AI debt collection from India and the UK authorisation boundary

Executive Summary

• The Pune supplier can sell software for the lender's staff to use, provided the lender actually conducts the collection and administration. Approval of templates alone does not establish that boundary. A supplier that operates payment demands can undertake debt collecting even where every payment goes directly to the lender. (Financial Services and Markets Act 2000 (FSMA), ss 19 and 22; Financial Services and Markets Act 2000 (Regulated Activities) Order 2001 (RAO), SI 2001/544, arts 39F–39H.)
• The proposed managed bot should be structured through an effective appointed-representative arrangement, the supplier's appropriate authorisation, or an authorised collector that actually operates the service. India-based delivery does not create a general exemption from UK regulation. Debt collecting and debt administration are activities for which the appointed-representative route is legally available. (FSMA, ss 39 and 418; SI 2001/1217, reg 2(1)(af)–(ag); FCA PERG 2.4.6G.)
• Lender-set negotiation limits do not remove the collecting activity. Acting for borrowers or advising them about liquidating their debts can add debt adjusting or debt counselling. Changing agreements and accepting funds require separate assessments before those features are enabled. (RAO, arts 39D–39G and 60B; Payment Services Regulations 2017, SI 2017/752, Sch 1.)
• The lender must assess individual circumstances and sustainable repayments. The product needs effective stops for possible debt disputes, unauthorised recipients and circumstances requiring human support. Recovery rates cannot substitute for those duties. (FCA CONC 7.3.4R–7.3.5IR, 7.9.10R and 7.14.1R–7.14.5R.)
• The UK rules for significant solely automated decisions changed on 5 February 2026. Human involvement must affect the actual decision; special-category data remain subject to stricter restrictions. A routine reminder and an automated refusal of hardship relief require different assessments. (UK General Data Protection Regulation (UK GDPR), arts 22A–22C; Data (Use and Access) Act 2025, s 80; SI 2026/82, reg 2(j).)
• Access to borrower logs by the separate Indian company requires a UK transfer assessment and an appropriate transfer mechanism. The initial contract should prohibit reuse for general model training and give the lender control over subprocessors, access and retention. (UK GDPR, arts 5, 28, 44A and 46.)
• India's foreign-contract exception under the Digital Personal Data Protection Act 2023 (DPDP Act) is not yet operative. The current Indian security, confidentiality and incident duties need separate treatment. When section 17(1)(d) starts, its conditions and retained security duties will still matter. (DPDP Act, ss 8, 17 and 44(2); G.S.R. 843(E), 13 November 2025; Information Technology Act 2000, ss 43A, 70B and 72A.)
• If the bot reveals a debt to a family member and continues demands after a possible dispute, the lender must stop the affected recovery, investigate and correct the records. The supplier must preserve evidence and support containment. Complaints, regulatory reporting and data-breach notification each require their own assessment. (FCA CONC 7.5.3R, 7.9.6R–7.9.10R and 7.14.1R–7.14.5R; DISP 1.4.1R; UK GDPR, arts 33–34.)

The agreement and the actor performing each function

The first release of the AI debt collection software should be operated by the lender's staff. The lender remains creditor, communicates with borrowers and decides whether to defer payments, reduce charges or accept a repayment arrangement. The Indian company supplies the software and support. Its staff can review conversation logs under controlled access, but the recommended initial scope gives them no authority to pursue payment or settle an account.

The matter concerns overdue regulated consumer-credit agreements. Article 60B defines a credit agreement by reference to credit provided to an individual or relevant recipient of credit. A regulated credit agreement excludes the specified exempt agreements. For these debts, the lender's exercise of its rights and duties falls within article 60B(2). The supplier does not acquire the debt or become the lender merely by providing the product. Different treatment would be needed for mortgages, exempt business lending or debts outside these definitions. (RAO, arts 60B(2)–(3), 60C–60H and 60L; FCA CONC 1.2.7G.)

The parties should record the actor behind each action: selecting an account, generating a demand, authorising dispatch, communicating an offer and recording acceptance. Software used by a lender is not, without more, a collection business carried on by its developer. The stronger objection arises where the supplier has contracted to run the collection process and uses the lender's approval as one step in that service. The operating rights, staff instructions and actual delivery then matter more than the software label. (FSMA, ss 19 and 22; RAO, arts 39F–39G.)

Article 39H includes exclusions for activity by the lender and specified persons connected with the credit transaction. Its supplier category concerns the financed transaction's supplier, rather than the AI vendor. A separate contractor does not inherit the creditor's exclusion simply because it acts as agent. Article 60J's arrangements concerning administration of agreements address article 60B(2); they do not create a general outsourcing exemption from articles 39F and 39G. The initial supplier contract should therefore reserve regulated conduct to the lender and restrict the vendor to defined technical functions. (RAO, arts 39H(1), (3), (5) and 60J.)

A supplier operated bot can perform debt collecting

The proposed later version crosses the functional boundary when the supplier operates the bot to obtain payment. Article 39F specifies taking steps to procure payment of debts due under the relevant credit or consumer-hire agreements. A reminder asking an overdue borrower to pay can satisfy that description before any negotiation occurs. The company performs the activity through its automated system. No receipt of money is required by that definition. (RAO, art 39F(1)–(4).)

A bot that contacts the lender's borrowers and seeks repayment in the lender's name performs a collections function. Limits on instalment size or permitted concessions constrain its authority, but leave the payment-procurement purpose intact. A creditor's branding also does not identify which company undertakes the activity. The lender's approval of every message is relevant evidence of control; it cannot alone exempt a contractor engaged to make the demands. (RAO, art 39F; FCA PERG 2.7.8DG.)

Debt administration covers steps performing duties or exercising or enforcing rights under a credit agreement on the lender's behalf. Administration can arise without a payment conversation: operating contractual notices or maintaining repayment arrangements can engage article 39G. Its exclusion for activity already specified in article 39F prevents automatic double classification of the same act. The permission map should distinguish payment demands from separate servicing functions. (RAO, art 39G(1)–(3).)

This differs from the inbound assistance considered in Licentium's Philippine AI voice agents for UK payment customer support. Here, the supplier's proposed service actively seeks payment of regulated consumer debt. The product specification should identify that purpose before the parties agree who will operate it.

UK facing collection needs a defensible permission route

The managed version should be planned as UK-facing regulated collection. FSMA prohibits carrying on a regulated activity in the United Kingdom without authorisation or an applicable exemption. Its territorial provisions extend the ordinary territorial analysis in specified circumstances; they are not an exhaustive definition. FCA guidance expressly recognises that an overseas person can carry on UK activities through telecommunications or the internet without a UK establishment. (FSMA, ss 19, 22 and 418; FCA PERG 2.4.3G–2.4.6G.)

Even if all the supplier's personnel, systems and contractual performance were in India, those facts would not by themselves settle the location of the regulated activity. The proposed service consists of repeated communications to UK borrowers to obtain payment under a UK lender's agreements. Those communications form part of the regulated function itself. On these facts, the commercially defensible launch route provides for UK permission or exemption. A different territorial conclusion would require a documented assessment of the complete operating facts before deployment. A service confined to foreign technical work, with the lender conducting all debtor activity, has a materially different territorial and functional basis. (FSMA, ss 19 and 418; FCA PERG 2.4.6G.)

The RAO overseas-person exclusion does not supply a general exemption for debt collecting or administration. Nor can a commercial agreement expand the lender's authorisation to cover an independent supplier's regulated business. The lender must ensure that an engaged third party has the appropriate Part 4A permission where required. (RAO, arts 39L and 72; FCA CONC 7.13.13R.)

An appointed-representative arrangement is available for debt collecting and debt administration. It needs the required contract and an authorised principal's written acceptance of responsibility for the specified business. The principal must satisfy the FCA's suitability and supervision requirements. Its notification must reach the FCA at least 30 days before the representative starts regulated activities. The FCA's overseas-representative guidance expects effective supervision across borders; a nominal appointment with inaccessible Indian operations would not meet that purpose. (FSMA, s 39(1), (3)–(4); SI 2001/1217, regs 2(1)(af)–(ag) and 3; FCA SUP 12.4–12.5 and 12.7.1R(3).)

FCA guidance allows the relevant activity where it falls within the principal's permission or is excluded when the principal itself carries it on. An own-lender exclusion can therefore matter; a separately named collecting permission is not invariably necessary for the principal. The appointment still needs to cover the supplier's precise functions and the principal must be able to discharge its responsibilities. (FCA SUP 12.4.1AG(1)–(2) and 12.4.2R; RAO, art 39H.)

The alternatives are the supplier's own appropriate authorisation or an authorised collections partner that actually conducts the customer activity. In the partner structure, the Indian company should retain the technical role. A partner that simply passes the entire regulated operation back to an unauthorised supplier leaves the same perimeter problem. An effective permission or exemption is also required before any agreement that itself constitutes regulated activity under article 64. No live managed-bot deployment should precede an effective route and the operating evidence that supports it. (FSMA, ss 19 and 39; FCA CONC 7.13.13R; RAO, art 64; FCA PERG 2.7.21G.)

Negotiation and payment powers change the assessment

The first release should let staff compare repayment options while reserving every offer and forbearance decision to the lender. Negotiation for the creditor remains relevant to debt collecting even within a fixed concession range. Acting on behalf of a borrower to negotiate discharge of a debt can instead engage debt adjusting. Advising a borrower about liquidating debts can engage debt counselling. Debt counselling does not require the supplier to act on the borrower's behalf; the content of its advice matters. (RAO, arts 39D–39F.)

A list of the lender's available arrangements is different from recommending a debt solution to a borrower. The bot should not provide personalised debt advice, rank insolvency solutions or negotiate with other creditors in the initial scope. A trained lender employee with appropriate internal authority can explain the lender's proposal and refer the customer to free debt advice. A reasonable instalment offer must reach the lender unless the collecting firm has authority to accept it. (RAO, arts 39D–39E; FCA CONC 7.3.7AG and 7.5.4R.)

Changing an existing repayment arrangement requires an assessment of the rights exercised and the supplier's authority. It can involve collecting or administration; a new refinancing agreement can add lending or credit-broking questions. A product change described as a better payment plan does not answer those questions. The initial contract should prohibit the supplier from binding the lender, creating new credit or altering interest and charges. (RAO, arts 36A, 39F–39G and 60B.)

Payments should continue directly to the lender through its approved channel. If the supplier later receives or remits borrower money, the parties must reassess payment services and the responsibilities for handling and reconciling those funds. The payment-services exclusion for qualifying technical support requires that the provider never possesses the funds and does not include payment-initiation or account-information services. Absence of custody therefore does not settle every payments question either. (Payment Services Regulations 2017, reg 138 and Sch 1, Parts 1–2, particularly Part 2, para 2(j).)

The lender retains responsibility for customer treatment

The lender must control the conduct that customers experience. The FCA's Consumer Credit sourcebook (CONC) requires it to ensure compliance by employees and agents, and to take reasonable steps concerning other persons acting on its behalf. The Consumer Duty's support obligations expressly extend to outsourced interactions and all communication channels. Lender approval of an original script cannot answer for later model choices about tone, timing or pressure. (FCA CONC 1.2.2R; PRIN 2A.6.1R–2A.6.2R.)

The outsourcing assessment must follow the lender's FCA classification. For firms within column B of SYSC 1 Annex 1 Table A, SYSC 8.1.6R preserves responsibility when relevant services or critical or important functions are outsourced. Several detailed outsourcing provisions apply as guidance to those firms. The lender remains bound by the applicable CONC conduct duties regardless of that distinction. (FCA SYSC 1 Annex 1, para 3.3R and Table A; SYSC 8.1.6R; CONC 7.13.8G.)

The proposed controls should give a trained lender employee the actual account evidence, the customer's circumstances and time to reject the model's suggestion. Approval must attach to the final message, recipient and sending time. The application should prevent changes after approval, enforce contact restrictions outside the model and record who authorised dispatch. These measures implement the recommended software boundary and the duties to communicate fairly and avoid foreseeable harm. (FCA PRIN 2A.2.8R and 2A.5.3R; CONC 7.2.1R.)

The lender should review sustained outcomes: inappropriate demands, repeated contacts, missed disputes, unaffordable arrangements and failed handovers. A high payment rate can coexist with harmful pressure. Consumer Duty monitoring must detect harmful outcomes and differences between customer groups, with action to address failures. The contract should require the supplier to provide usable evidence for those assessments. (FCA PRIN 2A.9.8R–2A.9.12R.)

Forbearance must reflect the borrower's circumstances

The lender must treat customers in or approaching arrears or in default with forbearance and due consideration. It must take account of individual circumstances that it knows or should know. The lender must take all reasonable steps to ensure repayment arrangements are sustainable, with objective income-and-expenditure assessments where used. The model should not infer affordability from willingness to agree during a pressured call. (FCA CONC 7.3.4R, 7.3.4BR, 7.3.5BR and 7.3.5DR.)

FCA guidance identifies reductions or suspension of interest, deferred payments and other arrangements as possible responses. These are examples requiring individual assessment. A specific rule requires reduction, waiver or cancellation of further interest or charges to prevent the debt rising while the customer meets a forbearance arrangement. The bot must not apply a fixed interest policy that defeats that requirement. (FCA CONC 7.3.5G, 7.3.5GR and 7.3.5IR.)

Collection design must also prevent demands for unaffordable lump sums, unreasonable deadlines or borrowing to repay. Where the customer informs the firm that the customer or a person acting on the customer's behalf is developing a repayment plan, active recovery must pause for a reasonable period. The guidance generally identifies 30 days where there is evidence of a genuine intention to develop a plan, and says the firm should consider a further 30 days where reasonable evidence demonstrates progress towards agreeing one. Those periods must not become a universal timer that overrides a dispute, statutory protection or an individual's circumstances. (FCA CONC 7.3.10R–7.3.12G.)

A shared contact history should cover the lender and every collector. Contact at unreasonable times is prohibited, and reasonable requests about when, where and how to communicate require due regard. The FCA's outsourcing guidance also addresses repetitive approaches by different parties. The lender should set and test cumulative contact limits, including retries and failed calls; CONC does not prescribe one universal daily call allowance. (FCA CONC 7.9.4R and 7.13.10G.)

Disputes and vulnerability require effective stops

The product should immediately remove an account from automated recovery when a customer disputes it on potentially valid grounds. CONC requires suspension on valid grounds or grounds that may be valid, followed by investigation and a timely explanation. The firm bears the task of establishing the correct debtor and amount where those matters are disputed. A bot should not reject the dispute because the lender's database repeats the demand. (FCA CONC 7.14.1R–7.14.5R; 7.13.4R.)

The recommended handover triggers include wrong-person claims, alleged payment, disputed balances, difficulty meeting essential expenses and signs of impaired understanding. A vulnerability trigger should pause automated demands pending a trained employee's assessment. That broader pause is a proposed control; vulnerability does not itself create a universal statutory ban on all contact. The lender must implement effective policies for customers it understands or reasonably suspects to be vulnerable. (FCA CONC 7.2.1R–7.2.4R and 7.5.2R–7.5.3R.)

FCA guidance explains how staff can recognise and respond to vulnerability, including confusion, bereavement and health-related difficulty. It is supervisory guidance under FSMA section 139A, not a separate statutory prohibition on using AI. The operational requirement is a route to staff who can change the response, with appropriate support for an authorised representative. The model must not use distress as a signal to increase payment pressure. (FCA FG21/1, paras 1.8, 2.5 and 3.12–3.15; PRIN 2A.2.8R–2A.2.10G and 2A.6.5R.)

Statutory protections need a separate status flag. For qualifying England and Wales breathing-space debts, the creditor and agent must stop prohibited recovery and contact. The regulations preserve defined exceptions, including responding to the debtor and sending required statutory communications. The scheme is geographically limited, so a UK-wide queue must distinguish borrower jurisdiction and the applicable legal hold. The first release should send any insolvency or moratorium notification to the lender's specialist team before further recovery. (SI 2020/1311, regs 1(8)–(9), 7 and 11; FCA CONC 7.3.16G.)

Borrower data must remain within defined purposes

The lender ordinarily determines the purpose of servicing and collecting its loans. The supplier can act as processor for that defined work. If it uses borrower conversations for its own general model development, it determines a separate purpose and can become controller of that processing. Contract labels cannot preserve processor status where the supplier determines the purposes and means of that processing. (UK GDPR, art 4(1), points (7)–(8), and art 28(10).)

The initial agreement should prohibit general model training and reuse across customers, and confine retention to an agreed schedule that accounts for applicable legal duties. Each operational purpose needs its own lawful basis and necessity assessment. Contractual necessity can support necessary servicing; legitimate interests require the applicable balancing assessment. A compatible further purpose does not itself make processing lawful. The lender must explain the processing, recipients, retention and relevant rights in accessible privacy information. (UK GDPR, arts 5(1)(b), 5(3), 6, 8A and 12–14.)

Health disclosures and inferred health conditions require an Article 9 condition as well as an Article 6 basis. The economic-wellbeing condition in the Data Protection Act 2018 covers necessary processing to protect an adult whose injury, illness or disability leaves them less able to protect their economic wellbeing. Its substantial-public-interest, specified reasons for proceeding without consent and appropriate-policy-document requirements must also be satisfied. The supplier should record the minimum support need and restrict access, rather than build an unrestricted health profile for collection scoring. (UK GDPR, arts 5(1)(c) and 9; Data Protection Act 2018, s 10 and Sch 1, paras 5, 19(1)–(3) and 39–41.)

Before live borrower data enter the system, the lender should complete a data protection impact assessment for the proposed processing. Article 35 requires one where likely high risk is present; systematic evaluation and sensitive circumstances make that assessment material here. Unresolved residual high risk requires prior regulatory consultation. The processor agreement must supply the assistance, security, deletion and audit arrangements needed to discharge those duties. (UK GDPR, arts 28(3), 32 and 35–36.)

Automated repayment decisions need the current UK test

The lender should reserve decisions about forbearance, disputed liability and binding repayment changes to staff in the initial release. Since 5 February 2026, Articles 22A–22D govern significant solely automated decisions. The test concerns the absence of meaningful human involvement and legal or similarly significant effects. A human approval click that leaves the model's result unexamined does not provide the required involvement. (UK GDPR, art 22A(1)–(2); Data (Use and Access) Act 2025, s 80; SI 2026/82, reg 2(j).)

The revised provisions permit a wider class of significant automated decisions involving ordinary personal data, subject to a lawful basis and safeguards. They do not preserve the former Article 22's general prohibition unchanged. Article 22C requires information about the decision, an opportunity to make representations and challenge it, and a route to human intervention. Routine scheduling may lack a significant effect; rejecting hardship assistance or imposing a consequential repayment outcome can meet the test. (UK GDPR, arts 6 and 22A–22C.)

Significant solely automated decisions using special-category data face Article 22B's additional restriction. One route requires the decision to rest entirely on personal-data processing covered by the person's explicit consent. The other combines the relevant contractual necessity or legal authorisation with Article 9(2)(g)'s substantial-public-interest condition. Article 22B also bars significant solely automated decisions if their supporting processing relies wholly or partly on the recognised-legitimate-interest ground in Article 6(1)(ea). The lender should avoid automated hardship decisions based on health data unless an applicable Article 22B route has been established. Ordinary legitimate interests alone cannot satisfy the special-category conditions. (UK GDPR, arts 9(2)(a), 9(2)(g) and 22B(1)–(4).)

In the initial release, a human should review the proposed action before it produces legal or similarly significant effects for the borrower. The reviewer needs source account data, the proposed action, relevant vulnerability information and authority to choose a different result. That design also supports CONC's individual assessment duties. An arrangement that satisfies the data-law test can still breach collections rules through unfair pressure or an unsustainable repayment plan. (UK GDPR, art 22A; FCA CONC 7.3.4BR and 7.3.5BR.)

Indian access requires a transfer arrangement before access begins

Making identifiable logs accessible to the separate Indian company creates a restricted transfer even when hosting remains in the UK. UK GDPR Article 44A and the data regulator's remote-access guidance require analysis of the actual overseas recipient. India is not covered by UK adequacy regulations. For regular outsourcing, an appropriate route is the UK International Data Transfer Agreement or the relevant EU standard clauses with the UK Addendum. (UK GDPR, arts 44A–46; ICO, International transfers guidance, remote-access and adequacy sections.)

Article 46 requires a reasonable and proportionate assessment that protection after transfer will not be materially lower than the UK standard. The assessment must examine the circumstances of the transfer and protection as a whole. For this service, that means Indian access rights and legal duties, enforceable remedies, the sensitivity of conversations, security and onward disclosure. Signing standard clauses without that assessment does not establish the condition. (UK GDPR, art 46(1A), (6)–(8).)

The data map should identify each model provider, contracting entity, hosting location, support location and log destination. Subprocessor approval must precede access on the agreed Article 28 terms. The overseas supplier's direct UK GDPR territorial position requires its own Article 3 analysis; supplying a UK business does not alone settle it. The contract and transfer instrument must impose the necessary obligations even where direct territorial application is absent. (UK GDPR, arts 3, 28 and 44A–46.)

Indian export processing remains subject to local duties

The supplier cannot use the DPDP Act's export-processing exception as a current launch clearance. The November 2025 commencement notification places the main processing provisions, including section 17(1)(d), in the stage commencing 18 months after Gazette publication, in May 2027. The related repeal of Information Technology Act section 43A is in that stage. Consent-manager provisions have a separate one-year stage. The final DPDP Rules 2025 are also phased; the principal operational rules have not all started together. (DPDP Act, ss 1(2), 6(9), 17 and 44(2); G.S.R. 843(E), 13 November 2025, paras (a)–(c); DPDP Rules 2025, G.S.R. 846(E), r 1(2)–(4), as corrected by G.S.R. 892(E), 10 December 2025.)

Once operative, section 17(1)(d) applies where a person based in India processes personal data of individuals outside India pursuant to a contract with a person outside India. It disapplies specified obligations while retaining the Data Fiduciary's responsibility for applicable duties and its obligation to take reasonable security safeguards under sections 8(1) and 8(5). The supplier's role depends on whether it determines purposes and means or processes on the lender's behalf. UK residence alone does not establish the location condition, and Indian staff records or independent model-development purposes require their own assessment. (DPDP Act, ss 2(i), 2(k), 3, 8(1), 8(5) and 17(1)(d).)

The current Information Technology Act and Sensitive Personal Data or Information Rules remain material. Financial and health information can fall within the protected categories. The Department of Information Technology's clarification of 24 August 2011 states that Rules 5 and 6 do not apply to qualifying services supplied under a contract with a legal entity inside or outside India. That departmental interpretation leaves the privacy-policy, transfer and security requirements in Rules 4, 7 and 8 in place. Section 43A compensation depends on negligent security causing wrongful loss or gain, while section 72A has a distinct intent or knowledge requirement for improper disclosure. The supplier should maintain documented security measures and restrict access and secondary use. (Information Technology Act 2000, ss 43A and 72A; G.S.R. 313(E), rr 3–8; Department of Information Technology, clarification on the 2011 SPDI Rules, 24 August 2011.)

CERT-In's directions separately require covered bodies to report specified cyber incidents within six hours of noticing them or being informed of them. They also require rolling 180-day ICT logs maintained within India. These requirements concern specified incidents and logs; they do not require every borrower recording to be copied into India. The contract must reconcile applicable retention and reporting with the UK transfer and minimisation duties. (Information Technology Act 2000, s 70B(6); CERT-In Directions, 28 April 2022, paras (ii) and (iv).)

The Reserve Bank of India's bank and non-banking financial company outsourcing directions apply to specified regulated institutions and their arrangements. They do not apply to this foreign-only UK lender mandate merely because its supplier is in Pune. If an Indian regulated institution or an Indian branch's regulated business becomes involved, or the product enters Indian lending, the parties must reassess the relevant rules before expansion. Indian recovery-call limits should not be presented as the rules governing UK collection contacts. (Reserve Bank of India (Commercial Banks – Managing Risks in Outsourcing) Directions 2025, 28 November 2025, paras 3–5; Reserve Bank of India (Non-Banking Financial Companies – Managing Risks in Outsourcing) Directions 2025, 28 November 2025, paras 3–5.)

Calls and recordings need their own controls

The managed voice variant must verify the recipient before revealing a debt. A family member answering the telephone is not automatically authorised to receive the borrower's information. The lender must explain the communicator's role and purpose without exposing debt details before suitable identification. The proposed design should also identify the automated assistant and provide a usable human route. (FCA CONC 7.9.1R, 7.9.6R–7.9.10R; PRIN 2A.5.3R.)

Pure arrears servicing is not ordinarily direct marketing. Adding refinancing offers or promotional material can change that assessment. The Privacy and Electronic Communications Regulations (PECR) then require separate analysis. Regulation 19 controls marketing communications comprising recorded matter through automated calling systems, including prior-consent and caller-identification conditions. Its calling-system definition concerns automated sequences and sounds that are not live speech. The actual dialler and audio process must therefore be assessed for a generative voice system. Live calls and electronic messages have their own rules. The initial specification should prohibit cross-selling within collection contacts. (Privacy and Electronic Communications (EC Directive) Regulations 2003, SI 2003/2426, regs 19(1)–(4), 21–22; ICO, Direct marketing and regulatory communications.)

Recording requires a lawful data-processing purpose and an assessment of the interception arrangements. Where the UK business-monitoring regulations are relied on, their conditions include the permitted purpose, the system controller's express consent and reasonable efforts to inform users. A generic quality-assurance clause does not establish each condition. Ordinary voice recording is distinct from specific technical processing of voice characteristics for uniquely identifying a person, which can engage Article 9's biometric-data restriction. (Investigatory Powers Act 2016, ss 3, 44 and 46; SI 2018/356, regs 3–4, as amended; UK GDPR, art 4(1), point (14), and art 9.)

An Indian service that qualifies as voice-based business-process outsourcing (BPO) can also fall within the Department of Telecommunications' Other Service Provider (OSP) guidelines. Non-voice BPO is excluded and OSP registration has been removed, but covered voice operations remain subject to telecom conditions, specified Indian-copy requirements and one-year retention of call data records, usage data records and system logs. Those provisions do not themselves require retention of all call audio. The parties must check the actual voice architecture before enabling that service. (Department of Telecommunications, Revised Guidelines for Other Service Providers, 23 June 2021, ch I, paras 4–5; ch II, paras 1, 4–5; ch III, para 2; ch V, paras 6–9.)

A wrong recipient and ignored dispute require immediate containment

Suppose the managed bot reveals the debt to an unauthorised family member, then continues demanding payment after the borrower disputes the balance and describes financial hardship. The supplier should stop the affected conversation and queued recovery, preserve the records and notify the lender immediately under the contract. The lender must investigate the potentially valid dispute, establish the correct balance and stop further prohibited demands. It should transfer hardship assessment to a trained employee. (FCA CONC 7.5.3R, 7.9.10R and 7.14.1R–7.14.5R.)

Containment must reach every channel and agent. Correcting the bot while a separate campaign continues would leave the customer exposed. The lender should reconcile payments, correct inaccurate records and check whether the same defect affected other customers. Where personal-data accuracy is contested, the restriction right applies during the verification period, subject to the permitted processing exceptions. Necessary evidence can be preserved without continuing recovery. The borrower should receive the investigation outcome and any appropriate correction or redress. (FCA CONC 7.13.2R–7.13.7R; DISP 1.4.1R; PRIN 2A.9.11R–2A.9.12R; UK GDPR, arts 5(1)(d), 16 and 18(1)(a), (2).)

The disclosure is a personal-data breach requiring assessment. A processor's notification duty to the controller is without undue delay; the contract should impose that standard on the Indian supplier. The lender must notify the UK data regulator without undue delay and, where feasible, within 72 hours of awareness, unless the breach is unlikely to create a risk to individuals. High risk requires notification to affected individuals without undue delay, subject to Article 34's exceptions. The lender must document the breach and its response even where external notification is unnecessary. (UK GDPR, arts 28(3)(f), 33 and 34.)

The collections complaint needs prompt acknowledgement and competent investigation. The ordinary DISP rule requires a final response or the prescribed explanation and Ombudsman information by eight weeks. A data-processing complaint also engages the controller's separate duty to facilitate complaints, acknowledge within 30 days and respond following appropriate enquiries without undue delay. The supplier should preserve the original receipt time and route the matter into each applicable process. (FCA DISP 1.4.1R and 1.6.1R–1.6.2R; Data Protection Act 2018, s 164A.)

A serious event or significant rule breach can also require immediate FCA notification. An Indian cyber incident needs its own CERT-In assessment. The lender and supplier should identify the applicable threshold and clock separately; reporting to one authority does not discharge another duty. Restart should require correction of the cause, testing of the failed controls and a decision by the lender's accountable owner. (FCA SUP 15.3.1R and 15.3.11R; CERT-In Directions, 28 April 2022, para (ii); UK GDPR, art 32.)

The contract should preserve the chosen product boundary

The initial contract should appoint the Indian company for specified software and processing services. The lender should own debtor communications, repayment offers, forbearance, complaint decisions and recovery holds. A permissions schedule should prohibit supplier dispatch of demands, binding negotiations, personalised debt advice to borrowers, statutory notices and payment execution unless an approved expansion expressly covers them. Those limits preserve the allocation of regulated functions to the lender. (RAO, arts 39D–39G; FCA CONC 1.2.2R and 7.13.13R.)

Approval controls should cover changes to the model, prompts, retrieval material, contact scheduling, negotiation parameters and subprocessors. The supplier must provide logs that identify the deployed version, information used, output, approvals and executed action. Testing should include a wrong recipient, an already-paid debt, a plausible dispute, hardship disclosures and unavailable human staff. The lender needs a direct suspension control and a tested way to continue servicing safely. (FCA CONC 7.2.1R–7.2.4R; PRIN 2A.5.10R and 2A.9.8R–2A.9.12R; UK GDPR, arts 28 and 32.)

Audit terms must give the lender usable records and secure regulatory cooperation. For material outsourcing, the FCA requires reasonable steps to obtain supplier cooperation and access to premises. Data-processing terms must provide the information and audit assistance required by Article 28. Confidentiality or model-provider restrictions must not make those rights ineffective. Exit provisions should secure records, pending complaints, customer holds and transition assistance, with return or deletion subject to defined legal-retention duties. (FCA SUP 2.3.5R–2.3.9G; UK GDPR, art 28(3)(g)–(h).)

The agreement should allocate correction costs and losses by responsibility, with express treatment of inaccurate lender data, unauthorised supplier actions and model-provider failures. Indemnities and liability caps cannot remove the lender's regulatory duties or borrowers' statutory rights. The supplier's commercial promise should match controls it can operate and evidence it can deliver. (FCA CONC 1.2.2R; SYSC 8.1.6R; UK GDPR, art 82.)

The supplier should launch the lender-operated tool only after the function map, data contracts, transfer assessment and tested escalation route are accepted. Expansion into a managed bot requires an effective permission or representative structure and revised controls for direct collection. The contract should also support the FCA incident-reporting changes commencing on 18 March 2027, with material-third-party reporting added where the lender falls within that regime's narrower scope. A change in who contacts, negotiates or decides must trigger the review before the new function is enabled. (FSMA, ss 19 and 39; FCA 2026/6, cl C and Annex C, new SUP 15.18.1R, 15.18.6R and 15.19.1R; UK GDPR, arts 28 and 35(11).)