When an approved lead source starts producing warning signs, a credit broker needs more than another report. Reliable comparisons, targeted investigation and clear stopping powers determine whether customers remain exposed, and whether restarting the source is justified.
The supplier passed due diligence. The contract is signed, the landing page was approved and the first month looked healthy. Then customers start asking why the broker has their number. The supplier says nothing has changed. Sales says the source is too important to lose. This is where lead source monitoring becomes a management decision rather than a reporting exercise. Does the broker keep accepting enquiries while it investigates, restrict one campaign, or stop the source altogether? And what would justify switching it back on?
The FCA’s outcomes-monitoring review, published on 27 July 2026, offers a revealing example. A firm examined rejected applicants, found that some distribution channels attracted people unsuitable for its high-risk products, and ended two paid affiliate relationships. This was not a finding about ordinary credit broking, nor a new rule requiring brokers to copy those firms’ financial tests. It illustrates monitoring that changed a commercial relationship. For a credit broker, the difficult part often comes after the first warning: establishing what changed, containing the risk without abandoning customers, and deciding whether the evidence supports a restart. FCA outcomes-monitoring review.
This article concerns UK regulated consumer credit broking within the Consumer Duty’s scope. It is not a template for mortgages or all business lending. Responsibilities depend on the firm’s activities and influence over outcomes, not simply its position somewhere between an advert and a loan. The Duty does not require a broker to undertake another regulated activity it would not otherwise perform. FCA Handbook, PRIN 2A.1. The binding rules already require regular outcomes monitoring, processes to identify root causes, and appropriate action where the conditions in PRIN 2A.9.12R are met. Those conditions include risks to required outcomes, not just harm that has already produced a complaint. FCA Handbook, PRIN 2A.9.
For brokers acting as distributors, PRIN 2A.3.19R requires regular review of distribution arrangements. Where a review identifies an issue, PRIN 2A.3.20R requires appropriate amendments, action to mitigate identified harm and prevent further harm, and prompt information to relevant distribution-chain participants about action taken. FCA Handbook, PRIN 2A.3. The operational controls below are illustrative ways to apply those obligations, not FCA-prescribed reporting fields, numerical thresholds or restart procedures. The starting point is an already approved source. Our finance-lead due diligence guide deals with the earlier admission decision.
Consider a hypothetical broker reviewing two weekly intake cohorts after the same seven-day observation period. The first contains 1,000 unique leads. Staff have reached 200 people, eight of whom complain that they did not expect the contact. The second contains 3,000 unique leads. Staff have reached 300 people, with 12 equivalent complaints. Divide complaints by leads received and the rate falls from 0.8% to 0.4%. Divide by people actually reached and it remains 4%. The apparent improvement disappears. More people have complained, while a larger share of the second cohort has not yet been reached. None of these figures, alone, establishes the cause or prevalence of a compliance failure.
The broker needs both views, accurately labelled. Complaints per received lead can describe the intake’s emerging experience; unexpected-contact complaints per unique person reached answer a narrower question about actual contact. Neither should be divided by call attempts, which can multiply without adding a single customer. People not reached are an unknown population, not satisfied customers. The same discipline applies elsewhere. A lender decline rate needs a defined application population and a distinction between decided and pending cases. A duplicate-submission rate needs to say whether it counts repeated records, repeated individuals or repeat submissions within a stated period. A consent-evidence failure rate from a targeted investigation sample cannot honestly be presented as the failure rate across the whole source.
For operational use, retain the event count beside the percentage, the population included, exclusions, cohort dates and observation cut-off. Keep submitted records distinct from unique customers and accepted leads. Otherwise a supplier can appear to improve because the broker rejects more records before they enter the reported population. Source identity also needs to survive the journey. If several publishers sit behind one supplier, supplier-level results may conceal a deteriorating sub-source. Preserve the originating campaign and journey version where available, together with subsequent routing. An unexplained change in the proportion of leads with missing origin data is itself a reason to investigate.
Time creates another flattering distortion. A cohort received yesterday has had little opportunity to complain, abandon an application after clarification or receive a lender decision. An older cohort has accumulated those experiences. Comparing their lifetime rates rewards the newer source for events that have not happened yet. A useful approach is to compare cohorts at equivalent ages while retaining a separate view of everything known today. The chosen observation windows should reflect the journey and the time an indicator takes to emerge. Seven days in the hypothetical example is a measurement choice, not a regulatory timetable or a claim that all relevant outcomes appear within a week.
Keep occurrence dates separate from reporting dates. A complaint arriving in November may concern an October enquiry. Feedback delivered late by a lender belongs to the relevant application cohort, while the reporting delay deserves its own visibility. Quiet reports can mean quiet customers. They can also mean a broken feed. Later lending outcomes, where relevant and lawfully available, may help investigate distribution concerns. They do not make the broker the lender’s underwriting department. CONC 5.2A applies to consumer credit lending and addresses creditworthiness, including affordability risk. A broker should examine what its own targeting, information and routing contributed without treating a decline as proof of harm or an approval as proof of good broking. FCA Handbook, CONC 5.2A. If downstream information is unavailable, record the gap and its effect on the decision. Seek useful, proportionate feedback rather than inventing a complete customer-outcome picture from conversion data.
Suppose, continuing the hypothetical example, unexpected-contact complaints cluster around one publisher’s mobile journey after a particular date. The investigation now has a shape. It can compare the actual page versions, the hand-off wording and the contact records for affected enquiries, rather than asking the supplier whether its business is generally compliant. Trace individual cases backwards. What did the customer see? Which organisation did they expect to hear from? What request or permission supported the contact? Which system received the record, and when? A screenshot of today’s repaired page cannot establish what yesterday’s customer encountered. Preserve relevant historical evidence before routine changes overwrite it.
Trace the cases forwards as well. Did the broker’s own confirmation message create confusion? Did a dialler retry too often? Did an internal mapping change replace the original campaign identifier? Did a lender alter eligibility criteria, increasing declines across several unrelated sources? A source-level warning is a starting point, not a verdict against the supplier. Combine affected-case reviews with a separately identified comparison sample. A complaint-led sample is useful for finding a mechanism but biased for estimating frequency. Compare similar products, campaign periods and journey versions, and keep uncertainty visible where numbers are small. One serious, credible case can justify protective action even when the percentage looks statistically unremarkable.
Check who is affected without making vulnerability a reason to exclude customers automatically. The question may be whether a source’s explanation or the broker’s support fails particular needs. Use information necessary for that purpose, with appropriate access and lawful processing arrangements. Monitoring does not justify collecting sensitive personal details simply because another reporting column might be useful. ICO data-minimisation guidance.
Not every movement requires suspension. A modest fluctuation with a credible explanation may justify closer observation. Repeated customer confusion after a journey change, missing evidence supporting contact, or an inability to identify affected traffic may require containment before the investigation concludes. The decision should reflect severity, credibility, reach and continuing exposure. A single substantiated systemic defect may matter more than several minor service complaints. An internal tolerance is a prompt for judgement, not permission to continue harmful activity until a counter reaches the chosen number. The FCA’s published examples do not supply a universal acceptable complaint rate or a mandatory percentage at which credit brokers must stop a source.
Containment can be narrower than ending the commercial relationship. A broker might stop a particular publisher, withdraw one campaign or prevent a disputed batch from entering outbound marketing. But a narrow restriction is credible only if the systems can reliably identify and isolate it. If the supplier cannot distinguish affected traffic, confidence in a campaign-only pause may be misplaced. Define what stops. New acquisition, receipt of records, outbound contact and onward referral are different operations. Switching off an advert does not empty a dialler queue. Blocking one source code does not help if the same publisher can send through another. Check scheduled messages, retries, cached records and alternative routes, then verify the restriction in the operational logs.
Existing customers need a separate decision. Some may be midway through a legitimate application or waiting for an explanation. A protective pause should not strand them without support. Distinguish stopping questionable acquisition or marketing from providing necessary, lawful assistance, and decide how pending cases will be reviewed. Give the decision an accountable owner and a route for urgent implementation. In an appointed representative model, the arrangement must also reflect the principal’s responsibility for the business it has accepted. A supplier’s reassurance cannot replace that judgement. FCA Handbook, SUP 12.3.
If the investigation exposes weak marketing permission, moving from calls to texts is not a harmless workaround. The applicable rules depend on the communication, whether it was specifically requested and the subscriber type. For unsolicited marketing emails or texts to individual subscribers using bought-in lists, the ICO requires valid consent covering the receiving organisation and the relevant method. Generic references to trusted partners are insufficient. The buyer cannot borrow the seller’s soft opt-in. That distinction matters when a supplier proposes sending replacement leads with the same defective evidence. ICO electronic-mail marketing guidance.
Most live marketing calls follow a different PECR framework. Previous objections and the TPS or CTPS matter, including the exception where the subscriber has specifically notified the caller that they do not object to its calls. A specifically requested call is different again. Do not declare every disputed call unlawful merely because an email-style consent record is absent; establish the facts and the relevant requirements. Data protection duties remain alongside PECR. ICO live-call guidance. Operationally, separate records withheld while evidence is investigated from people who have objected to marketing. Preserve and apply the relevant suppression controls. A later supplier upload or a renamed campaign should not quietly reintroduce someone whose preference the broker already knows.
A supplier reporting that the page is fixed answers only one question. It does not establish which customers saw the earlier version, whether queued contacts remain affected, or whether the change works across every route carrying the source’s traffic. Before restarting, define what would demonstrate that the identified cause has been addressed. In the hypothetical publisher case, that could include verified live wording, traceable journey versions, usable evidence supporting the intended contact, and tests showing that affected historic records cannot enter the resumed campaign. These are suggested controls, not a standard FCA reopening certificate.
Where the defect is corrected and the remaining risk justifies it, a restricted restart may provide evidence about the repaired journey. Limit it to verified routes, retain the ability to stop promptly, and decide in advance who reviews the results. Reduced volume does not make a known unlawful practice acceptable. Nor should customers become test subjects for a defect the firm already knows remains unresolved. Compare the resumed cohort with the affected cohort on equivalent definitions and observation windows. If contact volumes have fallen sharply, fewer complaints may demonstrate less exposure rather than better experience. If the source has changed its audience, an improvement may reflect a different customer mix. Both can matter, but neither proves that the original failure was repaired.
An absence of early complaints is particularly weak evidence when contact itself has barely resumed. Look for the direct signs the repair was intended to change: customer understanding in sampled conversations, reliable origin records, correct suppression and the elimination of the identified hand-off defect. Continue tracking slower outcomes as the cohort matures. Restart approval should state its limits. Who can increase volume? Which change would require another review? What evidence would stop routing again? A temporary restriction that disappears through an informal sales instruction was never much of a control.
A useful case record allows someone outside the original discussion to reconstruct events. It identifies the signal, the affected population, the evidence and its limitations, the alternatives considered, the decision-maker and the time each restriction took effect. It then connects the repair and restart conditions to later findings. Retain the reporting definitions and extracts used for the decision. A chart rebuilt next month may contain more mature outcomes and make an earlier judgement look obvious in hindsight. The question is what the broker knew, what it reasonably needed to investigate and how it responded at the time.
Remediation also looks backwards. Where the firm identifies foreseeable harm caused by its acts or omissions, appropriate action can include redress. PRIN 2A.10 addresses investigation and remedies, including where customers have not complained. Fixing tomorrow’s campaign does not settle yesterday’s customer impact. FCA Handbook, PRIN 2A.10. Keep regulatory notification separate from the commercial stop decision. PRIN 2A.9.17R requires notification where a firm in a distribution chain becomes aware that another firm in that chain is not, or may not be, complying with the Duty. That is not a rule to report every disappointing supplier metric; Principle 11 also remains relevant. FCA Handbook, PRIN 2A.9.
Our article on why a Consumer Duty dashboard is not evidence explains the broader evidential problem. Here, the practical test is narrower: can the broker show why this source was allowed to continue, why it was stopped, and why it was trusted again? Authorised Compliance Ltd helps credit brokers turn monitoring into workable reviews and actions. The most revealing entry in a source-monitoring record may not be a percentage. It may be the time somebody decided that the next customer should not enter the same defective journey.
I’m Will Hurst, and I bring 20+ years of hands-on experience across credit broking, AR/IAR oversight, lender relationships and regulated finance operations.
Learn more about my practical, FCA-focused approach