FCA and ICO clarify vulnerability data expectations for firms

JD Supra Finance & Banking

Published April 7th, 2026

Detected April 7th, 2026

Summary

The UK Financial Conduct Authority (FCA) and Information Commissioner's Office (ICO) published a joint statement clarifying regulatory expectations for financial firms on the use and sharing of vulnerability-related customer data. The statement addresses how firms should identify vulnerable customers, design appropriate products and communications, share data across distribution chains, and monitor outcomes under consumer duty while complying with UK GDPR.

View original document View source feed page

What changed

The FCA and ICO joint statement sets out expectations that financial firms understand and identify indicators of vulnerability, design responsive products and communications, and implement systems for consistent support delivery. Firms must comply with UK GDPR principles when processing personal information, including applying the ICO's data sharing code of practice when sharing vulnerability data across supply chains between manufacturers and distributors. Firms must also regularly assess outcomes for vulnerable consumers and ensure board-level oversight of vulnerability-related monitoring.

Financial institutions subject to FCA and ICO jurisdiction should review their current vulnerability identification and monitoring practices against these clarified expectations. Firms must ensure their data sharing arrangements across distribution chains comply with UK GDPR while fulfilling consumer duty obligations to avoid foreseeable harm to vulnerable customers. Compliance teams should update governance frameworks to incorporate board-level vulnerability outcome oversight.

What to do next

Monitor for updates

Source document (simplified)

April 7, 2026

UK FCA And ICO Joint Statement With Expectations On Firms' Approaches To Vulnerability Related Data

LinkedIn Facebook X Send Embed

The UK Financial Conduct Authority (FCA) and the Information Commissioner's Office (ICO) have published a joint statement clarifying regulatory expectations on the use and sharing of vulnerability related data. The statement explains how firms should approach this in delivering good outcomes for retail consumers under the consumer duty, while complying with UK data protection law.

Firms are expected to understand and identify indicators of vulnerability within their customer base, design products, communications and support that respond appropriately to those needs, and put in place systems that allow consumers to disclose relevant circumstances so that support can be delivered consistently and fairly. Firms are also expected to apply and demonstrate compliance with the UK GDPR principles when processing customers' personal information.

In relation to sharing data across distribution chains, manufacturers (such as lenders and payment networks) and distributors (such as intermediaries and financial advisers) are expected to work collaboratively and share relevant vulnerability‑related information, where necessary to avoid foreseeable harm. They are also expected to apply ICO's data sharing code of practice on how to share personal information in compliance with data protection law.

On monitoring consumer outcomes, firms are expected to regularly assess whether consumers in vulnerable circumstances are achieving outcomes comparable to other consumers, investigate and remediate any poorer outcomes identified, and ensure that boards have sufficient oversight and challenge over vulnerability‑related outcomes as part of their consumer duty monitoring and governance arrangements. The statement refers to finalised non-Handbook guidance on the consumer duty as a resource for firms, including a list of data and insight sources that firms can consider for their outcomes-monitoring activities.

[View source.]

Send Print Report

Latest Posts

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.
Attorney Advertising.