Sales calls · Disclosures

WorkflowFinancial services sales

Checking every sales call for disclosures, consent and risk warnings

Disclosure failures are binary: the words were said or they were not. This playbook builds one workflow that checks every sales call for them and sends the misses to a person within the day.

Valnora & Elric team30 September 20264 min read

Format: Playbook
Steps: 6
Solution: Workflow
Parts used: 5

Some call checks need judgement, such as whether an agent treated a customer fairly. Disclosure checks mostly do not. Either the agent told the customer the call was recorded, or they did not. Either the capital at risk warning came before the product pitch, or it did not.

Because the answer is usually clear, these checks suit an AI agent that reads every call. This playbook builds one workflow in the Agent Serve workflow builder that does exactly that, and hands every miss to a person.

List the disclosures your calls must contain

Start from your call scripts and compliance manual, not from the model. Write each required disclosure as one plain-English check, for example:

Recording notice. The agent tells the customer the call is recorded, before discussing any product.
Marketing consent. If the agent asks to contact the customer about other products, the customer’s answer is clear and recorded.
Risk warning. For investment products, the capital at risk warning comes before the product summary.
Costs. The agent states the main charges before the customer agrees to proceed.

Rules vary by regime. In the EU, MiFID II’s record-keeping requirements cover recording relevant telephone conversations and telling clients those calls are recorded. In the UK, SYSC 10A in the FCA Handbook carries the same duties and sets how long recordings are kept. In the US, the TCPA and the FCC’s rules under it set consent requirements for many telemarketing calls. Your compliance team decides which checks apply to which calls.

Give each check a severity and a scope

Not every miss is equal. Mark each check low, medium, high or critical, and say which calls it applies to, by product, call direction or campaign. A risk warning check on a call about a savings account should come back "not applicable", not "fail".

Store the checks, the exact script wording and your scope notes in a Knowledge Base. The workflow searches it on each run, so updating a script updates the checks without editing the workflow.

Build the workflow

One workflow from recording to flagged call

Workflow · Disclosure and consent check

01New recordingsA schedule or webhook picks up recordings from your call platform.
02Speech-to-TextTurns each recording into a text transcript the next steps can read.
03Mask personal dataA Guardrails block with PII detection masks card and account numbers.
04Check each disclosurePass, fail or not applicable per check, with the quote it relied on.
05Call check registerOne row per call and check, with the agent, product and result.
06Alert the QA teamA Condition block posts critical misses to a Slack or Teams channel.

Pick up recordings. A Schedule block runs every hour, or a Webhook trigger fires when your call platform finishes a recording.
Transcribe. The Speech-to-Text block turns audio into a transcript.
Mask personal data. A Guardrails block with PII detection masks card numbers, account numbers and similar details before the text goes further.
Check. An Agent block reads the transcript and the relevant checks, and returns pass, fail or not applicable for each, with the quote it relied on and its position in the call where the transcript records time.
Record. A Table block writes the results to a call check register in Tables.
Alert. A Condition block sends any critical fail to your QA channel through the Slack or Microsoft Teams block.

If you already have transcripts rather than audio, skip step 2.

Require evidence for every result

What the solution produces

Call check result (illustrative)

Record

Call: Outbound sales · investment ISA · 14 min 32 s
Recording notice: Pass at 00:06. "This call is being recorded for training and regulatory purposes."
Marketing consent: Not applicable. No marketing request on this call.
Capital at risk warning: Fail. No warning found before the product summary at 07:40.
Costs and charges stated: Pass at 08:55. "The ongoing charge is 0.45% a year."
Severity: Critical, because a required risk warning is missing.

Tell the Agent block to quote the words it relied on for every pass and every fail, or to state that it searched and found nothing. A result without evidence is a guess. A result with a quote and a timestamp lets a reviewer confirm it by listening to fifteen seconds of the call, not fifteen minutes.

Test against calls your QA team has already scored

Before switching it on, run the workflow over a few hundred calls your QA team has already reviewed. Compare results check by check. Where they differ, read the call. Most disagreements come from vague check wording, such as "mentions risk", which you fix in the Knowledge Base.

Deploy the workflow once the results agree well enough for compliance to sign off. Workflows run from a deployed version, so later edits are reviewed before they reach live calls, and every run is traced block by block in Logs.

Hand every miss to a person

The workflow flags. It does not discipline, re-contact customers or change sales records. A QA reviewer listens to each critical miss, confirms or overturns it, and decides on coaching or remediation, such as calling a customer back to give a missing warning.

Controls and governance

PII detection

A Guardrails block detects personal data and blocks or masks it before text reaches the next step.

Run logs

Every workflow run records each block’s inputs, outputs and errors, so a reviewer can trace how a result was reached.

Deployed versions

Workflows run from a deployed version, so a change is reviewed before it reaches production runs.

Roles and permission groups

Admin, write and read roles per workspace, plus permission groups that limit which models, blocks and integrations a team can use.

Row-level access

Row-level policies narrow what each person sees in tables, dashboards, exports and scheduled reports.

Self-hosting

Run Agent Serve in your own cloud or data centre, next to the systems it reads.

Zero data retention

Zero data retention with supported model providers, backed by your own provider keys and agreements or self-hosted models. Some provider features keep data by design, such as Gemini Deep Research, so they are outside zero data retention.

GDPR ready

Retention from one day to five years, deletion and access controls support GDPR obligations. Ready means the controls are in place, not a certification.

More on how Agent Serve handles access, data and audit on the security page.

For a dashboard view of the same results across teams and weeks, see call QA on every call, which uses a Call Compliance dashboard built with Dashboards. For signs that a customer on the call may need extra care, see vulnerable customer signals.

Request access All articles