affected by the new requirements should ensure that the necessary data is being captured from the start of that period.
The first requirement concerns complaints where the firm has identified the customer as being in vulnerable circumstances, regardless of how that information came to light. The vulnerability does not have to be directly relevant to the complaint.
For example, a customer who has previously disclosed a hearing impairment might complain that an online portal is difficult to navigate for reasons unrelated to hearing or communication. If the firm has identified the customer as being in vulnerable circumstances, the complaint falls within this first category.
The second requirement concerns complaints that relate to, or are caused by, the firm’s failure to consider or respond to the customer’s vulnerability. In this case, the vulnerability is relevant to the complaint itself.
For example, think about a customer who has disclosed memory difficulties but continues to receive lengthy, complex correspondence without appropriate adjustments. If the customer subsequently complains that they could not understand the information provided, the complaint may fall within both categories: the customer has been identified as vulnerable, and the complaint relates to the firm’s failure to respond appropriately to their needs.
This distinction matters because the two categories tell firms different things.
The first helps establish the extent to which complaints involve customers in vulnerable circumstances. The second provides a more direct indication of where the firm’s processes, communications or support arrangements may have failed those customers.
A firm that records only whether a complainant is vulnerable may be able to count complaints, but it may struggle to establish whether its treatment of customers is contributing to the problems being reported.
From identifying vulnerability to recording its implications
The new reporting requirements provide a useful opportunity to review a more fundamental issue: what information does the firm actually need to record when it identifies a customer in vulnerable circumstances?
Knowing only that the customer has a health condition or has limited financial resilience does not necessarily tell a member of staff what they should do differently. We need to think about what the information means for the customer’s interaction with our firm.
A customer experiencing bereavement may need additional time to deal with financial matters. Someone with limited financial resilience may need a careful assessment of their ability to maintain repayments. A customer who struggles with written communication may benefit from information being explained verbally, presented in a different format or broken into manageable steps.
Records should capture the practical implications of a customer’s circumstances rather than simply the existence of their vulnerability.
A record stating that the customer has disclosed a mental health difficulty is less useful than a record explaining that the customer has requested a particular communication method or that they need time to process information.
This doesn’t mean that staff should make assumptions about what a diagnosis or life event implies. Nor should customers be expected to disclose extensive personal information to receive reasonable support. The firm’s approach should be based on the information necessary to understand the customer’s needs.
The practical implication is that firms need to translate this understanding of individual customer needs into processes for recording and using vulnerability information. This is particularly important where the new requirements apply, as firms will need to capture relevant information accurately.
What should firms do before 1 January 2027?
Firms affected by the new requirements should use the period before implementation to assess whether their existing systems and processes can capture the necessary information accurately and consistently:
Map the existing data. Review where vulnerability information is recorded across CRMs, complaint systems, call handling tools and other records and identify any duplications or gaps.
Test the two complaints categories. Use realistic examples to establish whether staff can distinguish complaints involving identifies vulnerable customers from complaints relating to, or caused by, a failure to consider or respond to vulnerability. Confirm that a complaint can be captured in both categories where the criteria are met.
Review staff prompts and procedures. Check whether prompts help staff identify needs, establish appropriate support and record actions taken.
Check data protection arrangements. Confirm that the purposes for processing are clear, the lawful basis and any applicable special category condition are documented, access is appropriately controlled and retention arrangements are appropriate.
Test the information journey. Follow a sample of customer cases and check whether information remains accessible, accurate and useful.
Use quality assurance to test outcomes. Review whether recorded adjustments were implemented and whether complaints indicate recurring failures. Where problems are found, identify root causes and assign responsibility for corrective action.
Ensure staff record the right information in the first place
Our vulnerable customers online training course helps staff to understand how vulnerability can affect customers’ needs, recognise when additional support may be appropriate, and apply the FCA’s expectations in practice. For firms preparing for the changes coming into effect on 1 January 2027, it is a useful way to reinforce staff understanding and support a consistent approach to identifying and responding to customer needs.
Comments