Vulnerable customers: a process an outsourced team can follow

Key takeaways

A vulnerable customer process tells everyone who speaks to customers, including an outsourced team, how to recognise vulnerability, what to adjust and when to escalate. FCA guidance FG21/1 groups the drivers of vulnerability into health, life events, resilience and capability. A provider can follow the process well; designing it and handling complex cases stays with you.

• Four drivers: health, life events, resilience, capability.
• Train every customer-facing person, in-house or outsourced.
• Record only what is needed, with care under UK GDPR.
• Escalate complex cases to a named person.

What makes a customer vulnerable?

The FCA defines a vulnerable customer as someone who, due to their personal circumstances, is especially susceptible to harm, particularly when a firm is not acting with appropriate care. Its guidance names four drivers: health conditions, life events such as bereavement or job loss, low resilience to financial or emotional shocks, and low capability such as limited literacy or digital skills. Vulnerability can be temporary.

• Which business processes should you outsource?
• Customer-facing processes: outsource with care, not fear

What should the process tell an outsourced team to do?

Give the team clear steps: listen for signs, ask permission before recording anything about the customer's situation, make simple adjustments such as more time, a call back or a different channel, and escalate when the situation goes beyond those adjustments. Adjustments should be written down so every agent offers the same options.

• Listen for signs and do not assume.
• Ask permission before recording circumstances.
• Offer set adjustments: time, channel, call back.
• Escalate complex or urgent cases immediately.

• Escalation paths for outsourced teams: fast, not chaotic
• Complaints handling: what to outsource and what to own

How should vulnerability be recorded?

Health information is special category data under UK GDPR, so record only what is needed to help the customer, with their agreement where possible, and restrict who can see it. A short flag and the adjustment needed is often enough. Make sure your processor contract covers this data and that the outsourced team's access is limited.

• Processes with sensitive data: can they be outsourced?
• Data processing agreements for outsourcing

Which firms must follow FCA vulnerability guidance?

FCA-regulated firms, under the Consumer Duty and FG21/1, must show they treat vulnerable customers fairly and get good outcomes for them. Firms in other sectors are not bound by FCA guidance, but it is a sound model, and consumer law and equality duties still apply. Regulated firms keep responsibility when the contact is outsourced.

• Regulated processes: outsource the work, keep the duty
• Admin outsourcing for mortgage brokers

What does this look like in practice?

A pattern we see: agents want to help but are unsure what they are allowed to offer. A written list of adjustments they can make without asking removes the hesitation and makes the experience consistent.

• See client work
• BPO Solutions for UK businesses

Vulnerable customer checklist

Put these in place for every customer-facing team.

• A written definition and the four drivers.
• A list of adjustments agents can offer.
• Recording rules agreed under UK GDPR.
• A named escalation contact.
• Training for in-house and outsourced staff.
• Quarterly review of outcomes.

• Customer service processes: which ones to outsource
• Caller verification: confirm identity before you discuss accounts

Next step

Tell us how your team handles customers in difficult circumstances today. We will suggest a process an outsourced team could follow alongside yours.