Yes, a mortgage adviser can use AI to transcribe and summarise client meetings: no FCA rule forbids it, and the FCA has said it does not plan to introduce extra regulations for AI. It is compliant only if the firm has a lawful basis and tells the client under UK GDPR, an adviser checks what the AI produces, and the file still meets MCOB and the Consumer Duty.
What the FCA has said about AI
The FCA's page "AI and the FCA: our approach" says: "We do not plan to introduce extra regulations for AI." It says the FCA will rely on existing frameworks, and points to its 2024 AI Update, which set out how its existing rules apply to AI. The same page says the FCA's rules "emphasise accountability for senior managers and are relevant to the safe use of AI", citing the Senior Managers and Certification Regime, and lists firms' obligations under the Consumer Duty.
In practice that means the question is never "is this tool allowed?" but "does our use of it still meet the rules we already follow?" The firm and its senior managers stay accountable for advice and records, whoever built the software.
We know of no FCA scheme that approves or certifies AI tools. When a vendor describes its product as "FCA approved" or "FCA compliant", it is giving its own view of how the product can be used, not a regulatory status. Ask what that view rests on.
Do the FCA's call-recording rules apply?
The FCA's recording rules are in SYSC 10A of the FCA Handbook. They require firms to record telephone conversations and keep electronic communications that relate to activities in financial instruments, which is MiFID investment business. A regulated mortgage contract is not a financial instrument, so in our reading SYSC 10A does not require a mortgage adviser to record calls, and it does not govern how a mortgage meeting is transcribed.
If your firm also carries on investment business, part of what it does may be in scope. Check that with your compliance function rather than assuming a single answer for the whole firm.
The rules that do apply
MCOB: the suitability record
MCOB 4.7A sets the standard for advised mortgage sales. Under MCOB 4.7A.25R a firm must keep a record of the customer information it relied on and its explanation of why the advice was suitable, and MCOB Schedule 1 gives the retention period as three years from when the advice was given. A transcript can strengthen that record, because it shows what the client actually said. An AI summary is different: it is a draft written by software, and it becomes part of the record only once an adviser has checked it against what was said.
The Consumer Duty
The FCA's guidance on the Duty, FG22/5, says firms must be able to evidence the outcomes their customers receive and should keep records they can provide on request (paragraphs 11.1 and 11.26). It also says that where a firm uses a third-party provider, the firm stays "responsible and accountable" for its regulatory obligations (paragraph 11.29). Using an AI vendor does not move any of that to the vendor.
UK GDPR and the ICO
A recording and its transcript are personal data, and an advice meeting routinely touches on health, family and other circumstances that are special category data. Under UK GDPR the firm needs an Article 6 lawful basis for the processing and, for those details, an Article 9 condition as well. The ICO's guidance on the right to be informed lists what the privacy notice must cover, including the purposes, the lawful basis, who receives the data, any transfer outside the UK, and how long it is kept. If the transcription or the AI service runs outside the UK, the notice has to say so.
The ICO's list of processing that needs a data protection impact assessment includes innovative technology, which it says includes AI, when combined with another risk factor. Article 35(3)(b) of UK GDPR separately requires one for large-scale processing of special category data. Most firms adopting AI transcription will want a DPIA on file either way. The vendor will act as your processor, so Article 28 requires a written contract with it.
Before you switch it on
- Agree it with your compliance function or network, and get any network permission in writing.
- Record your lawful basis and your Article 9 condition, and complete a DPIA.
- Update your privacy notice to name transcription and AI drafting, where it happens, and how long recordings and transcripts are kept.
- Sign the vendor's data processing agreement, and read its sub-processor list.
- Ask in writing where audio is processed, how long the vendor keeps it, and whether it is used to train models.
- Decide how the adviser checks each AI summary before it reaches the file, and make that step impossible to skip.
- Decide what happens when a client says no, and make sure they get the same service.
- Set a retention period for audio, transcripts and summaries, and check the tool can delete each one.
Where firms go wrong
- Treating the AI summary as the record. If nobody compared it with the conversation, the file shows what the software thought was said.
- Asking the client once, in passing, and recording nothing about it. The file should show what the client was told and that they agreed.
- Forgetting the other people on the call. A partner, a parent or an interpreter is recorded too.
- Keeping audio indefinitely because nobody set a period. Data kept without a reason is harder to justify than data that was deleted on schedule.
For the consent question in detail, including what to say to the client and what to do when they decline, see our guide on whether mortgage clients need to consent to a meeting being recorded.
See how Crestwell handles meeting audio, transcripts and AI processing. Security and data.