How AI detects vulnerable customers in financial services
FCA Consumer Duty requires firms to proactively identify vulnerable customers - not wait for self-declaration. Here is exactly what AI analyses, what signals it detects, and how the output satisfies the FCA's evidencing requirement.
FCA Consumer Duty (PS22/9, effective July 2023) requires firms to demonstrate proactive vulnerable customer identification. The FCA is explicit: firms must not rely solely on customers self-identifying as vulnerable. They must have systems and processes that identify vulnerability signals regardless of whether the customer volunteers that information.
Why self-declaration is structurally insufficient
The FCA Consumer Duty guidance distinguishes between reactive and proactive identification of vulnerable customers. Reactive identification - where the firm identifies vulnerability only when the customer explicitly discloses it - does not satisfy the Duty. The FCA expects firms to demonstrate they have identified customers who may not have disclosed vulnerability or who may not even recognise their own vulnerability.
This creates a measurement problem that standard QA processes cannot solve. Most contact centre QA reviews only a sample of interactions, selected manually or randomly. Even within that sample, the primary vulnerability identification mechanism is still the customer saying something that a trained colleague recognises. Customers who are cognitively impaired, in financial difficulty, or in acute emotional distress do not reliably self-declare. They are, in fact, the customers least likely to do so.
AI-based vulnerability detection operates on 100% of covered interactions, analysing signals that neither the customer nor the colleague may consciously recognise - and generates auditable evidence that the assessment occurred.
What AI analyses: the three signal categories
Voice patterns
Language signals
Interaction patterns
Request a free analysis of a customer interaction - receive a vulnerability signal report within 5 working days.
What happens when a vulnerability signal is detected
EchoDepth does not make decisions. It generates a timestamped vulnerability flag for the interaction, identifies the specific signal type detected, and assigns a risk level (Elevated, High, Urgent). The flag is routed to the appropriate response pathway - a trained colleague review, an escalation to a specialist team, or a follow-up protocol depending on the risk level.
The human remains in the loop. The AI identifies the signal; the trained colleague responds. This is both ethically correct and operationally pragmatic - vulnerability is complex, contextual and requires human judgment to respond to appropriately.
Timestamped flag attached to the interaction record
Signal evidence documented - which specific indicators triggered the flag
Risk level assigned (Elevated / High / Urgent)
Response pathway initiated - colleague review or escalation
Outcome recorded - action taken and result
What this produces as FCA evidence
The FCA expects firms to be able to demonstrate on request that vulnerable customer identification occurred, what process was used, and what outcome resulted. EchoDepth generates four evidence artefacts per covered interaction period:
Coverage evidence
Percentage of interactions assessed for vulnerability signals - demonstrating proactive, systematic identification across the customer base.
Detection record
Timestamped flag log for each interaction where vulnerability signals were identified - with signal type and risk level documented.
Outcomes data
What action was taken for each flagged interaction - enabling the FCA's outcomes monitoring requirement to be met.
Process documentation
Complete audit trail of the vulnerability assessment methodology - satisfying the FCA's expectation of documented processes.
GDPR and data protection
Vulnerability detection analysis is conducted under legitimate interests (Article 6(1)(f)) - the lawful basis being the obligation to comply with FCA Consumer Duty and prevent harm to customers. Analysis occurs at the interaction level. No persistent biometric profile of the customer is built. Vulnerability flags are attached to the interaction record with defined retention limits.
A Data Protection Impact Assessment (DPIA) is conducted for each deployment. EchoDepth is ICO registered (ZB915633). All clients operate under signed Data Processing Agreements. For FCA-regulated firms subject to Consumer Duty, EchoDepth supports the production of all required DPIA and DPA documentation.
How does AI detect vulnerable customers in financial services?
AI analyses every covered customer interaction for three types of signal: voice patterns such as hesitation and changes in speech rate, language signals such as confusion or distress beneath neutral wording, and interaction patterns such as escalating distress or decision avoidance. Voice signals include extended pauses, language simplification under cognitive load and contradiction between spoken content and vocal communication signal. Language signals include repeated questions, topic drift and avoidance when sensitive subjects arise, while interaction patterns include uncharacteristic repeat contact on the same issue without resolution. When signals are detected, EchoDepth attaches a timestamped flag to the interaction record, with the signal evidence and a risk level of Elevated, High or Urgent. A response pathway such as colleague review or escalation is then initiated. This matters because FCA Consumer Duty means firms must not rely solely on customers self-identifying as vulnerable under PS22/9. The flag log, coverage evidence and outcomes data form the auditable evidence that Consumer Duty expects.
Satisfy FCA Consumer Duty with auditable evidence
Submit a sample of customer interactions. Receive a vulnerability signal report and evidence documentation within 5 working days.