Rules and ethics
Part of Financial adviser appointment setting: checks before the first dial
Financial adviser appointment setting: checks before the first dial
Pre-dial screening for adviser campaigns in the UK: TPS and CTPS checks, suppression lists, lawful basis, dialler limits and the records to keep.
What to take away
- Screen every B2B number against both the TPS and the CTPS, as well as the client's own do-not-call list.
- Sole traders and some partnerships register with the TPS; companies, some partnerships and government bodies register with the CTPS.
- Record a lawful basis, and a written legitimate interests assessment where you rely on it, before the first call.
- Set the dialler against Ofcom's abandoned-call cap and monitor it while the campaign runs.
- Keep records of screening, objections and dialler monitoring so the client can evidence its checks.
Why the first dial is the control point
Cold calling a business number is not banned in the UK, but the checks happen before the first dial, because a call that should not have been made cannot be unmade. For a financial adviser's brand, the first call is often a client's first contact with a regulated business.
Script approval and the section 21 position stay with the regulated firm, and claims fall under the advertising rules. What follows is the screening side: who may be called, how a list is cleared and what a dialler may do. The wider rule set sits in the UK rules and compliance guide.
Check the firm and its promotion first
Before any dialling, confirm that the client is authorised and that the script is an approved financial promotion. Check the firm and its relevant permissions on the FCA Register, and keep the approved version and the approval record.
The approval route comes from Section 21 of the Financial Services and Markets Act 2000. The FCA Handbook's COBS 4 rules then require financial promotions to be fair, clear and not misleading, so an opener that promises guaranteed returns or uses urgency to force a decision fails that test.
Sort the list by who is called
The ICO notes that sole traders and some partnerships register with the TPS, while companies, some partnerships and government bodies register with the CTPS. For business-to-business calls you therefore screen against both registers, as well as your own do-not-call list.
| Who is called | Register to screen | Note |
|---|---|---|
| Sole traders and some partnerships | TPS | Sit closer to consumer rules |
| Companies, some partnerships, government bodies | CTPS | Corporate bodies |
| Any business number | The client's own do-not-call list | Anyone who has objected stays off |
The consent and cold-call rules explain the register logic in more detail.
Screen in a fixed order
- Split the list by number typesole traders and partnerships on one side, companies and corporate bodies on the other.
- Screen live marketing numbers against the TPS and the CTPS.
- Remove anyone on the client's own suppression list, and anyone who has objected.
- Record the result and the date of each screen.
- Screen every new list the same way before it is dialled.
Cold call compliance checks
- Screen TPS and CTPS before dialling
- Keep number, date, time, outcome
- Caller names firm and callback number
- Cap abandoned calls and play message
- Record list source and purchase date
Do not call people who have objected. Screening against both registers before a campaign starts is the simplest way to avoid complaints.
Record the lawful basis before the first call
The Data Protection Act 2018 and UK GDPR govern how prospect data is collected, stored and used for marketing. The Information Commissioner's Office (ICO) is the UK's data protection regulator and enforces data protection and electronic marketing rules. Business details are personal data when they identify a living person.
For most B2B lists the lawful basis is legitimate interests, and a legitimate interests assessment should exist in writing before the first call. Sole traders and unincorporated partnerships sit closer to consumer rules, which catches many agencies out. Set a retention schedule and remove data when it is no longer needed.
Special category data raises the bar further. Health details need an additional condition under UK GDPR as well as a lawful basis, so scripts should never invite a prospect to describe a medical condition or a vulnerability on a cold call. Suitability and risk profiling belong after the first meeting.
Before a list is shared, work through the data protection checks.
Set the dialler against the abandoned-call cap
Ofcom sets the abandoned-call rate cap. The cap is three per cent of all live calls on each campaign over a 24 hour period, under its persistent misuse powers in the Communications Act 2003. Configure the dialler so abandoned calls stay within it, and monitor it while the campaign runs.
A dialler that ignores these limits can put the client's brand in front of Ofcom. Keep records of screening, objections and dialler monitoring so the client can evidence its checks.
What changes for email
Email follows a different rule. The PECR rule on direct marketing by electronic mail does not apply to corporate subscribers, so a B2B email to a company address needs no PECR consent. The sender should still be identified, give a clear opt-out and have a UK GDPR lawful basis.
For individual subscribers, including sole traders, consent or a qualifying soft opt-in is generally needed. The soft opt-in needs contact details obtained in a sale or negotiation, marketing of similar products from the same sender, and an opt-out offered at collection and in every message. Keep a do-not-email list of anyone who objects, and screen new lists against it.
Write the screening into the brief
Put the screening steps in the brief before the first call, with the register used, the person who screened and the date. A written brief, an approved script and a named compliance signatory are the three things that keep an outsourced campaign defensible.
Six-step compliance brief
- Name permitted and forbidden products
- Draft script with compliance approver
- Record lawful basis for each data source
- Screen numbers against TPS and CTPS
- Train callers on advice handover line
- Review recordings monthly and update script
The scripts guide covers drafting the approved script. This is general guidance. Individual cases need a qualified adviser, and nothing here replaces the firm's own compliance sign-off. When comparing providers, start with the questions to ask an agency.
Before the first call
- Split the list into sole traders and partnerships, and companies and corporate bodies.
- Screen against the TPS, the CTPS and the client's own do-not-call list.
- Record the lawful basis, and the written assessment where relying on legitimate interests.
- Set the dialler against the abandoned-call cap and arrange monitoring.
- Name who keeps the screening, objection and monitoring records.
Common questions
What is the difference between the TPS and the CTPS?
The TPS covers personal numbers and the CTPS covers corporate ones. Screening against both before a campaign starts is the simplest way to avoid complaints.
Does UK GDPR apply to B2B appointment setting?
Yes. Business contact details are personal data when they identify a living person, so a lawful basis and a retention period are needed. There is no universal retention period: document one suited to the purpose and erase data when it is no longer needed.
Do we need consent to email a business prospect?
For corporate subscribers, PECR does not require consent, but the sender should be identified and give a clear opt-out. For individual subscribers, including sole traders, consent or a qualifying soft opt-in is generally needed.
Can an agency cold call for an FCA-regulated firm?
Yes, provided the caller uses an approved financial promotion and the firm supervises what is said. The regulated business still owns the outcome.
