Meet your office and business support regulatory duties

A. FCA consumer credit authorisation and debt collection conduct

Debt collecting, debt administration and the provision of credit references are regulated activities under the Financial Services and Markets Act 2000 (brought within the FCA's remit from 1 April 2014 by the Regulated Activities Order amendments). You must hold FCA authorisation (or be an appointed representative) before carrying on any of these activities. Carrying on a regulated activity without authorisation is a serious offence and agreements made without authorisation are unenforceable.

If you collect debts, you must comply with the FCA's Consumer Credit sourcebook (CONC 7) — clear communication with debtors, treating customers in financial difficulty fairly, no misleading or oppressive practices, and compliance with the FCA's Consumer Duty.

Credit reference agency duties

If you provide credit references, you are subject to enhanced data-subject rights in addition to FCA authorisation. Individuals can obtain their statutory credit file and require correction of inaccurate data under sections 157–160 of the Consumer Credit Act 1974 and the UK GDPR. The ICO and FCA jointly oversee fairness and accuracy of credit data.

B. Call centre outbound marketing

If you run an outbound call centre using predictive diallers, you must not engage in the persistent misuse of an electronic communications network — including generating silent and abandoned calls. Ofcom's policy sets a maximum 3% abandoned-call rate per campaign (measured over 24 hours), requires a brief information message on an abandoned call (identifying the caller and giving an opt-out), and requires calling line identification (CLI). Ofcom can impose a penalty of up to £2 million under the Communications Act 2003.

Electronic marketing (PECR)

If you send marketing by email, text message or automated call, you must comply with the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR). PECR requires you to obtain prior consent before sending unsolicited electronic marketing to individuals, subject to the limited 'soft opt-in' exception for existing customers. You must screen against the Telephone Preference Service (TPS) before making live marketing calls. The ICO enforces PECR and can issue monetary penalty notices — since June 2025, PECR penalties are aligned with UK GDPR levels (up to £17.5 million or 4% of annual worldwide turnover, whichever is higher).