Call Centres Philippines: The 2027 Outsourcing Guide for Regulated UK Tech Scale-Ups

Britain’s fastest-growing technology companies share a problem they rarely discuss outside the boardroom. A fintech with 80 staff is held to the conduct standards of a high-street bank. A healthtech platform with 40 is expected to safeguard patients like an NHS trust. Their customers want expert help at midnight, and building that capability in London is slow and expensive.

For a growing number of them, the answer is call centre outsourcing to the Philippines. The reason has changed, and so has the contract. The agreements being drafted for 2027 look different from those of a decade ago.

Why has the Philippine call centre industry moved beyond pure cost arbitrage?

UK buyers now pay for specialised, regulated capability rather than the lowest cost per seat. The industry has shifted from high-volume voice queues to complex, knowledge-based work.

For two decades “offshoring to the Philippines” was primarily labour arbitrage. That model was rarely suitable for firms handling disputed payments or patient triage, and fewer providers now lead with pure cost.

The wider business process outsourcing (BPO) industry is forecast to reach roughly $42bn (£32bn) in export revenues and nearly 1.97 million people in employment in 2026, with growth in complex, knowledge-based work rather than tier-one volume. The buying motive has shifted with it. Deloitte’s April 2026 analysis of more than 500 global business and technology executives found that 67% of organisations have adopted outcome-based outsourcing models (up from 45% two years earlier), while 92% are integrating or planning to integrate AI into service delivery. The shift reflects a move from pure cost reduction toward agility, specialist talent and measurable results.

“The industry a British founder pictures is a decade out of date,” says John Maczynski, chief executive of PITON-Global and former global executive vice-president at the world’s largest contact centre company. “The cost advantage is still there. It stopped being the point some time ago.”

Why do UK tech scale-ups need compliant call centre services in the Philippines?

In a regulated business the support desk is also a compliance function, and every chargeback, claim and clinical escalation it handles becomes evidence a regulator may later read.

Early in my career I sat in on quality reviews for a London payments client. The agents were polite and quick. When a cardholder reported a transaction they did not recognise, the usual outcome was to block the card and close the ticket as “query resolved”.

Blocking the card helps contain the immediate risk, but the firm must still handle the disputed payment and meet any applicable reimbursement obligations. The same call may also reveal patterns – such as a rapid series of unusual transfers – that give grounds to suspect money laundering and require escalation to the firm’s Money Laundering Reporting Officer. The MLRO determines whether a Suspicious Activity Report must be submitted to the National Crime Agency under the Proceeds of Crime Act 2002. The reviews showed no reliable way to identify or escalate those concerns. Every unrecognised transaction was treated the same.

That is what a generic call centre costs a regulated business. The desk I would want handling a disputed £4,000 transfer at 11 pm on a Friday is built differently.

Routine queries resolve automatically. Anything scored high-risk goes to a specialist with the policy already on screen, and a Severity 1 incident wakes the client’s own engineers or clinicians. The same pattern holds across the sectors below.

How does the AI-human operating model work in a regulated call centre?

Software handles volume, context and risk scoring; people handle every decision with a regulatory or safety consequence.

Removing people from high-consequence decisions is a risk many founders still underestimate. Customers have already settled this argument. Gartner surveyed 3,566 customers in early 2026 and found that half said generative AI made their interactions easier, while 87% called it essential to be able to reach a person. The desks that get the balance right use AI to prepare the human. In a fintech queue it scores transaction velocity and surfaces the policy before the agent answers. In healthtech it spots acute symptoms in a chat and routes the message to a clinical lead before a non-clinical agent types a word. In travel it assembles every leg of a disrupted itinerary, with the UK261 position, so one specialist can rebook and settle the claim.

“AI makes your strongest people faster and better informed,” Maczynski says. “It carries the volume and the context so the human can own the judgement call.” By 2027 the board-level question will be who answers the fourth message, once AI has handled the first three.

What regulatory obligations stay with the UK board when outsourcing to the Philippines?

A UK firm can move the work to Manila. The legal accountability stays in London.

Outsourcing requirements vary by firm type and the function being outsourced. For many authorised firms, SYSC 8 of the FCA Handbook requires due diligence, a written agreement, rights to inspect the provider’s books and premises, exit arrangements and a named senior manager who remains responsible. Payment institutions and electronic-money institutions operate under their own specific frameworks. Material arrangements are typically notified to the FCA before they start, and firms within the operational-resilience rules must show that a disruption offshore stays inside their impact tolerances. The Consumer Duty adds an outcomes test: customers must receive clear communication, fair value and proper support when vulnerable, and the board must be able to evidence it.

From 18 March 2027, in-scope firms will also face the FCA’s new operational-incident and material third-party reporting rules. Buyers should require their Philippine partners to provide timely, structured information on incidents and material outsourcing arrangements so the UK firm can meet its own reporting obligations.

The Philippines has no UK adequacy decision, so personal data travels under the International Data Transfer Agreement or the UK Addendum to the EU standard clauses, backed by a written Transfer Risk Assessment. Card data brings the desk inside PCI DSS scope. The current standard is v4.0.1. An existing Attestation of Compliance against v4.0 is not automatically invalidated by the version’s retirement; validity is determined by the relevant compliance programme. Patient data does not automatically trigger Care Quality Commission standards or the NHS Data Security and Protection Toolkit. Those apply when the firm carries on a regulated activity in England or accesses NHS patient data and systems. On the Philippine side, Republic Act 10173 requires a registered data protection officer and breach notification to the National Privacy Commission within 72 hours for qualifying breaches.

None of this is exotic. It is the control environment a UK firm already runs at home, extended across eight time zones.

How do you choose a call centre partner in the Philippines?

Only a minority of the more than a thousand providers can run a regulated UK desk, and they are harder to identify from London.

When a founder asks me for a shortlist, I ask which providers they have already found. The names are nearly always the same four or five, and rarely the ones I would trust with a regulated fintech queue. I found the operators I rely on over 25 years of walking floors in Makati, Ortigas and BGC and sitting with their quality teams. The strongest ones win on results and spend relatively little on marketing.

Before signing, put every shortlisted provider through six questions:

1. Which regulated UK or EU accounts do you run today, and under whose oversight?
2. Can you show a live AI-to-human handover on a high-risk scenario, rather than a recorded demo?
3. What are the average tenure and annual attrition rates on your comparable technical queues?
4. Can you produce current PCI DSS, Transfer Risk Assessment and, where relevant, NHS DSPT evidence now?
5. What happens when a Severity 1 incident needs our on-call engineer at 3 am London time?
6. What are the terms for data deletion and knowledge transfer when we leave?

A weak answer to any of them ends the conversation.

What is the bottom line for UK tech leaders planning 2027?

Across engagements I have advised, fully loaded costs for a regulated desk in the Philippines have typically run 50 to 60 per cent below the cost of building an equivalent team in the UK.

The prize is enterprise-grade support, AI-enabled and compliance-ready, delivered by people who understand what a mishandled call costs. The leaders who plan their 2027 operations around that model will treat the support desk as part of their control environment and choose a Philippine partner on that basis. Those who prioritise cost alone will carry a higher risk that gaps only surface under regulatory scrutiny.