Banks, lenders and financial services firms need to move from reactive hardship processing to proactive, human-centred customer support.
Executive summary
Financial hardship and customer vulnerability are no longer peripheral conduct issues. They are becoming a central test of whether financial institutions can deliver fair, accessible and sustainable customer outcomes in a higher-cost, higher-risk environment. Cost-of-living pressure, housing stress, scams, financial abuse, gambling harm, family violence, mental health concerns, digital exclusion and product complexity are converging. The result is a larger group of customers who may be financially stressed, less resilient and more exposed to avoidable harm if institutions rely on standardised processes.
For boards and senior executives, hardship and vulnerability should be treated as enterprise conduct risks, not narrow collections or customer-care functions. Regulators, industry bodies, external dispute resolution schemes and financial counsellors are increasingly focused on whether institutions identify risk early, communicate clearly, tailor support and measure whether customer outcomes are improving in practice.
Monitoring overseas developments is useful, not because Australian institutions are directly governed by foreign regulators, but because comparable markets are reframing hardship and vulnerability as conduct, governance and customer-outcomes issues. In the UK, the Financial Conduct Authority’s Consumer Duty and vulnerable customer guidance require firms to consider whether products, communications and support arrangements deliver good outcomes for customers, including those in financial difficulty or vulnerable circumstances. In New Zealand, the Financial Markets Authority, together with the earlier Commerce Commission and MBIE framework for responsible lending and hardship, has emphasised fair treatment across the credit lifecycle. In the United States, the Consumer Financial Protection Bureau has focused on practical consumer harm arising from servicing failures, loss mitigation, debt collection, fees and complaints handling. For Australian boards, these developments provide horizon-scanning and useful benchmarks for assessing whether hardship and vulnerability frameworks are effective, not merely compliant.
Hong Kong and Singapore also provide useful regional context, although their regulatory framing is less explicitly centred on vulnerability. In Hong Kong, the Hong Kong Monetary Authority has emphasised customer protection, responsible lending, bank culture, inclusive banking, complaint handling and support for customers facing repayment difficulty. In Singapore, the Monetary Authority of Singapore has focused on fair dealing, responsible financial advisory practices, complaints handling, digital banking resilience, scam protection and financial inclusion. Together, they reinforce the broader regional trend that regulators increasingly expect financial institutions to consider whether their products, communications, service channels and remediation practices produce fair and sustainable customer outcomes.
This creates both risk and opportunity. Institutions that respond late, apply rigid information requirements or treat hardship as a compliance workflow may face enforcement, complaints, remediation, reputational damage and loss of trust. Institutions that build mature vulnerability and hardship capability can strengthen conduct culture, reduce downstream arrears and complaints, and demonstrate leadership as community expectations rise.
Why this issue is accelerating now
The traditional hardship model was built around discrete life events: job loss, illness, separation, bereavement or natural disaster. Those events remain important, but the current environment is broader and more persistent. Many customers are not facing one shock; they are dealing with layered pressures. Higher mortgage repayments, rent increases, essential living costs, unstable income, scam losses, family violence, caring responsibilities and deteriorating mental health can combine in ways that make a standard hardship assessment inadequate.
There is also a shift in regulatory thinking. Vulnerability is increasingly understood as situational, dynamic and capable of being created or worsened by the design of products, processes and communications. A customer may become vulnerable because of personal circumstances, but harm often occurs because an organisation requires repeated disclosure, asks for unnecessary information, communicates in inaccessible ways, fails to recognise indicators of distress or provides an arrangement the customer cannot realistically sustain.
That is why hardship and vulnerability can no longer sit solely with specialist support teams. Product design, digital servicing, complaints, scam response, AML customer identification, privacy, collections, data analytics, branch access, third-party authority arrangements and staff training all influence whether a financial institution helps or harms a customer experiencing vulnerability.
Superannuation funds should also be part of the vulnerability conversation, although hardship presents differently from credit. For funds, the key risk is not usually repayment difficulty, but whether members can access information, insurance benefits, death benefit processes, early release pathways and complaints support fairly at moments of financial, medical or emotional stress. Serious illness, incapacity, bereavement, family violence, cognitive decline, First Nations disadvantage, low literacy and digital exclusion can all make ordinary fund processes difficult to navigate. For trustees, the issue is whether systems, communications and decision-making are accessible, timely, compassionate and consistent with member outcomes.
Insurers face similar issues in claims handling, particularly where customers are dealing with injury, illness, bereavement, trauma, natural disaster, family violence or mental health concerns. Vulnerability risk can arise through complex forms, repeated evidence requests, slow decisions, adversarial communication or poor coordination between insurers, assessors and service providers. For insurers, fair treatment requires more than correct policy interpretation; it requires claims processes that are accessible, timely and sensitive to the customer’s circumstances.
Recent Australian developments
ASIC has reset expectations on hardship
ASIC’s 2024 hardship review was a turning point. In Report 783, Hardship, hard to get help, ASIC found that lenders were not doing enough to support customers experiencing financial hardship. The review identified confusing access pathways, poor communication, onerous assessment processes, limited tailoring and inadequate support for customers experiencing vulnerability. ASIC’s message was direct: hardship support is not optional customer service; it is a core credit obligation and an enforcement priority.
ASIC’s findings make clear what needs to change. Lenders need to move from reactive, hard-to-access processes focused on operational efficiency to models that are accessible, responsive, tailored and outcome-focused. ASIC criticised lenders for making hardship support hard to find, requiring customers to repeat their circumstances, asking for irrelevant or excessive information, failing to communicate clearly, relying on one-size-fits-all approaches and inadequately supporting customers experiencing vulnerability, including family violence.
ASIC also highlighted poor outcomes, including customers abandoning the process or falling back into arrears soon after assistance ended. The practical implication is that institutions need to redesign hardship as a customer recovery pathway, supported by clear triggers, trained staff, specialist escalation, sustainable arrangements, better communication, stronger data and outcome monitoring, and governance oversight that tests whether the process works in practice.
The consequences of failure are both legal and reputational. Legally, depending on the facts, poor hardship handling may expose institutions to National Credit Code breaches, ASIC Act risks, breach reporting, remediation, AFCA determinations, civil penalty proceedings, enforceable undertakings and adverse publicity orders. Reputationally, poor hardship practices can be deeply damaging because they affect customers at moments of acute stress. Institutions seen to ignore hardship notices, impose unnecessary barriers or treat vulnerable customers harshly risk media criticism, loss of trust, customer attrition, political scrutiny and long-term brand damage.
A technically compliant process may still fail if it is inaccessible, slow, generic or misaligned with the customer’s circumstances. ASIC’s concern with one-size-fits-all approaches shows that effective hardship support requires judgement, flexibility and evidence of outcomes, not just documented procedures.
ASIC has taken action against major banks for failing to respond properly to hardship notices, including proceedings against NAB and Westpac that resulted in substantial penalties and adverse publicity. Overseas, the UK Financial Conduct Authority has fined firms such as HSBC and TSB for inadequate treatment of customers in arrears or financial difficulty, including failures to assess affordability, tailor support and maintain effective systems and controls. These cases demonstrate that regulators are increasingly treating hardship failures as governance, systems and customer-outcome failures, not merely administrative errors. For boards, hardship and vulnerability settings must be tested in practice, with evidence that customers can access support, receive timely decisions and obtain arrangements that are realistic, fair and sustainable.
In superannuation, ASIC successfully secured a $23.5 million penalty in the Federal Court against Cbus’s trustee, United Super, over serious failures and delays in processing death benefit and TPD insurance claims, with a remediation bill for affected members and claimants of $32 million. ASIC’s broader death benefit claims review also found systemic failures by some trustees, including excessive delays, poor service, unclear processes, ineffective and insensitive communication, inadequate data and reporting, and insufficient support for First Nations claimants.
In insurance, ASIC has now identified claims handling as an enforcement priority, with a focus on delays, poor communication, record keeping, complaints handling and inappropriate reliance on exclusions.
ASIC’s work on low-income and First Nations customers exposed poor product design
ASIC’s Better banking for Indigenous consumers project and subsequent bank-fee work demonstrate the broader vulnerability agenda. The issue was not simply whether banks had low-fee accounts available. The issue was whether eligible low-income customers, including First Nations customers, were actually moved into appropriate products without unnecessary friction. ASIC’s findings show that institutions can cause harm through passive systems, opt-in processes and product settings that leave customers paying avoidable fees.
The lesson is that vulnerability risk can arise well before a customer formally asks for hardship assistance. Product distribution, channel design, identification requirements, fee structures, digital access, branch availability and data use can all create or reduce customer harm.
Financial counsellors are defining the practical benchmark
Financial Counselling Australia’s 10 Principles of Good Hardship and the 2026 Rank the Banks, Other Lenders and Debt Collectors report have sharpened the practical benchmark. The central finding is that hardship support remains inconsistent. In many cases, outcomes still depend on the organisation, brand, business unit or staff member a customer happens to encounter. That inconsistency is itself a conduct risk.
The strongest performers tend to identify hardship early, tailor arrangements, empower specialist staff, engage constructively with financial counsellors and use trauma-informed approaches. The weakest performers create barriers through delays, repeated information requests, inflexible decisions, poor communication or inadequate recognition of complex vulnerability, including scams, gambling harm, imprisonment, family violence and mental health concerns.
Industry codes are moving toward extra care as a practical obligation
The Banking Code of Practice and Customer Owned Banking Code of Practice both reinforce expectations that institutions will take extra care with customers experiencing vulnerability and recognise indicators of financial difficulty. These code obligations sit alongside statutory credit obligations, AFCA approaches, ASIC guidance and broader conduct expectations. The increasing alignment between these sources means institutions should not treat vulnerability as merely aspirational or reputational. It is becoming part of the conduct architecture of financial services.
Complaints and AFCA outcomes should be treated as conduct intelligence
Complaints and AFCA outcomes should be treated as conduct intelligence, not simply dispute-resolution data. Repeat complaints about hardship access, delays, poor communication, unaffordable arrangements or insensitive treatment may indicate systemic weaknesses in the operating model. Boards should expect reporting that identifies root causes, affected cohorts, remediation themes and whether changes made after complaints have improved customer outcomes.
What overseas regulation tells us
New Zealand: responsible lending, hardship and fair treatment
New Zealand remains a useful comparison because its credit regime connects hardship, substantial hardship assessments and lender responsibility principles. The Responsible Lending Code, updated in 2024, continues to frame lender behaviour across the life of the agreement, including repayment difficulties and subsequent dealings. Under the Credit Contracts and Consumer Finance Act 2003 (CCCFA) framework, lenders must treat borrowers fairly, make appropriate inquiries, assist borrowers to make informed decisions and respond properly when borrowers experience repayment difficulty.
A notable feature of the New Zealand direction is the move toward a more integrated conduct regulator for financial markets and consumer credit. From July 2026, the Financial Markets Authority became the single conduct regulator for financial markets, including consumer credit. For Australian institutions with trans-Tasman operations, this reinforces the need for consistent hardship and vulnerability standards across jurisdictions, while taking account of local legal requirements.
United Kingdom: Consumer Duty and borrowers in financial difficulty
The UK Financial Conduct Authority is one of the more mature conduct regulators on vulnerability. Its Consumer Duty requires firms to deliver good outcomes for retail customers across product governance, consumer understanding, consumer support and price and value. In 2024, the FCA finalised stronger protections for borrowers in financial difficulty, embedding aspects of pandemic-era tailored support into its rules for consumer credit and mortgages.
The UK approach is important because it focuses on customers who are already in difficulty and customers who may be at risk of payment difficulty. It also expects firms to communicate clearly, offer appropriate forbearance, signpost free debt advice, consider the wider impact of arrangements and adapt support to individual circumstances. For Australian institutions, the UK model points toward the future: early identification, tailored support, evidence of good outcomes and board-level accountability.
United States: servicing, loss mitigation and complaint intelligence
The United States does not use the same “vulnerability” language as Australia and the UK, but the Consumer Financial Protection Bureau’s work on mortgage servicing, loss mitigation, debt collection, credit reporting and fees is highly relevant. Recent CFPB supervisory material has focused on whether mortgage servicers respond properly to consumers seeking assistance, avoid unfair or deceptive practices, and provide accurate information about loss mitigation options. The CFPB’s complaint database and market monitoring also give regulators a data-rich view of emerging consumer harm.
The US lesson is that hardship capability is inseparable from servicing quality. Poor disclosure, confusing notices, unnecessary fees, dual tracking, slow loss mitigation and inaccurate credit reporting can turn temporary payment difficulty into long-term financial harm. CFPB materials also emphasise accessibility, affordability, sustainability and transparency in loss mitigation, recognising that support that works for consumers can also reduce losses for investors and servicers.
For Australian financial institutions, this reinforces the importance of looking beyond the hardship application itself and testing the surrounding system that determines whether a customer can recover.
What financial institutions should do now
1. Treat hardship and vulnerability as an enterprise conduct risk
Hardship and vulnerability require executive ownership, clear accountability and reporting that goes beyond volumes and processing times. Boards should receive insight on access, timeliness, sustainability, complaints, repeat hardship, customer outcomes and systemic issues.
2. Build earlier identification into systems and conversations
Early identification requires more than telling staff to “look for vulnerability”. Institutions need defined triggers, referral pathways and governance controls across the customer lifecycle. In practice, this means training staff to recognise signs of distress or financial pressure, embedding prompts in collections and complaints workflows, using account and contact data to identify material changes in repayment behaviour, and creating warm referral pathways to hardship, scams, family violence or specialist support teams. Data should not be used to make assumptions about a customer’s circumstances, but it can prompt a timely, respectful conversation before arrears deepen, complaints escalate or the customer is forced to repeat distressing information across multiple channels.
3. Move from standardised hardship offers to sustainable arrangements
Hardship assistance should do more than delay default. Institutions should assess whether a proposed arrangement is affordable, reflects the customer’s wider circumstances and gives them a realistic path to recovery. Warning signs such as repeat hardship requests, rapid re-arrears, broken arrangements or complaints from financial counsellors should prompt review of whether the support model is genuinely working.
Support models work when they are designed around recovery, not merely arrears management or short-term profit. They should be grounded in compassion, recognising that customers in hardship are usually trying to regain stability, not avoid responsibility. Institutions should distinguish between short-term hardship, persistent affordability stress and complex vulnerability, then offer pathways that match the customer’s circumstances, such as breathing space, reduced documentation, fee waivers, specialist escalation, financial counsellor engagement, family violence or scam pathways, repayment restructuring and regular review points. The test is not whether an arrangement was offered, but whether it was realistic, accessible, reviewed when circumstances changed and capable of preventing further harm.
Compassion is not inconsistent with commercial discipline. A support model that helps customers stabilise early can reduce complaints, re-arrears, enforcement costs, remediation, reputational harm and avoidable losses. The issue is not compassion instead of prudence, but compassion as part of a sustainable conduct and risk model.
4. Embed trauma-informed and culturally appropriate practice
Customers experiencing family violence, elder abuse, financial abuse, scams, bereavement, cognitive impairment, mental health concerns, First Nations disadvantage or imprisonment may need different pathways. Good practice includes minimising repeat disclosure, providing safe communication options, enabling trusted representatives, using interpreters appropriately, making identification processes flexible and ensuring staff know when to escalate.
5. Review products, channels and fees through a vulnerability lens
Institutions should ask whether product settings, fees, digital-only pathways, identification requirements, documentation standards or branch closures create avoidable barriers for customers with lower income, disability, limited literacy, limited English, low digital access or remote location. ASIC’s work on low-fee accounts shows that having a suitable product is not enough if the pathway to it is ineffective.
6. Test digital, automated and AI-enabled processes for vulnerability risk
Digital and automated processes can improve access, but they can also create new barriers. Online-only hardship forms, automated collections triggers, chatbot pathways or data-led decision tools may disadvantage customers with low digital access, limited English, disability, trauma, cognitive impairment or complex circumstances. Institutions using automation should test whether vulnerable customers can still reach human support, request adjustments, challenge decisions and access specialist pathways.
7. Invest in staff capability, discretion and assurance
Training should go beyond general awareness. It should begin with board-level ownership, clear risk and governance expectations, and best-practice workshops for senior executives. Staff also need practical decision frameworks, scenario-based learning, escalation pathways, authority to adjust service standards and confidence to respond respectfully to customers in distress. Assurance should test real customer journeys, not just file completion. Quality reviews, complaints analysis, call listening, financial counsellor feedback and outcome data should be used to improve both capability and process design.
Strategic opportunity
Hardship and vulnerability will continue to intensify as market, regulatory and social pressures converge. Leading institutions will be those that understand the many ways customers can experience difficulty and integrate legal obligations, conduct risk, accessible design, data insight, frontline judgement, human support and genuine compassion into a coherent operating model.
For institutions reviewing their hardship and vulnerability settings, the next step is not another policy refresh in isolation. It is a practical assessment of governance, customer journeys, staff capability, data use, assurance and product design to understand whether the operating model genuinely helps customers recover and prevents avoidable harm.
Board questions
Boards should be asking whether customers can find hardship support before they are in crisis; which cohorts abandon the process and why; how often customers fall back into arrears after assistance ends; whether assurance tests real customer journeys or only file completion; whether vulnerable customers can access human support when digital pathways fail; and what complaints, financial counsellors and AFCA outcomes reveal about systemic weaknesses.
GRC Solutions works with organisations to translate regulatory expectations into practical governance, training and operating model improvements, including in areas such as hardship, vulnerability and customer outcomes.
Louise Matthews – Senior Risk & Compliance Legal Consultant, GRC Solutions
Louise is a highly experienced legal, compliance and regulatory affairs specialist with more than two decades of experience in the Australian financial services sector. Her career has included senior advisory and leadership roles with organisations including Aware Super, Hostplus, PwC and KPMG. Louise advises organisations on governance, risk management and regulatory compliance and regularly delivers practical compliance education and thought leadership programs.