How should AI voice agents handle vulnerable customers on collections calls?

What UK regulators expect, how an AI voice agent should detect and hand over customers in vulnerable circumstances, and what to ask any vendor before it speaks to your customers.

The short answer

Treat vulnerability as a route, not a script. On every collections call, an AI voice agent should listen for the potential indicators of vulnerability the firm has defined, respond only with approved wording, and offer a person whenever the customer asks or the firm's policy requires it. When no specialist is available, the journey needs a defined fallback, not a dead end.

Vulnerability does not automatically mean a customer must leave the automated journey. Some customers in financial difficulty are comfortable agreeing next steps with an automated agent; others need a specialist straight away, so the journey should follow the person's needs and preferences. Registers such as the Vulnerability Registration Service (VRS) and affordability platforms such as IE Hub add what is already known, where the firm uses them. MEGA.AI provides the in-call layer and, with IE Hub, is preparing ELLIE, expected to launch in Q4 2026, so customers in financial difficulty explain their circumstances once instead of to every creditor.

What handling vulnerability on a collections call requires

For firms and activities the FCA regulates, consumer credit lending and debt collection among them, the bar is set by its guidance on the fair treatment of vulnerable customers (FG21/1) and the Consumer Duty. FG21/1 describes a vulnerable customer as someone whose personal circumstances make them especially susceptible to harm, particularly when a firm is not acting with appropriate care. It groups the drivers into four: health, life events, resilience and capability.

This is not a niche. In the FCA's Financial Lives 2024 survey, 26.4 million UK adults, 49%, showed at least one characteristic of vulnerability (FCA, Financial Lives 2024, p. 10). Many customers on a collections call are already in financial difficulty, and health problems or a recent life event often come with it.

Research the FCA published in March 2025 found that 44% of customers in vulnerable circumstances reported a negative experience with a financial services firm, against 33% of other customers, and that only 4 in 10 had told any provider about their circumstances (FCA). The FCA kept FG21/1 unchanged alongside the Consumer Duty (FCA review). Its good practice examples include real-time speech analytics that prompt staff when a customer mentions a possible indicator, and keeping a customer's circumstances in one place so they do not have to repeat them (FCA good practice).

In March 2026 the FCA and the ICO added a joint statement on vulnerability data. It confirms that data protection law does not stop firms supporting vulnerable customers, and sets out how to record, share and monitor that data lawfully.

Whether the firm making the call is the creditor or a collection agency acting for it, each call comes down to four jobs:

1. Know before the call. Check what is already held, such as a register entry, an earlier disclosure or a recent income and expenditure (I&E) assessment. No flag does not mean no need.
2. Notice during the call. Catch direct disclosures ("I've just come out of hospital") and indirect signals such as confusion, distress or a third party speaking for the customer. Disclosures often come before identity verification is complete.
3. Respond. Change what happens next, for example pausing collection activity, using approved wording, offering a person or signposting free debt advice where the firm's journey requires it.
4. Route and record. Pass the customer to someone who can help, with the context, and record the support need so the customer is not asked again.

The vendors involved, layer by layer

Each type of vendor covers part of those four jobs, and their capabilities overlap. The firm keeps its regulatory responsibility whichever vendors it uses.

• The firm's own policy and specialist team. Defines what counts as vulnerability, decides the treatment and handles complex cases, on every call. It cannot be outsourced: vendors carry out the firm's policy, they do not set it.
• Vulnerability registers, such as the Vulnerability Registration Service (VRS). Flag people registered by themselves, by an authorised third party or by a partner organisation, so the firm knows before or during contact. They cover only people on the register; no record does not mean no need.
• Affordability and I&E platforms, such as IE Hub. Capture income and expenditure in the Standard Financial Statement format and share it with creditors the customer chooses, before and during contact. They show financial strain, not necessarily health or life events.
• AI voice agents, such as MEGA.AI. Listen for potential indicators in the live conversation, respond with approved wording, and offer a person or hand over. They depend on the indicators configured, speech recognition quality and the route behind the handover.
• Speech analytics and call QA tools. Prompt staff in real time when a possible indicator is mentioned, or review recordings afterwards for missed cases and coaching. They prompt people; the response still depends on the person and the process.
• Contact centre platforms and diallers. Route, transfer and suppress contact based on flags throughout the call. They act on flags; they do not judge them.

VRS is a not-for-profit register that is free for individuals to join. Organisations check it under a contract with VRS, and it records vulnerability without validating it (VRS). The practical question for a firm is how these layers pass information to each other, so the customer is not asked the same painful questions three times.

How MEGA.AI handles vulnerability inside the call

MEGA.AI's agents listen for the potential indicators of vulnerability each firm defines, and act on them through routes the firm has approved. The firm designs the journey; MEGA.AI builds and runs it.

• Indicators checked on every turn. Each customer turn is checked against the firm's configured indicators, from the first turn, before identity verification is complete. They cover direct disclosures (illness, bereavement, job loss, a carer or third party on the line) and signals such as a customer repeatedly saying they do not understand. The agent can respond and route without revealing any account details.
• Controlled replies. Large language models are used to understand what the customer means. They do not write the answer: the agent speaks only wording the firm has approved. That controls what the agent says. It does not remove the risk that an indicator is missed or a meaning misread, which is why detection has to be measured (see below).
• A person on request. The customer can ask for a person at any point. If speech recognition is unsure what was said, the agent confirms it or hands over rather than guessing.
• A fallback when no one is free. The firm decides what happens when its specialist team is closed, a transfer fails or the customer cannot complete verification, and MEGA.AI builds that into the journey, for example an SMS with the team's direct number and opening hours. Urgent risks, such as a threat to someone's safety, need their own immediate route, agreed before go-live.
• The support need, not the story. The flag and the route taken go into the call's outcome report to the firm. The record should hold what the customer needs, not a medical history.
• Registers where the journey includes them. A VRS check can be added before or during contact if the firm builds it into the journey.

An illustrative example, not a real call:

1. The customer passes identity verification and the agent explains the balance.
2. The customer says they lost their job last month and have been unwell since.
3. The agent recognises two potential indicators, a life event and health, and stops the payment conversation.
4. It acknowledges what the customer said in approved wording and offers to put them through to the specialist team now, or to send the team's number by SMS if they would rather call later.
5. The specialist takes the call. The outcome report records the support need and the route taken.

Health disclosures and other sensitive data

A customer who mentions an illness has shared health data, which UK GDPR treats as special category data. The joint FCA and ICO statement is clear that this does not stop a firm supporting the customer, but it sets conditions:

• A lawful basis and a separate condition. Processing needs an Article 6 lawful basis and an Article 9 condition. Explicit consent is one option; another is substantial public interest under the Data Protection Act 2018, for example safeguarding the economic well-being of certain individuals. A customer mentioning a condition is not, on its own, explicit consent to record it.
• The minimum needed. Record the support need and the adjustment, such as "needs more time" or "call after 2pm", not a medical history.
• Controlled access and retention. Recordings, transcripts and flags need access limits and retention periods agreed in advance, including for disclosures nobody asked for.
• An impact assessment. Processing special category data on a large scale requires a data protection impact assessment (DPIA).

Roles depend on the deployment. The firm that owns the customer relationship is normally the controller. MEGA.AI processes data for that firm under a data processing agreement, keeps it for the period the firm sets, and does not train foundation models on client data without the firm's written agreement. Where a collection agency works for a creditor, or a partner such as IE Hub holds the customer's I&E, each party's role is set in its own contracts.

What lenders now ask AI vendors in due diligence

Vulnerability has moved from a feature on a slide to an audit question. In two supplier assessments MEGA.AI completed in 2026, one for a UK consumer lender and one in a multi-company UK collections tender, vulnerability came up as a control area in both. The lender's assessment went furthest: it named a missed vulnerability signal as a specific harm and asked how the vendor would measure it.

Here is what buyers look for and how MEGA.AI answers:

• A vulnerability signal is missed. Buyers look for detection on every call, routing to people and a way to measure how many signals are missed. MEGA.AI checks indicators on every turn, sends flagged calls to the firm's specialists, and counts an indicator found missed on review as an incident.
• The AI says the wrong thing to a distressed customer. Buyers look for proof the agent cannot improvise or concede outside policy. MEGA.AI speaks only approved wording and enforces policy limits outside the language model.
• The customer cannot reach a person. Buyers look for a human route and a fallback when no one is available. MEGA.AI offers a person on request at any point and builds the firm's fallback, such as an SMS with the team's number, into the journey.
• A health disclosure is mishandled. Buyers look for a lawful basis, minimal records, controlled retention and no model training on the data. MEGA.AI processes for the firm under a data processing agreement, with retention set per client and no foundation model training on client data without the firm's written agreement.
• The flag is lost after the call. Buyers look for the flag to reach their own systems. Today the flag is in MEGA.AI's outcome report; write-back into the firm's CRM comes with system integration.

The hardest question in this list is how many signals are missed. Recall measures it: of the calls where an indicator was present, how many did the agent catch? It only means something when measured on the firm's own indicators, using real call audio labelled by people, and broken down by accent, dialect and the way distress is expressed. Detection can work worse for some groups of customers without anyone collecting protected characteristics. Ask any vendor, MEGA.AI included, how recall is measured before go-live and how often it is reported afterwards.

ELLIE: MEGA.AI and IE Hub, so customers tell us once

ELLIE is a joint product from IE Hub and MEGA.AI, expected to launch in Q4 2026. It combines IE Hub's Standard Financial Statement (SFS) compliant income and expenditure platform with MEGA.AI's conversational AI, so affordability conversations start from what the customer has already shared (IE Hub).

It connects three of the layers above: the affordability platform, the register and the in-call agent. ELLIE is designed around four steps:

1. Before contact. The customer completes an SFS-compliant I&E digitally through IE Hub, or reuses one they have already completed. If none exists, ELLIE guides them through a shorter assessment during the conversation.
2. The conversation. ELLIE is designed to use the I&E together with the creditor's policies and rules to reach the next step: a repayment plan, a payment, or a handover to a person.
3. Alerts. The creditor is told when a customer's circumstances change or a new I&E becomes available, so customers who need attention are seen sooner.
4. Maintain. The customer keeps their information up to date in IE Hub and chooses when, and with whom, to share it.

For vulnerable customers, two parts matter most. ELLIE is designed to integrate with the Vulnerability Registration Service, so registered vulnerability can be picked up earlier and routed to specialist teams (IE Hub). And the "tell us once" principle answers the FCA's own good practice point: a customer in difficulty should not have to repeat sensitive circumstances to every organisation.

"Customers shouldn't have to spend 30 or 40 minutes repeatedly explaining their financial circumstances to different organisations." Gareth Llewelyn, Chief Commercial Officer, IE Hub

"AI has the potential to improve how organisations manage affordability conversations." Martin Thielst Nielsen, co-founder, MEGA.AI

ELLIE does not replace human agents. Customers can ask for a person, and creditors keep their people for the cases where personal support adds most. Because ELLIE is designed to agree repayment plans, each deployment also needs an assessment of whether the UK GDPR rules on solely automated decisions apply. Where they do, customers must be told and must be able to ask for a person to review the decision. IE Hub and MEGA.AI are working with creditors on opportunities to pilot ELLIE ahead of launch.

Questions to put to any vendor

Ask these of every vendor in the stack, MEGA.AI included. A good answer is a document or a real call, not a description. For the wider buying checklist, see How to choose a voice AI platform for a regulated UK enterprise.

1. Which vulnerability indicators does the agent detect, and who defines them: you or the vendor?
2. What exactly happens in the call when one is detected: which words are spoken, and where does the customer go?
3. Can the customer reach a person at any point, and what happens out of hours, when a transfer fails or when the system is unsure what it heard?
4. How is missed vulnerability measured, on whose indicators, and how often is it reported to you?
5. Does detection work equally well across accents, dialects and ways of expressing distress, and how would you know if it did not?
6. Does the specialist receive the reason for the transfer, or does the customer start again?
7. What is recorded when a customer discloses a health condition, on what lawful basis, for how long, and is it ever used to train models?
8. Which register and affordability integrations are live today, and which are planned? Ask for dates.

Frequently asked questions

Which vendors handle vulnerable customers on collections calls?

No single vendor. The firm's own specialist team, vulnerability registers such as VRS, affordability platforms such as IE Hub, AI voice agents such as MEGA.AI, speech analytics tools and the contact centre platform each cover part of it. The firm keeps its regulatory responsibility whichever vendors it uses.

Can an AI voice agent detect vulnerability on a collections call?

It can detect potential indicators, if it is given the firm's indicators and a clear route for each. MEGA.AI's agents check every customer turn against those indicators, respond with approved wording and offer a person or hand over. No detection is perfect, so the miss rate has to be measured.

Should AI handle calls with vulnerable customers at all?

Yes, where the journey adapts to the person. The FCA expects support tailored to each customer's needs, so vulnerability does not automatically mean leaving an automated journey. The agent should apply the same indicators on every call, at any hour, offer a person whenever the customer asks, and pass complex cases to specialists.

Who is responsible if a vulnerable customer is missed?

The regulated firm keeps its regulatory responsibility when it outsources. The FCA expects it to monitor outsourced support and to check, through ongoing due diligence, that the firms it works with treat vulnerable customers fairly (FCA). The vendor is responsible for what it has committed to in its contract and for its obligations as a data processor. That is why buyers now ask vendors to show how they detect, measure and report missed vulnerability.

What is the Vulnerability Registration Service?

VRS is a not-for-profit central register of people in vulnerable circumstances, registered by themselves, an authorised third party or a partner organisation. Joining is free for individuals; organisations check the register under a contract with VRS. A VRS check can be added to a MEGA.AI journey where the firm chooses.

Is ELLIE available now?

Not yet. ELLIE is expected to launch in Q4 2026, and IE Hub and MEGA.AI are working with creditors on opportunities to pilot it.

About MEGA.AI

MEGA.AI provides deterministic voice AI for inbound and outbound customer calls at regulated enterprises in lending and collections, banking, utilities, telecommunications and insurance. Every response the agent can give is approved by the organisation before deployment, with live data inserted only into permitted fields, and every call leaves a record that traces each step back to the approved journey. MEGA.AI is certified to ISO/IEC 27001, 27701 and 42001, is audited under SOC 2 Type II and holds Cyber Essentials Plus; its PCI DSS assessment is in progress. Current certificates are listed on the Trust & compliance page.

Book a briefing to walk through how one of your own journeys would detect, respond to and hand over a customer in vulnerable circumstances.

Sources

• FCA, Financial Lives 2024: key findings (16 May 2025), p. 10
• FCA, Vulnerable customers encouraged to open up to firms to get the right support (7 March 2025)
• FCA, Firms' treatment of customers in vulnerable circumstances: review (7 March 2025)
• FCA, Delivering good outcomes for customers in vulnerable circumstances: good practice and areas for improvement (7 March 2025)
• FCA FG21/1, Guidance for firms on the fair treatment of vulnerable customers
• FCA and ICO, Joint statement on regulatory expectations regarding firms' approaches to vulnerability related data (27 March 2026)
• Vulnerability Registration Service, FAQs for businesses
• IE Hub, Meet Ellie, our AI affordability agent
• IE Hub, IE Hub and Mega AI launch Ellie to transform affordability conversations (10 September 2026)