Complaints are one of the few regulatory metrics the FCA sees before it ever asks you a question. Every entry in your complaints return is a data point the regulator can trend, benchmark against peer firms and cross-reference with your Consumer Duty evidence. Yet for most small and mid-sized FCA-authorised firms, complaint handling is still handled in a shared inbox by whoever has capacity that week.
Outsourcing complaint management is a credible fix – but only if it is built as a regulated operating model, not as a cheaper mailbox. This guide walks through what to outsource, what you can never hand over, how to brief a complaints partner, and the oversight and MI the FCA expects you to keep in-house.
What FCA rules actually require of your complaints process
Complaint handling for most retail business is governed by the FCA’s DISP sourcebook. The core obligations sit with you regardless of who opens the envelopes:
- Eligible complainants must be identified and treated correctly. Not every dissatisfied customer is an eligible complainant, and the difference changes your timescales, your records and their route to the Financial Ombudsman Service.
- Acknowledgement and final response timescales apply. For most complaints you must acknowledge within five business days and issue a final response within eight weeks of receipt. Payment services and e-money complaints sit under separate, shorter statutory clocks, and the “three business day” rule only removes the acknowledgement and final response requirement when a complaint is genuinely resolved and recorded – it never removes the record itself.
- Complaints must be logged, retained and reported. DISP record-keeping obligations plus the FCA’s complaints return (submitted twice yearly, with quarterly reporting for larger firms) mean every complaint needs a durable, auditable trail.
- Root cause analysis is expected, not optional. Under Consumer Duty, complaint volumes and themes are direct evidence of whether you are delivering good outcomes. Recurring complaints point to a product, fee, disclosure or distribution problem – and the FCA expects you to act on what you find.
Complaints handling can legitimately be outsourced. What cannot be outsourced is accountability: outsourcing sits inside the FCA’s outsourcing rules, and it must never impair your ability to meet your regulatory obligations. Your SMF16 compliance oversight holder, or your board, still owns the outcome.
Step 1: Decide what to outsource and what to keep
Split the function before you brief anyone:
Good candidates for outsourcing
- First-line intake, triage and complaint-versus-enquiry classification
- Logging, acknowledgement letters and chasing of third parties for evidence
- Drafting final responses against your approved templates and policy
- Complaint file assembly, retention and MI pack production
- Root cause coding and thematic analysis
Keep in-house
- Sign-off of final responses that concede fault, offer redress, or decline a complaint
- Any decision that engages your legal, financial crime or vulnerable customer policy
- Decisions on whether to report a complaint theme to the board or escalate to the FCA
- Ownership of the complaints policy itself, and of the consumer outcome judgement
Most firms end up with a hybrid: outsourced operational throughput, retained decision authority.
Step 2: Run a proper selection and due diligence process
Treat a complaints partner as you would any critical supplier. Ask for:
- Named, trained complaint handlers with demonstrable experience in your sector – payment services, mortgage broking, credit, insurance and wealth all read complaints differently
- Documented quality assurance on draft responses, with sampling rates stated in writing
- A clear data protection position: UK GDPR roles, data location, retention and breach notification, plus security and access controls
- Humane handling of vulnerable customers and accessibility requirements
- Business continuity, capacity commitments and a realistic exit plan with data return
Ask for a sample MI pack. If a partner cannot show you complaint volumes by product, by category and by root cause, they cannot give you what the FCA will ask for.
Step 3: Brief them like a compliance function, not a call centre
Your outsourcing pack should contain, at minimum:
- Your written complaints policy and procedure, mapped to DISP
- Response templates pre-approved by your compliance function
- A complaints taxonomy – the categories you report on, and how each is coded
- Escalation triggers and named decision-makers with response times
- Timescale rules, including the shorter clocks for payment services complaints
- A conflict and vulnerability policy, and your financial promotions constraints
- The MI specification: what lands in your board pack, and when
Note that an outsourcing arrangement of this nature sits within your wider systems and controls framework. If complaint handling is an important operational function for your firm, your oversight, monitoring and exit planning need to be documented accordingly.
Step 4: Keep oversight evidence from day one
The failure mode we see most often is not a badly handled complaint – it is a firm that cannot prove it was watching. Build oversight that leaves a trail:
- Monthly: volumes, ageing, breach report, root cause themes, and a sample of responses quality-checked by your own compliance function
- Quarterly: trend analysis against your baseline, remedial actions opened and closed, board pack with named owners
- Annually: independent review of the arrangement itself – quality, controls, MI accuracy and continued suitability
Sample-checking the partner’s output is not distrust. It is the evidence that you discharged your oversight obligation, and it is the first thing an FCA supervision query will look for.
Step 5: Turn complaints data into something the board acts on
Complaint MI is only worth collecting if it changes a decision. The firms that do this well report three layers:
- The numbers: volume, upheld rate, redress paid, response times against the deadline
- The causes: root cause themes with the specific product, process or communication failure behind each
- The actions: what changed, who owns it, and what the next data point should show
That third layer is what separates a complaints report from Consumer Duty evidence. A falling complaint count with no root cause analysis attached proves very little.
Where outsourced complaint management goes wrong
- Handing over decision authority along with the admin
- No named owner for the complaints policy once the work moves out
- MI that reports volumes but never causes or actions
- Missing the shorter payment services clocks because the process treated every complaint the same
- Screening complaints without an audit trail you can reconstruct months later
- Never testing the exit plan until the relationship has already ended
Getting the model right
Outsourcing complaint management gives a small compliance team something it rarely has: consistent capacity, documented process and MI that arrives on time. It works when the operating model is designed around DISP, oversight and root cause analysis from the outset – and when you keep the decisions that define your firm’s conduct judgement.
If you want to move beyond handling complaints one at a time, our Complaints Root Cause Analysis & MI Reporting Template gives you the taxonomy, Five Whys method and board dashboard to make outsourced output reportable. And if you would rather have a compliance function managing the partner, the oversight calendar and the FCA reporting, our Compliance Retainer Services do exactly that.
SPEAK TO A COMPLIANCE EXPERT and we will map your complaint handling against DISP, Consumer Duty and your outsourcing obligations before your next supervision query arrives.
