The Financial Conduct Authority published its latest findings on payment firms' treatment of consumers in vulnerable circumstances on 17 September 2026. The review covers payment and e-money firms serving retail customers, including micro-enterprises and small charities, together with firms that distribute payment, e-money and open-banking services through intermediaries.¹
The publication introduces no new requirements and prescribes no single operating method. It gives firms current good and poor practice for assessing whether their arrangements understand customer needs, provide appropriate support and deliver good outcomes.¹
That status matters for senior owners. The immediate decision is how to demonstrate that an existing vulnerability framework works across the complete payment journey. A policy, staff training record or customer flag provides part of the evidence. The stronger operating record connects the need identified, the support provided, the journey outcome, the management response and any improvement that followed.
Start with the outcome the customer needs
The FCA found that stronger firms understood the characteristics of vulnerability most relevant to their customer base, recorded information consistently, tailored support, defined outcomes and used management information to improve their approach. It also found scope for stronger testing, more developed outcome monitoring, greater consistency and better intermediary oversight.¹
This moves the operating question beyond whether a vulnerability policy exists. A payment firm needs to identify the outcome at risk in each journey. A customer may need help completing onboarding, understanding a payment status, accessing funds, resolving a blocked account or using an alternative support channel. The evidence should show whether the response enabled that outcome within an appropriate time.
A useful journey record can connect five elements:
- the need or barrier observed, using only information required for the purpose;
- the customer journey and point at which it appeared;
- the support action, channel and accountable owner;
- the operational result and customer outcome; and
- any root cause, remediation and later effectiveness check.
This is an Asima operating recommendation. It turns separate product, support and compliance records into a sequence that management can test. Our article on auditability across the payment journey explains why durable decision evidence improves both customer experience and operational control.
Make digital journeys capable of recognising support needs
The FCA says digital or transactional business models can increase the potential for harm because customers may have limited opportunities to speak directly to a person. Its stronger-practice examples include prompts about support needs in online applications, testing through complaints and quality assurance, and technology that routes a potentially vulnerable customer to a human agent.¹
Digital identification should create a support opportunity. It should avoid turning a behavioural signal into a permanent conclusion about an individual. A repeated failed step, abandoned journey or request for help can trigger a clear choice of channel, extra time, simpler information or human review. The eventual record should state what the firm observed, what it offered and what happened next.
The control design also needs to recognise change. A customer may need support for one journey or period, while another customer may disclose a continuing need. Review dates, customer corrections and clear ownership help keep the record useful and accurate.
For automated journeys, teams should test more than technical completion. Test whether customers can disclose a need, reach the offered support, understand the next step and resume or exit safely. Segment those results where the firm has a lawful and proportionate basis to do so. The aim is evidence that the journey works for the people who use it.
Connect support actions to measurable results
The FCA's findings distinguish available support from support that produces a good outcome. Stronger firms designed support around identified needs, offered flexibility in time, channel or communication format, and tested their approach. Weaker evidence often failed to show how a recorded vulnerability led to tailored support or whether support was applied consistently.¹
Each support action therefore needs an observable result. Assisted onboarding might measure successful completion, repeat contact and later access problems. An alternative communication format might measure comprehension, task completion and complaints. Support during a frozen-account journey might measure contact availability, time to a permissible explanation and access to any urgent help the firm can provide.
Metrics require context. A faster handling time can coincide with an unresolved customer need. A low recorded prevalence of vulnerability may reflect weak identification. A fall in complaints may follow better service, limited access to complaint routes or a change in volume. Management should combine operational measures, customer feedback, complaints, quality assurance and sampled journey review before drawing a conclusion.
Use vulnerability data for a defined purpose
The joint FCA and Information Commissioner's Office statement says UK data-protection law permits firms to use or share personal information where doing so is appropriate and necessary to protect people or provide support. Firms still need to meet data-protection requirements, including lawfulness, fairness, transparency, purpose limitation, accuracy, data minimisation, storage limitation, security and accountability.²
The correct legal basis depends on the processing. The joint statement lists several Article 6 bases that may be relevant and leaves the firm to determine which one applies. Where the information is special-category data, such as health data, the firm also needs a separate Article 9 condition. High-risk processing can require a data protection impact assessment.²
Product and compliance teams should define the data purpose before choosing fields or detection methods. The record can focus on the support need and action where a detailed diagnosis adds no operational value. Access controls should follow the people and systems that need the information. Retention, correction and deletion rules should match the stated purpose.
Sharing across a distribution chain needs the same discipline. The joint statement describes aggregate or anonymised information that can support product review and circumstances where individual information may be needed to provide appropriate support or avoid foreseeable harm. It also emphasises transparency, accuracy, role clarity and suitable data-sharing arrangements.²
Close the evidence gap across intermediaries
The FCA found limited visibility in some firms over customers served through intermediaries. Stronger oversight used information from intermediaries, monitored complaints and outcomes, provided guidance or training and acted when evidence showed a problem.¹
This is particularly relevant to embedded and platform payments. The firm holding a permission, manufacturing a product or acting as principal may sit several steps away from the customer interaction. The intermediary may see the disclosure, failed journey or complaint first. The regulated firm may hold transaction states, service data and the authority to change the product.
The operating model should specify which party captures each fact, how support is handed over, what information can be shared, which outcome measures return to the product owner and when an exception requires escalation. Our analysis of principal and agent responsibilities provides relevant regulatory context for agent models. The exact allocation still depends on the parties' roles, permissions and activities.
Contracts and service schedules should make the evidence available in practice. The provider RFP scorecard sets out a method for carrying evidence requirements into implementation and in-life governance. It can be extended to cover support-channel availability, vulnerability-data handling, complaints, journey testing, remediation and exit records.
Supplier oversight also needs an end-to-end view. A customer outcome can depend on the platform, payment provider, bank interface, identity service, communications supplier and support operation. Our article on continuing ownership across critical third parties explains why supplier assurance remains an input to the firm's own service evidence.
Give boards decision-ready outcome evidence
The Consumer Duty Handbook requires firms to reflect the Duty in governance, leadership and people policies. It also requires a governing-body report on monitoring and at least annual review and approval of that report.³ The FCA's payment-sector findings add examples of useful evidence: prevalence and characteristics of vulnerability, customer outcomes, complaints, quality assurance, intermediary performance, root-cause analysis and evidence that changes improved results.¹
A board pack becomes useful when each measure answers a decision. Senior owners need to see the outcome expected, the population and journey covered, the threshold or qualitative test, the current result, the cause of any shortfall, the owner, the corrective action and the effectiveness check. A small number of connected measures can reveal more than a long inventory of activity counts.
The earlier FCA review of Consumer Duty implementation in payment firms reached a similar conclusion. Stronger management information linked measures to the Duty outcomes, used thresholds to trigger investigation, assigned owners and tracked remediation. The FCA also reported that creating a robust and sustainable management-information set was the biggest challenge for many firms in its sample.⁴
Boards should challenge gaps in the evidence as well as poor results. No recorded vulnerable customers, missing intermediary data or an unexplained difference between channels can indicate an identification or measurement problem. The response is a bounded investigation with a named owner and a date for reviewing what changed.
Run a proportionate evidence review
A firm can begin with one important customer journey and one clear outcome. Map where a support need can appear, which party can see it, what action is available, which data is lawful and necessary, and how success or harm becomes visible. Then test a sample of completed, abandoned, failed, complained-about and escalated journeys.
The review should leave four practical outputs:
- an outcome definition for the journey and customer groups in scope;
- an evidence map covering systems, teams, suppliers and intermediaries;
- a short management-information set with thresholds and accountable owners; and
- a remediation log that records whether each change improved the intended outcome.
This approach scales with the business model and risk. Smaller firms can use qualitative review and compact reporting where those methods provide enough insight. Larger or more intermediated services will usually need stronger data lineage, comparison across channels and formal supplier evidence.
The FCA's latest findings give payment firms a timely test of their current arrangements. The useful response is an operating record that shows how a customer's need changes the service they receive and how the firm learns when the result falls short.
Footnotes
- Financial Conduct Authority, payment-sector findings published 17 September 2026. Payments firms: delivering good outcomes for consumers in vulnerable circumstances
- Financial Conduct Authority and Information Commissioner's Office, joint statement on vulnerability-related data. Regulatory expectations regarding firms' approaches to vulnerability related data
- Financial Conduct Authority Handbook, current Consumer Duty rules and guidance. PRIN 2A: The Consumer Duty
- Financial Conduct Authority, payment-sector Consumer Duty findings. Payments Consumer Duty multi-firm review