UK FCA and ICO joint statement with expectations on firms' approaches to vulnerability related data

The UK Financial Conduct Authority (FCA) and the Information Commissioner's Office (ICO) have published a joint statement clarifying regulatory expectations on the use and sharing of vulnerability related data. The statement explains how firms should approach this in delivering good outcomes for retail consumers under the consumer duty, while complying with UK data protection law.

Firms are expected to understand and identify indicators of vulnerability within their customer base, design products, communications and support that respond appropriately to those needs, and put in place systems that allow consumers to disclose relevant circumstances so that support can be delivered consistently and fairly. Firms are also expected to apply and demonstrate compliance with the UK GDPR principles when processing customers' personal information.

In relation to sharing data across distribution chains, manufacturers (such as lenders and payment networks) and distributors (such as intermediaries and financial advisers) are expected to work collaboratively and share relevant vulnerability‑related information, where necessary to avoid foreseeable harm. They are also expected to apply ICO's data sharing code of practice on how to share personal information in compliance with data protection law.

On monitoring consumer outcomes, firms are expected to regularly assess whether consumers in vulnerable circumstances are achieving outcomes comparable to other consumers, investigate and remediate any poorer outcomes identified, and ensure that boards have sufficient oversight and challenge over vulnerability‑related outcomes as part of their consumer duty monitoring and governance arrangements. The statement refers to finalised non-Handbook guidance on the consumer duty as a resource for firms, including a list of data and insight sources that firms can consider for their outcomes-monitoring activities.

Return to main website.