How to Identify, Record and Support Vulnerable Customers: A Practical Guide for UK Mortgage Advisers

Most mortgage advisers know they should be doing something about vulnerable customers. Fewer have a clear, consistent process for actually doing it.

That gap matters more than it used to. The FCA's review of vulnerable customer outcomes, published in early 2024, found that most firms could not effectively monitor whether customers in vulnerable circumstances were receiving fair treatment. The regulator described weak identification, inadequate support, and poor documentation as widespread problems across financial services. Not isolated cases. Widespread.

The scale of it is larger than many advisers expect, too. The FCA's Financial Lives 2024 survey of nearly 18,000 UK adults found that 49% exhibited at least one characteristic of vulnerability, whether that was a health condition, a recent life event such as bereavement or redundancy, low financial resilience, or limited capability with financial products. That is not a fringe group. That could be every other client you see this week.

With the FCA's Mortgage Rule Review now underway, protecting vulnerable consumers has been named as one of its four priority themes. The expectation on advisers to get this right is only going in one direction.

This guide is written to be practical. It covers the full process: how to spot vulnerability during fact-find, how to record it in a way that withstands scrutiny, how to adapt your advice where it is needed, and how to build this into your workflow rather than treating it as something you revisit during compliance training once a year.

---

Why this is getting more scrutiny, not less

Consumer Duty, which came into force in July 2023, placed a specific obligation on firms to actively consider the needs of customers in vulnerable circumstances. Unlike earlier FCA guidance, which was largely principles-based, Consumer Duty requires firms to demonstrate outcomes rather than intent.

That means your compliance team, or your network, cannot simply point to a written policy and call it done. You need to show how you identify customers who may be vulnerable, what you actually did differently as a result, how you recorded the conversation, and whether the outcome was appropriate for their circumstances.

The FCA's Mortgage Rule Review, launched in 2025, explicitly includes vulnerable consumers in its reform agenda. The regulator is looking at how to better support victim-survivors of economic abuse, customers with variable income, and those with more complex financial circumstances. Policy development in this area is expected to run into 2027.

---

Understanding the four drivers of vulnerability

The FCA defines a vulnerable customer as "someone who, due to their personal circumstances, is especially susceptible to harm, particularly when a firm is not acting with appropriate levels of care."

One thing worth understanding from the outset is that vulnerability is not a fixed state. A client who is entirely capable in one meeting may disclose a health diagnosis, a relationship breakdown, or a job loss six months later. The FCA groups the triggers into four categories.

Health covers physical disability, severe or long-term illness, mental health conditions, cognitive impairment, and hearing or visual difficulties.

Life events include bereavement, redundancy, relationship breakdown, separation, caring responsibilities, retirement, and domestic abuse.

Resilience relates to low or erratic income, significant debt, limited savings, and a reduced ability to absorb financial shocks. The FCA's 2024 data shows that one in ten UK adults has no cash savings at all, with a further 21% holding less than £1,000.

Capability covers limited financial literacy, low confidence managing money, language barriers, or low digital literacy.

A client does not need to tick multiple boxes. A single significant life event, a bereavement or a serious diagnosis, can make an otherwise capable person temporarily vulnerable to making poor financial decisions.

---

Spotting vulnerability: what to look and listen for

No adviser can read minds, and some clients will not disclose personal circumstances even when directly asked. That said, there are consistent behavioural patterns that tend to show up.

During your initial conversation, watch for confusion about information already given, or clients asking the same questions more than once. Pay attention to signs of distress or anxiety when finances come up, or comments that reveal a recent significant change, even when said in passing ("my partner used to handle all of this"). Some clients will seem rushed or under pressure in a way that does not quite fit the situation.

During fact-find, keep an eye on income that appears to have dropped sharply or become irregular, high levels of existing debt relative to what they earn, arrears, or confusion about what they currently own, owe, or pay each month.

A useful framework here is the BRUCE model, used in financial services training. It stands for Behaviour (is the client acting out of character or showing signs of distress?), Remembering (are they struggling to recall information or losing their thread?), Understanding (can they summarise back what you have explained?), Communicating (is there anything affecting their ability to engage clearly?), and Evaluate (what is the overall picture?).

This is not a diagnostic tool and you are not a clinician. Working through these questions mentally during a meeting does help ensure vulnerability does not go unnoticed simply because the client seemed fine at first glance.

---

What to do when you suspect vulnerability

Step 1: Slow down and create space

Do not push through the fact-find at pace. Take additional time to check understanding. Ask open-ended questions: "Can you tell me in your own words what you are hoping to achieve here?" or "Is there anything you are worried about that we have not covered yet?"

If the client seems distressed, acknowledge it gently and directly. Something like: "It sounds like things have been quite difficult recently. There is no rush at all, so please take your time."

Step 2: Assess what the vulnerability means for this transaction

Not every instance of vulnerability calls for the same response. A client with mild anxiety who functions well when given clear written summaries needs something quite different from a client who has recently left a financially abusive relationship and may have had financial decisions made for them without their full understanding.

Ask yourself whether this vulnerability affects their understanding of the product or the advice. Does it affect their capacity to consent or to make a free, informed decision? Are there third parties involved whose influence you need to understand? Is there an urgency to the transaction that may be placing inappropriate pressure on them?

Step 3: Adapt your process accordingly

The FCA does not expect you to decline to advise vulnerable clients. It expects you to adjust how you advise them. Reasonable adjustments include providing written summaries of verbal advice in plain English, allowing additional time between meetings so the client can seek support from someone they trust, sending a follow-up email with key points before any documents are signed, and encouraging involvement of a trusted friend or family member where appropriate. Be thoughtful here, though: in cases of financial abuse, the person a client might naturally turn to could be part of the problem.

Where a situation genuinely goes beyond your expertise, refer the client on and document that you did so.

---

The part most advisers get wrong: documentation

Identifying vulnerability and adapting how you work is only half of what the FCA is looking for. The part that most frequently falls short in reviews is the documentation.

Your case file needs to show what you observed. Note the specific behaviours or disclosures that led you to identify potential vulnerability. "Client mentioned that her husband had recently passed away and that he had always managed their finances" is far more useful than "client may be vulnerable." One of those tells a story. The other tells a reviewer almost nothing.

Record how you assessed the situation: what questions you asked, what you considered, and whether you used any framework or checklist. Document what you actually did differently as a result, and if you took no special action because the vulnerability had no bearing on the advice, write that reasoning down too.

Evidence that the client understood the recommendation. Did they ask questions that suggest comprehension? Did they have someone supporting them through the process?

If you signposted to another service, whether debt advice, a GP, or legal support, record that as well.

This documentation should sit within your case file, not in a separate spreadsheet or a folder that never connects back to the mortgage record. The FCA's concern with most firms is precisely that vulnerability gets identified somewhere, but is then never integrated into how the advice is actually recorded and given.

---

Building vulnerability into your workflow, not onto it

The most common failure is not that advisers do not care about vulnerable customers. It is that the process becomes an afterthought: a section of the fact-find that gets skimmed over, or something that surfaces during training but not during live client meetings.

The fix is embedding it in the standard client journey rather than treating it as a separate task.

At fact-find stage, include a structured prompt covering the four FCA vulnerability drivers. It does not need to feel like a questionnaire. Frame it as part of getting to know the client: "Before we go through everything in detail, is there anything going on in your life at the moment that you would want me to be aware of? Health, family, work, anything really that might affect how we work together?"

At recommendation stage, before presenting anything, revisit what you have recorded. Does the product you are recommending still make sense given the client's full circumstances? Is the level of complexity appropriate?

Before case submission, have a simple checkpoint: was vulnerability considered, was it documented, and was any adjustment made?

For existing clients, remember that vulnerability screening is not a one-off. Life changes. Build a prompt into annual reviews as standard.

Advisers who embed this consistently tend to find it takes less time per case in the long run, not more. The upfront habit-building is the difficult part.

---

Common mistakes to avoid

Noting "client has anxiety" in a case file without documenting what that meant for how you advised them is unlikely to hold up under regulatory review. The FCA wants to see a clear link between what you identified and what you did about it.

It is also worth avoiding the trap of treating vulnerability as a binary thing. It exists on a spectrum and changes over time. A client who was fine last year may be struggling now. A client who discloses a health condition may still be entirely capable of understanding a complex mortgage product.

Many vulnerable clients will not self-identify. Behavioural observation during fact-find is just as important as what they tell you directly.

There is also an important professional distinction worth keeping in mind: the FCA is not asking you to decline to advise clients with complex circumstances. It is asking you to serve them appropriately.

Finally, sensitive personal data disclosed in the context of vulnerability carries specific data protection obligations. Store it securely, restrict access to those who need it, and handle it in line with your GDPR policies.

---

A quick reference checklist

Before closing any case involving a vulnerable client, check whether your file can answer yes to each of the following.

• Have I noted the specific circumstance or behaviour that indicated potential vulnerability?
• Have I considered how it affects this client's ability to understand and consent to the advice?
• Have I documented what I did differently as a result?
• Is the client's understanding of the recommendation clearly evidenced?
• Have I considered whether third-party involvement is appropriate or a risk factor?
• Is all of this documented in the case file itself, not a separate system?

If you can answer yes to all six, your documentation is in materially better shape than most of what the FCA found in its 2024 review.

---

Summary

Vulnerable customer support is no longer a compliance footnote. Consumer Duty has raised expectations significantly, and the FCA's ongoing Mortgage Rule Review signals continued focus on this area well into 2027.

The advisers who get this right are not necessarily doing more work. They are doing it differently: asking better questions at fact-find, recording what they observed in enough detail to be meaningful, and making adjustments that are proportionate to the client's circumstances. The documentation does not need to be lengthy. It needs to be specific.

The steps in this guide give you a workable foundation: use a framework like BRUCE to structure your observation, adapt your process where the situation calls for it, and keep everything within the case file where a reviewer can actually find it.

---

Cleera helps mortgage advisers keep case records that evidence client outcomes throughout the advice process, including for clients in vulnerable circumstances. If you would like to see how it works in practice, get in touch.