Calls · Vulnerability signals
MixedRetail financial servicesSpotting vulnerability on calls without labelling customers by machine
Customers often mention a bereavement, an illness or a lost job in passing, and the call moves on. Checking every call can catch those moments. What happens next has to stay with a person.
Valnora & Elric team6 min read
Most disclosures of vulnerability on a call are not announcements. They are asides. A customer says they have been in hospital, that their partner died in the spring, that they lost their job and are “just about managing”. The agent is focused on the reason for the call, and the moment passes.
Quality teams know this happens because they hear it in the small sample of calls they review. Checking every call can catch far more of those moments. The harder question is what a firm should do with them, and that is where most of the design effort belongs.
The case for listening to every call
The FCA’s guidance on the fair treatment of vulnerable customers, FG21/1, asks firms to understand their customers’ needs, equip staff to recognise and respond to them, and monitor whether they are getting it right. It groups the drivers of vulnerability into health, life events, resilience and capability. The Consumer Duty raises the stakes by asking firms to evidence good outcomes for all retail customers, including those in vulnerable circumstances.
Sampling a few calls per agent per month cannot show that. It tells you how a handful of calls went, not whether customers who mentioned a bereavement were consistently offered support. Checking every transcript can, as long as the output is treated as a prompt for a person and never as a fact about the customer.
Signals, not labels
The temptation with any detection system is to turn its output into a flag on the customer record. For vulnerability, that is the wrong move, for three reasons.
- The model can be wrong. A customer quoting a relative’s illness, or a sarcastic remark, can read as a signal. Only a person listening to the call can tell.
- Vulnerability changes. Someone recently bereaved may need help for months and then not at all. A permanent label does not fit a temporary circumstance.
- The data is sensitive. Health information is special category data under data protection law. Recording it needs a clear purpose, a lawful basis and tight access.
So the setup below produces a signal with evidence, routes it to a trained specialist and stops. It does not write a vulnerability marker, change a product, pause a collection or alter a credit decision. If your policy calls for any of those, a person makes the change in the system of record after speaking to the customer.
How the setup works
From call transcript to a person who can help
Workflow · Transcripts
- 01Call recordingsAudio from your telephony platform, or transcripts it already produces.
- 02Speech-to-TextA workflow with the Speech-to-Text block transcribes recordings automatically as they arrive.
Dashboard · Call Compliance
- 03Transcripts panelTranscripts are uploaded to the Call Compliance dashboard built with Dashboards.
- 04Vulnerability checksPlain-English checks return pass, fail or not applicable, with the customer’s own words as evidence.
- 05Signal monitorA rule monitor fires when any call has a possible signal that has not been followed up.
Relay · Vulnerability briefing
- 06Prepare a briefingStarts on the monitor alert, reads the flagged call and the support guide, and drafts a briefing.
- 07Report to specialistPosts the briefing into the specialist’s chat with the Relay. It never contacts the customer.
People · Customer support team
- 08Specialist reviewsListens to the call and decides whether and how to follow up with the customer.
- 09Team lead coachesUses the agent-response checks to coach, not to score customers.
Call compliance in Agent Serve is a capability of Dashboards, not a separate product. You start from the Call Compliance dashboard template, which includes a Transcripts upload panel for text, subtitle, document and CSV transcript files, and for call audio such as mp3, m4a or wav, transcribed with the model you choose and optional speaker labels. To transcribe recordings automatically as they arrive, a workflow built in the workflow builder with the Speech-to-Text block does the same job.
The checks are written in plain English with a severity. Two kinds matter here:
- Signal checks ask whether the customer mentioned something that may indicate vulnerability, and quote it.
- Response checks ask what the agent did next: acknowledged it, offered support or a referral, checked understanding, avoided pressure.
Each returns pass, fail or not applicable, with the customer’s or agent’s words as evidence. The response checks are the coaching tool. The signal checks are the prompt for follow-up.
A person on the other end of every signal
A rule marks calls where a signal was found and no follow-up is recorded. A monitor watches that rule and fires when it matches. The monitor starts a Relay set to the Observe autonomy level, built from the same pattern as the Compliance Reviewer template, with instructions that include “do not contact customers”.
The Relay reads the flagged call, searches your customer support guide in the Knowledge Base for the relevant section, and posts a short briefing into the specialist’s chat. At Observe it can read and draft, but it cannot save files, send email or book meetings. The specialist listens to the call and decides what happens next.
What the solution produces
Check results on one call (illustrative)
Checklist- Customer mentioned a possible vulnerability: yes. Evidence: “Since my husband passed in March I haven’t really kept on top of the post.”
- Agent acknowledged it and offered support or a referral: fail. The agent moved on to the payment date.
- Agent checked the customer understood the next steps: pass. Evidence: “So just to check, you’re happy with the 14th?”
- Agent avoided pressure to agree on the call: pass.
Briefing for the vulnerability specialist (illustrative)
MemoCall: inbound, payments team, 9 minutes. Possible signal: recent bereavement, mentioned once.
What the agent did: agreed a new payment date. No acknowledgement or referral was offered.
Relevant guidance: bereavement section of the internal customer support guide.
Suggested next step for you to consider: a call from the support team, at a time that suits the customer.
This briefing does not change anything on the account.
Access, retention and the data you keep
Vulnerability evidence should be seen by fewer people than ordinary call quality data. Row-level access policies limit call-level detail to the specialist team, while team leads see the response checks for their own agents and executives see totals. A Guardrails PII detection step can mask account numbers in transcripts before they reach a model.
Set a retention period for transcripts and check results that matches your policy, from one day up to five years, and run Agent Serve self-hosted with your own model keys or self-hosted models if transcripts cannot leave your environment.
Controls and governance
Row-level access
Row-level policies narrow what each person sees in tables, dashboards, exports and scheduled reports.
PII detection
A Guardrails block detects personal data and blocks or masks it before text reaches the next step.
Audit trail
Proposals, approvals, declines and executed actions are written to the workspace audit log, which admins can export.
Approvals before action
Relays never send email or book meetings without an approval, under any autonomy setting. An approval covers the exact payload the reviewer saw and expires if nobody decides.
Roles and permission groups
Admin, write and read roles per workspace, plus permission groups that limit which models, blocks and integrations a team can use.
Self-hosting
Run Agent Serve in your own cloud or data centre, next to the systems it reads.
Zero data retention
Zero data retention with supported model providers, backed by your own provider keys and agreements or self-hosted models. Some provider features keep data by design, such as Gemini Deep Research, so they are outside zero data retention.
GDPR ready
Retention from one day to five years, deletion and access controls support GDPR obligations. Ready means the controls are in place, not a certification.
More on how Agent Serve handles access, data and audit on the security page.
What good looks like after a quarter
Success is not a count of customers flagged. It is evidence that the firm responds well when customers disclose. Useful measures include the share of signal calls where the agent acknowledged the disclosure, the time from call to specialist review and the share of specialist reviews that led to support being offered. A rising acknowledgement rate tells you coaching is working.
Start with one team that handles payment difficulties, where disclosures are most common. Agree the checks with your vulnerability lead, run them on past calls, and have the specialist team review every signal for a month before you switch on the monitor. The same dashboard approach underpins full-coverage call QA, so the two can share transcripts.
What you need
- Call transcripts, or recordings plus a Speech-to-Text workflow
- Your vulnerability policy and customer support guide, uploaded to a Knowledge Base
- Plain-English checks for possible signals and for how agents should respond, agreed with your vulnerability lead
- A small, trained team who will receive and act on each signal
- Row-level access so only that team sees call-level vulnerability evidence
- A retention period for transcripts and check results, agreed with your data protection officer
- A decision, written down, that signals never feed credit, pricing or collections decisions automatically