Financial services companies have "little time" to prepare for the regulator's assessment on how they treat vulnerable customers.