You should always ask a mortgage client before recording a meeting, tell them why and what happens to the recording, and not record if they say no. Under UK GDPR, though, consent is not always the lawful basis for the recording: many firms rely on another Article 6 basis, and need a separate Article 9 condition for the health and personal details that come up in advice.
Agreement and lawful basis are different questions
Asking the client whether they are happy to be recorded is about fairness and transparency: they know it is happening, they understand why, and they can say no. The lawful basis is the legal ground under UK GDPR Article 6 on which the firm processes the recording at all. The two often get merged into one word, "consent", and that causes problems.
Article 6 gives six lawful bases, and consent is one of them. The ICO's guidance, "When is consent appropriate?", says consent is not appropriate where "you would still process the data on a different lawful basis if consent were refused or withdrawn", or where it is asked for "as a precondition of accessing your services". It also says consent "will not usually be appropriate if there is a clear imbalance of power" between the organisation and the individual.
So a firm that says it relies on consent must mean it: a client who refuses gets the same service, and a client who withdraws has the recording stopped and deleted. Where recording supports the advice the firm has agreed to give, many firms instead record performance of a contract as their Article 6 basis. Which basis fits is your firm's decision, and it should be written down.
Health and other special category data
A mortgage meeting rarely stays on income and outgoings. Health conditions, a divorce, a bereavement or caring responsibilities come up, and health data is special category data under UK GDPR Article 9. Processing it needs an Article 9 condition in addition to the Article 6 basis.
The ICO lists the Article 9 conditions. The two firms usually consider for advice meetings are the client's explicit consent, and substantial public interest under a condition in Schedule 1 to the Data Protection Act 2018, which for most of those conditions also needs an appropriate policy document. If explicit consent is your condition, the client's agreement has to be specific, informed and recorded, and it has to be as easy to withdraw as it was to give (Article 7(3)).
What to tell the client, and when
UK GDPR Article 13 requires the firm to give privacy information when it collects the data. The ICO's guidance on the right to be informed lists what that includes: the purposes, the lawful basis, who receives the data, any transfer outside the UK, how long it is kept, and the client's rights, including the right to complain to the ICO.
- Before the meeting: say in your privacy notice, and ideally in the booking confirmation, that you may ask to record, why, and that the client can say no.
- At the start: ask in plain words before you press record, and wait for a clear yes. Say who transcribes the recording and where, whether AI helps draft notes that the adviser then checks, and how long the recording is kept.
- On a video call: ask everyone on the call, not only the client.
- Afterwards: keep a note on the file of what the client was told, when, and who was present.
Other people in the meeting
A joint applicant, partner, parent, interpreter or carer who speaks is recorded too, and may share their own personal details. Ask each of them, record who was present, and if someone joins part-way through, pause and ask them before carrying on.
Vulnerable clients
The FCA's guidance on the fair treatment of vulnerable customers, FG21/1, describes four drivers of vulnerability: health, life events, resilience and capability. The Consumer Duty guidance, FG22/5, says FG21/1 remains relevant. A client in difficult circumstances may agree to anything to get the meeting over with. Explain recording slowly, check they have understood, offer not to record, and stop if they become distressed. Where someone holds a power of attorney or is helping the client, decide with your own advice whose agreement you need.
When the client says no, or changes their mind
- If they say no, do not record. Hold the meeting as you would have done, and write it up yourself. Note the decision on the file.
- If they withdraw during the meeting, stop the recording and delete it.
- If they withdraw afterwards, delete the recording and anything derived from it that you no longer have a basis to keep, and check whether details already copied into the fact find should be reviewed with them.
- Make sure saying no changes nothing about the service or the advice they receive.
Is there an FCA rule that requires recording?
The FCA's call-recording rules, in SYSC 10A of its Handbook, apply to activities in financial instruments, which is MiFID investment business. A regulated mortgage contract is not a financial instrument, so in our reading those rules neither require a mortgage adviser to record meetings nor forbid it. If your firm also does investment business, check with your compliance function which conversations are in scope. What MCOB does require is a record of the customer information and of why the advice was suitable (MCOB 4.7A.25R), and a recording or transcript can support that record without replacing it.
See how Crestwell records the client's agreement and handles meeting audio. Security and data.