Regulators increasingly view customer vulnerability as a firm-wide responsibility, not just a frontline issue. That means systems, controls, and oversight must be designed to anticipate and mitigate harm before it occurs.