Buying finance leads can look like a simple media purchase: agree a price, set an acceptance rule and wait for enquiries to arrive. For a credit broker, however, the lead is the end product of a customer journey that has already begun. The advert, landing page, consent wording, data collection and hand-off may all affect what the customer understood and whether the resulting contact can be used lawfully.

The commercial contract matters, but it is not the due-diligence file. Before buying a single lead, a broker should be able to reconstruct how the person was attracted, what they were told, what they agreed to and what activity the supplier actually performed.

This is particularly timely after changes to the FCA's lead-generator rules in CONC 8.9 took effect on 31 July 2026. Those specific rules apply to firms accepting leads for debt counselling, debt adjusting or credit information services, not automatically to every credit-broking lead purchase. Even so, their emphasis on checking websites, advertising, commercial practices, ICO registration and PECR processes is a useful regulatory benchmark. It shows the direction of travel: a supplier invoice is not evidence that the customer journey was sound.

Start with the activity, not the supplier's label

A business calling itself a publisher, affiliate, introducer or lead generator does not settle the regulatory perimeter. FCA guidance explains that credit broking can include introducing an individual seeking credit to a lender or to another broker, presenting or offering an agreement, or carrying out preparatory work.

The first review should map what the supplier does in practice:

• Does it merely display an advert, or does it qualify the customer?
• Does it recommend a product, lender or route?
• Does it collect information that shapes eligibility or the application?
• Does it make an introduction to the broker or directly to a lender?
• Does it communicate a credit-related financial promotion?
• Does it receive payment for an introduction or another regulated step?

Compare that activity map with the supplier's FCA status, permissions and any appointed representative relationship. Check the Financial Services Register and keep dated evidence. If the model depends on an exclusion or on genuinely passive activity, record why the facts fit it. A contract saying “unregulated introducer” cannot turn regulated activity into an unregulated one.

For the wider perimeter analysis, see our guide to whether a credit-broking business needs FCA permission.

Rebuild the customer's first journey

Ask the supplier to show the complete live journey for each traffic source, device and campaign. Screenshots are useful, but a recorded walkthrough is better because disclosures can appear late, behind accordions or only after a customer has entered personal information.

The review should cover the advert, affiliate page, landing page, form, privacy information, consent statement, confirmation screen and every email, SMS or call script used before hand-off. It should be clear who is communicating, whether the firm is a broker or lender, the nature of the service, any known lender identity, what happens next and who may contact the customer.

CONC requires credit-broking promotions to be clear, fair and not misleading. Credit brokers must not blur their role with that of a lender, and the legal name and status disclosures must work in the real presentation, not merely exist in a footer that nobody sees.

Do not approve a journey only once. Paid-search copy, comparison tables and affiliate pages can change quickly. The contract should require approval before material changes and give the broker audit access to live versions.

Test the consent chain, not just the data file

A spreadsheet containing a timestamp and an IP address does not prove valid consent. The broker needs the wording shown to the individual, the channel covered, the organisations named or described, the purpose of the contact and the date on which the wording was used.

Current ICO guidance says organisations using bought-in lists should check their origin and accuracy and satisfy themselves that the details were collected fairly. For email, text and recorded calls, the consent normally needs to be sufficiently specific to cover the receiving business. Telephone campaigns may also require screening against the Telephone Preference Service, depending on the circumstances.

Build these checks into acceptance testing:

• Can the supplier produce the exact consent record for a sample lead?
• Did the notice identify Authorised Compliance's client or a sufficiently specific category, rather than an indefinite list of “trusted partners”?
• Did the person choose the contact channel?
• Is the consent recent enough for the intended use?
• Can opt-outs and objections be passed through promptly?
• Are suppression lists used so rejected contacts are not resold later?

The buyer remains responsible for its own use of personal data. A warranty from the seller helps allocate contractual risk, but it does not supply the missing lawful basis.

Check the promotion and approval route

Identify every promotion that generated the lead and who was responsible for it. If an unauthorised supplier communicates material on behalf of an authorised broker, confirm the lawful approval or communication route and the scope of the broker's controls.

Review the whole impression created by the promotion. Common warning signs include guaranteed or near-certain acceptance, invented urgency, unsubstantiated “best rate” claims, lender-style branding, unclear panel limitations and a prominent application button paired with a barely visible broker disclosure.

The FCA's 2026 consultation on simplifying parts of CONC 3 does not remove the current rules while policy is being considered. It also reinforces a broader point: customer understanding and evidence matter more than a compliance team collecting approved screenshots after the event.

Ask whether the leads fit the target market

Cheap leads are expensive when the campaign attracts people for whom the service or available products were never designed. Before launch, agree the intended audience, exclusions, geography, product type and any vulnerability considerations. Then test whether the supplier's targeting and creative match them.

Consumer Duty responsibilities depend on each firm's role and influence in the distribution chain. Firms are generally responsible for their own activities, but they also need to share relevant information and act if they identify foreseeable harm elsewhere in the chain. For a broker buying leads, that means monitoring whether a source repeatedly produces confusion, unsuitable traffic or poor outcomes, rather than treating conversion rate as the only truth worth measuring.

The evidence pack to obtain before go-live

A proportionate onboarding file should contain:

• the supplier's legal entity details, ownership and trading names;
• FCA Register checks, permissions and principal details where relevant;
• ICO registration and data-protection contact details;
• a written activity and perimeter assessment;
• live customer-journey captures for every material source;
• financial-promotion approvals and version control;
• privacy notices, consent wording and sample consent records;
• sub-affiliate and subcontractor disclosure;
• data-flow and security information, including retention and deletion;
• complaints, opt-out and suppression processes;
• target-market and campaign rules;
• quality thresholds, rejection reasons and remediation timescales; and
• audit, suspension and termination rights.

Sub-affiliates deserve particular attention. A supplier may present a polished owned website while most traffic comes from publishers the broker has never seen. Require a current source register, approval before new sources go live and the ability to trace every lead back to its originating journey.

Monitor outcomes by source

Onboarding is a snapshot. The useful control is a monitoring loop that connects source, customer understanding and outcome.

Track complaints, consent disputes, duplicate rates, contactability, customer confusion about broker or lender status, rejection reasons, vulnerability indicators, drop-off after key disclosures and lender feedback. Compare sources rather than blending everything into a single conversion number.

Set triggers for investigation and suspension. A lead source that converts well but generates repeated “I did not ask for this call” complaints is not high quality. It is a warning with an attractive dashboard.

Retest live journeys periodically and after any material change. Keep the evidence of what was reviewed, who approved it, what was found and what changed as a result.

A practical decision rule

Do not buy the lead unless you can answer four questions with evidence:

1. Who generated it? The legal entity and every material sub-source are known.
2. What did they do? The activity sits within the correct regulatory perimeter and permissions.
3. What did the customer understand and agree to? The live promotion, journey and consent record support the intended contact and data use.
4. How will you know if outcomes deteriorate? Monitoring, escalation and termination controls operate by source.

Buying finance leads is not inherently incompatible with good credit-broking practice. Buying a customer journey that nobody has examined is the problem. Authorised Compliance can help firms map lead-generation activity, review promotions and consent journeys, build supplier due diligence and turn lead-source monitoring into evidence that management can actually use.

This article provides general compliance information and is not legal advice. Regulatory and data-protection analysis depends on the precise activities, parties, communications and customer journey.