Voice AI for an FCA-regulated lender identifies vulnerable customers by listening for the cues the FCA lists in FG21/1 (phrases like "I can't pay", confusion, requests for repetition, mentions of medication or bereavement) and then hands the caller to a trained person rather than carrying on alone. It handles complaints by treating any expression of dissatisfaction as a possible complaint under the FCA's definition, logging it, and routing it into the DISP process, which runs on a three business day and eight week clock. The AI's job is to spot, record and route; judgement on forbearance, redress and complaint outcomes stays with your people.

This guide turns the FCA's own text into eight requirements you can test a voice agent against. Every regulatory point links to the FCA Handbook or an FCA publication. It is a practical operations guide, not legal advice: your compliance team and the full Handbook text decide what applies to your firm.

Key takeaways

• Vulnerability has 4 drivers. FG21/1 groups characteristics of vulnerability under health, life events, resilience and capability, and says firms should think about vulnerability "as a spectrum of risk".

• A complaint is "any oral or written expression of dissatisfaction, whether justified or not" (FCA Glossary, as used in DISP). On a phone line, that bar is easy to meet, so the voice agent must flag liberally.

• The clocks are fixed. A complaint resolved by close of the third business day after receipt can close with a summary resolution communication; otherwise the firm must send a final or holding written response by the end of eight weeks.

• Keep complaint records for three years for most complaints (DISP 1.9), and make vulnerability information something staff can access later so customers "should not have to repeat information" (FG21/1).

• Automation needs an exit. FG21/1 warns that "automated helplines with no clear exit routes" can be very difficult for some customers and points to an "exit lane" from automated phone services.

How we chose and checked these

We started from one question: how does a voice agent identify vulnerable customers and handle complaints without creating new regulatory risk? We then read the FCA sources that govern those two jobs for a consumer credit firm: FG21/1, the FCA's guidance on the fair treatment of vulnerable customers; the Consumer Duty rules in PRIN 2A, especially the cross-cutting obligations and the consumer support outcome; the DISP complaints rules; and CONC 7 on arrears and default. Each numbered requirement below translates a point those texts make into what a voice agent and its team need to do. All pages were checked on 22 October 2026, and we quote only text we could see on them.

The "Tools that help" section describes vendors using only their own public pages. Lorikeet publishes this guide and is one of the tools listed. We have tried to describe every product, including our own, using only what each vendor publishes, and we link to the source for each claim.

Requirements for voice AI for FCA-regulated lenders at a glance

1. Listen for vulnerability cues: health, life events, resilience, capability

A voice agent should listen for the specific cues the FCA lists, not a vague sense of distress. FG21/1 defines a vulnerable customer as "someone who, due to their personal circumstances, is especially susceptible to harm, particularly when a firm is not acting with appropriate levels of care." It groups characteristics under four drivers: health, life events (such as bereavement, job loss or relationship breakdown), resilience (low ability to withstand financial or emotional shocks) and capability (including low literacy or digital skills).

The same guidance gives a practical list of "signs and phrases to actively look out for", drawn mainly from an FCA practitioners pack. For a voice channel, the relevant ones are:

• Phrases such as "I can't pay", "I'm having trouble paying", mention of breathing space or a debt adviser, "I can't understand the letter you sent me" and "I hate these press buttons".

• Asking for repetition, signs of confusion, shortness of breath or agitation, and mention of medication.

• Changes in payment behaviour, such as payments stopping suddenly or late or missed payments, which the agent can see if it reads account data.

FG21/1 also notes that a firm selling high-cost credit "may have common characteristics of vulnerability caused by a lack of financial resilience". Build your cue list from your own customer base and write each cue in as an explicit trigger. The FCA's 2020 Financial Lives data, cited in FG21/1, found 46% of UK adults had characteristics of vulnerability in February 2020, so these calls are routine, not edge cases.

2. Encourage disclosure without labelling the customer

The agent should make it easy to share needs, and should never call anyone "vulnerable". FG21/1 says consumers may not want the label and suggests "firms do not use this label in their interactions with consumers", focusing instead on what harm the customer may be exposed to and how to respond.

On how far to probe, the guidance is measured. Staff "should take steps to encourage disclosure where they see clear indicators of vulnerability" but "are not expected to go further than this to proactively identify vulnerability." If a customer briefly mentions something relevant, the firm should follow up sensitively, but "if the consumer is clearly not willing to share further information, it may not be reasonable for staff to continue asking questions."

For a voice agent, that translates into a simple design rule: one gentle, specific question ("Is there anything about your situation that would make it easier if we did this differently?"), an offer of a person, and then respect for a "no". FG21/1's TEXAS model (thank, explain how the information will be used, consent or checks, ask, signpost) is a useful script outline for that moment; the FCA notes it was originally developed following a study on mental health and debt collection.

3. Give every caller an exit lane to a human

A voice agent for a lender must let callers leave automation and reach a person, and must hand over on its own when a vulnerability cue appears. FG21/1 is direct about this: "automated helplines with no clear exit routes can be very difficult for people with cognitive disabilities or more complex needs to use." It describes offering an "exit lane" to an automated phone service, and for customers in financial difficulty it says firms using automated tools "should ensure there is the possibility of manual intervention".

The Consumer Duty sets the same expectation in rule form. PRIN 2A.6.2 requires support that "meets the needs of retail customers, including those with characteristics of vulnerability" and that customers "do not face unreasonable barriers", listing making a complaint as one of the moments that matter. PRIN 2A.6.1 applies "regardless of the channel used", including where support is outsourced to a third party.

Practical tests: can a caller say "person" or "agent" at any point and be transferred? Does the human receive a summary so the customer does not start again? Is there a callback route out of hours? See our guide to replacing IVR with voice AI in financial services for routing patterns.

4. Treat any expression of dissatisfaction as a possible complaint

The agent should flag dissatisfaction broadly, because the FCA's definition is broad. In DISP, a complaint is "any oral or written expression of dissatisfaction, whether justified or not", about the provision of, or failure to provide, a financial service, which alleges the complainant has suffered or may suffer financial loss, material distress or material inconvenience. "Oral" means a phone call counts. "Whether justified or not" means the agent cannot decide the customer is wrong and move on.

DISP 1.3.2 says a firm's procedures should "allow complaints to be made by any reasonable means" and "recognise complaints as requiring resolution". DISP 1.3.1A says complaints must be free of charge to make.

The safe pattern is to over-flag: tag the call as a possible complaint, tell the caller it has been noted, and let a trained complaints handler confirm the classification.

5. Start the DISP clock and route to your complaints team

Once a complaint is received, the deadlines run from receipt, so the agent should timestamp and route it immediately. Under DISP 1.5, a complaint resolved by close of business on the third business day after receipt can be closed with a "summary resolution communication", a written communication that must be sent promptly. Otherwise, DISP 1.6.2 requires that by the end of eight weeks the firm sends either a final response or a written response explaining why it cannot yet give one. The FCA adds that "almost all complaints" should be substantively addressed within eight weeks.

The substantive work is human. DISP 1.4.1 requires the firm to "investigate the complaint competently, diligently and impartially", assess it "fairly, consistently and promptly", offer redress where appropriate and explain its decision in a way that is "fair, clear and not misleading". A voice agent can gather facts and pass them on; it should not tell a caller their complaint is rejected.

6. Handle arrears with forbearance, signposting and no pressure

For consumer credit, the agent's collections behaviour is regulated directly by CONC 7. CONC 7.2.1 requires policies for "the fair and appropriate treatment of customers, who the firm understands or reasonably suspects to be vulnerable", and CONC 7.2.2 notes customers with mental health difficulties or mental capacity limitations may fall into that category. CONC 7.3.4 says a firm "must treat customers in or approaching arrears or in default with forbearance and due consideration".

Three rules matter most for scripting:

• CONC 7.3.10: the firm must not pressurise a customer to pay in one or very few repayments, within an unreasonably short period, or by selling property or borrowing more.

• CONC 7.3.7A: where appropriate, tell customers that free and impartial money guidance and debt advice is available from not-for-profit bodies, and refer them.

• CONC 7.3.6: allow the customer reasonable time and opportunity to repay.

An agent that negotiates hard is a liability. Our guide to AI for outbound collections and payment reminders covers outbound scripts in more depth.

7. Record it once, so nobody has to repeat it

Whatever the agent learns about a caller's needs or complaint should land on the customer record, where your team can see it next time. FG21/1 says firms should have systems that let staff "record and access information that will be required in the future", and that "consumers should not have to repeat information."

For complaints, DISP 1.9 requires a record of each complaint and the measures taken to resolve it, kept for three years for most complaints. Call recordings and transcripts are the natural evidence base for both, but vulnerability data is sensitive: FG21/1 reminds firms to comply with data protection requirements and to explain how disclosed information will be used. Decide where recordings live and who can see them before launch; our UK data residency guide for AI customer support covers the questions to ask.

8. Test before launch, then monitor outcomes

You need evidence that the agent behaves well with vulnerable callers, before and after launch. FG21/1 says firms should monitor "the outcomes vulnerable customers experience in comparison to other customers" and be able to demonstrate how their processes "result in the fair treatment of all customers". It does not set specific metrics.

On complaints, DISP 1.3.3 requires firms to identify and remedy "recurring or systemic problems", including by analysing root causes. Under the Consumer Duty, PRIN 2A.2.5 requires appropriate action, including redress where appropriate, when complaints or monitoring show customers suffered foreseeable harm.

In practice: script test calls for each cue in requirement 1, re-run them before every change, and compare outcomes for flagged callers against everyone else.

Tools that help

These vendors sell voice AI agents with controls relevant to the requirements above. None of them can make a firm compliant; that remains the lender's responsibility. Lorikeet publishes this guide and is one of the tools listed. We have tried to describe every product, including our own, using only what each vendor publishes, and we link to the source for each claim.

Lorikeet is built around the escalation pattern this guide describes. Its guardrails page says response guardrails can block, rewrite or escalate, that a fired guardrail can escalate "with full context", and that every guardrail event lands in analytics for QA review. The simulations page describes generating test scenarios from real tickets and re-running suites after each change, which maps to requirement 8. It holds SOC 2 Type II and ISO 27001:2022 per its trust page. Honest limits: Lorikeet does not claim to be FCA authorised, its pricing page lists data residency as USA on Start and Scale and custom only on Signature, and the UK lender story we cite, Carmoola, describes WhatsApp, chat and email rather than voice. Carmoola is a car finance lender in FCA-regulated consumer credit and reports 60% of inbound conversations on those channels resolved end to end.

What still needs a human

A voice agent can listen, flag, record and route. These decisions should stay with trained people:

• Vulnerability responses. FG21/1 expects frontline staff to "exercise judgement" and to refer to a specialist team where needed. The agent's job is to get the caller there.

• Complaint outcomes. Upholding, rejecting, redress and the final response under DISP 1.4 and 1.6.

• Forbearance. Which concession fits a customer's individual circumstances under CONC 7.3.4B.

• Third party authority. Calls from relatives or representatives, which FG21/1 treats as a distinct area with its own data protection questions.

• Compliance sign-off. Approving scripts, guardrails and the monitoring plan, and owning the Consumer Duty evidence.

Questions to ask a voice AI vendor

1. Show me the agent handling a caller who says "I can't pay" and mentions a hospital stay. Where does the call go, and what does the human see?

2. Can a caller reach a person at any point by asking? Is that tested on every release?

3. How do you flag possible complaints, and how is the receipt time recorded for DISP?

4. Where are recordings and transcripts stored, for how long, and who can access them?

5. Which certifications do you hold, and can we read the reports?

6. Do you charge for calls that end in a transfer to a human?

If you want to run these tests on your own scenarios, Lorikeet offers a 30-day free trial.