Back to Compliance Academy

Vulnerable Customers: What Evidence Should Mortgage Brokers Actually Keep?

Supporting vulnerable customers is an important part of running an FCA-regulated mortgage brokerage. Most mortgage advisers understand that customers may need additional support, but knowing how to recognise vulnerability, respond appropriately and record the right evidence can be less straightforward.

A common compliance question is: What should actually be recorded on the customer file to demonstrate that a vulnerable customer has been treated fairly?

Recording that a customer is vulnerable is not enough on its own. Firms need to consider what the customer’s circumstances mean in practice, whether any additional support is required and whether the service provided has helped the customer achieve a good outcome.

At H3 Consultancy, we believe compliance should be practical. In this article, we’ll look at what mortgage brokers should consider recording, what a good file note looks like and how firms can demonstrate that they are meeting their responsibilities.

What This Article Covers

In this article, we’ll explain:

  1. What the FCA expects from firms when supporting vulnerable customers.
  2. How mortgage advisers can recognise and respond to vulnerability.
  3. What evidence should be recorded on the customer file.
  4. Examples of good and poor vulnerability file notes.
  5. Common compliance mistakes to avoid.
  6. How firms can review their vulnerability procedures and demonstrate good customer outcomes.

What Does the FCA Expect from Mortgage Brokers?

The FCA’s Guidance for firms on the fair treatment of vulnerable customers (FG21/1) explains that vulnerability can arise from a range of personal circumstances.

These may include:

  1. Poor physical or mental health.
  2. Life events such as bereavement, divorce or redundancy.
  3. Low financial resilience, making it difficult to cope with financial shocks.
  4. Limited financial capability, literacy or numeracy.
  5. Cognitive difficulties that affect a customer’s ability to understand information or make decisions.

Importantly, vulnerability is not necessarily permanent. A customer may experience vulnerability at one point in their life but not at another, and different circumstances can affect customers in different ways.

The FCA expects firms to understand their customers’ needs, ensure staff have the skills to recognise and respond to vulnerability, provide appropriate support and monitor whether customers are receiving fair outcomes.

This is particularly relevant under the Consumer Duty, which requires firms to act to deliver good outcomes for retail customers.

The key point for mortgage brokers is that identifying vulnerability is only the starting point. Firms should consider what action, if any, is appropriate to help the customer understand their options, make informed decisions and access the service they need. You can read the FCA’s guidance here: Guidance for firms on the fair treatment of vulnerable customers .

Why Is Recording Vulnerability Important?

A mortgage adviser may have an excellent conversation with a customer, recognise that additional support is needed and adapt their approach accordingly.

However, if none of this is recorded, it may be difficult for another member of the firm to understand what happened or for a compliance reviewer to establish whether the customer received appropriate support.

Good record keeping helps demonstrate that the firm has considered the customer’s individual circumstances and taken reasonable steps to address their needs.

It can also help ensure consistency if the customer speaks to different members of staff throughout the mortgage process.

For example, a customer may explain during the initial fact-find that they struggle to understand lengthy written documents. If this information is recorded appropriately, the adviser can offer clearer explanations, allow additional time and check understanding when discussing the recommendation.

Without an appropriate record, the firm may not recognise the need to adapt its communications at a later stage.

The objective is not to record every personal detail about a customer. It is to record the information necessary to understand their needs, the support provided and the outcome.

What Evidence Should Mortgage Brokers Keep?

There is no single vulnerability file note that will be appropriate for every customer. The evidence required will depend on the circumstances, the customer’s needs and the support provided.

However, there are several areas firms should consider when reviewing their processes.

1. The Customer’s Circumstances

Where relevant to the advice or service being provided, the file should contain enough information to explain the circumstances that have led the adviser to consider whether additional support may be needed. For example, a customer may disclose that they have recently experienced bereavement, are dealing with a serious illness or are experiencing financial difficulties.

The adviser should consider how these circumstances may affect the customer’s ability to engage with the mortgage process. It is important to avoid making assumptions. A diagnosis or life event does not automatically mean that a customer cannot make financial decisions or understand mortgage advice.

Equally, customers do not need to disclose a medical diagnosis before an adviser can offer reasonable adjustments or additional support. Record relevant information proportionately, respecting the customer’s privacy and avoiding unnecessary sensitive details.

2. How the Customer’s Needs Were Identified

A file note should help explain why the adviser considered additional support appropriate, where this was relevant. This may arise from something the customer has disclosed directly, a request for assistance or an observation during a conversation.

For example:

A customer explains that they are struggling to manage paperwork following a bereavement and would prefer important information to be explained verbally. The adviser should consider whether this affects the way information is provided and whether any adjustments would help the customer engage with the advice process. There is no need to label a customer unnecessarily or make a formal diagnosis. The emphasis should be on understanding the customer’s needs and responding appropriately.

3. The Support or Adjustments Offered

This is one of the most important areas to record. If an adviser identifies that a customer may need additional support, the file should explain what was offered or provided, where relevant.

Examples may include:

  1. Allowing additional time for appointments.
  2. Explaining mortgage information in simpler language.
  3. Breaking down complex information into manageable sections.
  4. Providing information in an alternative format where appropriate.
  5. Offering a follow-up discussion before the customer makes a decision.
  6. Arranging an alternative communication method that meets the customer’s needs.
  7. Discussing whether the customer would like a trusted person involved, where appropriate and with suitable consent and safeguards.

Not every customer will need adjustments, and firms should not introduce unnecessary barriers or delays. The important point is to consider the individual’s circumstances rather than adopting a one-size-fits-all approach.

4. The Customer’s Understanding of the Advice

Mortgage advice can involve complex information, particularly where customers are considering debt consolidation, interest-only borrowing, longer mortgage terms or products with features they have not previously encountered. Where there is a reason to be concerned about understanding, the adviser should take appropriate steps to explain the information clearly and establish whether the customer understands the key implications.

This does not mean that every file must contain a formal assessment of understanding. However, where additional support has been needed, it can be helpful to record how the adviser explained the recommendation, addressed questions and checked the customer’s understanding.

For example, if a customer is considering consolidating unsecured borrowing into a mortgage, the adviser may need to explain that the debt could be repaid over a longer period and that the total interest payable may increase. The customer should also understand that the debt is being secured against their property.

Where this explanation has required additional time or a different approach, the file should make that clear.

5. The Outcome and Any Further Action

Finally, the file should provide a clear picture of what happened following the support provided. Did the customer understand the options? Were their communication needs met? Were any further discussions required? Did the adviser identify any unresolved concerns?

If further action was needed, this should be recorded along with the steps taken. The objective is to demonstrate that the firm has considered the customer’s circumstances throughout the advice process, rather than treating vulnerability as a one-off entry on a fact-find.

What Does a Good Vulnerability File Note Look Like?

Consider the following example.

A customer has recently experienced a bereavement and explains that they are finding it difficult to concentrate on lengthy documents. They are considering a mortgage product transfer and would like the available options explained during a telephone appointment.

Example of a weak file note

“Customer recently bereaved. Vulnerable customer. Additional support provided.”

Although this note identifies a potential vulnerability, it does not explain what the adviser did, why any adjustments were appropriate or whether the customer’s needs were met. A compliance reviewer would have little evidence of how the customer was supported.

Example of a stronger file note

“During the initial discussion, the customer explained that they had recently experienced a bereavement and were finding it difficult to concentrate on lengthy written information. The customer requested that the available mortgage options be explained verbally.

The adviser arranged a telephone appointment, explained the available options in clear language and allowed additional time for questions. The main features, costs and implications of the options were discussed, and the customer was given time to consider the information before confirming their preferred option.

The customer was invited to raise any further questions and confirmed that the explanation had been helpful. The adviser agreed to follow up with the relevant written information in a format suitable for the customer.”

This note provides a clearer record of the customer’s needs, the support provided and the customer’s response. The wording is illustrative rather than a prescribed FCA template. Advisers should only record actions that genuinely took place and should tailor their notes to the circumstances of each case.

Do Mortgage Brokers Need to Record Medical Information?

This is an area where firms should be particularly careful. Mortgage advisers should not collect detailed medical information simply because a customer may be vulnerable. The information recorded should be relevant, necessary and proportionate to the support being provided. In many cases, it may be sufficient to record the practical impact of the customer’s circumstances and the adjustments agreed.

For example, it may be more appropriate to record that a customer has requested shorter appointments and verbal explanations than to record unnecessary details about a medical condition.

Information about health can constitute special category personal data under UK data protection law. Firms should ensure they have an appropriate lawful basis and, where required, a separate condition for processing special category data. They should also consider data minimisation, access controls, retention arrangements and how information is shared within the business.

Where a customer discloses sensitive information, advisers should follow the firm’s data protection and vulnerable customer procedures. The FCA and Information Commissioner’s Office have published guidance and statements addressing vulnerability-related information. Firms can find further information through the FCA’s vulnerable customer guidance and the ICO’s guidance on special category data.

Common Vulnerability Compliance Mistakes – When reviewing vulnerability procedures and customer files, firms should consider whether their approach goes beyond simply identifying customers who may need support. Common weaknesses can include the following.

Recording Vulnerability Without Explaining the Action Taken – A file may state that a customer is vulnerable but contain no evidence that the adviser considered their needs or whether any adjustments were appropriate. The record should explain the practical response where additional support was required.

Making Assumptions About a Customer’s Ability – A customer may have a health condition, be older or be experiencing a difficult life event. None of these factors should automatically lead an adviser to assume that the customer cannot make decisions or understand advice. Support should be based on the customer’s individual circumstances.

Collecting Too Much Personal Information – Detailed medical or personal information should not be recorded without a clear reason. Firms should consider what information is genuinely necessary to provide appropriate support and retain it securely.

Failing to Record Changes in Circumstances – A customer’s needs can change during the mortgage process. For example, a customer may experience a bereavement, redundancy or a deterioration in their health after the initial fact-find. Advisers should remain alert to changes that may affect the customer’s ability to engage with the service.

Treating Vulnerability as a Tick-Box Exercise – Having a vulnerability policy, a field on the CRM system or a staff training record does not, by itself, demonstrate that customers are being treated fairly. Firms should be able to show how their processes work in practice and whether the support provided is helping customers achieve good outcomes.

How Should Firms Monitor Their Vulnerable Customer Processes?

Vulnerability should form part of a firm’s wider compliance monitoring arrangements. The appropriate approach will depend on the size and nature of the business, but firms should consider how they can establish whether their procedures are working effectively.

This may include:

  1. Reviewing a sample of files where additional support has been provided.
  2. Checking whether agreed adjustments are recorded and followed.
  3. Identifying recurring weaknesses in file notes or adviser practices.
  4. Reviewing customer feedback and complaints for potential vulnerability-related themes.
  5. Assessing whether advisers understand how to recognise and respond to vulnerability.
  6. Considering whether different groups of customers are experiencing poorer outcomes.
  7. Recording actions taken to address identified weaknesses and checking whether those actions have been effective.

Management Information (MI) can help firms identify trends, but the emphasis should be on useful information rather than simply counting the number of customers recorded as vulnerable.

For example, a high number of vulnerability records does not necessarily indicate a problem, and a low number does not necessarily mean that a firm is supporting customers effectively.

Firms should consider the wider picture, including the support provided, the issues identified through file reviews and whether customers are receiving fair outcomes. The FCA’s review of firms’ treatment of customers in vulnerable circumstances provides further insight into good practice and areas where firms can improve.

A Practical Vulnerable Customer File Review Checklist

  1. Have any relevant customer needs or circumstances been identified?
  2. Has the adviser avoided making assumptions about the customer’s ability to make decisions?
  3. Where appropriate, has the adviser considered whether additional support or adjustments were needed?
  4. Is there a proportionate record of the support provided?
  5. Where additional explanation was required, is there evidence of how the advice was communicated?
  6. Were any agreed adjustments followed throughout the process?
  7. Has the adviser considered whether further action or follow-up was needed?
  8. Has unnecessary sensitive personal information been avoided?
  9. Has information been recorded and stored in accordance with the firm’s procedures?
  10. Is there evidence that any identified concerns were addressed?

This checklist is intended as a practical starting point, not a substitute for the firm’s own compliance procedures or a complete assessment of every regulatory obligation. Not every question will apply to every customer. The objective is to establish whether the adviser recognised relevant needs, responded appropriately and maintained a record proportionate to the circumstances.

How H3 Consultancy Can Help

At H3 Consultancy, we support FCA-regulated mortgage and protection firms with practical compliance guidance, file reviews, compliance monitoring, Consumer Duty and Training & Competency.

If you would like to review your firm’s vulnerable customer procedures, strengthen your file-recording standards or identify potential gaps in your compliance arrangements, H3 Consultancy can help you assess your current approach and identify areas for improvement.

We have a template document which not only evidences vulnerability assessment on file but records the action taken. This one page template is easy to complete and helps you evidence compliant vulnerability checks are being completed. If you would like a copy of this please get in touch and request the template and we can provide more information. As always, no obligation and no sales calls.

Explore more Compliance Academy articles →