Ofcom Compliance Checklist 2026

Quick Reference

Step-by-Step Compliance Checklist

Phase 1: Registration (Day 1)

1. 1
   Submit Ofcom Notification

   Complete the online notification form at ofcom.org.uk. Required before providing any electronic communications services.

   Cost: Free | Time: 15 minutes | Processing: 1-3 days
2. 2
   Register with ADR Scheme

   Join either Ombudsman Services: Communications or CEDR. Required for residential customers.

   Cost: £200-500/year (based on size) | Time: 1-2 weeks
3. 3
   Register with ICO

   Data protection registration at ico.org.uk. Required if processing personal data.

   Cost: £40-2,900/year (based on size) | Time: Immediate online

Phase 2: Contract Documentation (Week 1-2)

4. 4
   Create GC C7 Compliant Contracts

   Contracts must include: minimum term, monthly price, included allowances, early termination charges, complaint procedure, ADR scheme details, switching information.

   Reference: Ofcom GC C7 Guidance
5. 5
   Prepare Pre-Contract Information

   Create standardised information document showing: service description, pricing, contract length, what happens at end of contract, how to switch away.

   Required: Before customer signs | Format: Durable medium (email/paper)
6. 6
   Document Cooling-Off Procedure

   14-day cancellation right under Consumer Contracts Regulations 2013. Must inform customer at point of sale and in contract.

   Deadline: Customer can cancel within 14 days without penalty

Phase 3: Operational Systems (Week 2-4)

7. 7
   Implement GC C1 Fraud Prevention

   Deploy: traffic monitoring, destination blacklists, credit limits, velocity checks. Document incident response procedure.

   Critical: Most common enforcement area | See: GC C1 Fraud Guide
8. 8
   Verify 999 Access (GC C2)

   All voice services must connect to emergency services. If using VoIP, ensure fallback for power/internet outages is documented.

   Test: Quarterly testing recommended
9. 9
   Configure CLI Display (GC C3)

   Outbound calls must display valid CLI. Implement CLI validation for customer-provided numbers.

   New: STIR/SHAKEN requirements from 2026 for large providers
10. 10
    Set Up Switching Procedures (GC C8)

    Implement One Touch Switch process. Customer initiates switch with new provider; you must release within 1 working day.

    Penalty: Active blocking of switches is a serious breach

Phase 4: Ongoing Compliance

11. 11
    Maintain Complaint Handling

    Resolve complaints within 8 weeks or issue deadlock letter. Log all complaints. ADR referral for unresolved disputes.

    Record retention: 12 months minimum
12. 12
    Annual Compliance Review

    Review contract terms, update for Ofcom changes, verify ADR membership current, test fraud controls, update staff training.

    Schedule: January recommended (before regulatory year)

General Conditions by Category

Condition	Topic	Applies To	Priority
GC A1-A4	Network access & interconnection	Network operators	-
GC B1-B4	Number portability	All providers	High
GC C1	Fraud & misuse prevention	All providers	Critical
GC C2	Emergency call access (999)	Voice providers	Critical
GC C3	CLI presentation	Voice providers	High
GC C4	Public payphones	Payphone operators	-
GC C5	Directory enquiries	Voice providers	Medium
GC C6	Facilitating number portability	All providers	High
GC C7	Contract requirements	Residential providers	Critical
GC C8	Switching	All providers	Critical

Enforcement Actions: Recent Examples

Required Documentation Checklist

Document	Purpose	Retention
Customer contracts	Proof of agreed terms	6 years after end
Pre-contract information	Proof of disclosure	6 years after end
Cooling-off acknowledgements	Proof rights explained	6 years after end
Complaint logs	ADR compliance	12 months minimum
Fraud incident reports	GC C1 compliance	3 years
Switching records	GC C8 compliance	12 months
Voice recordings (sales)	Verbal contract proof	6 years
CDR records	Fraud detection	12 months minimum

Related Guides