AI Voice Agent Compliance Checklist for UK Regulated Contact Centres: FCA, PCI DSS, and Data Protection Before You Go Live

Arkadas Kilic 9 min read · 2026-07-28

Deploying an AI voice agent in a UK regulated contact centre is not a technology problem. It is a compliance problem with a technology solution. Get the order wrong and you are looking at FCA enforcement action, PCI DSS audit failures, ICO investigations, and the kind of headlines that end careers.

This checklist covers every compliance control we validate before any AI voice agent goes into production for our clients in financial services, insurance, and other regulated sectors. We build these systems on AWS, and we deploy them in 4 to 6 weeks. That speed is only possible because compliance is baked in from day one, not retrofitted at the end.

Work through each section before you flip the switch.

Why Compliance Must Come Before Go-Live, Not After

Regulators do not accept "we were still iterating" as a defence. The FCA's Consumer Duty (in force since July 2023) applies to every customer interaction, including automated ones. If your AI voice agent gives a customer misleading information about a financial product, the firm is liable. Full stop.

PCI DSS v4.0 (mandatory since March 2024) tightened requirements around telephone-based card payments significantly. And UK GDPR carries fines of up to £17.5 million or 4% of global annual turnover, whichever is higher.

The cost of getting compliance wrong vastly exceeds the cost of building it in correctly from the start.

Section 1: FCA Conduct and Consumer Duty Requirements

1.1 Consumer Duty Obligations

• [ ] Outcome testing documented: Your AI voice agent must demonstrably deliver good outcomes for retail customers. Document the testing methodology, sample sizes (aim for at least 200 interactions per use case before go-live), and pass/fail criteria.
• [ ] Vulnerable customer identification: The agent must detect signals of vulnerability (distress, confusion, cognitive difficulty) and route to a human within 30 seconds of detection. Define your trigger phrases and sentiment thresholds explicitly.
• [ ] Information clarity audit: Every script, prompt, and dynamic response must be reviewed against the FCA's plain language standards. No jargon, no ambiguity on fees, risks, or product terms.
• [ ] Fair value assessment: If the agent is involved in any sales or upsell journey, a fair value assessment must be completed and signed off by your compliance team before deployment.
• [ ] Complaints routing: The agent must be able to recognise a complaint (including implied complaints) and route it correctly. The FCA's DISP rules require complaints to be acknowledged within 5 business days.

1.2 Approved Persons and Accountability

• [ ] Senior Manager accountability mapped: Under SMCR, a named Senior Manager must own the AI voice agent deployment. This is not optional. Document who holds accountability before go-live.
• [ ] Oversight framework in place: Define how the Senior Manager will receive ongoing MI on agent performance, error rates, and customer outcomes. Monthly is the minimum; weekly is better in the first 90 days.

1.3 Financial Promotions

• [ ] Promotions sign-off: If the agent mentions any product, rate, or offer, that content is a financial promotion under s.21 FSMA 2000 and must be approved by an authorised person before the agent says it to a single customer.
• [ ] Dynamic content controls: If responses are generated dynamically, you need a guardrails layer that prevents the model from generating unapproved promotional content. This is a hard technical requirement, not a policy aspiration.

Section 2: PCI DSS v4.0 Requirements

2.1 Scope Reduction First

The single most important PCI DSS decision you will make is whether the AI voice agent touches cardholder data at all. If you can architect it so the agent never receives, processes, or transmits PANs, expiry dates, or CVVs, you dramatically reduce your compliance burden.

• [ ] DTMF suppression implemented: If customers enter card numbers via keypad during an AI-handled call, DTMF tones must be suppressed so they are never captured in call recordings or transcripts. This is a Requirement 4 obligation under PCI DSS v4.0.
• [ ] Pause and resume recording: Call recording must automatically pause before any cardholder data is entered and resume after. This must be automated, not reliant on agent action (since there is no human agent to act).
• [ ] Transcript redaction: Real-time transcription pipelines must redact PANs, CVVs, and expiry dates before the transcript is stored or passed to any downstream system. Validate this with test data containing synthetic card numbers before go-live.
• [ ] Tokenisation for stored data: Any reference to a payment method stored in your CRM or contact centre platform must use a token, not the raw PAN. Verify your Amazon Connect and CRM integration handles this correctly.

2.2 Network and Infrastructure Controls

• [ ] Cardholder Data Environment (CDE) boundary defined: Document exactly where the CDE starts and stops in your AWS architecture. Your AI voice agent infrastructure should sit outside the CDE wherever possible.
• [ ] Encryption in transit: All audio streams, transcripts, and metadata must be encrypted in transit using TLS 1.2 or higher. TLS 1.3 is strongly recommended.
• [ ] Encryption at rest: S3 buckets, DynamoDB tables, and any other storage used by the agent must have encryption at rest enabled. Use AWS KMS with customer-managed keys for regulated workloads.
• [ ] Access logging: CloudTrail must be enabled across all accounts in scope. Log retention must meet your QSA's requirements (typically 12 months online, 12 months archived).

2.3 Third-Party Service Provider (TPSP) Requirements

PCI DSS v4.0 Requirement 12.8 requires you to manage your TPSPs rigorously.

• [ ] AWS Responsibility Matrix reviewed: Obtain and review the current AWS PCI DSS Responsibility Summary. Know exactly which controls AWS owns and which you own.
• [ ] TPSP agreements updated: Any vendor whose service touches cardholder data must have a written agreement confirming their PCI DSS compliance status. Collect current AOCs (Attestations of Compliance) before go-live.
• [ ] Annual review process documented: Your TPSP monitoring programme must be documented and assigned to a named owner.

Section 3: UK GDPR and Data Protection

3.1 Lawful Basis and Transparency

• [ ] Lawful basis documented: Identify and document the lawful basis for every category of personal data the agent processes. For most contact centre use cases this will be contract performance or legitimate interests. For special category data (health, financial vulnerability indicators), you need explicit consent or another Article 9 condition.
• [ ] Privacy notice updated: Your privacy notice must accurately describe AI-assisted processing. The ICO expects this to be in plain English and easily accessible before the interaction starts.
• [ ] AI disclosure to customers: Customers must know they are interacting with an automated system. This is both a UK GDPR transparency requirement and an FCA Consumer Duty expectation. The disclosure must happen at the start of the call, not buried in a terms page.

3.2 Automated Decision-Making

• [ ] Article 22 assessment completed: If the AI voice agent makes or contributes to decisions that have a significant effect on customers (credit decisions, claims outcomes, account restrictions), you must assess whether Article 22 applies and document your position.
• [ ] Human review pathway: Where Article 22 applies, customers must have the right to request human review of any automated decision. This pathway must be technically implemented and tested, not just described in a policy document.

3.3 Data Minimisation and Retention

• [ ] Data minimisation audit: Map every data field the agent collects, stores, or passes downstream. Remove any field that is not strictly necessary for the stated purpose. This is not a nice-to-have; it is a core UK GDPR principle.
• [ ] Retention schedules enforced technically: Retention periods must be enforced by automated deletion or anonymisation, not by manual processes. S3 Lifecycle policies and DynamoDB TTL settings are your friends here.
• [ ] Call recording retention reviewed: FCA-regulated firms typically need to retain call recordings for 5 years (MiFID II) or 3 years (non-MiFID). Align your S3 Lifecycle policy to the correct period for your regulatory category.

3.4 Data Subject Rights

• [ ] SAR process tested end-to-end: A Subject Access Request must be fulfillable within 30 days. Test that you can retrieve all data the agent holds or has processed for a given customer, including transcripts, interaction metadata, and any derived attributes.
• [ ] Right to erasure process documented: Where erasure is legally permissible, the deletion process must be documented and tested. Note that FCA record-keeping requirements may override erasure requests in some cases. Document your position explicitly.
• [ ] Data breach response plan updated: Your incident response plan must cover AI voice agent-specific breach scenarios, including transcript exposure, audio recording leakage, and unauthorised access to interaction metadata.

3.5 DPIA Completed

• [ ] Data Protection Impact Assessment signed off: A DPIA is mandatory for large-scale processing of personal data using new technology. An AI voice agent in a contact centre meets this threshold. The DPIA must be completed before go-live, not after. It must be reviewed and signed off by your DPO.

Section 4: Technical Controls and Audit Readiness

4.1 Logging and Monitoring

• [ ] Comprehensive audit trail: Every interaction must generate a tamper-evident audit log: call start and end times, intent classifications, routing decisions, escalation triggers, and outcome. This is your evidence base for FCA supervision and PCI DSS audits.
• [ ] Real-time anomaly alerting: Set CloudWatch alarms for error rate spikes above 2%, unexpected escalation rate changes above 15% from baseline, and latency above 3 seconds on critical intents. These thresholds indicate something is wrong before customers and regulators notice.
• [ ] Model drift monitoring: Establish baseline performance metrics at go-live and monitor weekly. A drop of more than 5 percentage points in intent accuracy or customer satisfaction scores should trigger a formal review.

4.2 Human Escalation

• [ ] Escalation rate benchmarked: Know your expected escalation rate before go-live. For most regulated use cases, 20 to 35% of interactions escalating to a human agent is normal. An unexpectedly low rate may indicate the agent is failing to recognise when it should escalate.
• [ ] Warm transfer implemented: When the agent escalates, it must pass context to the human agent. Cold transfers where the customer has to repeat themselves are a Consumer Duty failure. Implement a contact attribute or screen pop that carries the interaction summary.
• [ ] Out-of-hours routing defined: Document what happens when a customer needs a human and none are available. The agent must set accurate expectations and offer a callback or alternative channel.

4.3 Change Management

• [ ] Change control process defined: Any change to agent prompts, routing logic, or connected systems must go through a documented change control process that includes compliance review. This is a PCI DSS Requirement 6 obligation and good practice for FCA accountability.
• [ ] Rollback capability tested: You must be able to roll back to the previous version of the agent within 30 minutes if a production issue is detected. Test this before go-live.

Section 5: Pre-Go-Live Sign-Off

Before you move to production, obtain written sign-off from each of the following:

• [ ] Head of Compliance or Chief Compliance Officer: Confirming FCA and Consumer Duty requirements are met.
• [ ] Data Protection Officer: Confirming DPIA is complete, UK GDPR controls are in place, and the privacy notice is updated.
• [ ] QSA or Internal PCI DSS Lead: Confirming scope reduction measures are effective and controls are validated.
• [ ] CISO or Head of Information Security: Confirming encryption, access controls, and logging meet your security standards.
• [ ] Named Senior Manager (SMCR): Confirming accountability is accepted and the oversight framework is in place.

Keep these sign-offs in a dated, version-controlled document. You will need them if a regulator asks.

The Bottom Line

A compliant AI voice agent deployment in a UK regulated contact centre is achievable in 4 to 6 weeks if you treat compliance as an architecture decision, not an afterthought. The checklist above is not theoretical. It reflects the controls we build into every production deployment we deliver for regulated clients.

The firms that get this right move fast and stay clean. The ones that skip steps move fast and pay for it later.