Vulnerability in mortgage business should be treated as an operating issue, not a label added to the customer record. The FCA expects firms to recognise where personal circumstances make a customer especially susceptible to harm and to take appropriate steps so that those customers receive outcomes as good as other customers.
Mortgage journeys can create particular vulnerability risks because the decisions are large, long-term and often made during significant life events. Customers may be buying a first home, divorcing, dealing with bereavement, borrowing into retirement, consolidating debts or struggling with payments. A customer who appears resilient when the mortgage is arranged can become vulnerable later in the relationship.
The FCA's vulnerability guidance remains relevant and was updated again in July 2026. Its March 2026 joint statement with the Information Commissioner's Office also addresses a practical concern that has sometimes discouraged firms from acting: data protection law does not prevent firms from processing vulnerability-related information where this is done lawfully, fairly and responsibly to support good outcomes.
Use the FCA's drivers as a framework, not a checklist
The FCA's vulnerability framework identifies four broad drivers: health, life events, resilience and capability. These are useful because they help firms recognise the different reasons a customer may be more susceptible to harm, but they should not become a mechanical questionnaire in which one positive answer automatically determines the same treatment for every customer.
Health can affect communication, decision-making or the practical ability to complete a mortgage journey. Life events such as bereavement, divorce or redundancy can alter both financial and emotional circumstances. Low resilience can make a small payment shock materially harmful, while capability can affect how well the customer understands complex choices or digital processes.
The important question is what the customer's circumstances mean for the service being provided. Two customers with the same vulnerability driver may need very different adjustments, and another customer may need no special treatment beyond clear communication.
Firms should therefore train staff to identify needs rather than diagnose conditions. The objective is not to build a medical profile of customers. It is to understand where the normal process may create a poorer outcome and what proportionate change would help.
Mortgage advice should show how vulnerability affected the recommendation
For an advice firm, vulnerability can be relevant to both information gathering and suitability. The adviser should understand whether the customer's circumstances affect their objectives, risk tolerance, ability to sustain payments or need for particular product features.
Borrowing into later life is one example. Age alone does not make a customer vulnerable, but retirement, health, reduced income flexibility or reliance on a future repayment strategy can make certain facts more important to the recommendation. The adviser should evidence those facts rather than make assumptions based on age.
Debt consolidation can create another vulnerability risk. A customer under financial pressure may focus on the immediate monthly saving and pay less attention to the consequences of securing unsecured debt or extending the repayment term. The adviser should ensure that the trade-offs are explained in a way the customer can understand.
The file should show what changed because of the customer's needs. If the firm identifies vulnerability but the advice, communication and support are identical to the standard journey, management should be able to explain why that was still appropriate.
Lenders should connect vulnerability with affordability and support
For lenders, vulnerability can interact with responsible lending and later customer support. The affordability assessment should use the information relevant under MCOB, while the wider Consumer Duty framework requires the firm to consider whether customers in vulnerable circumstances receive appropriate outcomes.
Low financial resilience can be particularly significant. A mortgage may be affordable under the lender's model while leaving the customer with limited capacity to absorb future shocks. That does not automatically mean the lender should decline the application, but product design, stress testing and support arrangements should be capable of addressing the foreseeable risks associated with the firm's target market.
The FCA's second charge work is relevant because many customers in that market have high debt levels and lower financial resilience. The regulator expects firms to review whether their advice and affordability processes deliver good outcomes for those customers.
Vulnerability can become more important after completion. Illness, job loss, bereavement or relationship breakdown may change what support the customer needs. Servicing teams should therefore be able to recognise and respond to changed circumstances rather than rely only on information captured at origination.
Consumer understanding may require different communication
Mortgage information can be complex even for experienced customers. Where vulnerability affects the customer's ability to process information, the standard communication may need adjustment.
That can mean providing more time, using a different channel, explaining a decision in simpler language, allowing a trusted third party to assist where appropriate or offering information in an accessible format. The correct response depends on the customer's needs rather than a fixed vulnerability playbook.
Timing matters. A customer dealing with bereavement or financial distress may struggle to make a significant decision during one call. A process built around speed can therefore create harm if staff feel pressure to complete every interaction immediately.
The FCA's March 2026 consumer understanding work is relevant because it emphasises design, testing, monitoring and governance. Firms should consider whether communications work for the range of customers they serve, including people who may need additional support.
The practical evidence can come from complaints, call reviews, repeated questions, digital journey failures and customer feedback. If vulnerable customers consistently struggle at one stage, the firm should treat that as a design issue rather than simply an individual servicing problem.
Data protection should enable, not block, appropriate support
Firms have sometimes worried that asking about vulnerability or recording sensitive information could conflict with data protection law. The FCA and ICO's joint statement in March 2026 is intended to give firms greater confidence in applying both regimes together.
The key is lawful, fair and responsible processing. A firm should collect information that is relevant to delivering the service and support, explain how it will be used and apply appropriate access, retention and security controls.
This does not justify collecting every possible detail. In many cases the firm needs to know the effect on the customer's needs rather than the full medical or personal history behind it. Recording "customer needs extra time and written follow-up after calls" may be more useful operationally than extensive sensitive detail that staff do not need.
Where information needs to be shared within a group or with a service provider, the firm should consider both the regulatory purpose and the applicable data protection requirements. A vulnerability framework works best when the right staff can see the support need without exposing unnecessary personal information more widely.
Financial difficulty can create or amplify vulnerability
Customers in mortgage payment difficulty often have one or more vulnerability drivers. Financial pressure itself can reduce resilience, while the event causing the arrears may involve illness, bereavement, job loss or relationship breakdown.
The firm's arrears and forbearance process should therefore connect with the vulnerability framework. A customer should not need to repeat sensitive circumstances at every contact because different teams cannot see the relevant support information.
For lenders and administrators, appropriate forbearance remains a separate MCOB requirement. Vulnerability does not dictate one particular solution, but it can affect how the firm communicates, what evidence it requests and how quickly it expects the customer to make decisions.
Brokers can also encounter existing customers who return because their circumstances have changed. The firm's service should make clear what support it can provide and when the customer needs to speak directly with the lender or a free debt advice organisation.
Historic FCA work on mortgage arrears should not be presented as current supervisory authority where it is now marked historical. Firms should instead use the current MCOB rules, Consumer Duty material and current FCA vulnerability guidance.
Outcomes monitoring should compare experience, not just identification rates
A common weakness is to report how many customers were identified as vulnerable without assessing whether those customers received appropriate outcomes. A rising identification rate can actually be positive if staff have become better at recognising needs.
The more useful analysis compares relevant outcomes. Complaints, abandoned journeys, support contacts, file review results, arrears, time to resolution and customer feedback can each show whether customers in vulnerable circumstances experience materially different results.
Segmentation should be proportionate. A small firm does not need dozens of vulnerability categories, but it should be able to detect a meaningful pattern where one group consistently receives a worse outcome.
Management should also understand where the data is weak. If vulnerability is recorded inconsistently, a dashboard showing no difference between customer groups may simply reflect poor identification rather than good outcomes.
The FCA's Consumer Duty outcomes-monitoring work makes this point more broadly. Data should enable the firm to understand what customers are experiencing and act before harm becomes entrenched.
ARs and outsourced providers need the same outcome standard
Mortgage principal firms should consider vulnerability within AR oversight. The principal remains responsible for regulated activity within the AR appointment and should be able to identify whether one AR has materially different vulnerability identification, advice quality or support outcomes.
The objective is not to force every AR to use identical wording. The principal should define the outcome and minimum controls, then use monitoring to determine whether customers receive the appropriate support in practice.
Lenders using outsourced servicing providers have a similar challenge. A contract requiring fair treatment is not enough if the lender cannot see whether vulnerable customers are experiencing long waits, repeated evidence requests or poor communication.
The regulated firm should therefore obtain the MI and assurance necessary for its role. Vulnerability should not disappear from governance simply because another firm controls the customer interaction.
What should management test in 2026?
A useful vulnerability review should trace real customer journeys from identification through to outcome. Management should test whether staff recognise relevant indicators, whether information is recorded proportionately, whether adjustments are available and whether those adjustments actually change the customer experience.
The review should also test data protection in practice. Staff should understand what can be recorded, who can see it and when information should be updated or deleted. Fear of processing personal data should not become an excuse for failing to support customers, while over-collection creates its own risks.
Mortgage firms should then connect vulnerability with advice QA, affordability, Consumer Duty, arrears and AR oversight. The strongest framework is one in which the customer's support need follows the journey rather than sitting in a separate policy that operational teams rarely use.
How Regulatory Counsel can support
Regulatory Counsel supports mortgage brokers, lenders and networks with vulnerable customer frameworks, Consumer Duty, advice QA, customer journey reviews, outcomes monitoring and regulatory remediation.
We can review policy design, operational implementation or a representative sample of customer cases.
Speak to Regulatory Counsel to discuss a vulnerable customer review.
Frequently Asked Questions
The FCA identifies health, life events, resilience and capability as four broad drivers that can increase a customer's susceptibility to harm.
No. Age or later-life borrowing does not automatically make a customer vulnerable. Firms should consider the customer's actual circumstances and support needs.
Yes where it has a lawful basis and complies with relevant data protection requirements. The FCA and ICO published a joint statement in March 2026 explaining how firms can deliver good outcomes while processing personal information responsibly.
No. Vulnerability does not dictate one product outcome. It may affect the advice, communication, support or other treatment required to achieve an appropriate outcome.
Yes. We can assess identification, staff processes, communication, data governance, advice, Consumer Duty outcomes and monitoring.