Mortgage broker compliance and automation

Automation and compliance are usually presented as opposites: the more you automate, the more risk you take on. That framing is wrong in both directions. Manual processes fail constantly and invisibly, and an automated step that is logged and consistent is often easier to defend than a human step that depended on someone remembering.

The real question is narrower. Which parts of your advice process can be executed by a rule, and which parts require a person exercising judgement that they can later explain?

Sorting your process into three buckets

Take your case journey and sort every step into one of three categories.

Mechanical steps have a right answer that does not depend on the client. Sending an agreed document pack, timestamping a file, moving a case to the next stage when a lender reference arrives, generating a reminder before an offer expires. These can be automated with very little argument.

Judgement steps require an adviser to weigh something. Whether a lender's criteria genuinely fit this client's income pattern. Whether the client understood the trade-off between term and monthly cost. Whether a disclosure landed. These cannot be automated, and dressing them up as a form field does not change that.

Assisted steps sit in between. A draft suitability narrative, a summary of a recorded call, a first pass at categorising incoming email. Software can produce a starting point, but a named person has to read it, correct it and take responsibility for the output that reaches the client.

Most firms get into trouble by quietly moving judgement steps into the assisted bucket and then quietly moving assisted steps into the mechanical bucket, one small convenience at a time.

Consumer Duty is not a checklist you can automate against

Consumer Duty is an outcomes-based regime. It asks whether your clients are actually getting good outcomes across products and services, price and value, consumer understanding and consumer support. It does not hand you a list of boxes that, once ticked, mean you are done.

This has a specific consequence for automation. You cannot buy a product that makes you compliant, because compliance here is a claim about results, not about process artefacts. What software can do is give you the evidence to test the claim: how long clients waited for a response, how many did not complete after being told a fee, which cohorts of clients dropped out, where complaints cluster, whether your communications are understood.

That is a genuinely useful thing to automate. A monthly view of outcome indicators, produced without anyone assembling it by hand, is worth considerably more than a folder of policy documents nobody reads.

Where you need to know precisely what your firm must produce and retain, check the FCA Handbook or your network's compliance function. Do not infer requirements from what a software vendor's marketing implies.

The appointed representative question changes everything

If you are an appointed representative, your principal firm is responsible for your regulated activities, and that responsibility is real rather than nominal. Networks have tightened oversight considerably, and most now specify which systems you use, what your client-facing communications may say, and what evidence must sit in a case file.

That means the automation decision is often not yours alone. Before you connect a tool to your case data, or let something draft client emails, ask your network three things: whether the tool is permitted, whether their file-checking process can read what it produces, and whether anything you generate needs their sign-off before it goes out.

If you are directly authorised you have more latitude and more exposure. You own the decision, and you own the consequences of it.

Data protection is the part that gets skipped

Every automation project in a brokerage is also a data project. You hold income details, bank statements, credit information, health information where protection is involved, and sometimes information about a client's personal circumstances that they would be very unhappy to see loose.

Work through the basics before you connect anything.

• Know where the data physically goes and who else can see it. "Cloud" is not an answer.
• Check whether the vendor uses your client data to train or improve their models, and whether you can switch that off.
• Have a written processing agreement with anyone handling personal data on your behalf.
• Assess whether the processing is high risk enough to need a formal impact assessment before you start, rather than after.
• Know how you would extract or delete a client's data if they asked.
• Make sure your privacy notice honestly describes what now happens.

The ICO publishes accessible guidance on all of this. Read it directly rather than relying on a summary.

Vulnerability and automation pull against each other

Automated journeys are efficient because they assume a standard client. Vulnerable clients are, definitionally, the ones the standard journey does not fit.

A portal that will not proceed without a document the client cannot obtain, a reminder sequence that keeps firing at someone in financial distress, a chatbot that cannot recognise a bereavement mentioned in passing — these are the characteristic failures. Design an escape route into every automated sequence: an obvious way to reach a person, and a rule that a human takes over as soon as certain signals appear.

Also make sure your automation is capable of recording a vulnerability disclosure properly, so that the next person to touch the case knows without the client having to explain again.

Practical guardrails worth writing down

• Nothing that constitutes advice or a recommendation is produced without an adviser reviewing and adopting it.
• Anything drafted by a tool and sent to a client is identifiable as such in the audit trail, with the reviewer named.
• Every automated action writes a log entry a file checker can read.
• Automations have an owner. When they break, someone specific is responsible for noticing.
• There is a documented way to turn each automation off quickly.
• Client-facing automated messages are reviewed for clarity, not just accuracy.

Where to start

Pick the step in your process that is most repetitive and least contentious — usually document collection or status notification — and automate that first. Watch what it does to your file quality for a month. Then look at the exceptions it created, because the exceptions are where the compliance risk actually lives.

Nothing in this article is compliance advice. It is a way of thinking about the problem before you talk to your compliance support, so that the conversation starts from something concrete.