Depiction of Consumer vulnerability: making sense of this new ground for regulatory intervention

Consumer vulnerability: making sense of this new ground for regulatory intervention

In February 2019, the UK Competition and Markets Authority (CMA) published a major study on consumer vulnerability, which puts vulnerability firmly on the agenda of regulators and firms. Peter Andrews, Oxera Senior Adviser, considers what is driving this focus on vulnerability, what its implications are, and the principles under which the concept of vulnerability would lead to intervention.

The CMA’s study is entitled ‘Consumer vulnerability: challenges and potential solutions’.1 Given the CMA’s cross-governmental role, the work puts vulnerability squarely on the agenda of regulators and firms in many sectors of the economy. Indeed, the concept of ‘vulnerability’ is used increasingly by UK regulators as an input to strategy, and as a justification for more intense or novel interventions in markets. Vulnerability can therefore be seen as a special case meriting action to protect consumers.2

This article explores:

  • what is driving this focus on vulnerability, and what its implications are;
  • whether there is clarity among regulators about what is meant by the concept of vulnerability, and what the consequences of a broad definition might be;
  • under what principles the concept of vulnerability would trigger intervention.

What are the drivers of the vulnerability initiative, and what are its implications?

The demand for good regulation is clear from the scale of the criticism heaped on regulators when things go wrong. While this justifies regulators having substantial resources, it also puts them under pressure to perform.

Regulators have generally sought to ‘perform’ by making markets work well for consumers. They know that they cannot supplant markets and that competition will, in many cases, serve most people well. They therefore seek to facilitate competition by addressing two standard market failures: information asymmetry and market power. For the present purposes, we can reasonably ignore a third failure used to justify regulation: negative externalities.3

In the context of making markets—i.e. competition—work well for consumers, a major problem is that the demand side often does not behave in the way assumed by standard economic models. For example, consumers may not make effective use of mandated disclosures. Regulators have addressed this, rightly, by deploying behavioural economics to identify how the psychology of consumers is likely to affect the functioning of markets. This has involved the identification and analysis of ‘behavioural’ market failures, which can be characterised as psychologically motivated deviations by the demand side from the conduct and decision-making hypothesised in standard economic models. This analysis has tended to result in ‘behavioural’ remedies such as nudges, which are changes to the choice architecture designed to alter decisions in a predictable way, but without ruling out any options or changing the economic incentives of the decision-makers.

Unfortunately, aside from defaults, which are pre-determined decisions that take effect unless decision-makers actively pick an alternative, the practical effect of behavioural remedies on market outcomes has generally so far been small. This can be seen in various UK Financial Conduct Authority (FCA) Occasional Papers, such as ‘Full disclosure: a round-up of FCA experimental research in giving information’ (2016), and the Stirling University Nudge Database.4 Regulators’ use of behavioural economics has improved outcomes somewhat, but in most cases it has not brought about the widespread change in outcomes that regulators—and society—need. Given the evidence, it is not a great leap to suggest that the best response to the presence of ‘behavioural’ market failures is often not ‘behavioural’ remedies. The process of competition might require other stimuli if it is to prosper.

Against this background, it is intuitive to see the current focus on vulnerability as a rational response to many consumers’ apparent inability to get good deals either when armed with mandatory disclosures in a market crowded with competitors or when nudged in the right direction. In fact, this might even be a useful definition of ‘vulnerability’ for regulatory purposes. There may, however, be two further important drivers of the regulators’ vulnerability agenda.

One is that the set of biases used in behavioural economics may be too narrow to capture all causes of poor outcomes that are not due to information asymmetry or market power, or that these biases may be too difficult to identify accurately in practice. Narrowness may be an issue because behavioural economics focuses on psychological drivers of decisions, and other drivers are possible. It might be instructive to define where ‘vulnerability’ provides wider grounds for intervention. Practicality may be an issue because biases cannot be observed directly—instead, their presence must be determined by empirical research. In contrast, it might reasonably be assumed that particular categories of vulnerable people will fail to meet the standards of Homo economicus (i.e. behave in ways that are consistently rational) in specific ways.

The other, probably more important, driver of the focus on vulnerability is part of a bigger picture: the broad perception that markets are unfair and even that capitalism is not working. If vulnerable people are exploited in markets and suffer material detriment, a large number of people, not just the victims themselves, will believe this to be morally wrong and that remedial action is required. The recent book Prosperity, by Professor Colin Mayer, one of the founders of Oxera, addresses head on the problem of some corporations’ narrow focus on shareholder returns—as does Oxera’s current campaign ‘Beyond the Bottom Line’.5

Two cautionary observations are needed at this point. The first is that regulators should assess the demand side in all its diversity rather than through partial lenses such as vulnerability (if it is partial) and psychological bias—especially a single bias, which is often the focus of policy work. One key to bringing about well-working markets is to understand as well as possible why the demand side is not performing as assumed by standard economic models, whatever the reasons for this. This means understanding all material drivers of consumers’ apparently biased decision-making. In the same market, these may include psychological, emotional, entirely rational, social, circumstantial, cognitive, narrative and evolutionary drivers.

In the absence of the approach just described, deploying effective ‘market design’ in regulation—that is, understanding how a market is really working, including the multiple reasons why it may be failing, and designing an interacting set of interventions that take account of market dynamics—is unlikely to succeed. Unfortunately, taking this approach is challenging but it is critical to the success of what Nesta, an innovation foundation based in the UK, has termed ‘positive regulation’.6 As Nesta explains, the idea is not that regulators should try to micromanage markets. Instead, it is that regulators have a positive role to play in how markets evolve, for example through facilitating useful innovations.

The second cautionary observation is that poor outcomes for vulnerable people do not necessarily mean that the market system as a whole is undesirable. It may be better to address entirely legitimate concerns about fairness through redistribution and redress rather than by supplanting markets. This is a cost–benefit question.

Striking a balance between the extent of intervention in markets and the extent of redistribution might require explicit co-operation between government and regulators. The creation of separate entities in the form of regulators should not prevent policy being joined up where it needs to be. This seems preferable to maintaining the notions of regulators’ complete independence from government and lack of involvement in social policy, neither of which may be entirely tenable in practice.

Is there clarity in the current debate among UK regulators about what is meant by vulnerability? What might be the consequences of a broad definition?

It must be said that there is room for doubt. Or, at least, the most plausible candidate for a general definition of vulnerability is so wide that it seems legitimate to question whether it is intended to be the trigger for regulatory intervention.

The UK regulators Ofgem, Ofwat and the FCA all published papers on vulnerability before the CMA did. It is not clear what will be the impact on them of the CMA’s approach, but it may be useful that the CMA has set a general standard:

In this paper we use the term consumer vulnerability in a broad sense, to refer to any situation in which an individual may be unable to engage effectively in a market and as a result is at a particularly high risk of getting a poor deal.7

Terms such as ‘may be’ and ‘risk’ make this a broad definition. A concern arising is that whenever a regulator deems a vulnerable person’s outcome to be poor, the broad notion of vulnerability might be used to justify intervention. This could make regulatory intervention more unpredictable and increase the volatility of firms’ net income. This in turn could potentially raise firms’ cost of capital and, depending on the state of competition, product prices for consumers. One way to reduce any such effects would be for regulators to publish a policy stance on ‘hard cases’. For example, if capable consumers fail to take an appropriate level of care because their jobs require them to work long hours, will they be treated as ‘vulnerable’—i.e. meriting extra protection?

The other main definition in the CMA’s paper is the distinction between ‘market-specific vulnerability’ and ‘vulnerability associated with personal characteristics’. The meaning of the second term is fairly clear, even if it is hard for firms to tell who among an aged population is vulnerable in practice. Consequently, compliance risk could lead some firms to withdraw, for example, products aimed at older people (such as pension transfers). A further challenge to using this term is: if a characteristic is not relevant to a specific market, why should it concern regulators? An interesting aspect of the second term is that the CMA seems not to include people who are widely considered in other contexts to have vulnerable characteristics—specifically, people with susceptibility to negative discrimination and people in adverse institutional, deferential or care-constrained circumstances.

The first term, ‘market-specific vulnerability’, is less clear. It seems to include much of the CMA’s past work (which concerned market failure), boundedly rational consumers and people in temporary stress triggered by specific events, as well as those who suffer from malpractice such as misleading discount claims and hidden charges. In other words, this seems to include just about everybody, at least some of the time.

Overall, it would be simpler and more intuitive to define vulnerability as a trait or a state that renders a person vulnerable to a specific danger which they cannot directly control. This would import a set of well-developed and tested ideas from psychology, and would be closer in line with the definition adopted by the International Federation of Red Cross and Red Crescent Societies (IFRC), as described in the box below.

The IFRC’s definition of vulnerability

In other contexts, the IFRC defines vulnerability as follows:

Vulnerability…can be defined as the diminished capacity of an individual or group to anticipate, cope with, resist and recover from the impact of a natural or man-made hazard….

The reverse side of the coin is capacity, which can be described as the resources available to individuals, households and communities to cope with a threat or to resist the impact of a hazard….

To determine people’s vulnerability, two questions need to be asked:

  • to what threat or hazard are they vulnerable?
  • what makes them vulnerable to that threat or hazard?1
Source: 1 IFRC, ‘What is vulnerability?’.

What are the principles under which the concept of vulnerability would trigger intervention?

The significance of the breadth of regulators’ definitions of vulnerability partly depends on what can be said about the principles under which the concept of vulnerability will trigger intervention. On these principles, the CMA’s paper is remarkably quiet. The paper moves from describing a range of case studies, to expressing concern about the lack of evidence on outcomes, to proposing a set of five implications for remedy design. While the case studies are emotionally powerful and as such may influence the decision-making of public policymakers, the lack of clear principles can add to the costs of uncertainty mentioned already.

The CMA is surely right about the ambiguity in the evidence. Evidential ambiguity, though, is not a principle for determining that intervention is appropriate. It might even be the opposite because, while intervention will certainly impose costs on society, it will bring benefits only if there is a problem that intervention can at least partly solve.

On the other hand, a degree of frustration with market outcomes and suspicion about the efficacy of competition and regulation to date seem warranted. There is plenty of evidence that competition does not always work well for large numbers of consumers, implying that vulnerability is widespread. In 2019, the financial services think tank New City Agenda collated a list of the top ten mis-selling scandals in UK retail banking, as shown in Figure 1.

Figure 1   Top ten financial scandals in UK retail banking (£bn)

Source: New City Agenda.

The need for consumers, the firms themselves and society more broadly to avoid costs such as these, which have the potential to create systemic risk, is an important driver of Oxera’s Beyond the Bottom Line initiative.

A better way forward?

In other contexts, rigorous approaches to dealing with vulnerability have been set out, which may have high-level lessons for UK regulators. In particular, according to the IFRC, counteracting vulnerability requires:

  • reducing the impact of the hazard itself where possible (through mitigation, prediction and warning, preparedness);
  • building capacities to withstand and cope with hazards;
  • tackling the root causes of vulnerability…8

The IFRC’s approach is specific enough to make the approach to intervention fairly clear. A point of particular interest is the reference to capacity. This is roughly the equivalent, in the context of regulating markets, to taking into account market solutions, such as advisory services and digital aids such as product comparison tools, to potential market failures. If market solutions deal with what realistically can be solved, why intervene? The mere observation of poor outcomes in a market does not establish that a regulator can improve on the way the market works.


We have seen that the vulnerability initiative in the UK has major and legitimate drivers and that the definition of vulnerability may be unhelpfully wide. The principles under which the identification of vulnerability will lead to regulatory intervention can be defined more sharply, and firms themselves, flexible product standards and clear thinking about market design could enhance the set of remedies generally contemplated. As it stands, there is a risk of significant costs arising from the CMA’s approach to vulnerability, partly because it is not overtly economic.

Overall, it is not clear that the concept of vulnerability adds much to the existing regulatory concepts of suitability and fairness, since these are applied to individual consumers. An efficient way forward might be to combine what these concepts require in a simple duty of care. Breach of this duty would be likely to mean payment of redress, and in recent years the costs of redress have been large enough to make them an issue of financial stability. As a result, firms would be well advised to design business models and transaction data monitoring systems to ensure that breaches are minimised.

1 Competition and Markets Authority (2019), ‘Consumer vulnerability: challenges and potential solutions’, 28 February, accessed 25 January 2020.

2 Here a report by the House of Commons Committee of Public Accounts on the subject of consumer protection, published in July 2019, provides a useful overview of the state of play, as it is based on testimony from the Chief Executives of the Financial Conduct Authority (FCA) and the regulators Ofcom, Ofgem and Ofwat. The full report is available at:, accessed 25 January 2020.

3 In principle, correcting market failures should enhance the process of competition, but it does not always lead to good outcomes across the board, and regulators are rightly held to account for outcomes.

4 Financial Conduct Authority (2016), ‘Full disclosure: a round-up of FCA experimental research into giving information’, Occasional Paper 23, November, accessed 25 January 2020; and Stirling University, ‘Nudge Database v1.2’, accessed 25 January 2020.

5 Mayer, C. (2018), Prosperity: Better Business Makes the Greater Good, Oxford University Press. For details about Oxera’s ‘Beyond the Bottom Line’ campaign, see Oxera, ‘Beyond the Bottom Line’, accessed 25 January 2020.

6 Nesta (2019), ‘Renewing regulation: “anticipatory regulation” in an age of disruption’, March, accessed 30 January 2020.

7 Competition and Markets Authority (2019), ‘Consumer vulnerability; challenges and potential solutions’, 28 February, para. 5.

8 IFRC, ‘What is vulnerability?’, accessed 25 January 2020.


Peter Andrews

Senior Adviser
Senior Adviser



9 minute read
Depiction of A guide to revising tariff structures 

A guide to revising tariff structures 

A vital aspect of the design of regulated markets is the definition of tariff structures. There are many influences on this, with potentially conflicting pressures, and as a result there is a wide range of potential outcomes. This article discusses both influences and outcomes and identifies factors to consider… Read More

9 minute read
Depiction of Economics of the Data Act: part 1

Economics of the Data Act: part 1

As electronic sensors, processing power and storage have become cheaper, a growing number of connected IoT (internet of things) devices are collecting and processing data in our homes and businesses. The purpose of the EU’s Data Act is to define the rights to access and use data generated by… Read More

Back to top