How AI detects vulnerable customers in financial services
FCA Consumer Duty requires firms to proactively identify vulnerable customers — not wait for self-declaration. Here is exactly what AI analyses, what signals it detects, and how the output satisfies the FCA's evidencing requirement.
FCA Consumer Duty (PS22/9, effective July 2023) requires firms to demonstrate proactive vulnerable customer identification. The FCA is explicit: firms must not rely solely on customers self-identifying as vulnerable. They must have systems and processes that identify vulnerability signals regardless of whether the customer volunteers that information.
Why self-declaration is structurally insufficient
The FCA Consumer Duty guidance distinguishes between reactive and proactive identification of vulnerable customers. Reactive identification — where the firm identifies vulnerability only when the customer explicitly discloses it — does not satisfy the Duty. The FCA expects firms to demonstrate they have identified customers who may not have disclosed vulnerability or who may not even recognise their own vulnerability.
This creates a measurement problem that standard QA processes cannot solve. Most contact centre QA reviews 2–3% of interactions, selected manually or randomly. Even within that 2–3%, the primary vulnerability identification mechanism is still the customer saying something that a trained colleague recognises. Customers who are cognitively impaired, in financial difficulty, or in acute emotional distress do not reliably self-declare. They are, in fact, the customers least likely to do so.
AI-based vulnerability detection operates on 100% of covered interactions, analysing signals that neither the customer nor the colleague may consciously recognise — and generates auditable evidence that the assessment occurred.
What AI analyses: the three signal categories
Voice patterns
Language signals
Interaction patterns
Request a free analysis of a customer interaction — receive a vulnerability signal report within 5 working days.
What happens when a vulnerability signal is detected
EchoDepth does not make decisions. It generates a timestamped vulnerability flag for the interaction, identifies the specific signal type detected, and assigns a risk level (Elevated, High, Urgent). The flag is routed to the appropriate response pathway — a trained colleague review, an escalation to a specialist team, or a follow-up protocol depending on the risk level.
The human remains in the loop. The AI identifies the signal; the trained colleague responds. This is both ethically correct and operationally pragmatic — vulnerability is complex, contextual and requires human judgment to respond to appropriately.
Timestamped flag attached to the interaction record
Signal evidence documented — which specific indicators triggered the flag
Risk level assigned (Elevated / High / Urgent)
Response pathway initiated — colleague review or escalation
Outcome recorded — action taken and result
What this produces as FCA evidence
The FCA expects firms to be able to demonstrate on request that vulnerable customer identification occurred, what process was used, and what outcome resulted. EchoDepth generates four evidence artefacts per covered interaction period:
Coverage evidence
Percentage of interactions assessed for vulnerability signals — demonstrating proactive, systematic identification across the customer base.
Detection record
Timestamped flag log for each interaction where vulnerability signals were identified — with signal type and risk level documented.
Outcomes data
What action was taken for each flagged interaction — enabling the FCA's outcomes monitoring requirement to be met.
Process documentation
Complete audit trail of the vulnerability assessment methodology — satisfying the FCA's expectation of documented processes.
GDPR and data protection
Vulnerability detection analysis is conducted under legitimate interests (Article 6(1)(f)) — the lawful basis being the obligation to comply with FCA Consumer Duty and prevent harm to customers. Analysis occurs at the interaction level. No persistent biometric profile of the customer is built. Vulnerability flags are attached to the interaction record with defined retention limits.
A Data Protection Impact Assessment (DPIA) is conducted for each deployment. EchoDepth is ICO registered (ZB915623). All clients operate under signed Data Processing Agreements. For FCA-regulated firms subject to Consumer Duty, EchoDepth supports the production of all required DPIA and DPA documentation.
Satisfy FCA Consumer Duty with auditable evidence
Submit a sample of customer interactions. Receive a vulnerability signal report and evidence documentation within 5 working days.