This checklist covers the main rules a UK contact centre has to meet in 2026: what each one requires, and where to read the rule itself. It is a starting point for a compliance review, not legal advice; the linked sources are the authority.
FCA Consumer Duty
The Consumer Duty requires firms to deliver good outcomes for retail customers across four areas: products and services, price and value, consumer understanding, and consumer support. It has applied to products open to sale or renewal since 31 July 2023, and to closed products since 31 July 2024.
For contact centres handling financial services calls, this means communication that is clear and not misleading, support that customers can reach without unreasonable barriers, and outcomes monitored across the whole customer base. Quality monitoring should include criteria for each of the four outcome areas, and scripts should be assessed against them.
Call recording and UK GDPR
Recorded calls are personal data. Tell callers that calls are recorded, document the lawful basis for recording (commonly legitimate interests for quality and training, or legal obligation where a regulator requires recording), store recordings securely, keep them no longer than necessary, and be ready to provide them in response to a subject access request.
The Data (Use and Access) Act 2025, which became law on 19 June 2025, brings enforcement of the electronic communications rules (PECR) into line with UK GDPR and widens the definition of a call to include attempts that do not connect. Its changes are coming into force in stages, so check the ICO's summary for the current position.
PCI DSS for telephone payments
Contact centres that take card payments by phone must meet the Payment Card Industry Data Security Standard. PCI DSS v4.0.1 is the current version, and its future-dated requirements became mandatory on 31 March 2025.
In practice, card data must never reach call recordings: pause recording during payment capture or use DTMF masking. Agents should not read card numbers back, card data should not be written down or stored outside PCI-compliant systems, and assessments should be kept current.
Vulnerable customers
The FCA's guidance on the fair treatment of vulnerable customers (FG21/1) expects firms to understand their customers' needs, give staff the skills to recognise and respond to vulnerability, and monitor whether they are meeting those needs. Train agents to recognise indicators such as health conditions, bereavement, financial difficulty or low literacy, set clear escalation routes, and record and review interactions where vulnerability is identified. Speech analytics can help find indicators across every call rather than a sample.
TPS and CTPS for outbound calls
The Telephone Preference Service (TPS) and Corporate Telephone Preference Service (CTPS) are the statutory registers of people and organisations who do not want live marketing calls. The ICO's rules say you must check numbers against both registers before making live marketing calls, and a new registration takes 28 days to take effect, so lists should be screened shortly before each campaign. You must also say who is calling and give contact details or a Freephone number if asked. Claims management calls need the person's specific consent, and pension scheme calls have their own stricter conditions.
Abandoned and silent calls
Ofcom's persistent misuse policy limits abandoned calls (a live person answers and the call is then terminated) to 3% of live calls on each campaign over a 24 hour period. Where answering machine detection is used, the rate must include a reasoned estimate of its false positives. An information message must be played no later than two seconds after the call is picked up or the person starts to speak, and a number that received an abandoned call should not be called again within 72 hours without a live agent guaranteed.
Caller ID (CLI)
Ofcom's CLI guidance under General Condition C6 requires that, where caller ID is provided, it includes a valid, dialable telephone number that uniquely identifies the caller. The ICO also requires marketing callers to display their number or a valid alternative contact number. Check that every outbound campaign presents a number customers can call back.
Complaints handling
FCA-regulated firms must handle complaints under the DISP rules. A final response must be sent within eight weeks of receiving a complaint. Complaints resolved by the close of the third business day after receipt can instead be closed with a summary resolution communication. Train agents to recognise a complaint even when the caller does not use the word, and to log and escalate it correctly.
Record keeping
Keep adequate records of customer interactions for audit: call recordings, transaction records, complaint files and quality monitoring. Where the FCA's recording rules in SYSC 10A apply, records must be kept for five years, and for up to seven years if the FCA asks. Everything else follows UK GDPR's principle of keeping data no longer than necessary, so document a retention schedule that reflects every rule that applies to you and enforce it.
Frequently asked questions
How often must call lists be screened against the TPS?
The ICO says you must check numbers against the TPS and CTPS before making live marketing calls. A new registration can take 28 days to take effect, so a list screened more than 28 days ago may include numbers that are now registered.
What is the maximum abandoned call rate in the UK?
Ofcom's persistent misuse policy limits abandoned calls to 3% of live calls on each campaign over a 24 hour period, and expects the rate to include a reasoned estimate of answering machine detection false positives.
How long must FCA-regulated firms keep call recordings?
Where the FCA's recording rules in SYSC 10A apply, records must be kept for five years, and for up to seven years if the FCA asks. Outside those rules, UK GDPR requires that recordings are kept no longer than necessary.