Compliance Guide 2026

    FCA Compliance for Mortgage Brokers: The Consumer Duty Guide

    The Consumer Duty turned compliance from a filing exercise into an evidence problem. This guide covers what the FCA actually expects of brokers, where the first response to an enquiry creates risk, and how a logged, auditable WhatsApp AI helps you evidence good outcomes instead of writing them up at midnight.

    Trusted by leading UK mortgage brokers

    Heron Financial
    Evolve Financial Solutions
    Fluent Money
    MAB
    Meridian Mortgages
    D&M Financial
    Stones FS
    98%

    WhatsApp open rate on client messages

    87%

    Reply rate across our WhatsApp conversations

    24/7

    Every enquiry answered and logged

    300,000+

    Messages handled monthly, each one timestamped

    Consumer Duty Made Compliance an Evidence Problem

    Since 31 July 2023 the FCA's Consumer Duty has required firms to deliver, monitor and evidence good outcomes for retail customers. For a broker who already gives good advice, the hard part is not the advice. It is proving you reached the client in time, asked the right questions, and can produce the trail.

    Consumer Support Is Now an Outcome

    Support must be as accessible as sales. An enquiry that sits unanswered overnight, or a client who cannot reach anyone after 5.30pm, is exactly the friction the Duty asks firms to remove.

    Evidence, Not Intentions

    Annual board reports must show what your monitoring actually found about customer outcomes. The test is no longer whether you meant well. It is whether you can produce the trail.

    Record Keeping Under SYSC 9

    Who dealt with the message, who actioned it, where are the notes in the system? If client conversations happen on personal WhatsApp, the honest answer is often nowhere.

    Consistency Across Every Client

    Two clients asking the same question at 9am and 9pm should get the same fair, clear answer. Ad hoc first responses by whoever is free make that impossible to evidence.

    Where Broker Compliance Risk Actually Lives: the First Response

    Most compliance attention goes on the advice itself, which is the part brokers already do well. The exposed flank is everything before the adviser picks up the case: the enquiry that lands at 10pm and waits until morning, the qualification questions that vary depending on who answers, and the WhatsApp thread on someone's personal phone that never reaches the file.

    One agency principal summed the anxiety up to us as a chain of questions: who is dealing with the message when it comes in, who actioned it, where is the trail, where are the notes in the system? That is the record-keeping worry the Duty is built around, and we unpack it fully in our Consumer Duty compliance guide.

    An AI first response closes that flank by construction. Every enquiry gets an instant, consistent, compliance-reviewed reply on the channel the client actually used. Every exchange is timestamped and logged. The handoff from qualification to regulated advice happens at a documented point, in your adviser's diary, with a mini fact-find attached. The audit trail is not extra admin done after the fact. It is a byproduct of answering properly in the first place.

    The after-hours enquiry

    Lands at 10pm and waits until morning. By then the client has often messaged three other brokers.

    Inconsistent qualification

    The questions asked depend on whoever picks up. Two identical enquiries get two different first responses.

    The off-record thread

    A conversation on someone's personal WhatsApp that never reaches the case file or your monitoring.

    On the right side of the perimeter

    What a compliant first response looks like at 10pm

    An enquiry lands long after the office closed. The AI answers instantly, gathers the facts, says plainly it cannot advise, and introduces the client to an authorised adviser, every message timestamped and logged.

    OM
    Oakmere Mortgages
    online · logged to your CRM
    Message

    Illustrative example of a broker's own compliant AI setup, not a real client conversation. Results may vary.

    "Oakmere Mortgages" is a fictional brokerage used for illustration.

    Answered in the moment

    No enquiry sits unanswered overnight, the Consumer Support friction the Duty asks firms to remove.

    Stays the unregulated side of the line

    Factual questions and qualification only. The AI states it cannot advise and hands regulated advice to your authorised adviser.

    Introduces to an authorised adviser

    A booked appointment with a named, FCA-authorised adviser, and a mini fact-find attached, under the Article 33A introduction exclusion.

    Timestamped and on file

    Every message is retained and syncs to your CRM, so the conversation the client had is the conversation in your SYSC 9 records.

    The Regulated Perimeter: What the AI Does and Does Not Do

    SalesRook is a lead qualification and introduction service. Introducing a borrower to an authorised person is excluded from regulated activity under Article 33A of the Regulated Activities Order (see PERG 4.5), provided the introduction does not itself bring about a regulated mortgage contract. The same discipline applies on the protection side under PERG 5: qualification and introduction only, with all regulated advice staying with your authorised advisers.

    What SalesRook does

    • Answers every enquiry instantly on WhatsApp, at any hour, in a consistent, compliance-reviewed voice
    • Collects factual qualification information: budget, timeline, employment status, deposit
    • Books appointments directly into adviser diaries and completes a mini fact-find before first contact
    • Introduces qualified prospects to your FCA-authorised advisers for regulated advice
    • Logs every message, timestamped, and syncs the full conversation record to your CRM

    What SalesRook never does

    • Provide mortgage, protection or insurance advice, or make recommendations
    • Arrange regulated mortgage contracts or enter into contracts for lenders or borrowers
    • Compare products or providers, or conduct demands and needs analysis
    • Carry out identity verification or formal KYC checks (those stay with your firm)
    • Create or approve financial promotions (your approval process still applies)

    For the platform capabilities behind this, see the complete guide to AI for mortgage brokers.

    How an Auditable First Response Maps to the Four Consumer Duty Outcomes

    The Duty's cross-cutting rules ask firms to act in good faith, avoid foreseeable harm, and enable customers to pursue their financial objectives. A fast, logged, consistent first response supports all three, and maps directly onto the four outcomes.

    1

    Products and Services

    The AI widens access to regulated advice. Enquiries that used to die unanswered in an inbox reach a qualified adviser as a booked appointment with context attached.

    2

    Price and Value

    Advisers spend their hours on advice instead of chasing and re-typing. The same team serves more clients without the corner-cutting that harms outcomes.

    3

    Consumer Understanding

    Clear, jargon-free, compliance-reviewed responses, applied identically to every client. The next step in the advice process is always explicit.

    4

    Consumer Support

    Instant response on the channel clients already use, 24 hours a day. No client is left without a reply because the enquiry landed at 10pm on a Friday.

    The Audit Trail Writes Itself

    Under SYSC 9, regulated firms must keep adequate, retrievable records of client communications. In practice that is where good firms leak: the phone call that was never written up, the message answered from a personal number, the qualification detail that lives in one adviser's memory.

    With SalesRook, every client conversation is captured as it happens: timestamped messages, the qualification questions asked and the answers given, and the documented handoff point where the AI stepped back and the authorised adviser took over. The record syncs automatically into your CRM, including Mortgage Advice Bureau (MAB) Platform, Mortgage Kart, Reapit, Alto and AcquaintCRM, so retrieval follows the retention policy your firm already runs. Data handling sits under a UK GDPR compliant Data Processing Agreement, with encryption in transit and at rest and ICO registration (ZC045388).

    The upstream admin matters too. The mini fact-find the AI completes before the appointment is the start of the case file, not a separate system to reconcile. We cover that side, and where AI has no business going, in our guide to fact-find and protection admin automation.

    Where records used to leak
    What captures it now
    The phone call that was never written up
    Every message captured as it happens, timestamped, no write-up required.
    The message answered from a personal number
    Runs on the WhatsApp Business API and syncs straight to your CRM.
    The qualification detail that lived in one adviser's memory
    Answers recorded on the case file, not in someone's head.

    The record your compliance officer can actually pull

    Not a memory of a phone call or a thread on someone's personal number. A timestamped, retrievable trail, synced to your CRM under SYSC 9.

    your-crm.com · clients/james-w · communications
    James W. — enquiry record
    Remortgage enquiry · handled 22:14, retained per firm policy
    Full trail retained
    22:14Enquiry received on WhatsApp Business API

    First response sent in seconds, in the compliance-reviewed persona voice.

    22:14–22:16Factual qualification gathered

    Balance, property value, employment and joint status recorded. No advice given.

    22:16Advice boundary stated to client

    AI confirmed it cannot recommend a product; regulated advice routed to an authorised adviser.

    22:17Appointment booked with named adviser

    Introduced under Article 33A; mini fact-find attached to the case file.

    22:17Conversation synced to CRM

    Every message timestamped and retrievable for monitoring and board reporting.

    Illustrative audit record from the sample conversation above.

    What Your Firm Must Still Do

    SalesRook keeps its side of the perimeter clean. These responsibilities stay with you, as the regulated firm.

    Hold the right FCA permissions

    SalesRook qualifies and introduces. Every regulated activity, from advice to arranging, remains with your authorised advisers and your firm's permissions.

    Review the AI's messaging before deployment

    Your compliance officer signs off the persona's scripts and flows, the same way you would sign off any client-facing communication.

    Keep financial promotions approval in-house

    Any promotional content must go through your Section 21 approval process. SalesRook does not create or approve financial promotions.

    Run KYC and suitability as normal

    The AI hands over factual information. Identity verification, fact-find completion and suitability assessment stay with the authorised adviser.

    Treat SalesRook as an outsourced provider

    SYSC 8 due diligence applies: written agreement, DPA, security documentation and monitoring. We support all of it, including questions direct from your compliance officer.

    Configure retention to your policy

    Conversation records sync to your CRM so retention follows the schedule your firm already operates under SYSC 9.

    What This Looks Like in a Real Brokerage

    Heron Financial, a full-service London brokerage, runs SalesRook across new enquiry handling and remortgage pipeline management. Enquiries that land at 10pm are answered in the moment, and advisers arrive in the morning to a booked appointment with a mini fact-find already completed, every exchange on the record from the first message.

    FCA Compliance for Mortgage Brokers: Evidence Good Outcomes Without Drowning in Admin
    Go Deeper

    FCA Compliance for Mortgage Brokers: Evidence Good Outcomes Without Drowning in Admin

    The Consumer Duty asks mortgage brokers to evidence good outcomes, not just deliver them. Here is how good firms are meeting that evidence burden without the admin swallowing the advice.

    Read the Full Article

    FCA Compliance FAQs

    No. SalesRook operates as a lead qualification and introduction service, which sits outside regulated activities under the Financial Services and Markets Act 2000 (Regulated Activities) Order. Under Article 33A (introducing to authorised persons), introducing a borrower to an FCA-authorised adviser is excluded from regulated activity, provided the introduction does not itself bring about a regulated mortgage contract. The AI collects factual information and books the appointment; your authorised advisers conduct every regulated activity.
    The channel is not the problem; the record is. Regulators worldwide have fined firms for client conversations on personal messaging apps precisely because nothing was retained. SalesRook runs on the WhatsApp Business API: every message is timestamped, logged and synced to your CRM, so the conversation your client actually had is the conversation in your records. That is the difference between WhatsApp as a record-keeping risk and WhatsApp as part of your SYSC 9 audit trail.
    No, and be wary of any vendor who claims otherwise. You are the regulated firm and no software makes you compliant. What SalesRook does is remove two of the hardest evidence problems: proving every client was supported promptly and consistently, and producing the communication trail when someone asks. Our Consumer Duty guide for mortgage brokers covers the evidence burden in depth.
    Every conversation is logged in full with timestamps: the client's messages, the AI's responses, the qualification answers gathered, and the handoff point where the AI stepped back and your adviser took over. The record syncs automatically to your CRM, including Mortgage Advice Bureau (MAB) Platform and Mortgage Kart, so retention follows your existing policy. Data processing is governed by our Data Processing Agreement and UK GDPR practice is documented on our GDPR page.
    No. That boundary is a hard design constraint, not a setting. The AI answers factual questions about the process, gathers qualification information and books the appointment. Anything that edges towards advice, product comparison or recommendation is routed to your authorised adviser. Keeping the AI on the unregulated side of the perimeter is exactly what keeps your firm's position clean.
    The AI can be configured to flag potential vulnerability indicators and escalate to a human adviser at any point, with no pressure tactics and no time limits. A client can always ask for a person and get one. Because every exchange is logged, you can also evidence how a vulnerable customer's contact was handled, which is precisely what the FCA's guidance asks firms to be able to show.

    This page explains how SalesRook operates within the FCA regulatory framework. It is not legal or compliance advice, and SalesRook is not authorised or endorsed by the FCA. Regulated firms should consult their own compliance advisers and conduct their own due diligence. Compliance officer questions are welcome: [email protected] or +44 808 175 1795.

    As Featured In

    Property Industry Eye
    Yahoo Finance
    Business Insider
    Associated Press
    Trusted by leading UK brokerages

    Show Your Compliance Officer, Then Show Your Advisers

    Book a 30-minute consultation and we will walk through the regulatory position, the audit trail, and what an instant, logged first response would look like on your own enquiries.