GFSC Guidance Note on Fair Treatment of Vulnerable Customers

Version: 2 Publication Date: 28/03/2025 www.gfsc.gi GFSC Guidance Note The Fair Treatment of Vulnerable Customers

Gibraltar Financial Services Commission Guidance Note on the Fair Treatment of Vulnerable Customers 2 Table of Contents 1 Introduction..................................................................................................................................... 4 This Guidance .................................................................................................................................. 4 The Core Principles.......................................................................................................................... 6 Monitoring firms’ treatment of vulnerable customers................................................................... 6 2 Understanding the Needs of Vulnerable Consumers...................................................................... 7 Understanding the nature and scale of characteristics of vulnerability that exist in the firm’s target market and customer base................................................................................................... 7 ......................................................................................................................................................... 9 Understanding the impact of vulnerability on the needs of consumers in their target market and customer base, by asking themselves what types of harm or disadvantage their customers may be vulnerable to, and how this might affect the consumer experience and outcomes................. 9 Examples of harm and disadvantage that firms should be alert to .............................................. 10 3 Skills and Capability of Staff .......................................................................................................... 13 Embedding the fair treatment of vulnerable consumers across the workforce........................... 14 Ensuring frontline staff have the necessary skills and capability to recognise and respond to a range of characteristics of vulnerability........................................................................................ 15 Encouraging Disclosure ................................................................................................................. 16 Recording and accessing information about consumers’ needs................................................... 16 Offering practical and emotional support to frontline staff dealing with vulnerable consumers 19 4 Taking Practical Action .................................................................................................................. 19 Product and service design............................................................................................................ 19 Considering the potential positive and negative impacts of a product or service on vulnerable consumers and designing products and services to avoid potential harmful impacts................. 19 Considering if features of products or services exploit vulnerable customers............................. 19 Designing products and services that meet evolving needs and avoiding inflexibility that could result in harmful impacts .............................................................................................................. 20 Taking vulnerable consumers into account at all stages of the product and service design process ....................................................................................................................................................... 21 Customer Service........................................................................................................................... 25 Delivering appropriate customer service that responds flexibly to the needs of vulnerable consumers..................................................................................................................................... 27 Telling consumers about the support available to them .............................................................. 29 Supporting decision-making and third party representation........................................................ 29 Third party representation............................................................................................................ 30 Specialist Support.......................................................................................................................... 31 Putting in place systems and processes that support the delivery of good customer service ..... 32 Communications............................................................................................................................ 33

Gibraltar Financial Services Commission Guidance Note on the Fair Treatment of Vulnerable Customers 3 Ensuring all communications and information about products and services are presented in ways that are understandable for consumers .............................................................................. 34 Considering how to communicate with vulnerable consumers, taking account of their needs... 36 5 Monitoring and evaluation............................................................................................................ 37 Implementing appropriate processes to evaluate where the needs of vulnerable consumers are not met.......................................................................................................................................... 38 Appendix 1.................................................................................................................................................. 41 Key relevant definitions for this Appendix .................................................................................... 41 Bases on which firms can process data......................................................................................... 42 Special Category Data.................................................................................................................... 43 Data Sharing .................................................................................................................................. 44 Additional areas to consider.......................................................................................................... 44 Appendix 2.................................................................................................................................................. 47

Gibraltar Financial Services Commission Guidance Note on the Fair Treatment of Vulnerable Customers 4 1 Introduction 1.1 A vulnerable customer is someone who, due to their personal circumstances, is especially susceptible to harm, particularly when a firm is not acting with appropriate levels of care. 1.2 Ensuring consumers have an appropriate degree of protection is central to what the GFSC does. This includes protecting vulnerable consumers. 1.3 We want vulnerable consumers to experience outcomes as good as those for other consumers and receive consistently fair treatment across the firms and sectors we regulate. 1.4 When we consider our consumer protection objective, we have regard to the general principle that consumers should take responsibility for their choices and decisions. However, we know that there are very real factors that might limit their ability to do so. 1.5 Characteristics of vulnerability may result in consumers having additional or different needs and may limit their ability or willingness to make decisions and choices or to represent their own interests. These consumers may be at greater risk of harm, particularly if things go wrong. 1.6 We expect firms to provide their customers with a level of care that is appropriate given the characteristics of the customers themselves. The level of care that is appropriate for vulnerable consumers may be different from that for others and firms should take particular care to ensure they are treated fairly. If firms do not understand the characteristics of vulnerability of their target market and main customer base (Chapter 2), and so fail to ensure staff, products and services meet these needs (Chapters 3-4), customers may suffer poor or inconsistent outcomes, or increased risk of harm. 1.7 We want to see the fair treatment of vulnerable customers embedded as part of a healthy culture throughout firms, not just on the frontline but also in areas such as product development. Firms’ senior leaders should create and maintain a culture that enables and supports staff to take responsibility for reducing the potential for harm to vulnerable customers. They should ensure that firms embed the fair treatment of vulnerable customers in their policies and processes throughout the whole customer journey. We have seen some good examples where commitment comes from the top and where there is a culture of feedback and learning from the frontline. This Guidance 1.8 This Guidance sets out our view of what firms should do to ensure they treat vulnerable customers fairly, in the context of complying with their obligations under the Financial Services (Core Principles and Consumer Duty) Regulations 2024 (the ‘CPCD Regulations’). 1.9 It explains that to achieve good outcomes for vulnerable customers, firms should: • understand the needs of their target market / customer base; • ensure their staff have the right skills and capability to recognise and respond to the needs of vulnerable customers; • respond to customer needs throughout product design, flexible customer service provision and communications; and • monitor and assess whether they are meeting and responding to the needs of customers with characteristics of vulnerability, and make improvements where this is not happening.

Gibraltar Financial Services Commission Guidance Note on the Fair Treatment of Vulnerable Customers 5 1.10 This Guidance applies to all firms where the Core Principles or the Consumer Duty apply, regardless of sector. It applies to the supply of products or services to retail customers who are natural persons, even if a firm does not have a direct client relationship with the customer. 1.11 In this Guidance: • ‘Retail customer’ has the same meaning as in Regulation 9 of the CPCD Regulations. • ‘Natural persons’ includes individuals but may also include some businesses or charities which are not incorporated. For example, individuals or groups of individuals who are un-incorporated business customers – e.g. sole traders and some partnerships. It does not apply where businesses or charities are incorporated because in that case, it is the corporate body, not any natural persons running it, that is the firm’s customer. • We use the terms ‘vulnerable consumer’ and ‘vulnerable customer’ interchangeably throughout the Guidance to refer to retail customers who are ‘natural persons’ and have characteristics of vulnerability. These characteristics may mean they are especially susceptible to harm, particularly where a firm does not act with appropriate levels of care. 1.12 This Guidance sets out ways in which firms can comply with their obligations under the CPCD Regulations – to treat vulnerable consumers fairly. It does not provide a checklist of required actions and will apply to firms in different ways because of the significant differences across and within sectors. Firms will need to use their judgement to decide precisely what the Guidance means for them. This will depend on the specific context of the firm, including its size, the markets it operates in, the products it offers and the characteristics of its target market and its customers. 1.13 Throughout this Guidance we use: • Must: where an action is required by a legislative provision (within the CPCD Regulations or elsewhere). • Should: where we think a firm ought to consider a course of action (not specified in the CPCD Regulations) to comply with a Core Principle or an aspect of the Consumer Duty, but that does not necessarily mean they should follow a detailed or prescribed course of action. • May: where an action is only one of several ways of complying with a Core Principle or an aspect of the Consumer Duty. • How firms can put this into practice: to illustrate how firms may put actions described in the Guidance into practice. • Case studies: to provide examples of good and bad practice we have seen, for example through our supervisory and enforcement work. 1.14 While firms are not bound to adopt or follow any of the specific actions described in this Guidance, they must meet the standards set by the CPCD Regulations and treat customers fairly. 1.15 For many firms, the entire Guidance may be relevant to their business. For other firms, only certain chapters might be relevant. This may be the case where firms do not have a direct relationship with customers, for example, in distribution chains. 1.16 While this Guidance only applies to firms’ dealings with retail customers who are natural persons, firms should remember that the Core Principles, including the obligation to treat customers fairly, extend to all customers. Firms may find this Guidance helpful when considering how to comply with their obligations under the Core Principles for incorporated businesses. For example,

Gibraltar Financial Services Commission Guidance Note on the Fair Treatment of Vulnerable Customers 6 when dealing with a representative of an incorporated business who has characteristics of vulnerability. 1.17 This Guidance does not replace or substitute other applicable guidance or law and does not require firms to act in a way that is incompatible with any legal or regulatory requirements. Appendix 2 provides an overview of some of the regulatory obligations that may be relevant to the fair treatment of vulnerable customers under the Equal Opportunities Act 2006 (the Equal Opportunities Act). The Core Principles 1.18 The extent to which firms meet their requirements under the Core Principles and the Consumer Duty will depend, in part, on the characteristics of the customers concerned. The relevant interests and needs that firms must have due regard to and what is reasonable care in the relevant circumstances will depend on those characteristics. 1.19 Beyond specific interactions with customers, firms should integrate an understanding of the needs of vulnerable consumers into their business. This means ensuring the business and staff have the necessary knowledge and skills to treat vulnerable customers fairly. Firms also need to have adequate processes and control systems in place to ensure the firm is managing the risk of harm to vulnerable customers. Monitoring firms’ treatment of vulnerable customers 1.20 We supervise and enforce against the standards set by the Core Principles and the Consumer Duty, taking into account the CPCD Regulations and the Consumer Duty Guidance Note. Understanding user needs, and recognising where some users may be vulnerable, is a key factor in the way we make regulatory judgements. This Guidance will support us as we apply a ‘vulnerability lens’ to supervising and enforcing the standards set by the CPCD Regulations. 1.21 Firms can expect to be asked to demonstrate how their business model, the actions they have taken and their culture ensure the fair treatment of all customers, including vulnerable customers. 1.22 The GFSC focuses on business models and culture as the key drivers of harm in firms. When we assess culture, we look at what drives behaviour in a firm. We address the key drivers of behaviour which are likely to cause harm. These include: • The firm’s purpose, as understood by its employees; • The attitude, behaviour, competence and compliance of the firm’s leadership; • The firm’s approach to managing and rewarding people, such as staff competence and incentives; and • The firm’s governance arrangements, controls and key processes, such as for whistleblowing or complaint handling. 1.23 Firms should be able to provide us with the information they are using to monitor whether they are achieving outcomes for consumers with characteristics of vulnerability that are as good as those

Gibraltar Financial Services Commission Guidance Note on the Fair Treatment of Vulnerable Customers 7 for other consumers (see monitoring and evaluation in Chapter 5). They should do this with reference to all of the aspects of the firm customer relationship. 1.24 Firms should note that the way we supervise the treatment of vulnerable consumers will be integrated into our supervision, it will not be a one-off supervisory exercise. For example, we may ask for information about the treatment of vulnerable customers in any supervisory work relevant to the fair treatment of consumers, including during our regular interactions or as part of our proactive supervisory work. 1.25 We will also seek to understand consumers’ experiences of their treatment, for example whether they are experiencing difficulties effectively engaging with firms and accessing appropriate products. 1.26 This Guidance may also be relevant to an enforcement case. For example, we may use the Guidance to help us assess whether it could reasonably have been understood or predicted at the time that the conduct in question fell below the standards the CPCD Regulations require. The factors that inform our supervision of firms’ treatment of vulnerable consumers, as outlined above, are also relevant to enforcement. 2 Understanding the Needs of Vulnerable Consumers 2.1 The needs of vulnerable consumers in a firm’s target market or customer base are likely to vary and will often require additional measures to ensure good outcomes. 2.2 It is important for all firms to understand the needs of vulnerable customers in their target market or customer base. This includes firms that offer self-service digital channels or are part of a distribution chain, and so do not directly interact with customers. If firms do not do this they may not be able to ensure their staff have the right skills and capability (Chapter 3) or take appropriate practical action (Chapter 4). This may result in gaps in the provision of suitable services and products and lead to poor outcomes for vulnerable consumers. 2.3 In this chapter, we set out how firms should understand the: a) nature and scale of characteristics of vulnerability that exist in their target market and customer base; and b) impact of vulnerability on the needs of consumers in their target market and customer base, by asking themselves what types of harm or disadvantage their customers may be vulnerable to, and how this might affect the consumer experience and outcomes. Understanding the nature and scale of characteristics of vulnerability that exist in the firm’s target market and customer base 2.4 Firms should be aware of the many situations and circumstances that may lead to a consumer in their target market or customer base becoming vulnerable.

Gibraltar Financial Services Commission Guidance Note on the Fair Treatment of Vulnerable Customers 8 2.5 Our definition of vulnerability refers to customers who, due to their personal circumstances, are especially susceptible to harm, particularly when a firm is not acting with appropriate levels of care. Firms should think about vulnerability as a spectrum of risk. All customers are at risk of becoming vulnerable and this risk is increased by characteristics of vulnerability related to 4 key drivers. • Health – health conditions or illnesses that affect ability to carry out day-to-day tasks. • Life events – life events such as bereavement, job loss or relationship breakdown. • Resilience – low ability to withstand financial or emotional shocks. • Capability – low knowledge of financial matters or low confidence in managing money (financial capability). Low capability in other relevant area such as literacy or digital skills. 2.5 Table 1 below gives examples of the types of circumstances and characteristics under these 4 drivers which can lead to consumers having additional or different needs. This is not a complete exhaustive or definitive list. Firms should consider what characteristics of vulnerability are relevant to their target market and customer base. 2.6 Not all customers with characteristics of vulnerability will be vulnerable, but they may be more likely to have additional or different needs which, if not met by firms, could limit their ability to make decisions or to represent their own interests. 2.7 Consumers may not want the label ‘vulnerable’ applied to them. While we refer to customers as being vulnerable throughout this Guidance, we suggest that firms do not use this label in their interactions with consumers. Instead, firms should focus on what harm or disadvantage customers may be vulnerable to and how they can respond appropriately. Table1: Characteristics associated with the 4 drivers of vulnerability Health Life Events Resilience Capability Physical disability Retirement Inadequate (outgoings exceed income) or erratic income Low knowledge or confidence in managing finances Severe or long term- illness Bereavement Over-indebtedness Poor literacy or numeracy skills Hearing or visual impairment Income shock Low savings Poor English language Mental health condition or disability Relationship breakdown Low emotional resilience Poor or non-existent digital skills Addiction Domestic abuse (including economic control) Learning difficulties Low mental capacity or cognitive disability Caring responsibilities No or low access to help or support Other circumstances that affect people’s experience of financial services, e.g. leaving care migration or seeking asylum, human trafficking or modern slavery convictions 2.8 Firms should understand that characteristics of vulnerability are likely to be complex and overlapping. For example, a life event like a relationship breakdown or bereavement may lead to further vulnerability such as mental ill-health or low resilience. This may be made worse if the consumer has low or limited capability to engage with financial services or to manage their finances. 2.9 Firms should understand what characteristics of vulnerability are likely to be present in their target market or customer base. For example, firms that advise on investments and pensions have an older customer base, so common characteristics of vulnerability may involve health and life events associated with old age. If a firm is selling high-cost credit, its customer base may have common

Gibraltar Financial Services Commission Guidance Note on the Fair Treatment of Vulnerable Customers 9 characteristics of vulnerability caused by a lack of financial resilience, such as inadequate or erratic income. Some characteristics of vulnerability, such as bereavement and relationship breakdown, will be present in all sectors. 2.10 Firms should ensure they are aware of their requirements under the Equal Opportunities Act. Groups of consumers with certain protected characteristics may have, or be more likely to have characteristics of vulnerability, for example older consumers. In addition, the driver of vulnerability, health, largely overlaps with the ’equal opportunities ground’ of ‘disability’ under the Equal Opportunities Act. Understanding the impact of vulnerability on the needs of consumers in their target market and customer base, by asking themselves what types of harm or disadvantage their customers may be vulnerable to, and how this might affect the consumer experience and outcomes 2.11 All consumers are at risk of becoming vulnerable, particularly if they display one or more characteristics of vulnerability. They may become more or less vulnerable, and so have an increased or reduced risk of harm throughout their lives. A heightened period of vulnerability can be short, such as a hospital stay, or long term, such as long-term unemployment affecting financial resilience. 2.12 Figure 2 below illustrates this spectrum. Consumers to the left of the spectrum are less likely to be vulnerable and so face a lower risk of harm than those on the right where risk of harm is more acute. Those to the right of the spectrum are more likely to have different needs, for example, consumers with multiple overlapping characteristics of vulnerability. Firms should respond to the needs of all customers along this spectrum. 2.13 Firms should take additional care to ensure they meet the needs of consumers at the greatest risk of harm. These consumers are more likely to require support and adaptations than other consumers. But firms should also act early to prevent risk of harm emerging or growing. For example, by ensuring they design their products and services to recognise and respond to the needs of vulnerable customers in their target market and customer base. 2.14 Firms should understand how vulnerability can be perpetuated or worsened by their own actions, or inaction. For example, if a consumer loses their job or falls ill and is not offered appropriate forbearance measures on their mortgage (where this would be in the customer’s best interests taking into account the overall circumstances), this could lead to greater stress and Examples of how firms can put this into practice – Understanding the nature and scale of characteristics of vulnerability • Using published information to understand the drivers of vulnerability and the impact that being vulnerable can have on a person’s ability to engage in financial services markets. Other organisations, including charities, trade bodies and professional bodies, have published information on vulnerable consumers. Much of this is free and widely available. • Using or adapting existing internal and external research and data to identify the vulnerabilities that may be present in their customer base. This could be simple analysis of data held on the characteristics of consumers likely to be in the target market and customer base or combining these sources with customer transaction activity for more advanced analysis.

Gibraltar Financial Services Commission Guidance Note on the Fair Treatment of Vulnerable Customers 10 anxiety. In turn, this could lead to the customer taking actions that may create more harm, such as borrowing from higher-cost sources in an attempt to address the payments shortfall. 2.15 Firms should also understand how vulnerable consumers may be more likely to be susceptible to behavioural biases. Firms should know how behavioural biases may present themselves so that they understand where there may be a risk of inappropriately exploiting these biases when engaging with those consumers. 2.16 So firms should be asking themselves what types of harm or disadvantage their customers may be vulnerable to, and how their own actions can increase or reduce the risk of harm. Examples of harm and disadvantage that firms should be alert to 2.17 Behavioural and personal consequences of vulnerability for consumers include: • Heightened stress levels due to difficult, or different, personal circumstances; • Increasing time pressures due to additional responsibilities; • Increasing pre-occupation (‘brain is elsewhere’) limiting their ability to manage; • Processing power and ability decreasing due to competing pressures, for example due to the side effects, or emotional toll, of receiving medical treatment; • Lack of perspective especially when experiencing something for the first time, not fully understanding the broader implications; being unable to make comparisons, or see the ‘bigger picture’; and • Changing attitudes towards taking risks – people often become more ‘reckless’ and/or careless when under stress. 2.18 These consequences may affect the way vulnerable consumers engage with providers and may negatively impact their decision-making. For example, consumers with characteristics of vulnerability may be more likely to suffer from behavioural patterns such as ‘scarcity mindset’. This can reduce bandwidth and lead consumers to focus on certain factors at the expense of others. This may mean consumers with characteristics of vulnerability are more likely to make poor decisions about buying and using financial services, exacerbating financial difficulties. 2.19 The decision-making of consumers with characteristics of vulnerability may also be worsened by information asymmetry. This happens, for example where they have less information about the firm, product or service because they are less able to access or process relevant information to Examples of how firms can put this into practice – Understanding the impact of vulnerability on consumers’ needs • Using market research, such as surveys or focus groups, to inform a good understanding of the risks of harm for vulnerable consumers, or how to make it easier for vulnerable consumers to share information about their needs with the firm. • Creating an internal vulnerability policy that includes information on the likely vulnerabilities and needs in the firm’s target market. Formalising this information in a policy can help raise awareness throughout the firm.

Gibraltar Financial Services Commission Guidance Note on the Fair Treatment of Vulnerable Customers 11 make an informed decision. The combined effects of asymmetric information and behavioural distortions can contribute to vulnerable consumers buying unsuitable or poor value products and services. 2.20 The impact of characteristics of vulnerability and behavioural biases could be made worse by firms’ behaviour or business decisions. Financial services are also increasingly being recognised as essential, especially where they are a gateway to other services. However, the nature of financial services may also have a negative impact. Products and services are often complicated and can involve entering into extended commitments. Subsequently, the financial impact of decisions can be life changing and poor decisions can have long-term effects. 2.21 If firms don’t understand the impact of vulnerability and associated needs and respond to these, the overall impact of these consequences on consumer welfare may be detrimental and vulnerable consumers will be at increased risk of experiencing harm. Where this results in actual harm, then the impact on vulnerable consumers is likely to be greater than for other consumers. 2.22 Research into the experiences of consumers with characteristics of vulnerability has provided further evidence that the way firms respond to vulnerability can increase or reduce the risk of harm. a) Financial exclusion: vulnerable consumers are more likely to be unbanked and less likely than average to hold any form of savings, insurance or protection, pension, or investments. b) Difficulty accessing services: some characteristics of vulnerability may make it difficult for consumers to use a particular communication channel. For example, a disability may make it difficult for a consumer to access a branch in person or contact a firm by phone. Low digital capability may prevent consumers from accessing services online. Unresponsive or inflexible customer service can exacerbate difficulties in accessing services. Difficulties with access can lead to disengagement, exclusion, mistrust or even risk of scams as customers may instead rely on informal access methods. c) Disengagement with the market/partial exclusion: consumers who show characteristics of vulnerability may find it difficult to engage with markets and search for products and services effectively. As a result, vulnerable consumers may be more likely to pay a higher price than other consumers because they do not switch. They may also go without products and services. Case study: Good practice providing a choice of communication methods A consumer with cancer wanted to understand why he was being charged for his overdraft. He did not want to talk to the bank as he was ill and didn’t have good phone reception in hospital. He contacted his bank via secure email in his banking app and received a response from the customer service team. Although he was not satisfied with the outcome of his query, he was happy that the bank got back to him promptly via his preferred communication method.

Gibraltar Financial Services Commission Guidance Note on the Fair Treatment of Vulnerable Customers 12 d) Inability to manage a product or service: consumers with characteristics of vulnerability may be less likely to understand how to manage their use of a product or service on an ongoing basis. They may be less likely to be aware of their rights including their ability to get redress if things go wrong. People whose mental health has affected their social cognition are often reluctant to bring problems to their providers’ attention. This can be out of fear that they will be misunderstood or say the wrong thing or due to the emotional strain of trying to interact with other people. e) Over-indebtedness: consumers with characteristics of vulnerability are more likely to fall behind on key household bills or credit commitments. Being over-indebted may also be linked with experiencing mental health conditions or addictions. The UK’s Money and Mental Health Policy Institute have reported that nearly half of all consumers in problem debt also have a mental health problem. People with problem debt are also twice as likely to develop major depression as those who are not. Life events such as bereavement, relationship breakdown and ill health can contribute to temporary loss of income and greater risk of debt. Case study: Mixed experience of staff understanding needs A consumer with poor health struggled to fill in complicated forms when searching for travel insurance. When directed to call centres she found call handlers to be abrupt and insensitive. After contacting a number of firms one call handler made her feel comfortable and explained things in plain English which made her feel at ease and comfortable discussing her circumstances. While this consumer was able to continue their search until they found a provider sensitive to their situation, such experiences can lead to mistrust and disengagement with the market. Case study: Poor practice – failing to understand a changing need A consumer with a mental health condition tried to become an advocate for his partner so he could manage his current account while his partner was ill. He expected to be able to look after his partner’s financial affairs temporarily, until he was well enough to look after them himself. He made several calls with little progress and found it stressful and frustrating to have to prove he had permission to speak on behalf of his partner and repeat the story every time. There was no one point of contact or specialist team to deal with. The experience was in direct contrast to his own bank with whom he has had good experiences in relation to his own needs. Failing to recognise and respond sensitively to a customer’s needs can have a direct impact on the customer’s engagement with financial services and, in turn, on how they manage their financial affairs. Case study: Mixed practice – customer service A consumer became overdrawn due to financial difficulties and had payments refused. The consumer asked her bank for extra time to add money to her account, but the call handler did not approach the situation sensitively. As a result, the customer felt overwhelmed and unable to explain her situation which remained unresolved. This contrasts with the same consumer’s experience at another bank where they were put at ease so they felt comfortable discussing their financial difficulties. The bank offered to set up a basic bank account for the consumer and reassured her by offering to answer any questions. This shows the importance of empathetic, empowered and knowledgeable staff in delivering the fair treatment of customers.

Gibraltar Financial Services Commission Guidance Note on the Fair Treatment of Vulnerable Customers 13 f) Buying inappropriate products or services and exposure to mis-selling: consumers with characteristics of vulnerability may be more likely to have mistakenly bought an inappropriate product or service because they misunderstood the features or the terms and conditions. g) Scams and financial abuse: consumers with some characteristics of vulnerability may be more likely to fall victim to scams, including misleading online financial promotions. They may be specifically targeted through unsolicited approaches, more trusting or more likely to be persuaded to disclose personal financial details. For example, research has shown that older consumers who may be lonely are more likely to be at risk of being scammed. Some vulnerable consumers may be less likely, or less able, to regularly check their bank account or statements and so less likely to spot unusual transactions. Some may need to rely on informal access methods, which can increase the risk of financial abuse. 2.23 Although some consumers may display characteristics of vulnerability and be at greater risk of harm, this does not mean that they will suffer harm, particularly if firms act with appropriate levels of care. This is demonstrated in the case study below. 3 Skills and Capability of Staff 3.1 It is important for firms to recognise the role that staff play in meeting the needs of vulnerable consumers. These consumers are more likely to suffer harm when staff do not understand how vulnerability is relevant to their role, or if frontline staff do not have the skills and capability to recognise and respond to their needs. Case study: Poor practice – failing to understand the characteristics and needs of your target market A firm that provides car purchase finance to consumers with poor or non-existent credit files placed consumers who were having trouble repaying their loans into short term repayment arrangements. The firm did this to avoid further charges and further devaluing of the car in case of default. However, many of these arrangements were set at unsustainably high levels, particularly for consumers with a history of defaults and non-standard finances. This caused consumers to default or become short of money for other essential expenses. This illustrates the need for firms to understand and respond to their target market’s needs. This firm’s target market included consumers with characteristics of vulnerability including a poor credit history, illness, unemployment. These consumers were at greater risk of harm when they fell into arrears. Understanding the needs of this market, putting adequate policies and procedures in place and using them appropriately should have formed an essential part of how this firm approached arrears management and forbearance. Case study: Good practice - A firm acts with an appropriate level of care avoiding harm A consumer who had to stop working in a period of serious illness contacted an equity release provider to get some more information about releasing equity from his house. He declared his health condition and circumstances and was transferred to a specialist team who gave him information about the options available in his situation. He felt the information provided was objective and he did not feel pressured. He was able to consider the information he’d been given and decided that equity release was not a suitable option for him.

Gibraltar Financial Services Commission Guidance Note on the Fair Treatment of Vulnerable Customers 14 3.2 In this chapter, we set out how firms should: • Embed the fair treatment of vulnerable consumers across the workforce. All relevant staff should understand how their role affects the fair treatment of vulnerable consumers. • Ensure that frontline staff have the necessary skills and capability to recognise and respond to a range of characteristics of vulnerability. • Offer practical and emotional support to frontline staff dealing with vulnerable consumers. 3.3 This chapter may not be relevant to some staff, such as ancillary staff, i.e. people who don’t perform a role specific to financial services. Embedding the fair treatment of vulnerable consumers across the workforce 3.4 Staff, from senior management through to frontline and relevant back-office staff, can influence outcomes for vulnerable consumers. Firms should ensure that all relevant staff have the appropriate skills and capability, as well as support from appropriate systems and processes, to understand and take into account the needs of vulnerable consumers in their work. 3.5 Senior leaders should create and champion a firm culture that prioritises the fair treatment of vulnerable consumers. They should ensure that governance, processes and systems support staff to meet the needs of vulnerable customers when carrying out their role. 3.6 All relevant staff should understand how their role can affect vulnerable consumers. For example, staff working in product and service design or transformation programmes should take vulnerable customers’ needs into account as part of the design process or transformation agenda. If these staff do not have a sufficient understanding of the needs of vulnerable consumers in a firm’s target market, products, customer service systems and operations may not meet consumers’ needs. 3.7 Firms should ensure that all relevant staff understand the potential needs from their target market’s vulnerabilities and what this may mean in practice for their role. To demonstrate why this is important, below we look at 2 examples covering the possible impacts of mental health conditions and disabilities and domestic abuse, including economic control. • Mental health conditions and disabilities: relevant staff should understand that a consumer with a mental health condition or disability may be more likely to fall into debt and that debt can worsen a consumer’s mental health. 86% or respondents to a Money and Mental Health Policy Institute survey said that their financial situation had made their mental health problems worse. If a consumer with a mental health condition or a disability becomes indebted and a firm’s staff understand how this may make the customer vulnerable, they will have a better understanding of the support and assistance the consumer may need. • Domestic abuse (including economic control): where relevant, staff should be aware that this is widespread, with both immediate and long-term impacts on victims and survivors across all drivers of vulnerability. It is important that relevant staff are aware of how perpetrators of abuse can use financial services in their abuse and recognise how to safely provide victims with the support they need.

Gibraltar Financial Services Commission Guidance Note on the Fair Treatment of Vulnerable Customers 15 3.8 Firms should improve the skills and capability of staff in a way that is proportionate. For example, smaller firms may choose to share existing materials on vulnerabilities with their staff, such as those from professional bodies and trade associations or charity and consumer organisation websites. They may also want to hold informal information-sharing sessions for staff. Ensuring frontline staff have the necessary skills and capability to recognise and respond to a range of characteristics of vulnerability 3.9 Firms should ensure that staff have the skills and capabilities to recognise vulnerability and respond appropriately to individual consumers’ needs so they can treat them fairly. Staff should be capable of recognising and responding to needs: • where the consumer has told the firm about a need; • where there are clear indicators of vulnerability; or • where there is relevant information noted on the consumer’s file that indicates an additional need or vulnerability. 3.10 Frontline staff should be capable of exercising additional care to adapt to the consumer’s needs and be able to exercise judgement on when it is necessary to do so. Where possible, staff should be able to respond to the consumer’s needs promptly so that action is taken to ensure harm does not occur or become more severe. Adapting to consumers’ needs may mean referring them to a colleague or specialist team that is able to help. 3.11 Staff should take steps to encourage disclosure where they see clear indicators of vulnerability (see below) but are not expected to go further than this to proactively identify vulnerability. 3.12 Staff should be able to recognise when it is appropriate to seek additional support, such as escalating a case to the next level, seeking additional help from specialist teams or referring a consumer to third party support. For example, if the consumer is in a difficult situation which is out of scope of the firm’s remit (see Chapter 4 on taking practical action for more information). 3.13 Harm can arise because frontline staff are not aware of existing policies. Firms may have high￾level policies in a number of areas, but there is a clear risk to vulnerable consumers if frontline staff do not have the right knowledge or skills to implement these effectively. We refer to this as the policy/practice gap. We cover how firms can put in place appropriate systems that support staff to implement vulnerability policies in Chapter 4. Case study: Good practice – Understanding characteristics of vulnerability and the associated needs A firm launched a training tool to educate financial advisers on interacting with older consumers. The tool takes an hour to complete and gives advisers an understanding of what characteristics of vulnerability they are likely to see among their older customer base, how to recognise them and how changes in working practices can ensure they provide additional care and support where necessary. This firm has been proactive in providing training opportunities for advisers. The training tool is an example of a useful resource that firms may use to improve the skills and capability of staff, at a low cost.

Gibraltar Financial Services Commission Guidance Note on the Fair Treatment of Vulnerable Customers 16 Encouraging Disclosure 3.14 Firms should help frontline staff to understand how to actively listen out for information that could indicate vulnerability and, where relevant, seek information from vulnerable consumers that will allow them to respond to their needs. Signs and phrases to actively look out for when engaging with customers: 3.15 The steps firms should take to seek information will depend on the type of interaction, the consumer, and the type of service provided. For example, if a consumer has briefly mentioned something that could indicate vulnerability, then staff should be proactive in following this up. For example, by sensitively asking if it might affect their needs or by offering a service that is available. However, if the consumer is clearly not willing to share further information, it may not be reasonable for staff to continue asking questions. 3.16 Chapter 4 on taking practical action gives more detail on how firms can make it easier for consumers to tell them about their needs. Recording and accessing information about consumers’ needs 3.17 Knowing how to record and access information about consumers will enable firms to meet their needs promptly, consistently and fairly. If staff do not record and access this information, customer Case study: Good practice – A firm acts with an appropriate level of care avoiding harm A consumer's partner had recently passed away. She explained this to a member of staff at her bank and was offered the option to go to a separate room where she was able to speak to a specialist adviser who was well informed in bereavement matters. The adviser explained the process and cancelled the partner’s Direct Debits. By acting with appropriate levels of care, the firm was able to prevent problems with payments and further distress to the customer. Phrases such as: • I can’t pay; • I’m having trouble paying; • Mention of breathing space/debt moratorium or contacting a debt advisor; • I can’t read my bill; • I can’t understand the letter you sent me; • I can’t hold on all day; or • I hate these press buttons. Changes in payment behaviour such as: • Payments stopping suddenly; • Late or missed payments; • Regular unarranged overdrafts and charges; or • Unusual activity on an account. Staff could also be on the lookout for: • Shortness of breath or signs of agitation; • Asking for repetition (a sign that the customer is not retaining information); • Signs that the consumer has not understood or signs of confusion; or • Mention of medication.

Gibraltar Financial Services Commission Guidance Note on the Fair Treatment of Vulnerable Customers 17 service and communications may not meet consumers’ needs. For example, if a consumer with a sight impairment requests a document in large print and this is provided, but information about their need for large print communications is not recorded or accessed by staff in future, they may send the customer important communications they cannot read. In this scenario, the consumer is likely to experience harm. They might contact the firm to repeat their request which may be time￾consuming or stressful. If they do not do this, they may miss out on important information about their product, such as a notice requiring immediate action, which could result in charges on their account, causing financial harm. 3.18 Firms should ensure that staff are able to recognise when information about a consumer’s needs is relevant to future interactions and know how to record it. Staff should also know how to access and use previously recorded relevant information to prompt meeting that consumer’s needs. Case study: Poor practice – Staff failing to understand changing need A consumer wrote to a debt management firm to explain that they had been diagnosed with cancer and had to give up work due to starting treatment. In the letter, they included an updated income and expenditure form, reflecting that their income had reduced and was now based on benefits. The consumer said they were struggling financially and asked the firm for help. A member of staff received the consumer’s letter but took no action. Payments were only reduced 6 months later when the issue was discussed during an annual review, despite the material change in the consumer’s circumstances. The firm had not sufficiently trained their staff to understand the impact of changing needs and did not have processes in place for them to respond flexibly. As a result, the firm failed to respond to information provided by the consumer, collecting unaffordable payments for a period of 6 months. This may make a difficult personal and financial situation worse. This demonstrates that if firms do not train their staff to recognise and respond appropriately to consumer needs, and have adequate systems and policies in place to support staff to do this, this can lead to harm.

Gibraltar Financial Services Commission Guidance Note on the Fair Treatment of Vulnerable Customers 18 3.19 When dealing with its customers’ personal information, firms and staff must ensure that they comply with all applicable data protection requirements. Appendix 1 discusses data protection considerations that firms should take into account when interpreting the Guidance. 3.20 Although the TEXAS model refers to obtaining explicit consent, firms need not rely on consent to process data: there are alternatives and use of consent will not always be appropriate (please see Appendix 1). In all cases, firms should ensure that they are open and transparent with their customers about how any information disclosed will be used to meet their needs. Example of how firms can put this into practice – the TEXAS Model TEXAS was originally developed following a study on mental health and debt collection but it has become a tool that is used across the sectors to handle a wider range of vulnerable situations. It helps ensure staff record (i) the most relevant information about characteristics of vulnerability, (ii) how these characteristics affect support needs, while (iii) helping to meet data protection requirements. The steps of the model include: Thanking the customer for their disclosure. Explaining how their disclosed information will be used. Depending on the basis on which the data will be processed either: eXplicit consent is sought Or cheXs (‘checks’) made to ascertain if the customer objects to data processing. Asking the customer questions to find out key information to understand the situation better. Signpost to internal support, or to external services with specialised expertise (where this is appropriate). Case study: Good practice – Understanding and responding to the evolving needs of different clients A wealth management firm records information about individual clients during its onboarding process and it uses this opportunity to assess indicators of vulnerability. It also conducts periodic reviews of the client’s information and circumstances to ensure its records are up to date and accurately reflect the client’s situation. Where a client is presenting indicators of vulnerability, or conversations indicate a change in circumstance, cases are assessed by the firm. Steps are taken to ensure only appropriate products and services are offered to the client, and in a way that suits their needs. This small firm monitors the needs of their consumers and regularly checks to ensure that their offer to their clients is appropriate.

Gibraltar Financial Services Commission Guidance Note on the Fair Treatment of Vulnerable Customers 19 Offering practical and emotional support to frontline staff dealing with vulnerable consumers 3.21 Frontline staff may come across challenging situations and firms should offer practical and emotional support to staff where appropriate. This may take the form of offering self-help information, time out following difficult or challenging phone calls or time for staff to share experiences either in face-to-face meetings or via online forums. Large firms may offer an employee assistance service. By supporting and improving staff members’ mental and emotional resilience, firms can help their frontline staff engage with vulnerable consumers more sensitively. 4 Taking Practical Action 4.1 Firms should turn their understanding of vulnerable consumers in their target market or customer base (see Chapter 2) into practical action to meet their needs. 4.2 In this chapter, we set out how firms should take into account the needs of vulnerable consumers in their product and service design, customer service and communications. Product and service design 4.3 Where firms design products and services that do not take into account the needs of vulnerable consumers in their target market and customer base, there is a risk that these consumers can suffer harm as their needs may not be met from the start. Products and services can have inherent features that could be harmful to some vulnerable consumers. For example, if products and services are complex, some of these consumers may find it more difficult to understand and access the products best suited to their needs. 4.4 In this section, we set out how firms should: a) consider the potential positive and negative impacts of a product or service on vulnerable consumers, and design products and services to avoid potential harmful impacts. b) take vulnerable consumers into account at all stages of the product and service design process, including idea generation, development, testing, launch and review, to ensure products and services meet their needs. Considering the potential positive and negative impacts of a product or service on vulnerable consumers and designing products and services to avoid potential harmful impacts Considering if features of products or services exploit vulnerable customers 4.5 While some products and services may not be seen as harmful, they could have features that are harmful to vulnerable consumers. For example, it has been found that that short term credit with high fees and charges for rollovers negatively affect consumers with low financial resilience. 4.6 If a firm’s business model intentionally exploits vulnerable consumers, this would be a clear breach of the Core Principles and the Consumer Duty. However, harm to vulnerable consumers might occur unintentionally and firms should actively consider the likelihood of any unintended effects when they are developing products and services to avoid potential harm. Firms should proceed with

Gibraltar Financial Services Commission Guidance Note on the Fair Treatment of Vulnerable Customers 20 additional care for characteristics of vulnerability present in their target market or customer base. This includes cases where the product is targeted at vulnerable consumers, or where the firm sells to a broad cross-section of people, which will include vulnerable consumers. Overly complex products and services can be hard for consumers to understand and can make it difficult for them to buy the product best suited to their needs. Designing products and services that meet evolving needs and avoiding inflexibility that could result in harmful impacts 4.7 Firms should consider how characteristics of vulnerability present in their target market or customer base may affect their customers’ needs over time. Standard services with little flexibility can prevent consumers from engaging with or using them. For example, automated helplines with no clear exit routes can be very difficult for people with cognitive disabilities or more complex needs to use. 4.8 Standard contracts can be inflexible and often don’t have easy options for consumers to vary or change them in response to changes in circumstances. For example, an individual who has had a change in financial circumstance from taking an extended period off work due to medical treatment, might expect they will struggle to repay their mortgage. If their provider is not able to respond promptly and flexibly to their circumstances this could exacerbate any financial strain the customer are experiencing due to their ill health, resulting in harm. Example of how firms can put this into practice: vulnerable customers in financial difficulty Not all customers in financial difficulty will be vulnerable. Firms should establish effective policies for the fair and appropriate treatment of customers who the firm understands or reasonably suspects to be particularly vulnerable. Below are 2 examples of what fair and appropriate treatment of customers who may be particularly vulnerable could mean in practice. Flexibility to exit automated processes Firms may use automated solutions or digital tools in their processes to manage consumers who are in financial difficulty, however, they should ensure there is the possibility of manual intervention where this may be necessary to meet the needs of those customers who are vulnerable. They should tell consumers about the support available and encourage them to disclose their needs. For example, asking about the consumer’s communication preferences when contacting them. Flexibility to respond to needs of customers impacted by ill health or major life events Building in flexibility to offer customers forbearance for a specified period without changing contractual terms may be an appropriate response for some vulnerable customers impacted by ill health or major life events, particularly where their financial circumstances are expected to improve soon. Designing sales processes that meet consumers’ needs 4.9 Firms should consider the characteristics of vulnerability in their target market or customer base when designing how they distribute products. For example, firms may decide that, where the relevant legislation does not already require advice, it is prudent for consumers with certain characteristics of vulnerability to seek advice before making a decision. Where that is the case a firm may decide the product will be always sold on an advised basis. Alternatively, they may signpost consumers who could be at greater risk of harm to appropriate help or advice services.

Gibraltar Financial Services Commission Guidance Note on the Fair Treatment of Vulnerable Customers 21 4.10 In some circumstances, a firm may decide it would be prudent for consumers whose vulnerability is temporary, for example caused by a life event, to have extra time before they make a decision. This might be because the customer lacks the capability to make a decision at that point in time, or is faced with an unexpected or complex decision. For example, a customer with a sum of money to invest as a result of a negative life event, such as for example a life insurance pay-out or compensation for a life-changing accident, may need more time and help to consider all the information and their options to ensure they reach a conclusion which is best for them in the long￾term. Taking vulnerable consumers into account at all stages of the product and service design process 4.11 To ensure products and services meet the needs of vulnerable consumers in their target market or customer base wherever possible, firms should take such needs into account at all stages of the product and service design cycle. They should also take them into account if they are considering changing a product or service. For example, if they are closing a communication channel or branch or reducing the services offered by a particular channel. Firms may use different terminology to refer to their design process but the key considerations will remain the same. Idea generation 4.12 During idea generation, firms should spend time understanding what vulnerable consumers might need from a product or service or how they might be affected by changes to an existing product or service. Firms should consider the characteristics and needs of vulnerable consumers likely to be in their target market and customer base. This will help firms anticipate and proactively address the difficulties these consumers may have over a product’s life. By doing this, firms may prevent potential harms from occurring, and deliver better outcomes for vulnerable consumers. 4.13 Firms may want to consider options such as creating a product specifically to meet the needs of vulnerable consumers. They could also take an inclusive design approach when designing their products and services, so that as many consumers in their target market as possible, including vulnerable consumers, can access and use them (see example below). Examples of how firms can put this into practice Consulting with people in the firm who are in contact with consumers most frequently. Holding focus groups with vulnerable consumers or consumer representatives at the development stage to get a greater understanding of their needs and how products can meet them. Exploring resources provided from, and consulting with, specialist organisations offering information on how the needs of vulnerable consumers can be met in the design stage.

Gibraltar Financial Services Commission Guidance Note on the Fair Treatment of Vulnerable Customers 22 Development 4.14 During development of a product or service, firms should build features into products or services that meet the needs of vulnerable consumers. Firms should also consider whether any products or services might have features that could risk harm for vulnerable consumers, for example because they are highly complex, and find ways to reduce this where possible. 4.15 When designing products and services, firms should consider what distribution channel (how consumers access their service) is suitable for their target market. For example, firms should consider whether a digital or telephone-only channel is appropriate or if it is necessary to provide alternative ways or channels to communicate. 4.16 Firms who do operate via a single channel should consider how they might recognise and respond to the needs of their consumers if they were to develop characteristics of vulnerability. For example, providing a call back service for consumers who might struggle with phone menus or the option to notify the firm of a change in circumstance via an app or live web chats. This may also include a face-to-face option for consumers who may be digitally excluded or have lost access to telephone services. 4.17 Proactively offering help is valuable and this applies even in digital journeys. For example, some websites have the functionality to pick up on hesitation (for example by tracking analytics such as ‘hover time’) on their pages and automatically generate chatbots or webchats. Some provide simple definitions of jargon if the reader hovers over a word or phrase. Others offer screen reader functionality. Examples of how firms can put this into practice – Inclusive design Firms may wish to take an inclusive design approach to meet both the needs of their vulnerable customers and the majority of consumers in their target market. By this we mean designing inbuilt features of the product or service which ensure the needs of vulnerable customers are met, while at the same time benefitting a wider range of consumers. For example: • Easy to read materials in plain English would be beneficial to a wide range of consumers. This can include people with low capability, people with poor literacy (1 in 7 adults have literacy skills at or below those expected of a 9 to 11 year-old) and people with cognitive disabilities. • Having an online or text function that allows customers to notify their financial provider of a change in circumstances easily and everyone can use this to update their circumstances in their own time and at their own pace. For people with characteristics of vulnerability it may help them avoid a challenging conversation, and provide some privacy. We encourage firms to research the needs of consumers with characteristics of vulnerability in their target market and customer base and consider inclusive design principles.

Gibraltar Financial Services Commission Guidance Note on the Fair Treatment of Vulnerable Customers 23 Examples of how firms can put this into practice Stress-testing the product or service to identify how it might perform in a range of market environments and how vulnerable consumers could be affected. Consulting with consumers or representative groups when seeking to alter or withdraw a product or service. Employing third-sector organisations who can review products and services from the viewpoint of vulnerable consumers. Testing 4.18 Firms should consider, and potentially test, the impact the product or service has on vulnerable consumers. Firms should test any innovative features designed specifically to meet the needs of vulnerable consumers, and assess how flexible the product could be to changing needs. They should adapt the product or service based on this testing to reduce the risk of harm for vulnerable consumers, or to ensure that product features designed to meet the needs of vulnerable consumers actually work. Launch 4.19 When the product or service is ready to launch, firms should consider how to launch it appropriately so that vulnerable consumers are aware of and understand it. They should take steps to avoid selling products or services to vulnerable consumers if they may not be appropriate. This should also include ensuring all frontline staff are aware of the product and its features, as well as who it might be most or least appropriate for. Review 4.20 All firms should periodically review their products and services to check whether they still meet the needs of vulnerable consumers in their target market and customer base, and do not unintentionally disadvantage them. Such systems and controls to review products and services will help firms comply with Core Principle 2 (see Chapter 5 on monitoring and evaluation). 4.21 When a firm alters or withdraws a product or service, for example closing a channel such as telephone banking or stopping paper statements or correspondence, they should seek to understand if and how this will affect vulnerable groups of their customers. Firms should communicate any changes from withdrawing products or services in a timely, clear and sensitive manner. They should set out what it means for the consumer, communicating alternative solutions, and the consequences to any consumers of not acting. Firms should take additional care in how they proactively manage the change where a consumer is very vulnerable or the potential for harm is serious. For example, they may wish to consider supporting the customer to find an appropriate alternative. 4.22 This may also be relevant where firms undertake transformation programmes or change their operations, for example where branch closures or conversions are planned. Firms should seek to assess the needs of customers currently using the sites and consider the availability and provision of alternatives, to ensure the way firms implement these decisions leads to fair outcomes for consumers, particularly those who rely on access to cash.

Gibraltar Financial Services Commission Guidance Note on the Fair Treatment of Vulnerable Customers 24 Products sold through intermediaries in distribution chains 4.23 Financial services products are often distributed through chains of firms, for example lenders, insurers, master-brokers, brokers, and financial advisors. All firms in the chain must treat consumers fairly, irrespective of whether they have a direct relationship with the consumer, or whether they design the product and service they distribute. 4.24 Where products are sold through a broker or other intermediary, firms should ensure products are clearly explained and understood by the consumer, for example by following up directly with consumers. 4.25 Where there is a chain of regulated firms they should each consider how effective their own approach to vulnerability and associated procedures is. During initial and ongoing due diligence, and particularly where they rely on third party providers and outsourcers, firms should ensure that firms they work with treat vulnerable consumers fairly. Case study: Good practice – Product features supporting the needs of vulnerable consumers Several banks have introduced optional blocks on payments to gambling firms to help consumers who would benefit from greater control of their spending on gambling. These banks have considered the needs of vulnerable consumers in their target market and worked to support them through their product design. They have empowered consumers who may have a gambling addiction to take control. This is also an example of inclusive design. Case study: Poor practice – Failing to understand a customer’s needs and being inflexible A consumer with complex post-traumatic stress disorder who cannot work contacted her bank to advise them of her situation and asked if they could limit her cash withdrawal limit. Her bank told her they were unable to help with this. An episode of poor mental health resulted in the consumer spending all her unemployment benefit at once. She subsequently reported to a local charity for 2 consecutive weeks requesting food bank vouchers as she did not have enough money to eat. This firm was inflexible in their approach to vulnerability, failing to understand and respond to a customer’s needs leading to consumer harm. Case study: Good practice – Product features supporting the needs of vulnerable consumers One firm serving older consumers encourages consumers to provide a designated second contact (e.g. spouse, carer or family member) when the customer joins. This puts a process in place from the start that would provide a support system to a consumer if they were to become unable to manage their own financial affairs, such as experiencing a loss of capacity or a period in hospital. This firm has taken a proactive step, through product design, to help prevent harm. This is an example of inclusive design which can potentially benefit all consumers.

Gibraltar Financial Services Commission Guidance Note on the Fair Treatment of Vulnerable Customers 25 4.26 When a number of firms are working together in a distribution chain for the product and/or services, they should also consider other relevant requirements and guidance, particularly the CPCD Regulations and the GFSC’s Consumer Duty Guidance Note. 4.27 This Guidance aligns with, and does not go beyond, these other legislative requirements and guidance. It is not intended to imply that a firm must take on the regulatory responsibilities of other authorised firms in the distribution chain. Customer Service 4.28 Vulnerable consumers are more likely to have different service needs. For example, they may find some channels of communication challenging or stressful or need more time to understand information and make decisions. If firms do not ensure their customer service provision meets the needs of vulnerable consumers, they can exacerbate the risk of harm from being vulnerable. For example, unresponsive or inflexible customer service can increase the stress and confusion a consumer may suffer when already dealing with unexpected or challenging life events. 4.29 Failure to recognise when consumers are struggling to make decisions or act in their own interests and provide the right support, can result in harm. For example, cognitive disabilities, mental health conditions or addiction can lead to harmful financial decisions, vulnerability to scams and buying unsuitable products. 4.30 In this section, we set out that firms should: a) Set up systems and processes in ways that will support and enable vulnerable consumers to disclose their needs; b) deliver appropriate customer service that responds flexibly to the needs of vulnerable consumers; c) tell consumers about the support available to them including relevant options for third party representation and specialist support services; and d) put in place systems and processes that support the delivery of good customer service, including systems to note and retrieve information about a customer’s needs. Case study: Poor practice – Recognising a consumer’s needs and considering if a product is appropriate An elderly consumer who lived alone had been sold credit by a broker during a sale in her home. The lender phoned the consumer as part of its follow-up process before the loan was released, and she initially told the firm that she wanted to go ahead with the sale. The lender knew that the consumer was vulnerable and arranged another call to confirm her decision. Despite the consumer changing her mind over several phone calls, she then agreed to proceed, and the loan was processed. After this, it transpired that the customer had dementia and, with the intervention of the consumer’s daughter and a lawyer, the lender wrote the loan off. This broker and lender were both responsible for recognising the consumer’s vulnerability, and whether the product was suitable for the consumer’s needs and circumstances. Neither the broker nor the lender gave sufficient consideration to the consumer’s vulnerability as the loan was granted despite the consumer’s confusion.

Gibraltar Financial Services Commission Guidance Note on the Fair Treatment of Vulnerable Customers 26 Setting up systems and processes in ways that support and enable vulnerable consumers to disclose their needs 4.31 Consumers in vulnerable circumstances are more likely to have different needs when dealing with a firm than the average consumer. If the firm does not recognise and meet those needs, vulnerable consumers are more likely to suffer harm from poor service. 4.32 Frontline staff should have the skills and capability to recognise characteristics of vulnerability and respond to individual consumer needs where a consumer has shared a need or where there are clear indicators of vulnerability. See Chapter 3 where we describe staff skills and capabilities in more detail. 4.33 Firms should be proactive in offering support. They should enable consumers to tell them about any additional needs they have so they can deliver appropriate customer service. This includes in digital or paper-based customer journeys where there may be no direct interaction with frontline staff. 4.34 Firms should ensure that staff focus on understanding and responding to the consumer’s financial services’ needs. For example, if a consumer in arrears mentions that their mental health condition means they find opening letters distressing, firms should focus on how they can meet their communications needs using other channels and if it would be appropriate to sign-post to sources of help and advice. 4.35 Firms should try to recognise the needs of consumers, whatever channel they use. Firms that use face-to-face interaction or speak to customers on the phone can support staff to recognise observable signs of vulnerability and encourage the customer to discuss their needs. Firms with digital channels could introduce tools, such as text boxes or chatbots, to allow consumers to share information about their needs. 4.36 Vulnerability is often temporary and can happen at different times in a consumer’s life or at different stages in the product life cycle. It may not occur to a consumer to share needs when buying a product. For example, a consumer who holds an insurance product may have additional needs when making a claim that did not seem relevant when they bought the product. The consumer’s circumstances may change over time such as a change in health, employment or relationship status. This is relevant to all products but particularly to low contact products such as insurance. Firms should consider whether there are touchpoints in the customer journey they can use to gather information on customer needs. For example, at renewal insurers could build in relevant questions or prompts to contact the insurer.

Gibraltar Financial Services Commission Guidance Note on the Fair Treatment of Vulnerable Customers 27 Examples of how firms can put this into practice • Encouraging consumers to talk to them about their needs by promoting their support services. • Providing easy to understand information on the services they can offer to vulnerable consumers, for example, via a website link if the customer is interacting online. This can give consumers confidence that telling firms about their needs will help them. • Supporting vulnerable consumers to explain their needs and what support would help them. For example, by asking questions about needs and preferences across key points of the customer journey, such as when taking out a new product or service. • Using targeted online questions and FAQs or open text boxes that encourage customers to volunteer any relevant additional information. • Building in online tools that flag support available from a human adviser if customers display certain behaviours, such as hovering for a long time before inputting information, pressing help buttons, or entering inconsistent information. 4.37 If a consumer does not disclose information so that it is not clear they may have additional needs, staff or customer service systems may not be able to respond. Delivering appropriate customer service that responds flexibly to the needs of vulnerable consumers 4.38 The needs of some vulnerable consumers may be met by building flexibility into existing customer services. Frontline staff should be able to adapt their approach to deliver a service that meets the individual needs of vulnerable consumers. Case study: Good practice – Responding to temporary vulnerability in the target market and customer base One firm in the energy sector has adapted its customer service strategy to tackle risks associated with temporary vulnerability. This includes people leaving hospital treatment, young adults living independently and people suffering life events such as divorce and bereavement. The firm has implemented a script for staff to help them recognise and review vulnerability at key points in the customer journey such as switching to the provider, moving to a new house, or taking out a different or additional product. Where a vulnerability is expected to be short lived, agents agree a review date with the consumer, and place reminder flags on the account. This firm has identified touchpoints in the customer journey that can be used to gather and update information on customer needs. Case study: Poor practice – Recognising vulnerability and taking needs into account A consumer who could not read or write, and had a significant speech impediment, could not work as he was also the main carer for his disabled wife. Trading Standards identified that he had bought expensive goods on credit, sold via a credit broker, that he did not need or want. He was making the credit payments as he thought he had to, although he found this financially difficult. Trading Standards supported the consumer to raise a complaint. However, the lender refused to put the consumer back in the position he was in before he took out the loan unless they were able to speak to the customer directly. The vulnerable consumer did not feel comfortable having such direct contact with the lender. The broker had poor processes in place to recognise whether the loan was unsuitable for the consumer. The lender should have considered the communication needs of the consumer and allowed him to complain with support from the third party.

Gibraltar Financial Services Commission Guidance Note on the Fair Treatment of Vulnerable Customers 28 4.39 Firms should support staff to do this by ensuring that their culture and systems, do not discourage staff from taking extra time or flexible steps to respond to vulnerable consumers’ needs. For example, staff should be able to ‘stop the clock’ on a case if they feel the consumer needs more time or support to understand information and make a decision. As a result, pay and reward structures should not just look at volumes or speed of consumers served, but the quality of service and outcomes. 4.40 Firms should ensure that they can alter their customer service processes to help consumers with additional needs. For example, changing a process that may usually involve automated letters, so that a person who may be visually-impaired receives a more appropriate communication, such as using Braille or audio. 4.41 For consumers with protected characteristics such as physical or mental health disabilities, firms may also need to make such changes to comply with the Equal Opportunities Act. In this way, whilst this Guidance is broader, it also seeks similar outcomes to the anticipatory duty under the Equal Opportunities Act that requires reasonable adjustments for people with disabilities. 4.42 Many firms offer self-service options, such as through apps, automated phone line or online channels. These firms should consider how to build in flexibility to the system to allow consumers to pause or exit the process and get more time or receive a more personalised service. For example, offering an ‘exit lane’ to an automated phone service so the consumer can access more help or advice, using chatbots or providing a contact number to help online consumers who may have further questions or whose needs are not met by standard service options. Case study: Good practice – Tailoring customer service to meet the needs of a consumer An investment management company had a client who needed advice on their pension but could not read or write and did not appear to have any relatives who could help him. The firm sat down with the client over a number of weeks and explained their options, breaking these down into small decisions. Did they prefer a larger pension or a smaller one with some cash? Did they prefer a pension that went up each year or a larger one that stayed the same? At each stage the consumer indicated their preferred option. This firm found value in taking the time to explain options to a consumer with limited capability in a way they could understand, helping them to make a decision. Case study: Good practice – Considering how to adapt to meet the needs of vulnerable consumers A consumer was on long-term sickness absence from work and could no longer afford their credit card payments. They wrote to their providers for help. One firm called back to let the consumer know, in advance of their formal response, that it had frozen interest and charges for several months. The firm also accepted the proposed lower monthly payment. The account was placed with their specialist support team so that the debt would not be sold on. This firm had flexible systems and processes in place, allowing them to adapt to the needs of the vulnerable consumer.

Gibraltar Financial Services Commission Guidance Note on the Fair Treatment of Vulnerable Customers 29 Examples of how firms can put this into practice • Firms may want to consider how digital services and information technology can provide helpful tools to support vulnerable consumers. For example, some payment accounts allow consumers to place blockers for certain types of expenditure, for example gambling, or for large amounts. • Some banks offer third party mandates or authorities. These allow consumers to nominate a third party to carry out everyday transactions, such a paying bills or withdrawing money, on their behalf. These can be useful if a consumer is unable to access their banking services for a short period of time, for example a trip abroad or a hospital stay. Telling consumers about the support available to them 4.43 Firms should proactively tell consumers about the options of help and support they offer to meet the needs of vulnerable consumers. This should happen where the firm recognises that an individual consumer has a specific need and also through their communications and websites. Making this information available may encourage consumers to share information about their needs with firms. 4.44 Firms should ensure the help and support they offer is easy to access and use. Supporting decision-making and third party representation 4.45 Some consumers, due to low capability or reduced cognitive ability (e.g., dementia, cognitive disabilities or brain injuries) will struggle to safeguard their own interests. Other consumers may have temporarily-impaired capacity or decision-making ability. For example, fluctuating mental health conditions or addictions can lead to harmful or reckless financial behaviour. These consumers can be more at risk from buying inappropriate products, fraud or financial abuse. 4.46 Firms should consider how they can empower consumers to take actions that will support them to manage their finances or protect themselves from scams in times of low capacity or impaired decision-making. The box below gives examples of actions that firms can take. 4.47 Firms should consider consumers’ vulnerability and capacity to make decisions when deciding how to treat consumers who have been victims of scams or fraud. They should also consider the needs of vulnerable consumers when designing their complaints processes. They should consider how they can support vulnerable consumers to complain, if services are not meeting their needs, Case study: Poor practice – Poor processes and inflexible staff A consumer whose partner had recently passed away went to the bank to sort out their partner’s affairs. They were told “There isn’t anyone here who does bereavement today. Come back tomorrow.” The firm, rather than the staff member, was at fault here due to its inflexible processes and inadequate training for dealing with vulnerable consumers suffering distressing life events. Even if specialist staff are not available, all frontline staff should have been trained to advise consumers on how processes, such as registering a bereavement, work, and been able to sensitively advise the consumer of their options. Lack of sensitive frontline support can lead to disengagement and harm to the consumer.

Gibraltar Financial Services Commission Guidance Note on the Fair Treatment of Vulnerable Customers 30 and get redress. Third party representation 4.48 Some vulnerable consumers need additional support in making decisions, or rely on others to make some decisions on their behalf. This may be because their ability to manage their money or represent their own interests is permanently or temporarily impaired (for example, due to dementia or mental health conditions). Where appropriate, firms should provide straightforward options to enable legitimate and legal delegated access or support, while maintaining robust safeguards to reduce the risk of abuse. 4.49 It is important to note that a firm should not regard a customer as lacking capacity to make a decision unless the firm has taken reasonable steps without success to help the customer to make that decision (see Mental Health Act 2016). 4.50 There are a range of legal mechanisms, including Power of Attorney to support customers who do not make their own decisions. 4.51 Firms should also consider how to meet the needs of consumers who need a third party to access their account or to support them on a short or medium-term basis. Flexibility that doesn’t undermine important safeguards may be appropriate in the case of an emergency or short-term need. For example, to allow a third party to pay an emergency bill to prevent a consumer from going into debt, to freeze accounts where there are concerns over fraudulent activity or to let a debt adviser negotiate with a lender on the customer’s behalf. 4.52 If a firm has doubts about a consumer’s ability to understand a product or service, suspects they do not have capacity to make decisions or that they are acting as a result of fraud or coercion, it should assess whether it should allow the consumer to proceed. It may be appropriate for firms to contact or act on the instructions of a family member, friend or other third party. This may even be appropriate in circumstances where formal third-party access mechanisms are not set up. Firms and staff must ensure that they comply with all applicable data protection requirements; Appendix 1 discusses data protection considerations that firms should take into account when interpreting this Guidance. Case study: Good practice – Flexible processes to respond to temporary need A bank has implemented a flexible third-party policy to ensure that nominated people, such as family members, friends or carers, can access and manage the consumer’s account on a short-term basis, with the consumer’s consent. The policy clearly outlines the different levels of access that a consumer can give to a nominee and the arrangement can be stopped at any time. The bank explains where a Power of Attorney would be suitable for certain levels of management, such as changing the name on the account, opening and closing accounts and signing up to or changing products. The firm also allows consumers to nominate a third-party who can manage their account in the short-term if they have temporary loss of capacity. The policy also offers home and hospital visits in emergency situations if the consumer requires this. This firm has a pre-emptive and flexible process for dealing with temporary vulnerability, and has explored different types of third-party representation.

Gibraltar Financial Services Commission Guidance Note on the Fair Treatment of Vulnerable Customers 31 Examples of how firms can put this into practice • Creating dedicated vulnerability units that have the skills, knowledge and time to support consumers with complex or specialist needs as well as offer advice and support to frontline staff. • Nominating individuals to become vulnerability champions or ‘super-users’ to provide support and expertise to colleagues. Specialist Support 4.53 Even with inclusive design, some vulnerable consumers will have complex needs or be in situations that will be difficult for firms to address within their standard processes. These consumers may need more targeted support or referral to specialist services. 4.54 Larger firms or those with many vulnerable consumers may consider introducing specialist teams or staff trained to provide specialist support. For example, some larger firms may want to have dedicated bereavement services where staff have the training and time to deal sensitively with the needs of bereaved consumers. If specialist support is available internally, firms should ensure that frontline staff know and make it easy for vulnerable consumers to access that support. For example, firms may enable ‘warm handovers’ where a vulnerable consumer is transferred directly and introduced to a specialist team. 4.55 If a firm believes that consumers may benefit from support or help from a third-party organisation or charity they should provide clear information to signpost the consumer to the third party. Large firms or those with many vulnerable consumers could explore formal partnerships with specialist organisations, such as through enabling ‘warm referral’ routes to give consumers benefits advice or support for mental health conditions. 4.56 Some vulnerable consumers may be in difficult, or crisis situations and it is not appropriate for the firm to resolve them. Where there is immediate or serious risk to the health or life of the consumer or their family members, firms may consider it appropriate or necessary to inform the relevant authorities. Case study: Good practice – Helping vulnerable consumers access specialist services A mortgage company was approached by a consumer who wanted to release the equity in his property because he believed he was ineligible for a state pension and needed some income. Research by the company revealed the consumer was misinformed and was in fact eligible for a state pension and had a significant amount of unclaimed state pension due. The product application did not proceed as the consumer no longer needed to release money from their property to provide the income they needed. This firm has taken extra steps to ensure that a consumer in a vulnerable situation and under financial pressure is buying the right product for their needs. When the firm found there was no need for the product the consumer sought they did not proceed with the application. This firm has a pre-emptive and flexible process for dealing with temporary vulnerability, and has explored different types of third-party representation.

Gibraltar Financial Services Commission Guidance Note on the Fair Treatment of Vulnerable Customers 32 Putting in place systems and processes that support the delivery of good customer service 4.57 Vulnerable consumers can be exposed to harm if firms have incorrect information or are not aware of information that has already been shared with another part of the organisation. For example, if a consumer in debt informs one part of the business that they are experiencing financial difficulties due to illness but the system does not allow this to be shared with the collections department. The firm could fail to alter their collection process to the consumer’s new circumstances, making their situation worse. 4.58 Firms should ensure that they have systems and processes that allow customer service staff to record and access information that will be required in the future to respond to vulnerable consumers’ needs. Consumers should not have to repeat information. 4.59 In designing such systems, firms should consider what consumers would reasonably expect when they share information about their needs with the firm. For example, where a consumer holds multiple products within a single brand they may expect staff within that brand to be aware of their needs. Where a consumer holds products across different brands they may not know they are part of the same group and may expect to contact the brands separately to discuss their needs. Firms should ensure they record and process data in line with requirements of data protection legislation, see Appendix 1. Case study: Good practice – Helping vulnerable customers access specialist services One insurer has created a partnership with a voluntary organisation where it can refer consumers for a home visit if it feels they are in a particularly vulnerable situation. The firm makes a donation for each referral to prevent burdening the charity’s resources. Some employees also volunteer with the charity for an afternoon each week. This firm helps consumers get the support they need where it is beyond what the firm itself can offer, and is considerate of the resource constraints faced by voluntary organisations. Staff can be reassured that those in particularly vulnerable situations will receive further help, and have the opportunity to learn more about circumstances that drive vulnerability. Examples of how firms can put this into practice • Having systems in place that minimise the number of times a customer must inform firms about their vulnerability. For example a ‘tell us once’ style process where customer can notify a firm of a bereavement just once. • Adding a free-text box on systems or notes on a customer file that allows staff to describe the customer’s needs.

Gibraltar Financial Services Commission Guidance Note on the Fair Treatment of Vulnerable Customers 33 Communications 4.60 Failure to communicate with vulnerable consumers in ways they can understand may result in an increased risk of harm. Consumers may not be able to understand the information they are sent or may struggle to communicate their needs to firms. Low capability or physical disabilities may result in specific communication needs. Several factors can drive low capability, including low literacy, numeracy, poor knowledge of financial products and cognitive disabilities. Physical conditions can also result in specific communication needs. For example, sight and hearing impairments can make some channels of communication impossible to use and makes alternative accessible formats essential. 4.61 Some temporary circumstances or characteristics can mean that consumers struggle to understand or take in information. For example, stressful circumstances after life events like divorce or bereavement may make consumers more susceptible to harm, particularly where Case study: Good practice – Recording and using relevant information on consumer vulnerability A consumer with poor mental health missed several credit payments due to feeling too overwhelmed and anxious to deal with the situation. When they finally contacted the firm, the firm was helpful. It noted the consumer’s difficulties on file, asked if the consumer would like a named representative put on file, and arranged an affordable repayment plan for the consumer. The consumer now feels comfortable to call the firm in future. This firm had a process in place for recording consumer vulnerability and third party representation, as well as being able to help the consumer deal with their arrears. This holds true for future interactions, when having information recorded about a consumer’s circumstances available will enable other staff members to understand their needs. Case study: Good practice – Offering specialist and flexible services A digital firm allows consumers to enter text into a box in their App to inform them about their personal circumstances, and how these might affect how they manage their finances or use their account. This firm has made good use of technology by creating an easy way to encourage consumers who use their mobile app to share information in their own time and made them aware of the kind of things the firm may be able to help with. Case study: Poor practice – inadequate systems and processes While one firm had policies and procedures in place to support customers when they fell into arrears, for example transferring accounts to collections, having contact strategies and completing an affordability assessment with customers, these were not always followed. Following a review, it found poor outcomes caused by factors including delays, poor quality conversations, failure to take customers' circumstances into consideration, and inappropriate forbearance solutions being applied. In addition, systems did not support assessment of affordability and there were inconsistencies in approaches between collections teams. Due to weaknesses including in operating models, management, and systems this led to some consumers experiencing harm such as additional fees and charges, when they were already in difficult circumstances.

Gibraltar Financial Services Commission Guidance Note on the Fair Treatment of Vulnerable Customers 34 Examples of how firms can put this into practice • Providing a means of communicating using British/Irish Sign Language such through video services • Simplified versions of communications, e.g. using infographics • Colour schemes friendly to people with conditions such as dyslexia • Large print • Accessible websites • Next Generation Text • Easy grip pens in branch • Audio options communications are unclear or are potentially misleading. Some mental health conditions can lead to anxiety and avoiding certain communication channels such as letters or the telephone. In the following section, we set out how firms should: a) Ensure all communications and information about products and services are presented in ways that are understandable for these consumers. b) Consider how they communicate with vulnerable consumers, taking account of their needs. Where possible, firms should offer multiple channels so vulnerable consumers have a choice. Ensuring all communications and information about products and services are presented in ways that are understandable for consumers 4.62 Firms should ensure communications throughout the life-cycle of a product or service are clear and provided to vulnerable consumers in a way that they can understand, this includes: • marketing • point of sale • post-contractual information • information about changes to the product or service • complaints processes 4.63 Firms should consider the needs of vulnerable consumers in their target market and customer base when designing communications. 4.64 If needs cannot be accommodated within standard communications, firms should provide different formats where it is proportionate to do so, particularly for key documents. 4.65 Where disclosures are standardised by legislative provisions, firms must ensure they comply with mandatory disclosure requirements. However, this should not prevent them from additionally providing information in a form that meets the communication needs of vulnerable consumers. For example, a staff member could explain the written information that has been provided to the consumer in a way that is easy to understand. 4.66 In addition to this Guidance, firms should consider the requirements of the Equal Opportunities Act 2006.

Gibraltar Financial Services Commission Guidance Note on the Fair Treatment of Vulnerable Customers 35 4.67 Firms should consider the challenges vulnerable consumers may face in understanding features of a product or service. In addition to how they present information, firms should also consider how vulnerable consumers process that information and the potential effect of behavioural biases. 4.68 Some vulnerable consumers may be concerned that asking for clarification on seemingly basic terms or calculations, or for extra thinking time could be perceived negatively, or they might feel under pressure to make a decision quickly. Firms should ensure customers do not feel rushed into making decisions and ensure that complex terms and concepts are communicated clearly. 4.69 Firms can support customers in this by ensuring that frontline staff have the time to talk customers through information and respond to any questions. Firms with online offers could consider building in easy-to-read FAQs, pop ups that explain complex terms through the journey or chatbots that can help customers who may have more questions. Firms could also make customers aware of sources of independent help and guidance. 4.70 Firms should proactively check that consumers with characteristics of vulnerability that may impact their comprehension, understand information provided about a product or service. The section above on customer service discusses further how firms can support customer decision making, including where third-party representation is needed. Case study: Poor practice – Not meeting specific communication needs One consumer was unable to read large print and did not know braille. He wanted his bank to communicate by email as he can turn emails into speech, but the bank did not offer this option. The bank continued to send the consumer communications on paper. This firm does not have processes that can flex and adapt to deal with nonstandard situations to provide the consumer with a solution that meets their needs. The firm should consider solutions to fill this gap in their service provision. Case study: Poor practice – Engaging with consumers and recognising when a consumer needs extra support A consumer with cerebral palsy has experienced several aspects of poor practice. Despite having a greater knowledge about financial services than his wife, staff will often talk to her when they enter branches together, and make prejudgements about what he is able to do. The consumer would like firms and staff to be more flexible in their approaches and consider alternative information formats where possible. He suggests that firms offer alternative ways of engaging with key information and processes, and use technology, such as videos, where it can help. These firms and their staff have not understood the needs of the consumer, assuming that physical disability also means low mental capacity or financial capability. The firms haven’t taken into account that the format of information can cause the challenge rather than the information itself. As a result, firms are increasing the likelihood of harm by preventing people from being able to interact with their services.

Gibraltar Financial Services Commission Guidance Note on the Fair Treatment of Vulnerable Customers 36 Examples of how firms can put this into practice • Offering a choice of channels which could include telephone, email, in branch, text, written, web￾chat, and video calls. • Making staff aware of the different channels that can be offered. • Offering tailored communications where necessary. Considering how to communicate with vulnerable consumers, taking account of their needs 4.71 Some vulnerable consumers, perhaps due to a mental health condition, could find using telephones stressful and so may choose not to inform a firm of an important issue if that is the only available channel. They may prefer the option to communicate with the firm in writing, for example by post, webchat or secure email. 4.72 Other consumers who find writing or typing difficult could suffer detriment if they are unable to speak to the firm in person or by phone. 4.73 Firms with a predominantly single channel strategy should also think about the possible communication needs that consumers with characteristics of vulnerability in their target market or customer base may have and consider providing another channel or channels. Firms should proactively raise awareness of the different channels available. This will allow vulnerable consumers to communicate through a channel that they can use effectively. Where an existing customer is no longer able to engage with a product or service as a firm is not able to provide a channel that will meet the customer’s needs, it should consider the most appropriate steps to ensure they treat the customer fairly. Firms should take additional care in how they can proactively manage this situation where a consumer is very vulnerable or the potential for harm is serious. For example, they may Case study: Good practice – Checking understanding For a product which is mainly purchased by vulnerable consumers, one firm, which distributes its products via brokers, also contacts consumers directly to talk about their circumstances and understanding of the product. Another firm, where the sale is on an execution-only basis, contacts the consumer to check that they wanted the product in question and to let them know advice is available. They also use the contact to pick up on other needs the consumer may have. These firms use proactive communication to check the understanding of vulnerable consumers and identify any other needs the consumer may have. Case study: Poor practice – Failing to ensure understanding of all consumers involved in a transaction A consumer organisation reports a client being unaware she was agreeing to be a guarantor for a loan for her son. Her son took out a loan of £3000 with a guarantor lender. She is an older woman with a disability and caring responsibilities and it is unlikely she was ever going to be able to take on payments. The client’s son is now unemployed and the client is being pursued by the lender for £6300. The firm did not ensure sufficient understanding of all parties involved in the transaction, failing to communicate appropriately with the guarantor and safeguard their interests.

Gibraltar Financial Services Commission Guidance Note on the Fair Treatment of Vulnerable Customers 37 wish to consider supporting the customer to find an appropriate alternative product, service or provider. 4.74 Firms should ensure that consumers are made aware of the different communication channels available so they are able to access them. 5 Monitoring and evaluation 5.1 In the preceding chapters of the Guidance, we have set out our view on what firms should do to ensure the fair treatment of vulnerable consumers. 5.2 Firms should monitor the actions they are taking to ensure they treat vulnerable customers fairly and the outcomes vulnerable customers experience in comparison to other customers. They should do this with reference to all of the aspects of the firm customer relationship. 5.3 Monitoring in this way will allow firms to determine whether they are achieving good outcomes for vulnerable customers and understand which activities and processes work well, and which ones needs to be adapted to improve the outcomes for vulnerable consumers. For example, for some larger firms with a diverse customer base, this may be an ongoing process. For smaller firms it may involve a regular review. 5.4 This Guidance does not require firms to monitor or report on specific metrics but, as discussed in Chapter 1, firms need to ensure they are able to demonstrate how their culture and processes result in the fair treatment of all customers, including those who are vulnerable. In this chapter, we set out how firms should: Case study: Poor practice – Inflexible communication options A consumer had severe social anxiety disorder and had difficulty using a phone. When the consumer’s husband tried to get a block on a transfer removed, their bank refused to speak to him, or suggest alternatives ways of contacting them. The consumer was forced into a long phone call leaving them quite distressed and fearing the thought of it happening again. The firm took appropriate steps to protect the consumer from fraud but did not have an alternative third-party support process or option to communicate over a different channel. Case study: Good practice – Ensuring vulnerable consumers have a method of communication they are able to use effectively A consumer with mental health issues had recently moved their bank account but lost control of their finances, and was facing bank charges. She was able to communicate easily with her bank through their online web chat. The web chat advisor talked things through with the consumer, making them feel genuinely understood and supported, and refunded the bank charges. The firm had staff appropriately trained to communicate with vulnerable consumers using modern communication methods.

Gibraltar Financial Services Commission Guidance Note on the Fair Treatment of Vulnerable Customers 38 a) implement appropriate processes to evaluate where they have not met the needs of vulnerable consumers, so that they can make improvements b) produce and regularly review management information, appropriate to the nature of their business, on the outcomes they are delivering for vulnerable consumers Implementing appropriate processes to evaluate where the needs of vulnerable consumers are not met 5.5 Lack of effective quality assurance on services and products along the customer journey may result in firms failing to spot where the needs of vulnerable customers are not being met and what needs to be changed as a result. 5.6 Firms should implement quality assurance processes throughout the whole customer journey to highlight areas where: • they do not fully understand vulnerable customers’ needs; • the performance of staff has led to poor outcomes for vulnerable customers; • products or services unintentionally cause harm to vulnerable customers; or • customer service processes are not meeting vulnerable customers’ needs. 5.7 Some firms, especially larger firms or those with a target market that may be particularly vulnerable, may wish to consider carrying out proactive data analysis to identify where vulnerable customers are more likely to suffer harm when things have gone wrong or where there are patches of poor staff knowledge and performance. Firms may want to consider the following aspects of the firm customer relationship in their monitoring: • Decision making: are products/services meeting the needs of customers when providing information and support to make decisions? • Engagement throughout the customer journey: are customer service and communications meeting the needs of vulnerable customers? Are customers experiencing difficulties effectively engaging with firms throughout the customer journey? • Disclosing changes in circumstance/needs: are vulnerable customers supported and encouraged to share information about their circumstances or their needs? • Suitable products: are customers able to access products/product features that are suitable and that meet their (changing) needs?

Gibraltar Financial Services Commission Guidance Note on the Fair Treatment of Vulnerable Customers 39 Management information 5.8 As outlined in Chapter 1, under Core Principle 6 firms should have management information (MI) or measures in place to test whether they are treating their customers fairly. The MI should demonstrate to them and to us that they are consistently treating customers fairly. 5.9 To understand if vulnerable consumers are being fairly treated, firms should identify and monitor MI that allows them to review the outcomes vulnerable consumers experience in comparison to other consumers. They should do this with reference to all of the aspects of the firm customer relationship. 5.10 The type of information, and frequency with which it is collected will depend on the firm type, their products and target market, although some sources of MI are likely to be common across all types firms, for example analysis of complaints. Firms should ensure they collect MI at different points in the customer journey, including key points of interaction with consumers. Firms should also ensure that the MI is useful and will allow them to understand both the experience and outcomes of vulnerable consumers. 5.11 Firms should not monitor MI as a one-off exercise. Consumer needs and circumstances can change, as can the ways different consumers prefer to interact with firms. If firms do not regularly collect and analyse MI on the experience of consumers with characteristics of vulnerability in their customer base, they risk being unable to ensure they are delivering the right outcomes for Examples of how firms can put this into practice • Looking at complaints data (in tandem with ensuring it is easy for vulnerable consumers to make complaints, and that complaints can be made through multiple channels). • Using feedback that may not be sent to the firm directly, including online reviews and social media complaints. • Testing experiences of vulnerable customers through processes such as mystery shopping, auditing, focus groups and deep dives. • Using insights from organisations with an understanding of the ‘lived experience’ of vulnerable consumers, such as consumer bodies, charities and other third sector organisations. This may include published insights. • Allowing staff to feedback honestly when they think processes for vulnerable consumers could be improved. • Reviewing whether processes and policies are effective in the fair treatment of vulnerable customers. Case study: Good practice – Assessing treatment of vulnerable consumers One firm has a self-assessment scoring method for various requirements for treating vulnerable consumers fairly, and several parts of the organisation complete this. It has set criteria for achieving each rating out of 10. The firm has created a way to self-assess its progress, but also indicates what steps could be taken to achieve higher scores, encouraging improvement. This is likely to be effective as a component of a firm’s strategy for the fair treatment of vulnerable consumers, provided that it takes account of a range of elements such as external feedback.

Gibraltar Financial Services Commission Guidance Note on the Fair Treatment of Vulnerable Customers 40 vulnerable consumers. They may also miss new areas of need or opportunities to achieve this more effectively. 5.12 Firms should take action where they see poor outcomes for vulnerable consumers to understand what is driving the those outcomes. They should ensure learning is effectively fed back into product and service design to ensure that improvements can be made. Case study: Good practice – Implementing learnings from management information A firm saw from their MI that one product they offered was disproportionately likely to be purchased by vulnerable consumers. Following this, the firm introduced a specific phone-based sales process to make it easier to identify common characteristics of the consumers purchasing the product. The firm made changes as a result of learnings from their MI, which helped to improve the way they were able to identify, and therefore ultimately address, the needs of vulnerable consumers. Examples of how firms can put this into practice Producing MI that captures outcomes for identified vulnerable customers, and making sure it is discussed regularly at an appropriate level and escalated and acted on where necessary. Types of MI firms may want to collect include: • Business persistence: analysis of customer retention records – e.g. claims and cancellation rates and details of why customers leave. This may flag where poor treatment is contributing to high turnover of customers. • Distribution of legacy products/pricing and fees and charges: review of whether consumers with characteristics of vulnerability (where known) are more likely to incur particular fees and charges or are receiving rates not as good as other customers. • Behavioural insights: consumer interactions and drop off rates; use of communications channels including digital; consumer testing of financial promotions. This may flag where policies, processes and systems need to be improved (e.g. where there are barriers to consumer engagement or understanding). • Additional support: contact rates with vulnerability teams, referrals to and feedback from specialist services. • Training and competence records: analysis of records of staff training, including remedial actions where staff knowledge or actions were found to be below expectations. • File reviews: reviewing customer files and monitoring calls to check for errors and assess if customers were treated fairly (this is particularly useful for sales processes). • Customer feedback: using formal and informal feedback from customers to identify trends and areas for improvement (e.g. complaints and comments made to the firm but also comments and complaints on social media). • Numbers of complaints: trends in numbers of complaints involving vulnerable customers in comparison to other customers. • Complaint root cause analysis: investigating complaints fully to understand the cause of customer complaints, not just dealing with the symptoms. • Compliance reports: review compliance reports to check if standards are being met in terms of treating customers fairly.

Gibraltar Financial Services Commission Guidance Note on the Fair Treatment of Vulnerable Customers 41 Appendix 1 GDPR and DPA 2004 considerations when interpreting the Guidance

1. We recognise that several elements of the Guidance may involve obtaining, using, storing and sharing personal data. • In chapter 3 we set out how firms should ensure staff are able to use, record and share this data where appropriate. • In chapter 4 we set out how firms should have systems in place to record information on the • needs of vulnerable consumers, and also to ensure relevant customer service staff have access to information they require in order to recognise and respond to customer needs.
2. Given this, firms will need to ensure that they continue to comply with the relevant requirements of the Gibraltar General Data Protection Regulation (the ‘GDPR’ – which refers to EU Regulation 2016/679 as it forms part of Gibraltar law) and the Data Protection Act 2004 (the ‘DPA ’). This Appendix highlights some of the areas of the GDPR and the DPA that may be relevant for firms to consider when interpreting the Guidance. Nothing in this Guidance is intended to conflict with the GDPR or DPA .
3. The Gibraltar Regulatory Authority is designated as the Information Commissioner (IC) for the purposes of the GDPR and is an independent information rights regulator. They provide advice and support to organisations and also enforce data protection legislation such as the GDPR and DPA .
4. We have taken account of comments from the IC in drafting this Appendix, but it should not be considered as a formal representation of the IC’s position.
5. This Appendix does not constitute legal advice or suggest firms take particular approaches to interpreting the GDPR and DPA . The content is based on publicly available IC guidance that we have signposted to throughout this Appendix. Firms are responsible for ensuring that they comply with the requirements of the legislation.
6. If firms are unsure of what is required under the GDPR and DPA 2004, firms should use the extensive resources and guidance available on the IC’s website, obtain their own legal advice, or consult Data Protection Officers (DPOs) in their own organisations (where available). Firms could also consider the benefit of working with their trade associations or professional bodies to produce industry codes of conduct by raising awareness of important data protection issues or challenges within their sector in order to improve compliance. Key relevant definitions for this Appendix
7. Personal data is information that relates to an identified or identifiable living individual (the full definition of ‘personal data’ is set out in Article 4(1) GDPR).
8. Processing refers to any operation or set of operations which is performed on personal data or on sets of personal data, including collection, recording and sharing (the full definition of ‘processing’ is set out in Article 4(2) GDPR).
9. Special Category Data is more sensitive personal data, for example about an individual’s: race, ethnic origin, politics, religion, trade union membership, genetics, biometrics, health, sex life or sexual orientation. Because it is more sensitive, it requires more protection. This does not include criminal offence data as separate requirements apply.

Gibraltar Financial Services Commission Guidance Note on the Fair Treatment of Vulnerable Customers 42 10. A lawful basis is needed to process personal data. Article 6 of the GDPR details the 6 available lawful bases for processing. To process Special Category Data or Criminal Offence Data, additional conditions need to be identified under Articles 9 and 10 respectively. 11. Consent is a freely given, specific and informed statement or affirmative action, which indicates that an individual agrees to the processing of their personal data. Firms should refer to the IC’s in detail consent guide. This includes information about capacity to consent, how long does consent last and third party consent. Data Protection Officers 12. Firms may find it useful to seek advice from their DPO (where applicable), particularly when undertaking Data Protection Impact Assessments (DPIA) (see paragraphs 56 and 57 of this Appendix for more information). Information about appointing a DPO and the assistance and advice they can provide is available on the IC website. Bases on which firms can process data 13. Under the GDPR, there must be specific grounds for processing and a lawful basis on which to process personal data. Article 6 of the GDPR details the 6 lawful bases on which firms can rely when processing personal data. Where firms process personal data in interpretation of this Guidance, firms will need to consider which of the 6 lawful bases is the most appropriate in the circumstances. 14. We have set out below the lawful bases that may be the most relevant for firms when interpreting the Guidance. Firms should note that this is not an exhaustive list of the lawful bases on which they may process personal data, and they should therefore consider Article 6 of the GDPR as a whole. Firms should also note that consent is not the only basis they can/ should rely on and may not be appropriate to rely on in all cases. The IC also provides further information about when firms can change the lawful basis. • Basis (a), Consent: the individual has given clear consent for a firm to process their personal data for a specific purpose. Firms should consider the IC guide on valid consent when seeking to understand what determines consent. • Basis (b), Contract: the processing is necessary for a contract a firm has with the individual, or because they have asked the firm to take specific steps before entering into a contract. • Basis (f), Legitimate interests: the processing is necessary for a firm’s legitimate interests, the legitimate interests of a third party, or wider societal interests, unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. This may be most appropriate where firms use customers’ data in ways the customer would reasonably expect and which have a minimal privacy impact, or where there is a compelling justification for the processing. 15. In determining whether legitimate interests can be relied upon as a lawful basis, firms will need to consider the three-part test set out by the IC: • Purpose test: are you pursuing a legitimate interest? • Necessity test: is the processing necessary for that purpose? • Balancing test: do the individual’s interests override the legitimate interest? 16. Firms could use a legitimate interests assessment to help determine whether they should use it as a basis for processing.

Gibraltar Financial Services Commission Guidance Note on the Fair Treatment of Vulnerable Customers 43 17. Firms should be aware that, depending on the customer’s circumstance, the Article relied on to process data under may differ. Firms should also be mindful that there are additional protections needed to process some data. For example: • When processing personal data about criminal convictions or offences where firms must have both a lawful basis under Article 6 and either legal authority or official authority for the processing under Article 10. • When processing Special Category Data under Article 9 GDPR (see below). Special Category Data 18. Some personal data that are processed about vulnerable consumers may be Special Category Data as defined by the GDPR. 19. It may not always be immediately obvious that information about a consumer is Special Category Data. For example, information about changes made for a consumer because of their health may not specifically identify the health issue, but would be likely to constitute Special Category Data as their health issue could be inferred. 20. GDPR also gives extra protection to special category data due to its sensitivity. In addition to identifying a lawful basis under Article 6 (see above), firms need to identify a separate condition under Article 9 of the GDPR. This Article details the additional conditions for Special Category Data, only one of which needs to be met. We set out the potentially most relevant conditions below: explicit consent (Article 9(a)) and substantial public interest (Article 9(g)). Firms should be mindful that they should choose the condition that is most appropriate and that relying on explicit consent may not always be appropriate for their circumstances. Consent is not the only way to comply with the GDPR. Depending on the Article 9 condition relied upon, firms should also note that there are additional requirements that may need to be met under Schedule 1 of the DPA. Explicit Consent 21. Firms may be able to obtain explicit consent from their customers to process the special category data, under condition (a) of Article 9. Explicit consent does not have to be written, and can also be oral, however, it is more difficult to prove explicit consent when it is not in writing. Explicit consent requires a very clear and specific statement of consent. Substantial Public Interest 22. Another condition in Article 9 which firms may find appropriate to use is processing necessary for reasons of substantial public interest in Article 9(g). Where relying on Article 9(g), firms must also refer to Schedule 1, Part 2 of the DPA and identify the further relevant condition, for example safeguarding economic wellbeing or insurance. Substantial Public Interest – Safeguarding Economic well-being 23. A substantial public interest condition that may be appropriate for firms to rely on is safeguarding economic wellbeing, under paragraph 19, Schedule 1 of the DPA . Firms can process (which includes recording and sharing) health data without the customer’s consent if: • they believe it is necessary for the purpose of protecting the economic well-being of an adult at economic risk, and • it might be unreasonable to expect them to obtain consent concerning physical or mental injury, illness or disability, or

Gibraltar Financial Services Commission Guidance Note on the Fair Treatment of Vulnerable Customers 44 • if obtaining consent would adversely affect the provision of the protection. 24. Applications of paragraph 19 of Schedule 1 could include the context of third parties sharing and recording health data where consent from the customer is not possible, for example: • between product providers and other involved third party firms, for example brokers; or • where a third party is claiming to be in contact on behalf of the customer but no formal arrangement with the third party is currently in place. In such a case, firms will have to satisfy themselves that the third party is truly acting on the customer’s behalf, because of the informal nature of the arrangement. 25. Firms should also be aware that they need to be able to demonstrate the necessity of processing under this schedule condition, and are required to have an Appropriate Policy Document (APD) in place. The same also applies under some of the other conditions. 26. The IC provides more information on conditions for processing special category data and APDs here. Data Sharing 27. Data protection legislation provides a framework to ensure fair, lawful and proportionate data sharing, and should not be perceived as a barrier to appropriate information sharing. Sharing data with third party individuals or organisations may be important in achieving good outcomes for a vulnerable customer. 28. In order to comply with relevant data sharing obligations, firms should consider whether they are a controller, joint controller, or processor of personal data. According to the IC: • The controller ’determines the purposes and means of the processing of personal data’. • The processor ’processes personal data on behalf of the controller’. • Joint controllers are ’two or more controllers that jointly determine the purposes and means of processing’. 29. Firms should understand that, where they are the controller, they are able to share data within their organisation provided that the data is processed for a purpose that is compatible with that for which it was originally collected under the original lawful basis under Article 6 and, where applicable, the relevant condition under Article 9. The IC provides further detail on this here. 30. As with wider sharing, firms should assess whether they need to carry out a DPIA to share data with third party individuals or organisations. Firms should also consider what information needs to be shared, why they are sharing this, the risks associated with sharing, and how to share this information. 31. Firms must identify a lawful basis for sharing personal data. If the firm is sharing Special Category Data, firms must identify an additional condition under Article 9(2) and, if required, under Schedule 1 of the DPA . Firms must also ensure they share information in compliance with the principles laid out in Article 5 of the GDPR. 32. The IC has published a Data Sharing Code of Practice. It also provides other information through its Data Sharing Hub and suite of resources, including case studies. These provide practical advice to businesses and organisations on how to carry out responsible data sharing. Additional areas to consider

Gibraltar Financial Services Commission Guidance Note on the Fair Treatment of Vulnerable Customers 45 33. Firms will need to consider all further requirements of the GDPR, including those relating to Individual Rights, and the Data Protection Principles including Accountability, and Governance. Relevant information is set out below. Individual rights 34. Firms should ensure that they have appropriate policies and procedures in place to provide individuals with the information they are entitled to under Article 13 and 14 of the GDPR (Right to be Informed), no matter what lawful basis or Article 9 condition they are relying on. 35. Firms should also ensure that they are able to meet individuals’ rights requests under the GDPR, for example the right of access (Article 15) and right to rectification (Article 16). 36. The IC provide further information on individual rights here. 37. Firms should also be aware that the lawful basis chosen may have an impact on the individual rights available to the data subject. 38. The IC provide further information on how rights may be affected depending on the lawful basis chosen. Data Protection Principles 39. Article 5(1) of the GDPR sets out 6 key principles core to the GDPR, some of which have already been outlined. These include: a) Lawfulness, fairness and transparency b) Purpose limitation c) Data minimisation d) Accuracy e) Storage limitation f) Integrity and confidentiality 40. There is also a separate Accountability Principle (described below). 41. Under Article 5(2), firms must take responsibility for complying with all Article 5(1) principles and the wider GDPR. These principles are interconnected and failure to comply with one of the data quality principles (Article 5(1)(c), (d) & (e)) may lead to non-compliance with others, therefore it’s important they are considered together. They must also be able to demonstrate compliance. 42. Firms should maintain a record of their data processing activities, including the purpose for processing and data sharing in line with Article 30 of the GDPR. Documenting this information will help firms remain accountable. 43. The IC suggests that developing a privacy management framework, raising awareness, training staff, monitoring and auditing could be useful in demonstrating successful implementation of data protection policies and ensuring accountability. Lawfulness, fairness and transparency 44. Firms must ensure they process data lawfully and fairly, and ensure they are transparent by acting in a way which is open and honest, and complying with the transparency obligations of the right to be informed. This means that for any legal basis relied on firms should be transparent with customers

Gibraltar Financial Services Commission Guidance Note on the Fair Treatment of Vulnerable Customers 46 about the information they are recording, including any specific needs, and how it will be used in accordance with Articles 13 and 14 GDPR. Purpose limitation 45. Article 5(1)(b) sets out that data should be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with these purposes. Firms must be clear from the outset why they are collecting personal data and what they intend to do with it. The IC provides more information about purpose limitation here. Data minimisation 46. Firms must ensure that the information they record in relation to customer vulnerability meets the data minimisation requirements under Article 5(1)(c) of the GDPR. This requires that information recorded should be ’adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed. 47. Firms should ensure that the information they record about vulnerable customers is enough to understand their needs and translate that into action, but not more than that which is necessary. Firms will need to balance this with considering the potential harm to consumers if information about their needs is not recorded. 48. Firms may choose to record the interventions or support requested by a customer rather than the vulnerability itself. However, if this information means that the vulnerability could be inferred then that could come under special category data, and it has to be treated as such. The IC provides more information on data minimisation here. Accuracy 49. Under Article 5(1)(d) firms should take care to ensure the accuracy of information they record about customers and vulnerabilities. This may be challenging for firms where vulnerabilities are temporary, and firms should consider this in the context of the customer service they provide. 50. Information relating to a customer’s vulnerability characteristic or needs should be recorded accurately to reflect the information as presented. This also includes differentiating factual accuracy from opinions. This should help staff when interacting with such customers in the future. For example, when recording information staff should be clear if they are making an assumption or expressing an opinion, as opposed to recording factual information. 51. Firms should consider how they ensure the data they hold remains accurate. For example, they could ask customers who have shared information relating to a vulnerability characteristic or need if or when they would like to be contacted again, or check that particular events relating to their circumstance, which the customer previously indicated were upcoming, had occurred. Recording the date alongside the information provided by the customer may also prevent any data becoming inaccurate and help staff recognise where circumstances may have changed. The IC provides further information on data accuracy here. Storage limitation 52. Firms should also take into account the principle of storage limitation under Article 5(1)(e). This states that personal data should be retained for no longer than is necessary. This may be particularly relevant in relation to temporary vulnerability when determining whether it is still necessary to retain information.

Gibraltar Financial Services Commission Guidance Note on the Fair Treatment of Vulnerable Customers 47 53. The IC provides more information on the principle of storage limitation here. Accountability Principle 54. Firms are required to take responsibility for what they do with personal data and how they comply with other Data Protection Principles in Article 5(1) of the GDPR. They must have measures and records in place to be able to demonstrate compliance. 55. The IC provides further information on accountability here. Data protection impact assessments 56. Prior to processing data on vulnerability, firms should consider carrying out a DPIA to help identify and minimise data protection risks. A DPIA is a key tool for identifying and mitigating data protection risks and ensuring consideration of how the processing will comply with the principles contained in Article 5 of the GDPR. 57. In certain circumstances under Article 35 of the GDPR, performing a DPIA is a requirement to comply with the regulations and firms should refer to IC guidance or seek their own legal advice on this if they are unsure as to whether they need to carry out a DPIA. The IC provides further information on DPIAs here. Appendix 2 Other obligations relevant to the treatment of vulnerable consumers Equal Opportunities Act 2006

1. As well as the Core Principles, firms may have to comply with other legal and regulatory obligations for vulnerable consumers. A key piece of relevant legislation is the Equal Opportunities Act 2006 (the ‘Equal Opportunities Act’). This seeks to protect people with certain personal characteristics, which are protected characteristics under the Act, from discrimination and harassment. It is likely that a breach of the Equal Opportunities Act will be a breach of the Core Principles, as well as other legislative provisions.
2. There is an overlap between certain ’equal opportunities grounds’ under the Equal Opportunities Act, and characteristics of vulnerability. In particular, one driver of vulnerability, health, largely overlaps with the ’equal opportunities ground’ of ‘disability’ under the Equal Opportunities Act. In this respect, whilst this Guidance is broader, it also seeks similar outcomes to the anticipatory duty under the Equal Opportunities Act that requires reasonable adjustments for disabled people

Published by: Gibraltar Financial Services Commission PO Box 940 Suite 3, Ground Floor Atlantic Suites Europort Avenue Gibraltar www.gfsc.gi © 2025 Gibraltar Financial Services Commission