Vulnerable Customers: FCA FG21/1 and the Irish Code Explained

Anyone can find themselves in vulnerable circumstances: a bereavement, a health problem, a job loss or simply a bad week. For firms that serve consumers, the challenge is spotting changing needs early and adapting without stereotyping or intrusive assumptions. This guide explains the Financial Conduct Authority's (FCA) finalised guidance on the fair treatment of vulnerable customers, FG21/1, and then looks at how the Central Bank of Ireland's revised Consumer Protection Code deals with the same subject. It supports our course overview on supporting customers in vulnerable circumstances.

The UK position: FCA guidance FG21/1

According to the FCA, FG21/1 was published on 23 February 2021, and the FCA page was last updated on 22 July 2026. The guidance is relevant to firms serving retail customers, including some business customers, whatever their size or sector. Firms are not required to follow the specific actions in it, but they must meet the standards of the FCA's Principles for Businesses, including treating customers fairly.

How the FCA defines vulnerability

The FCA describes a vulnerable customer as someone whose personal circumstances make them especially susceptible to harm, particularly when a firm does not act with appropriate care. It treats vulnerability as a spectrum of risk: everyone is at some risk of becoming vulnerable, and certain characteristics increase that risk. People with those characteristics may have different needs, though not everyone with them will suffer harm.

The four drivers

• Health: for example, cognitive impairment or other poor health.
• Life events: for example, new caring responsibilities.
• Resilience: limited ability to cope with financial or emotional shocks.
• Capability: for example, poor literacy or numeracy skills.

The FCA page cites its Financial Lives research from October 2020, which found that 53 percent of adults showed at least one characteristic of vulnerability. That figure is the FCA's, from 2020, and should be read as a snapshot.

What the FCA expects firms to focus on

The guidance is organised around four areas. First, understanding the nature and scale of vulnerability in the firm's target market and customer base, and how it affects outcomes. Second, the skills and capability of staff, including making fair treatment part of every relevant role and equipping frontline staff to recognise and respond to vulnerability. Third, practical action across product and service design, customer service and communications, such as allowing customers to disclose needs, responding flexibly and signposting support. Fourth, monitoring and evaluation, including reviewing management information on outcomes for vulnerable customers.

How it fits with the Consumer Duty

The FCA's July 2026 update notes that FG21/1 refers to publications that predate the Consumer Duty, and directs readers to its Consumer Duty pages for current expectations on management information and good outcomes. It also points to the FCA's March 2025 review of how firms treat customers in vulnerable circumstances. Our guide to the FCA Consumer Duty sets out the wider framework.

The Irish position: Consumer Protection Code 2025

In Ireland, the Central Bank published a revised Consumer Protection Code on 24 March 2025, and it took effect on 24 March 2026, according to the Central Bank. A law firm summary (A&L Goodbody) says the Code comprises the Standards for Business Regulations (S.I. 80/2025) and the Consumer Protection Regulations (S.I. 81/2025), with three guidance documents, one of which is Protecting Consumers in Vulnerable Circumstances.

The same summary reports several changes on vulnerability. The definition of a consumer in vulnerable circumstances now makes clear that vulnerability can be temporary or permanent. Firms have more flexibility in how they record vulnerability information. The trusted contact person requirement has been adjusted so that it does not overlap with decision-making representatives under the Assisted Decision-Making (Capacity) Act 2015. New guidance covers staff training on safeguarding adults at risk of financial abuse, harm or exploitation. Our guide to staff training under the Consumer Protection Code covers the training angle.

Common ground, and one difference

Both regimes treat vulnerability as something that can change over time and expect firms to build recognition and response into staff roles, products and communications. A visible difference is the framing: the FCA's guidance sits alongside an outcomes-focused Consumer Duty, while the Irish Code addresses vulnerability through a dedicated guidance document under a revised rulebook. Firms operating in both jurisdictions should check each source rather than assume they match.

Practical steps: our suggestions

These are our suggestions, not statements in either source. Train frontline staff to ask open questions and to avoid labelling customers. Give customers more than one way to disclose a need, and make recording it proportionate. Review complaints, drop-outs and arrears for patterns that suggest unmet needs. Test your communications with people who have different levels of capability. For structured training, browse our CPD courses.

What we could not confirm

We read the FCA's FG21/1 web page but not the full guidance document or the March 2025 review. For Ireland, we relied on the Central Bank's web page for the dates and on a law firm summary for the content of the regulations and guidance, rather than reading the regulations or the guidance document themselves. We did not review how the Irish Code applies to particular types of firm. This post is general information, not legal advice.