How to run a vulnerable customer review under Consumer Duty.
I am not a law firm, and I am not a compliance monitor. If you need a legal opinion on the Consumer Duty, instruct a lawyer. If you need someone to run your compliance monitoring, that is a different job. What follows is how I would help a fintech or insurtech run a vulnerable customer review: a practical look at whether customers in vulnerable circumstances are getting fair outcomes, and what you would change as a result.
I have done customer work inside a large regulated firm, including at Standard Life, and I have delivered customer-vulnerability research for a UK bank. The shape of the review is the same in a small, remote-first firm. The scale is not. You do not need a long framework before you can see anything. You need a clear view of where harm can show up, and a short list of changes someone owns.
The FCA has already set the frame. In its guidance for firms on the fair treatment of vulnerable customers (FG21/1), a vulnerable customer is someone who, due to their personal circumstances, is especially susceptible to harm. The guidance groups the drivers as health, life events, resilience and capability. The Consumer Duty then asks firms to pay attention to whether customers in those circumstances get good outcomes. I use those FCA sources as the brief. I do not invent a private definition, and I do not cite anyone else.
Name the customers and the journeys
Start with your actual book, not a generic persona. Which products do you sell, and which moments matter: onboarding, a claim, a complaint, a cancellation, arrears, or a bereavement? In a small insurtech the list is often short. Write it down. A vulnerable customer review that tries to cover every possible life event on day one will stall. Pick the journeys where a customer can lose money, lose cover, or get stuck and not know what to do next.
For each journey, ask three questions. What do we assume about the customer, including time, confidence, health and income? Where does the journey only work if they disclose something personal? What happens if they do not? Read the FCA's multi-firm review of firms' treatment of customers in vulnerable circumstances before you answer. Product and service design, and outcomes monitoring, still need work across the market. A support script added at the end does not fix a product that only works for a confident, well customer.
If you want the wider context of that review, and what it means for proposition design, I have written that up separately. This piece is the working version: what I would actually do with a founder or a customer lead over a few working sessions.
Look at design, not only at the helpline
Map the journey as the customer meets it, including what is digital and what is human. Note the points where someone in vulnerable circumstances has to repeat themselves, prove something hard, or wait without knowing why. Then look at the product rules, not just the tone of the emails. Eligibility, exclusions, fees, and the path to a human being are design choices. If the only way to get help is to know the right words, you will miss people, and you will not know that you missed them.
I would sit with the people who actually take the calls or read the chats, even when that is a founder and one colleague. Frontline interviews tell you where the process and the policy diverge. On the UK bank work, journey mapping and frontline interviews informed stronger external-referral options in serious circumstances. That is the standard I use: a change a customer would notice, not a new label in a policy document that nobody on the front line has read.
Check whether you can see the outcome
A review that only counts training sessions has not finished. Pick a small set of outcomes you can already measure, or sample by hand if the book is still small. Did the complaint get a fair answer? Did the customer keep the cover they needed? Did they reach a person when the app was the wrong tool? Did a referral actually happen? Write down what you cannot see. Gaps in the data are findings.
The Consumer Duty asks for evidence. For a fintech, evidence can be a sample of real cases, a journey map with the failure points marked, and a note of what you changed. It does not have to look like a large insurer board pack. What matters is that a founder, a product lead, or a customer lead can explain the choice in plain language, and that your compliance colleague can see you have not wandered into giving legal advice. I will not do that. I am not a law firm, and I am not sitting in as your compliance monitor.
Close with owners
End with a short action list. Each item needs an owner, a change to the journey or the product, and a date you will look again. Separate what you will do now from what you will not do, and say why. Share it with the founder or the customer or product lead, and with whoever owns compliance, so the review does not sit in a slide no one uses. If an action needs a lawyer, write that down and stop there. Do not let a customer workshop drift into interpreting the Handbook.
If you want me to run this with you, I work as a Consumer Duty consultant with founders and customer or product leaders at remote-first fintech, insurtech, femtech and small agile firms. The Consumer Duty page sets out how that help is shaped. I will say on the first call if a lawyer, or your own compliance team, should lead instead of me.