Quick answer: If you will use AI voice agents for KYC, reminders, or collections, your terms & conditions, privacy notice, and consent language should clearly cover (1) voice/electronic contact, (2) recording/transcription, (3) AI-assisted calling, and (4) how borrowers update or withdraw channel preferences — under PDPA 2010 principles and your market-conduct duties. Outdated T&Cs that only mention “SMS and email” create avoidable gaps when AI dials start.
This supports the BNM & AI compliance checklist. Not legal advice — have counsel draft Malaysia-specific wording.
What usually needs refreshing
| Clause area | Why update |
|---|---|
| Contact channels | Include voice calls, AI/automated voice, messaging apps you actually use |
| Recording | Disclose recording/transcription for quality, training, compliance |
| Purpose | Onboarding verification, servicing, arrears, collections |
| Data sharing | Processors / cloud / voice vendors as personal-data processors |
| Preferences | How to update phone, email, do-not-call style requests where applicable |
| Consequences | Unverified / invalid contact data may pause disbursement or trigger re-KYC |
Ops mapping (so legal text becomes software)
Store boolean (or timestamped) fields such as:
consent_voice_contactconsent_call_recordingconsent_automated_voicenotice_version_acceptedphone_otp_verified_at
Suarify / CRM should block dials when required flags are missing — same pattern as OTP verify.
Rollout tips
- Don’t silently rewrite — use versioned notice to existing customers where required
- Keep a PDF/HTML archive of each T&C version accepted
- Train agents (and AI scripts) to answer “are you a robot?” honestly per your disclosure policy
- Align marketing pages and in-app checkboxes with the same language
FAQ
Do we need explicit consent for AI specifically?
Many programs disclose “automated / AI-assisted calling” to avoid surprise. Whether a separate tick is mandatory depends on your counsel’s PDPA analysis — clarity reduces complaint risk either way.
What if a customer refuses voice but allows SMS?
Honor channel preferences in CRM. Route arrears to allowed channels only.
Does updating T&Cs replace calling-hour rules?
No. Contract language does not override market-conduct hour and harassment rules. See calling hours.
Cluster: Pillar · Email-first · Reduce complaints