What does the FCA's October 2026 AI good practice publication mean for collections?

What the FCA published on 19 October 2026, the points that matter most for AI voice agents on collections calls, and the checks a collections firm can make now.

The short answer

On 19 October 2026 the FCA published AI in financial services: good practice and areas for improvement, updated on 20 October. It creates no new rules. For collections, it is the clearest guide yet to what the FCA looks for in AI voice agents: decide where the AI stops and a person takes over, test outcomes for vulnerable customers, be clear when AI is used, keep auditable records, and give senior managers clear ownership of the risk.

What did the FCA publish?

• A web publication of examples of good practice and areas for improvement, drawn from the FCA's industry engagement, supervisory work and AI Lab initiatives, including AI Live Testing and the Supercharged Sandbox. It was published on 19 October 2026 and updated on 20 October.
• Three themes: the Consumer Duty and consumers in vulnerable circumstances; governance and accountability; and operational resilience.
• No new rulebook. The existing framework applies within each regime's scope, including the Principles for Businesses, the Consumer Duty, SYSC, SM&CR, operational resilience, outsourcing and complaints rules.
• The examples are illustrative, not exhaustive, and the FCA expects them to change over time. They do not prescribe a single model.
• It is relevant to firms that develop, procure, deploy or use AI, which includes a collections firm using a supplier's voice agent.

Which points matter most for an AI voice agent on a collections call?

Each point below gives the FCA's example or observation, with the section number, what it means on a collections call, and a question to ask yourself.

1. Decide where AI supports, automates or abstains (2.1). Define which calls the agent handles end to end, which it hands over, and the exact triggers. Ask: can we list every handover trigger and show it works?
2. Do not exclude vulnerable consumers by default without an alternative (2.1, 2.3). Routing every vulnerable customer away from AI can be unfair if no equal route exists. Keeping them in a journey with no exit is worse. Ask: what happens to a vulnerable customer in our journey, step by step?
3. Do not assume a language model reliably spots vulnerability (2.3). Test for gaps, particularly temporary vulnerability, and adjust indicators and questions. Ask: how often does our agent miss vulnerability, and how did we measure it?
4. Be clear when AI is used and do not overstate it (2.2). Tell customers they are speaking to an AI, what it can do and how to reach a person, without revealing the debt before verification. Ask: does our opening say it is an AI, and do our materials overstate accuracy?
5. Keep auditable records (2.2). Log customer inputs, outputs, model versions, filters and escalation decisions. Ask: can we reconstruct one call for a complaint?
6. Give choice and continuity (2.3). Where appropriate, let customers choose a person and switch channel without repeating themselves. Ask: do the transcript and verification status go with the transfer?
7. Learn from edge cases (2.3). Review unexpected calls, such as a customer mentioning a food bank, and refine controls and escalation. Ask: who reviews outliers, and how often?
8. Give senior managers clear ownership (3.3). Clear responsibility for the voice agent under SM&CR where it applies, with documented oversight and sign-off. Roles can be split, with one senior person accountable for overall oversight. Ask: who signed off the agent, and where is it recorded?
9. Human oversight that can intervene (3.4). Reviewers need authority, criteria and escalation routes. Box-ticking review is an area for improvement. Ask: can our reviewers stop the agent?
10. Test vendor claims and plan for change (4.2). Firms stay responsible for outsourced AI, and untested vendor assurances are an area for improvement. Seek contractual notice of significant model changes and tested fallback plans. Ask: have we tested the vendor's claims ourselves?
11. Include AI in resilience planning (4.1). Put AI dependencies, including externally hosted models, into severe but plausible scenarios; this is required for firms in scope of SYSC 15A. Stress-test before launch. Ask: what happens to calls if the model provider fails?

Does a deterministic voice agent meet these expectations?

It helps with some of them and not others.

Where it helps: the FCA cites, as good practice, assistants that are limited to approved source material, with checks and routes to a person. A deterministic voice agent goes further: it can only speak wording the firm approved before the call, so it cannot invent a promise or a threat. Every sentence also traces back to an approved version, which makes records and explanations simpler. The FCA's example is not an endorsement of any particular architecture. We compare the two designs in deterministic vs generative voice AI for FCA-regulated collections.

What it does not remove: approved wording does not correct wrong source data or a wrong choice of response, so data and routing must be tested. Nor does it replace outcome testing across customer groups, vulnerability detection (the agent still uses language models to understand what the customer said), clear senior management ownership, testing of the vendor, or resilience planning. A vendor that says its product makes you compliant is offering the kind of untested assurance the FCA warns about.

What should a collections firm do in the next 30 days?

1. List every AI tool used in collections journeys, including vendor tools, with a named owner for each.
2. Give a senior manager clear ownership of each tool under your governance and SM&CR arrangements, and record their sign-off.
3. Write down the handover triggers and test them with scripted calls, including vulnerability, dispute and repayment plan scenarios.
4. Check the opening disclosure and every customer-facing description of the AI for overstatement.
5. Pick ten calls, including transfers and vulnerable customers, and reconstruct each one from the records. If you cannot, fix the logging first.
6. Ask your vendor for notice of model changes, test access, a records export and an exit plan.
7. Add the AI dependency to your operational resilience and continuity scenarios.

For the rules themselves, see is it legal and safe to use AI voice agents for debt collection in the UK? and does AI debt collection comply with FCA CONC 7?

Which MEGA.AI controls can a firm test against these examples?

• Approved wording only. The agent speaks only what the client approved before the call, in a journey the client designed.
• Defined handover triggers. Uncertain speech recognition, vulnerability indicators, a mention of Breathing Space or a debt adviser, an objection to recording and a request for a person.
• AI disclosure. The agent tells the customer it is an AI by default in the UK.
• Records. A recording, transcript, step-by-step phase log and flags for every call. See what a full audit trail should contain.
• Model hosting. The language model used for UK traffic is hosted in MEGA.AI's own Microsoft Azure UK South environment, and Microsoft does not retain or review prompts.
• Independent assurance. ISO/IEC 27001, ISO/IEC 27701 and ISO/IEC 42001 (AI management system) certifications, a SOC 2 Type II report and Cyber Essentials Plus. PCI DSS validation is in progress. Details are on the MEGA.AI Trust Center.

These are controls the firm can test. They do not replace the firm's own testing, monitoring and sign-off.

Frequently asked questions

Does the FCA's October 2026 publication create new rules?

No. It shows how existing requirements, including the Consumer Duty, SYSC and SM&CR, apply to AI, using illustrative examples. It does not prescribe a single model.

Does it apply if we use a vendor's AI voice agent?

Yes. The FCA says firms can outsource AI services but remain responsible for them, and it lists relying on untested vendor assurances as an area for improvement. We cover the split of responsibilities in who is accountable when an AI voice agent harms a customer.

Does the FCA require us to tell customers they are talking to an AI?

There is no separate rule. The publication describes clear explanation of AI use as good practice and lists being unclear whether AI or a person performed a function as an area for improvement. Existing duties, including the Consumer Duty's consumer understanding outcome, still apply.

Is human review of AI outputs enough?

No. The FCA warns that over-reliance on human-in-the-loop controls can hide model weaknesses, and that review can become box-ticking. Reviewers need the authority and criteria to intervene.

Are smaller collections firms treated differently?

The FCA describes proportionate approaches for smaller firms, such as testing with sample outputs and curated data and starting with narrow use cases. Proportionality does not reduce accountability.

About MEGA.AI

MEGA.AI provides deterministic voice AI for inbound and outbound customer calls at regulated enterprises in lending and collections, banking, utilities, telecommunications and insurance. Every response the agent can give is approved by the organisation before deployment, with live data inserted only into permitted fields, and every call leaves a record that traces each step back to the approved journey. MEGA.AI is certified to ISO/IEC 27001, 27701 and 42001, is audited under SOC 2 Type II and holds Cyber Essentials Plus; its PCI DSS assessment is in progress. Current certificates are listed on the Trust & compliance page.

Book a briefing to test one of your own collections journeys against the FCA's examples.

Sources

• FCA, AI in financial services: good practice and areas for improvement (19 October 2026, updated 20 October 2026)
• FCA Handbook, CONC 7.3 Treatment of customers in or approaching arrears or in default
• FCA FG21/1, Guidance for firms on the fair treatment of vulnerable customers

This article summarises the FCA publication of 19 October 2026 (updated 20 October) as at November 2026. It is general information, not legal advice. Read the full publication on fca.org.uk. Last reviewed: November 2026.