The compliance cost of bad data: Are you doing enough before collections?

On a dashboard, it might all look fine. CRA feeds are in place. Your engagement steps are logged. Escalation rules are ticking over. If the regulator asked for a process walkthrough, you could show them one.

But the FCA isn’t asking what your process is. They’re asking how confident you are in the data that drives it.

If the information you’re working from is out of date, such as a phone number, an employment record, or even a missed vulnerability flag, then whatever comes next may not be defensible.

That’s the compliance cost of bad data. Not a dramatic system failure. Just small, invisible gaps that quietly accumulate risk. Until the FOS gets involved, or redress is on the table. Or your next audit throws up a string of questions you’re not quite equipped to answer.

So yes, the collections process might be working. But the bigger question is: can you prove it’s working fairly, consistently, and with the right data behind it?

If the answer is ‘probably’, it might be time for a closer look.

 

Bad data is a regulatory liability

It’s easy to think of poor-quality data as a performance issue. Lower contact rates. Slower resolutions. More accounts escalated than necessary. But that’s not the real risk. The real risk is what happens when someone asks why this customer ended up at a DCA? Why was there no affordability check? Why wasn’t vulnerability flagged earlier?

And all you have to show is a half-validated contact number and a missed signal from six months ago.

From a compliance perspective, that’s a huge red flag.

Because under Consumer Duty (and Principle 6 before it), the expectation isn’t just that you try to engage. You need to make a reasonable, documented, and fair attempt based on accurate information. Not old records. Not assumptions. Not legacy bureau data that hasn’t been refreshed since onboarding.

The regulator doesn’t expect perfection. But they do expect relevance. They expect to see that your decisions were informed by a current view of the customer, not just a template process.

And to be honest, that’s where a lot of collections strategies still fall short.

 

What compliance actually looks like before escalation

You already know Consumer Duty expects firms to “deliver good outcomes” and “treat customers fairly.” But in practice, that’s being interpreted through a very specific lens, especially in collections.

What did you know about the customer at the time?
What actions did you take, based on that knowledge?
Can you prove it?

That’s the bar set.

So if a customer was passed to a DCA without verified contact details, without evidence of vulnerability screening, or without a fair attempt to offer support, it doesn’t matter that your process said to escalate on day 90. It’s not defensible.

Here’s the kind of evidence firms are increasingly expected to have:

• A log of contact attempts using validated channels 
• A record of current employment or income status (not six months old) 
• Indicators that show vulnerability was either flagged or ruled out 
• Notes or audit trail showing the rationale for escalation 

 

If any of those are missing, or worse, built on assumptions, you’ve got exposure.

The FCA has already said poor pre-escalation data quality is contributing to consumer harm. It’s showing up in complaints. It’s influencing redress decisions. And it’s raising questions about whether creditors are doing enough before handing debt off to someone else.

That’s why a defensible data trail matters just as much as recovery outcomes. Maybe more.

 

Where traditional data starts to break down

Let’s be clear, this isn’t about blaming the CRAs. Their data has a role to play, and it’s a valuable one. But it was never built to tell you who picked up a second job last week, or who just applied for a loan to cover their energy bill.

And yet, that’s exactly the kind of insight you need if you’re trying to engage fairly before escalation.

Here’s where the cracks tend to appear:

• Contact details that haven’t been validated in months
  Maybe the phone number’s still active. Maybe it’s not. You won’t know until the call fails and at that point, you’ve already missed a chance to engage. 
• No visibility of employment or income changes
  If someone’s circumstances have changed recently, such as a new job, reduced hours, or multiple income streams, you’re not going to see that in static bureau data. And without it, affordability decisions become guesswork. 
• Missed indicators of financial stress
  High-cost loan applications. Borrowing for essential expenses. Repeat requests for short-term credit. These are the early signs of vulnerability that rarely show up in traditional credit files, but they’re exactly what regulators expect you to monitor. 
• No link between data and decision-making
  Even when data does exist, if it’s not being surfaced in a usable way, such as being tied to actions, tracked over time, logged in a way you can show, then it doesn’t count. 

 

And that’s the problem. Relying on traditional data alone gives the illusion of visibility, when in fact, you’re missing key context. The kind of context that makes the difference between a justified escalation and a compliance breach.

 

What FinTrace adds and why it matters before collections begin

FinTrace was built for exactly this stage in the journey, the bit between early arrears and escalation, where the right data can still change the outcome.

Here’s what it brings to the table:

• Real-time contact validation
  You’ll know whether the number or email on file is still active and what to use instead, if it isn’t. That one shift alone can boost right-party contact rates and stop the cycle of failed engagement. 
• Up-to-date employment and income insights
  Instead of relying on outdated records or waiting for self-disclosure, you’ll get a current view of someone’s employment status, income trends, and change of circumstances. The insight you need to make a fair affordability decision. 
• FCA-aligned vulnerability indicators
  FinTrace flags signals like short-term borrowing for bills or frequent credit applications, which are signs of financial stress that align with the FCA’s own vulnerability characteristics. So when you act on that information, it’s grounded in exactly what the regulator is looking for. 
• A usable, reportable data trail
  Every contact, every flag, every attempt is all logged. Not buried in a spreadsheet, but ready to show that your decisions were informed, timely, and appropriate. 

 

So that if and when questions are asked by a regulator, by the FOS, even internally, you’ve got a clear line from data to decision.

That’s what defensibility looks like in 2025.

 

What’s at stake if you don’t close the gap

Sometimes the hardest part of this conversation is that perhaps nothing’s gone wrong yet. No complaints. No FOS rulings. No public enforcement.

But that’s kind of the point.

Most compliance failures don’t look like failures until someone starts asking questions. Until a customer says they weren’t treated fairly. Until an auditor can’t see how you assessed vulnerability. Or until the regulator decides to dig.

And at that stage, it’s not enough to say “we tried.”

You’ll need to show:

• That you had the right data, not just some data 
• That decisions were made based on what was known at the time, and that what was known was accurate 
• That escalation wasn’t a default; it was the right next step 

 

If you can’t show that, the risk isn’t just theoretical. It’s reputational. Financial. Operational. And once it starts, it rarely stops at one case.

So the question isn’t whether you have a collections process. You already do. It’s whether the data behind it is strong enough to hold up under pressure, under scrutiny, and under a regulator’s spotlight.

And if there’s even a small doubt, now’s the time to test it.

Start with a data audit. Or run a Proof of Value project with FinTrace to see exactly where your blind spots are and what it looks like when you close them.