Debt Collection Compliance Software: FDCPA, Regulation F and TCPA Guardrails for US Creditors

Five things, and they are checkable in a demo rather than claimed on a pricing page. A contact window resolved in the recipient's time zone. An attempt counter that increments per debt. A consent state that a one-word reply can flip to blocked, instantly and across every channel. A demand amount constrained by the terms your customer actually signed. And an audit log you can export as a file without asking support.

Everything else sold under the compliance heading is either a template library, which every vendor has, or a state rule pack aimed at licensed agencies chasing consumer accounts. If you are a business collecting your own invoices, the rule packs solve a problem you do not have, and you are paying for them.

The reason the five controls above matter more than the badges is that they are the only parts of compliance that survive staff turnover. A collector's calling habits leave with the collector. A scheduler's configuration is still there, versioned and inspectable, eighteen months later when somebody asks what you sent and when. For which vendors do this well and which do not, we keep an honest roundup on the best debt collection software comparison page.

Generally no, on two independent grounds. The FDCPA defines "debt" at 15 U.S.C. 1692a(5) as an obligation arising out of a transaction incurred primarily for personal, family or household purposes, so a commercial invoice between two businesses is outside the statute entirely. Separately, the definition of "debt collector" at 1692a(6) turns on collecting debts owed or due another, which is why a creditor collecting its own account in its own name is treated as a first-party creditor.

The exception is the one people trip over. If you collect under a name that suggests a third party is involved, a house agency with an official-sounding name, a letterhead that implies an outside recovery firm, you can lose first-party treatment. That is a naming decision, not a legal one, and it costs nothing to get right. Our page on first-party collections works through what stays in-house and what does not.

Two things this does not mean. It does not mean state law leaves you alone, because Texas and New York both regulate original creditors on consumer accounts. And it does not mean you should ignore Regulation F. Adopting its windows and caps voluntarily is cheap, is what a jury would consider reasonable, and removes the argument entirely.

Regulation F is the CFPB rule at 12 CFR part 1006 that implements the FDCPA. It took effect on November 30, 2021 and replaced decades of informal interpretation with specific numbers, which is why it is the reference point even for creditors it does not legally cover.

The provisions that matter operationally are short. Calls are permitted between 8am and 9pm in the consumer's local time. There is a rebuttable presumption of harassment above seven calls about a particular debt within seven consecutive days, and a second presumption for calling within seven days of a phone conversation about that debt. Electronic messages must carry a clear, reasonable opt-out method. The limited-content message defines what you may leave on a voicemail without it counting as a communication that triggers third-party disclosure problems.

Two details are widely mis-stated. The call frequency limits attach to each individual debt, so a consumer who owes three accounts is subject to three separate counters. And the calling window keys on the consumer's location, so a national book of accounts needs per-recipient time resolution rather than one office-hours setting.

Yes, and this is the rule most B2B finance teams get wrong. Business-to-business calls and texts are subject to the same TCPA wireless restrictions as consumer ones. An autodialed or prerecorded call, or a text, to a wireless number generally requires prior express consent regardless of whether the person answering is a homeowner or a purchasing manager. Statutory damages start at $500 per call and treble for willful violations, so a modest text campaign to a list of cell numbers is a real exposure.

The federal do-not-call registry rules do carve out business landlines, which is why plain manual dialing to a company's main line is comparatively low risk. That carve-out disappears the moment the number is a mobile, and small business contacts are overwhelmingly mobile numbers that double as personal phones. Several state mini-TCPA statutes, notably Florida, Oklahoma, Washington and Maryland, apply restrictions to B2B contacts without the federal landline exemption at all.

Revocation is the other half. Since April 11, 2025, FCC rules let a recipient revoke consent by any reasonable method, including a one-word text reply, and revocation carries across channels: a STOP sent by text also ends the robocalls. You must honor it within a reasonable time, not exceeding ten business days, and you cannot designate an exclusive revocation method. A further FCC provision extending a single revocation to all future calls and texts from the business was delayed to April 11, 2026.

Yes, and the compliance question for an AI system is the same as for a human one, because the FDCPA, Regulation F and the TCPA regulate the contact, not the technology. There is no separate federal AI collections statute. The CFPB has stated that firms are responsible for the conduct of their AI systems, which is the correct default: an automated voice that misstates a balance is the same violation as an employee who does it.

What changes with automation is that the guardrails become testable. A human collector's calling window is a habit. A scheduler's calling window is a configuration value you can inspect, version and audit. That is genuinely better for compliance, provided three things are true. The system must resolve the recipient's time zone rather than the sender's. It must count attempts per debt. And it must stop instantly on a revocation word rather than at the end of a queued campaign.

The pattern we recommend, and the one DebtAgent uses, is that the agent drafts and schedules and the system enforces, with a human able to inspect the full sequence before anything sends. Our AI debt collection page covers how the sequence is generated, and the collection call script page covers the language side for live calls.

Less than it did, and the direction of travel matters for how you plan. Through 2025 and into 2026 the Bureau sharply reduced enforcement, supervision, staffing and rulemaking. A Department of Justice opinion concluded that Federal Reserve losses block the funding transfers the Bureau relies on, and the CFPB has indicated it expects to exhaust available funds in early 2026. Multiple cases, including a challenge to mass layoffs and a multi-state attorney general action, were still live in 2026.

Read that carefully before you relax. The FDCPA and Regulation F remain federal law whatever happens to the agency's budget. What shifts is who enforces them: the FTC, state attorneys general, and the private plaintiffs' bar, which never depended on CFPB funding in the first place. Private FDCPA suits and state unfair-practices claims are the practical risk in 2026, and neither is deterred by a quiet supervision calendar.

The planning conclusion is the boring one. Do not build a collections policy that is calibrated to the probability of a federal exam. Build one calibrated to what a state attorney general or an opposing lawyer would see in your audit log, because that is the audience that is definitely still there.

Generally no. Roughly 45 states license or register collection agencies, with surety bonds running from about $5,000 to $300,000, but the statutes are written around collecting for others. New York City's Administrative Code 20-489 is a clean example: it defines a debt collection agency as one whose principal purpose is collecting debts owed to another, includes buyers of delinquent debt, and expressly excludes an officer or employee of a creditor collecting, in the creditor's name, debts for that creditor. Illinois exempts persons whose collection activity is confined to and directly related to operating a business other than a collection agency.

Two situations flip you into the licensed world. Buying delinquent debt makes you a debt buyer, and most modern statutes reach debt buyers explicitly. Collecting under an assumed name that implies an outside agency does the same in practice, and Illinois bars it outright.

Illinois deserves a specific flag for anyone with a national book. The Collection Agency Act at 225 ILCS 425 carries a $25,000 bond through IDFPR, and IDFPR has given ACA informal guidance that Illinois licensing does reach commercial debt collection, which is unusual: California's Debt Collection Licensing Act, by contrast, is limited to consumer debt owed by a natural person. Our commercial debt collection laws pillar has the state-by-state detail, with dedicated pages for Illinois, New York and California.

Enough to reconstruct any single contact without asking a person what they remember. In practice that is nine fields per attempt: timestamp in UTC, the recipient's resolved local time, channel, recipient address or number, the account and specific invoice the attempt related to, the template or script version used, the amount demanded, the consent state at the moment of sending, and the identity the message was sent under.

The per-invoice field is the one teams skip and then need. Regulation F counts calls per debt, so a log keyed only to the customer cannot demonstrate you stayed under the cap. Template version is the second. Six months after a policy change you will be asked what the message said on a specific date, and "we updated the wording at some point in March" is not an answer.

Retention should outlast the limitation period you are actually exposed to. FDCPA claims carry a one-year limit from the violation, but the underlying contract claim runs four to ten years depending on the state and whether the sale was of goods, and a dispute over the debt often drags the collection history in with it. Keeping the log for the life of the receivable plus a year costs almost nothing and settles arguments quickly.

Most US businesses that sell to both individuals and companies end up wanting one policy, because two policies means someone eventually applies the wrong one. The cheapest defensible answer is to run the stricter consumer standard everywhere and accept that you are over-complying on the commercial side.

• Contact window: 8am to 9pm in the recipient's local time, applied to email and text as well as calls, even though Regulation F's window is written for calls.
• Frequency: a hard cap of seven contact attempts per debt per seven days, counted per invoice, with a seven-day pause after any completed phone conversation about that debt.
• Channel default: email first, escalating to text or voice only where you hold recorded consent for that number, and never autodialed or prerecorded to a mobile without it.
• Revocation: honored immediately on any recognizable stop word, across all channels, with a hard system block rather than a note in a CRM field.
• Amounts: interest and late fees demanded only where the signed terms authorize them, at the contracted rate, with the clause reference stored against the demand.
• Identity: every message sent as your own trading name, with a real reply address monitored by a human.

None of this reduces recovery. The evidence runs the other way: accounts worked consistently under 90 days past due recover well above 70 percent, while accounts past 180 days often recover under 15 percent, so the win comes from starting early and staying regular, not from contacting more aggressively. The practical sequence is covered in unpaid invoice collection and, for the escalation point, the demand letter stage.