Compliance monitoring in customer service means checking each conversation for the steps your rules require, such as identity checks, required disclosures and how card data is handled, and keeping the evidence. Done on a sample, it tells you a problem exists.
Done on every call, chat and email, it tells you which conversations were affected and lets you prove the rest were fine.
In short
- Compliance monitoring checks required steps on each conversation; quality QA judges how well the conversation went, and both can share one scorecard.
- A sample can show that agents miss a disclosure, but not which customers were affected, which is the question an auditor or regulator asks next.
- A compliance scorecard needs auto-fail checks for the steps that must never be missed and weighted checks for the rest.
- PCI DSS forbids keeping card verification codes after authorization, including in recordings, and some US states, California among them, require everyone’s consent to record a call.
- Six steps set it up, and the result is an evidence pack you can hand over when someone asks.
For the platform side, the page on customer service QA shows how Kaizo scores every conversation against your criteria, and the page on compliance and risk covers how compliance criteria sit on the same scorecard.
What is compliance monitoring in customer service?
Compliance monitoring in customer service is the review of support conversations against the rules a company must follow: laws, regulator requirements, card scheme rules and its own policies. It asks whether each required step happened, not how pleasant the conversation was.
It overlaps with QA but is not the same. QA asks whether the agent solved the problem well.
Compliance monitoring asks yes or no questions with consequences: was the customer verified, was the recording notice given, was the risk warning read, did a card number end up in the transcript. In regulated support, such as financial services or gambling, these questions decide whether you can defend a complaint.
| Quality QA | Compliance monitoring | |
|---|---|---|
| Question | How well was this handled? | Did every required step happen? |
| Scoring | Weighted criteria, a score out of 100 | Pass or fail per check, often auto-fail |
| Who asks | Team leads, QA, CX leadership | Compliance, auditors, regulators, card schemes |
| What a miss costs | A coaching moment | A complaint you cannot defend, a fine, a remediation exercise |
| Evidence needed | A score and a comment | The exact line in the transcript, kept for the retention period |
The two work best on one scorecard, so agents get one review and one standard. Our guide on auto-fail criteria explains how a single failed compliance check can zero a score without distorting the rest.
Why does sampling fail a compliance audit?
Sampling fails a compliance audit because it can estimate how often a step is missed, but it cannot tell you which conversations missed it, and that is what an auditor or regulator asks next.
Worked example (illustrative numbers, not Kaizo data). A contact center takes 30,000 calls a month. On 8,000 of them, payments and account changes, agents must read a required disclosure. Agents skip it on one call in 50 of those: 160 calls. QA reviews a random sample of 900 calls.
| Value | |
|---|---|
| Calls a month | 30,000 |
| Calls that need the disclosure | 8,000 |
| Calls where it was skipped | 160 |
| Calls reviewed | 900 |
| Expected skipped calls found in the sample | about 5 |
| Skipped calls nobody looked at | about 155 |
The sample does its job as a measurement: five misses out of about 240 calls that needed the disclosure tells you the problem exists.
Then the questions start. Which customers were affected? Was the call behind this complaint one of them? Did the miss happen on all teams or one? With a sample, you answer by listening to 8,000 calls after the fact. With every call scored, you filter on one failed criterion and have the list.
There is a second gap. The calls with the most compliance risk, a complaint, a vulnerable customer, a dispute about limits, are rare, so a random sample is least likely to contain them. The statistics behind this are in why a 3% QA sample cannot support agent-level decisions.
The checks a compliance scorecard needs
A compliance scorecard holds auto-fail checks for steps that must never be missed, such as identity verification and card data handling, and weighted checks for steps where a partial miss is possible. Each check must be answerable from the transcript.
Here is a starting set you can adapt. Replace the examples with the exact wording your rules require.
| Check | Example of a pass | Type | Evidence |
|---|---|---|---|
| Identity verified before account details | Agent asked the required security questions before discussing the balance | Auto-fail | The verification lines |
| Recording notice given | “This call is recorded for quality and training” at the start | Auto-fail where consent rules apply | The opening of the call |
| Required disclosure read | The approved risk warning, fee or terms statement, in full | Auto-fail | The disclosure line |
| No card data in the transcript | No full card number or security code written in chat or email | Auto-fail | Absence, checked on every message |
| No personal advice where not allowed | Agent gave information, not a recommendation | Weighted or auto-fail, per your rules | The relevant answer |
| Complaint recognized and logged | Agent named it as a complaint and followed the process | Weighted | The complaint and the next step |
| Vulnerability flagged | Signs of vulnerability noticed and handled per policy | Weighted | The customer’s words and the agent’s response |
| AI disclosure (AI agents) | The customer was told they were speaking with an AI | Auto-fail where required | The first message or greeting |
Write each check as one question with a yes or no answer, and name what counts as evidence. “Did the agent read the fee disclosure before taking the payment?” can be scored the same way on every call. “Was the agent compliant?” cannot.
PCI DSS, call recordings and QA
PCI DSS does not allow card verification codes to be stored after authorization, even if encrypted, and the PCI Security Standards Council says this covers audio recordings. QA should check that card data never lands in recordings or transcripts.
The details, from the source:
- PCI DSS Requirement 3.3.1 says sensitive authentication data is not stored after authorization, even if encrypted. The PCI SSC FAQ on audio recordings says storing card verification codes in any digital audio recording after authorization therefore violates it, that every effort must be made to prevent the data from being recorded, and that suppression or redaction should be enabled where the technology exists.
- If recording cannot be prevented, the FAQ says the data should be securely deleted once the transaction is authorized, with compensating controls if that is not feasible.
- PCI DSS v4.0.1 is the current version; the PCI SSC announced that v4.0 would be retired on December 31, 2024.
- PCI DSS does not override local laws on how long recordings must be kept, as the same FAQ notes.
What this means for QA in practice: the controls that keep card data out of recordings belong to your telephony and payment setup, not to QA. QA’s role is to check that they work on every conversation.
Score whether agents asked customers to read a security code aloud when the process says they should not, and whether a full card number appears in a chat or email transcript. Kaizo’s own compliance page uses “Card number shared” as an example of an auto-fail criterion.
US call recording consent rules
US federal law allows recording with one party’s consent, but some states require everyone’s consent, so most contact centers give a recording notice at the start of every call.
- Federal: under 18 U.S.C. § 2511(2)(d), it is not unlawful for a person not acting under color of law to intercept a communication when they are a party to it or one of the parties has given prior consent, unless it is done to commit a criminal or tortious act.
- California: Penal Code § 632 makes it an offense to record a confidential communication without the consent of all parties, with a fine of up to $2,500 per violation for a first offense.
- Other states: the Reporters Committee for Freedom of the Press lists about 11 states that primarily require all-party consent, and advises assuming the stricter state’s law applies when a call crosses state lines.
This is a summary, not legal advice; check the rules for every state and country you serve with your counsel. For QA, the step is concrete: make “recording notice given” an auto-fail check at the start of every recorded call, so you can show it happened on each one.
How to set up compliance monitoring for every call
To set up compliance monitoring on every call, list the rules, turn each into a yes or no check, add the checks to your scorecard, test the scoring, score everything, and review each failure.
Step 1: List the rules that apply
Work with your compliance team to list every rule that touches a support conversation: laws, regulator requirements, card scheme rules, your own policies. For each one, write down which conversations it applies to, such as payment calls, complaints or account closures.
Step 2: Turn each rule into one check
Write one yes or no question per rule, with the exact wording or behavior that counts as a pass and the evidence you expect. Decide which checks are auto-fail. Keep it short: a check nobody can score consistently is worse than no check.
Step 3: Put the checks on your QA scorecard
Add the compliance checks next to your quality criteria, so each conversation gets one review. Scope each check to the conversations it applies to, so a disclosure check does not fail a call where no disclosure was needed. Our guide on how to weight QA scorecard criteria covers how auto-fail and weighted criteria combine.
Step 4: Test the scoring before you rely on it
Score a set of past conversations by hand, with your compliance team, and compare the results with the automated or reviewer scores. Fix the checks where they disagree. This is the step that makes the results defensible.
Step 5: Score every conversation
Score all calls, chats and emails the checks apply to, with each result linked to the line in the transcript behind it. Our guide on QA score traceability explains why a score without its evidence is hard to defend.
Step 6: Review every failure
Route each failed auto-fail check to a person the same week. Decide whether it was an agent error, a process gap or a scoring error, act on it, and record what you did. Then look for patterns by team, queue and check.
See it in a live demo. Kaizo scores every conversation against your compliance criteria and links each score to the transcript. Let’s talk.
The evidence pack for an auditor or regulator
Show the rule, the check that tests it, the coverage, the failures and what you did about each one. An evidence pack with these five parts answers most compliance questions about support conversations.
Use this as a template:
| Part | What it contains |
|---|---|
| 1. Rule | The requirement, its source and which conversations it applies to |
| 2. Check | The scorecard question, what counts as a pass, and whether it is auto-fail |
| 3. Coverage | How many in-scope conversations were scored in the period, out of how many |
| 4. Failures | Each failed conversation, with the transcript line and the date |
| 5. Actions | What you did per failure: coaching, process change, customer remediation, and when |
If the question is about one conversation, such as a complaint, the same record answers it: the score on each check and the transcript lines behind it. That is the point of 100% QA coverage in a regulated context: the audit trail is the review itself, not a report assembled afterwards.
Kaizo is built for this part. Its compliance page says it scores every conversation against your compliance criteria and links each score to the transcript, with custom criteria for your regulatory context, and its scorecards take your existing criteria rather than a template.
Kaizo is SOC 2 Type II and ISO 27001 certified and GDPR compliant, with the reports in its Trust Center. Kaizo reviews conversations once they have ended, so it does not stop a mistake during a live call. For a regulated gaming example, see how GAMING1 uses Kaizo across responsible gaming conversations.
How to start compliance monitoring
Start with one rule that a regulator or auditor would ask about first, turn it into one auto-fail check, and score every conversation it applies to for a month. The list of failures is your first evidence pack, and the gaps in it show which check to add next.
For regulated teams, the page for fintech support teams shows how Kaizo applies compliance criteria to every conversation.
Frequently asked questions
What is the difference between compliance monitoring and quality assurance?
Quality assurance judges how well a conversation was handled, usually with weighted criteria and a score. Compliance monitoring checks whether each required step happened, usually pass or fail, with the evidence kept. They work well on one scorecard: the compliance checks as auto-fail criteria, the quality criteria weighted, and one review per conversation.
Is a call center PCI compliant if it records calls?
It can be, but recording adds risk. PCI DSS does not allow card verification codes to be stored after authorization, and the PCI SSC applies this to audio recordings: prevent the recording where possible, or delete the data securely. Whether your setup is compliant is decided in your PCI assessment, not by your QA tool.
Do you need consent to record customer service calls in the US?
Federal law allows recording with the consent of one party, which can be the company itself. Several states, including California, require the consent of all parties to a confidential call. Because customers call from many states, most contact centers play a recording notice at the start of every call. Check the rules for your states with counsel.
How often should you monitor calls for compliance?
Every call the rule applies to, if you can score automatically, because a missed disclosure on one call is a problem for that customer whether or not it was in the sample. If you review by hand, review every call in the highest-risk categories, such as complaints and payment disputes, and sample the rest.
Can AI check calls for required disclosures?
Yes, if each disclosure is a clear check, such as “the agent read the fee statement before taking the payment”, and the scoring is first tested against your own past reviews. Every result should link to the transcript line behind it, so a person can check any score, and failed checks should go to a person for review.
