Only 29% of firms tested what their product does to a vulnerable customer.

There are two kinds of figure in this review and they should be read differently.

The customer-experience numbers describe a gap: 61% of vulnerable customers felt suitable contact methods existed against 72% of everyone else; 49% of consumers in poor health agreed suitable products were easy to find against 75% of consumers not in vulnerable circumstances. Those are real and they are hard to act on directly, because they are outcomes of many things at once.

The firm-behaviour numbers are different. They describe specific things a firm did or did not do, and every one of them is a decision somebody can change on a Tuesday.

The 19% is the one to sit with

Four in ten customers with vulnerability characteristics told their provider. Fewer than two in ten felt encouraged to.

Those two numbers together describe a system that waits. A firm that waits to be told will identify a minority of the people it should, and will then report — accurately — that it has very few vulnerable customers. The data will confirm the policy, and both will be wrong.

Encouraging disclosure is a design question rather than a training one. Where in a journey does someone get asked, in what words, with what assurance about what happens next? A single question in an annual review is not the same intervention as a route that exists at every point of contact.

Why 29% is the most damning figure here

Testing a product's impact on vulnerable customers is not expensive. It is a workshop, a handful of scenarios and somebody willing to write down an uncomfortable answer.

Seven in ten firms did not say they did it. Across 725 firms including small ones, that looks less like a resourcing problem than like a question nobody owned. And the FCA's harder finding sits right beside it: most firms in the multi-firm outcomes work "were unable to show how they effectively monitor and take action on outcomes" for this group at all.

Unable to show. Not failing to deliver — unable to demonstrate either way. That is the same finding as the board report review, arriving from a different direction, and it has the same fix.

What good looked like, in the FCA's own examples

The practices it praised are notably concrete. A small number of firms used data to identify where vulnerable customers were getting worse outcomes than others. Some removed call-time targets for these conversations — an operational change with a cost attached, which is what makes it credible. Some built specialist teams for complex needs, reviewed documents for plain English, and tested understanding with actual consumers.

One firm built gambling-blocking features. Another brought disability charities into product review. Neither is a policy document.

Four things worth doing, in order of cheapness

1. Count your disclosure rate. What share of your customers have a vulnerability flag? Compare it with the population you would expect. A very low number is a finding about your process, not your book.
2. Ask where the flag is visible. If a non-frontline person cannot see it, or has never been told what it means for their job, the 54% figure is about you: nearly half the firms that train those staff did not tie the training to their role.
3. Cut one outcome measure by vulnerability and look at it. Complaint rate, or time to resolution. One cut is enough to know whether you have a problem.
4. Run the product test. Four scenarios, an afternoon, written down. You will be in the 29%.

What this does not tell you

The survey figures are self-reported by firms, which usually flatters. If 54% of the firms that train non-frontline staff say the training covers their role, the share doing it well is lower still.

It also does not define vulnerability for you, and the FCA's guidance deliberately treats it as a spectrum of circumstances rather than a category of person — someone can be vulnerable for a fortnight. A flag set once and never reviewed creates a different failure from the one it prevents. Capturing that properly is a data problem before it is a compliance one, and it is why the record has to carry a date beside every state it stores.