Complaints are the one regulatory obligation that arrives without an appointment. A single vulnerable customer, a mis-sold fee, a payment that went missing for three days – and a two-person compliance function suddenly has eight weeks, a paper trail to build, and a case file that the Financial Ombudsman Service may later read line by line.
For most UK FCA-authorised firms, that is the real problem with complaints: not the individual case, but the steady, unpredictable drain on the people who also own AML, Consumer Duty, SMCR and the FCA relationship. This guide sets out how outsourced regulatory complaint management works, what the FCA expects when you delegate it, and the operating model we recommend to firms of 2-50 staff.
Why complaints handling breaks small compliance teams
The volume is rarely the issue. The friction is everything around it:
- Deadlines that do not move. DISP gives you defined windows to resolve, respond and, where the customer remains dissatisfied, to point them to the Ombudsman. Missing one converts a service complaint into a regulatory one.
- Evidence that has to stand up later. A fair outcome is not enough. You need a documented investigation, an assessment against your own terms and the FCA’s rules, and a clear record of the decision.
- Root cause work that gets skipped. When the same person answers the complaint and analyses it, the analysis is the first thing to go. That is precisely the data the FCA expects you to use.
- Peaks. A product change, an interest rate move or a payment outage can triple volumes for six weeks. Staffing for the peak means carrying cost the rest of the year.
Add Consumer Duty to that mix and complaints stop being an administrative task. Under the consumer support outcome, complaint handling is direct evidence of whether you are delivering good outcomes – and the FCA has been explicit that it reads complaints data as a signal.
What the FCA actually requires
Before you delegate anything, be precise about the obligations that stay with you.
DISP governs the mechanics. You must have clear, effective and published complaint handling procedures, acknowledge complaints promptly, investigate fairly, and respond within the applicable timescales – the eight-week final response window for most complaints, with earlier resolution and summary resolution where a complaint is upheld within three business days. Where the customer remains dissatisfied, you must tell them about the Financial Ombudsman Service and the six-month referral window.
Consumer Duty (PRIN 2A) sits above the process. It asks what your complaints data tells you about outcomes – particularly for customers in vulnerable circumstances – and whether you have acted on it.
SM&CR keeps accountability with your people. The SMF16 compliance oversight function and, where held, the SMF17 money laundering reporting function, cannot be contracted away. You can delegate activity. You cannot delegate responsibility.
DISP’s root cause analysis requirement means complaints must be read in aggregate, not just individually: what is failing, why, and what has changed as a result.
Can you outsource complaints handling?
Yes – provided you treat it as outsourcing, not abdication. The FCA’s outsourcing expectations, set out in SYSC 8 for insurers and echoed across its guidance for payments firms, cloud arrangements and technology partners, follow a consistent logic:
- The firm remains fully responsible for regulatory compliance.
- You must conduct due diligence on the provider, and be able to prove you did.
- The arrangement must be governed by a written agreement with clear service levels and audit rights.
- You must retain the expertise and the data needed to oversee the provider.
- You must be able to exit, and to demonstrate a plan for doing so.
Nothing about a complaints partner changes that framework. If anything, the bar is higher, because complaints touch vulnerable customers and Ombudsman exposure directly.
A six-step model for outsourcing complaints management
Step 1: map the journey and the volumes before you shop
Count twelve months of complaints, the categories they fall into, average handling time, and how many escalate to the Ombudsman. Pull the peak weeks. Without this, every provider quote is guesswork and every service level you agree is arbitrary.
Step 2: decide what stays in-house
Outsource the throughput. Keep the judgement. In our view, the non-negotiables for an FCA-authorised firm are:
- Final sign-off on complex, high-value or Ombudsman-bound cases
- Root cause analysis and the reporting that goes with it
- Complaints MI and board reporting
- The relationship with the FCA
- Anything touching Consumer Duty outcome assessments
Step 3: write the agreement with DISP in mind
Your schedule should name the DISP timescales, your vulnerable customer policy, your escalation thresholds, your Ombudsman procedure and the format of the MI you require. Add audit rights, data protection terms under UK GDPR, and a clause requiring notification before any subcontracting.
Step 4: onboard deliberately
Give the provider your products, your terms, your tone and your complaints policy – then test them. Run a sample of closed historic cases through the partner and compare outcomes against your own decisions. Discrepancies at this stage are a gift: they show you where your written policy and your practice diverge, which is exactly what an FCA reviewer looks for.
Step 5: keep root cause analysis under your own roof
This is where outsourcing most often goes wrong. The provider can supply structured data – category, outcome, time to resolve, redress, repeat cause – but the interpretation belongs to you. Apply a consistent root cause taxonomy, use a Five Whys approach to get past the symptom, and record what you changed as a result.
Step 6: monitor, evidence, report
Set a monthly review of service levels, upheld rates, Ombudsman referrals and root cause themes. Feed the output into your complaints MI, your Consumer Duty evidence file and your half-yearly complaints return to the FCA. Keep a clean audit trail of due diligence, oversight minutes and remediation actions.
What good looks like twelve months in
You should be able to answer four questions without opening a case file:
- Are we responding within DISP timescales, every time?
- Which root causes are recurring, and what did we change?
- What are our complaints telling us about customer outcomes?
- Can we evidence how we oversee the provider?
If any of those answers relies on a provider’s dashboard you cannot interrogate, the arrangement is not yet defensible.
Where Compliance Consultant fits
We act as the compliance department for UK FCA-authorised firms – authorisation, audit and benchmarking, AML and financial crime, training and retained advisory support. On complaints, we help you design the operating model, define the in-house controls, and produce the root cause analysis and MI that the FCA expects to see.
Our Complaints Root Cause Analysis & MI Reporting Template gives you an FCA-ready framework for DISP compliance and Consumer Duty evidence: a root cause taxonomy, Five Whys methodology, board dashboard, trend analysis and governance structure. Pair it with our retained compliance support and you have a complaints function that runs predictably, whether the handling sits in-house or with a partner.
SPEAK TO A COMPLIANCE EXPERT to sense-check your current complaints model before the next FCA query arrives.
