How FCA financial promotions rules apply to outsourced sales teams

What to take away

What counts as a financial promotion under FCA rules

An FCA financial promotion is an invitation or inducement to engage in investment activity, communicated in the course of business. That definition is broad. It catches a cold call, a LinkedIn message, an email sequence and a scripted phone conversation if the purpose is to move a prospect towards a regulated product.

The product does not have to be named for the rules to bite. If your appointment setter says "our specialist can show you a way to grow your pension pot", that is likely an inducement. The FCA looks at the substance, not the label.

Regulated products include investments, mortgages, insurance and credit broking. A meeting about a buy-to-let mortgage, a term life policy or a stocks and shares ISA sits inside the perimeter. A meeting about bookkeeping software does not.

Most outsourced sales teams work across both regulated and unregulated clients. The same script can be compliant for one client and a breach for another. That is why client onboarding must classify each campaign before dialling starts.

A useful test: would a reasonable prospect think they are being invited to buy or consider a regulated product? If yes, treat the communication as a financial promotion. Document that decision.

The FCA's perimeter guidance is not a checklist, but it is the starting point. Agencies working with UK financial-services clients should keep a written product classification for every campaign. That record supports both FCA supervision and your own commercial contracts.

Section 21 approval and the authorised-firm exemption

s21 approval is the rule in section 21 of the Financial Services and Markets Act 2000. It says a person must not communicate a financial promotion unless an authorised person has approved its content or an exemption applies.

In practice, an unauthorised appointment-setting agency cannot write its own regulated script and use it. The script, the email template and the call opening must be signed off by an authorised person at the client firm, or by another authorised firm willing to approve it.

Approval is not a one-off event. If the script changes, the approval must be refreshed. If the product terms change, the approval must be refreshed. Regulators expect a version history.

The exemption for authorised firms is the main relief. If the communicator is an authorised person, or an appointed representative acting within its scope, s21 approval is not needed for that firm's own promotions. The exemption does not travel to a third-party agency.

There is also an exemption for certain communications by authorised persons to persons who are not retail clients. This is why some B2B campaigns are treated differently. The classification of the audience matters as much as the product.

A common mistake is assuming that a client's authorisation covers the agency. It does not. The agency is a separate legal person. If the agency communicates the promotion, the agency needs approval or an exemption.

When you review agency relationships, check who signs off the script and where that approval is stored. This is a standard question in commercial contracts for appointment setting. Get it wrong and the client's compliance team will end the campaign.

COBS 4 conduct rules for outsourced sales teams

COBS 4 is the FCA's conduct of business sourcebook on financial promotions. It sets the standards for how promotions must be presented. The core requirement is that a promotion must be fair, clear and not misleading.

For outsourced sales teams, that means scripts must not exaggerate returns, hide fees or downplay risk. A balanced promotion gives the prospect the information they need to make an informed decision.

COBS 4 also requires that a promotion is identifiable as such. A prospect should know they are being marketed to. A call that pretends to be a survey, or an email that looks like a personal note from a friend, fails that test.

Risk warnings must be prominent. If the product carries risk of loss, the script must say so. Small print at the end of a long email is not enough. The warning must be part of the main message.

Comparisons must be fair and balanced. If your setter says "our client's returns beat the market", that is a comparison. It needs a reasonable basis and a clear explanation of the risks involved.

COBS 4 applies to the content and the manner of communication. Tone matters. Pressure selling, artificial urgency and repeated calls after a clear no can breach the rules even if the words are technically accurate.

Outsourced sales teams should map each script line to a COBS 4 principle. That mapping becomes the training document and the audit trail. It also makes the client's sign-off faster because the reasoning is visible.

The rules are not limited to the first call. Follow-up emails, voicemails and LinkedIn messages are all promotions if they invite engagement with a regulated product. Every channel needs the same discipline.

The ICO's Business-to-business marketing | ICO rules apply alongside FCA promotion rules, so consent and the right to object must be handled on every channel your team uses.

Record-keeping duties for appointment setters

Record-keeping duties for appointment setters flow from FCA rules and data protection law. The FCA expects firms to keep evidence that promotions were approved and that conduct rules were followed. For an outsourced team, that evidence sits with the agency as well as the client.

Data protection law is part of the picture. The Data Protection Act 2018 underpins prospect data handling in regulated outreach, so lawful basis, retention periods and subject rights must be documented.

Retention periods should be set by the client's compliance policy, but five years is a common baseline for financial promotions. Do not delete records early just because a campaign has ended. Do not keep them indefinitely without a lawful basis either.

Access controls matter. Only trained staff should be able to change a script. Changes should be logged with a timestamp and an approver's name. A shared drive with no version history is a weak control.

When a client asks for an audit, you should be able to produce the approved script, the training record, a sample of calls and the consent trail within a reasonable time. If that takes days, your record-keeping is not fit for purpose.

Agencies should also keep a record of complaints and how they were resolved. Complaints are a signal of conduct risk. The FCA looks at how firms handle them, not just whether they occur.

What appointment setters may and may not say when booking meetings

Appointment setters may describe the category of advice the client provides. They may explain that the client is authorised and regulated by the FCA. They may confirm the prospect's interest and book a time.

They may ask qualifying questions about circumstances, such as whether the prospect already has a pension or a mortgage. Qualifying is not advising, provided the answers are used to route the call, not to recommend a product.

They may not recommend a specific product. They may not say "this is the best plan for you". They may not compare products or promise returns. They may not give tax or legal advice.

They may not use misleading sales practices. The Consumer Protection from Unfair Trading Regulations 2008 make misleading actions and aggressive practices unlawful, and outbound sales teams are within scope. A script that creates false urgency or hides the commercial purpose risks breaching both FCA and consumer protection rules.

They may not imply that the FCA approves or endorses the product. They may not use the FCA logo or name in a way that suggests regulatory backing for the offer.

They may not collect sensitive data beyond what is needed for the appointment. Health data, for example, should only be captured if the client has a lawful basis and a clear purpose.

A setter calls a sole trader about a business loan. Permitted: "I'm calling from an agency working with an FCA-authorised lender. They offer business loans. Would you like a 20-minute call to see if it fits your plans?"

Not permitted: "We can get you a loan at 4% with no credit check, and the rate will not change."

The first version invites engagement without recommending. The second promises an outcome and omits risk. The difference is the difference between a booked meeting and a regulatory breach.

Escalation and sign-off when a regulated product is in scope

Escalation and sign-off must be designed before the campaign goes live. The agency should have a named compliance contact at the client firm and a written process for script changes, complaints and edge cases.

A practical process looks like this:

Step three is the one agencies skip. A verbal "the client is fine with it" is not approval. Get it in writing, with a named approver and a version number.

Escalation triggers should include any prospect question about returns, fees, risk or suitability. The setter should not improvise. The script should have a holding line and a route to a qualified adviser.

Complaints should escalate the same day. A complaint about a promotion is a conduct event. The client's compliance team needs to know, and the agency needs to record what was said and what was done.

Sign-off should also cover the data source. If the agency buys a list, the client needs to know. The ICO's direct marketing guidance and the Data Protection Act 2018 set the standard for lawful B2B outreach. A campaign built on unclear consent is a risk to both parties.

Finally, review the relationship annually. Products change, rules change and staff change. A campaign that was compliant last year may not be compliant today. A short annual review, documented, keeps the agency and the client on the right side of the FCA.

Before the first call, agree how the campaign will be described in every message. Your disclosure policy should state who the agency is, which firm it represents and that the firm is FCA authorised.

Common questions