Call Recording for Insurers: Evidencing Every Interaction Without Storing Card Data

The best call recording setup for an insurer records every customer call in full, makes any call findable in seconds, keeps it for the required period, and never captures card numbers or security codes. Automated pause and resume, or taking payments outside the recorded audio, handles the card data.

TL;DR

• Insurers use recordings to settle disputes, handle complaints, check quality and show the Central Bank or FCA what was said.
• PCI DSS prohibits storing card security codes after authorisation, which includes in a call recording.
• Manual pausing relies on agents remembering every time. Automated pause and resume, secure payment IVRs and AI payment handling remove that dependency.
• A recording is only useful if someone can find it: search, transcripts and summaries matter as much as storage.

What does an insurer actually use call recordings for?

An insurer uses call recordings for five jobs, and each one sets a different requirement.

The first is disputes. A customer says they cancelled, or that a driver was added, or that nobody told them about an excess. The recording settles it, so it has to exist, be complete and be retrievable months or years later.

The second is complaints. Complaint handlers need the call quickly to respond within their deadlines, which means search by customer, policy or date rather than a request to IT.

Quality assurance and training come third and fourth. Supervisors listen to samples, spot patterns and coach agents. That needs volume and speed, and it benefits from transcripts.

The fifth is regulatory evidence. When the Central Bank of Ireland or the FCA asks how a sale, renewal or claim was handled, the recording and its metadata are the evidence.

Which rules shape how an insurer records calls?

Three sets of rules shape the design: conduct rules, data protection and card security.

The Consumer Protection Code. The Central Bank's revised Consumer Protection Code has applied since 24 March 2026. It covers informing customers, errors and complaints, and record-keeping. The 2012 Code required regulated entities to keep consumer records for six years after a transaction ended. Confirm the equivalent requirement in the 2025 Code with your compliance team, and check how your current recording retention maps to it.

GDPR. Recordings are personal data, so retention has to be justified and limited. The Data Protection Commission has published a case study on an erasure request where the firm relied on the Consumer Protection Code's retention requirement. It shows why each retention period needs a documented reason.

PCI DSS. The PCI Data Security Standard prohibits storing sensitive authentication data, such as the three-digit card security code, after a payment is authorised. That applies to audio as much as a database. A recording that captures a customer reading out their card number and code brings the whole recording system into PCI scope.

UK groups also answer to the FCA, whose rules on record-keeping and complaints sit alongside these.

How do insurers keep card data out of recordings?

There are four common methods. They differ mainly in how much they rely on the agent getting it right every time.

Manual pausing is still common on older systems, and it's the weakest option because it depends on memory during a busy call. Campion Insurance faced this on its legacy Cisco platform, which had no automated mechanism for payment calls.

DigitalWell built Campion a desktop application that watches the active window on each agent's machine. When a payment screen opens, it sends a pause command to the Genesys Cloud CX recording engine through the API, then resumes when the payment is done. Every contact centre agent had it from go-live, with no extra steps. The Campion case study has the details.

For calls handled end to end by AI, DigitalWell's AI Voice Agents take premium, excess and fee payments inside the same interaction, and keep card data out of the recording entirely.

What makes a recording usable when a dispute arrives?

A recording is only as useful as your ability to find the right one and understand it. Storage is the easy part.

Dual-channel recording, with the agent and customer on separate tracks, makes it easier to hear who said what and improves transcription. Campion's deployment uses dual-channel recording with supervisory reporting and analytics.

Transcripts and summaries turn hours of audio into something searchable. Karen Hickey, Enterprise Account Director at DigitalWell, describes what AI summaries can pull from an insurance call:

"It can pull out key pieces of information like car registration number, policy number, whatever the case may be, whatever is important to have in that summary." Karen Hickey, Enterprise Account Director, DigitalWell

Storage still has to be large and managed. KennCo Insurance, regulated by the Central Bank, moved to DigitalWell 360 with 250,000 hours of cloud call recording storage, replay and compliance management, replacing local server-based recording.

"We gained a single point of accountability, eliminating our legacy hardware headaches and resolving major security risks." Clare McDonagh, Director of Operations and Communications, KennCo Insurance

The KennCo case study covers the six-week migration.

What should an insurer's recording specification include?

Put these requirements in writing before choosing or renewing a recording solution.

1. Record every customer call, inbound and outbound, including transfers and calls handled by AI.
2. Keep card data out automatically, using automated pause and resume, a secure payment IVR or AI payment handling.
3. Record in dual channel so each speaker is on a separate track.
4. Index calls by customer, policy number, agent, queue and date, so complaint handlers can find them without IT.
5. Transcribe and summarise, so calls can be searched by what was said.
6. Set retention by call type, with a documented reason for each period and automatic deletion at the end.
7. Control and log access, so you can show who listened to or exported each recording.
8. Store recordings in known locations under a data processing agreement, and list the provider in your outsourcing register if it's an outsourced service.

Should recording sit in the contact centre platform or separately?

Either can work. Recording built into the contact centre platform is simpler, with one system and one set of permissions. Genesys Cloud CX and DigitalWell 360 both include recording. A separate specialist recording and quality platform suits large operations with complex quality programmes; DigitalWell also partners with Verint, listed on its Technologies page.

A third option sits at the network layer. The AI Voice Network records, transcribes and summarises calls as they pass through DigitalWell's voice network, whatever phone or contact centre platform sits behind it. That suits insurers with mixed estates, such as a group whose acquired brokers still run different systems. The Insurance Brokers & Providers page explains how this structured call data supports regulatory evidence.

Frequently Asked Questions

How long should an insurer keep call recordings?

Long enough to meet your regulatory and legal obligations, and no longer. The 2012 Consumer Protection Code set six years after a transaction ended for consumer records. Confirm the current requirement with compliance and document the reason for each retention period.

Is manual pause and resume PCI DSS compliant?

It can be, if it's applied perfectly on every call. In practice, it depends on agents remembering during busy calls, so automated methods are more reliable.

Can a customer ask us to delete their call recording?

They can ask. Where a regulatory requirement such as the Consumer Protection Code obliges you to keep the record, that can be grounds to retain it; the Data Protection Commission has published a case study on this situation. Explain the reason and the retention period to the customer.

Do we need to tell customers calls are recorded?

Yes. Customers should be told at the start of the call, and your privacy notice should explain why recordings are kept and for how long.

What's the difference between call recording and call analytics?

Recording captures and stores the audio. Analytics transcribes, summarises and categorises it, so you can search by content and spot trends. Many insurers want both.

Can we record calls on legacy systems before migrating?

Yes, network-layer recording through the AI Voice Network works with existing phone systems. Insurers often use a migration as the moment to modernise recording, as KennCo did.

Does AI call handling change our recording obligations?

No, the same rules apply. The advantage is that AI-handled calls are transcribed, summarised and logged automatically, so the evidence exists by default.

Key Takeaways

1. Recordings serve disputes, complaints, quality, training and regulatory evidence, and each needs fast, reliable retrieval.
2. PCI DSS bans storing card security codes after authorisation, so card data must stay out of the audio.
3. Automated pause and resume, secure payment IVRs and AI payment handling remove the agent memory risk that manual pausing carries.
4. Retention needs a documented reason: Consumer Protection Code obligations on one side, GDPR minimisation on the other.
5. Transcripts, summaries and dual-channel audio make a recording usable when a dispute or complaint lands.

Reviewing how your calls are recorded, stored and searched? Talk to DigitalWell about an insurance recording review, including payment handling and retention.