Which rules govern an automated collection call depends on who is collecting and in whose name. A lender calling its own borrowers in its own name isn’t a debt collector under Regulation F, but it still answers to the Telephone Consumer Protection Act (TCPA), state collection law, and the ban on unfair, deceptive, or abusive practices.
When an AI voice agent places the call, the TCPA’s consent rules come with every dial. The FCC ruled in February 2024 that an AI-generated voice counts as an artificial voice, so it needs the same prior consent as a prerecorded message.
We’ll cover which rules bind a lender, an agency, and a debt buyer, the call limits and consent rules an automated dialer has to enforce, how an AI voice agent applies them on a single call, and the records and state laws an examiner will check.
What Is Debt Collection Compliance?
Debt collection compliance means the controls that keep every collection call, text, email, and letter within federal and state law, plus the records proving it.
Most of the duties come from the Fair Debt Collection Practices Act (FDCPA) and the Consumer Financial Protection Bureau’s (CFPB) Regulation F (12 CFR 1006), which requires a debt collector to:
- Send a validation notice with the debt’s details, and stop collecting on a debt disputed in writing until it’s verified
- Limit when, where, and how often it contacts a borrower
- Avoid harassment, threats, and misleading claims
- Never sue, or threaten to sue, over a time-barred debt
- Collect only the fees the loan agreement or the law allows
- Speak to the borrower, or write and wait 14 days, before reporting the debt to a credit bureau
- Keep records of compliance for three years after the last collection activity on a debt
The TCPA and state collection law add rulebooks of their own.
How much of Regulation F binds your team depends on whether you count as a debt collector under it.
How the Rules Differ for Lenders, Agencies, and Debt Buyers
Regulation F’s debt-collector duties attach to the business making the contact, so the same overdue loan can carry different rules depending on who works it. The regulation defines a debt collector as a business whose principal purpose is collecting debts, or one that regularly collects debts owed to someone else.
The three kinds of collectors compare like this:
Lender collecting its own loans, in its own name
Rules that apply: The TCPA, the federal ban on unfair, deceptive, or abusive acts or practices (UDAAP), state collection statutes and licensing
What changes the picture: Collecting under a name that suggests a third party makes the lender a debt collector under Regulation F
Agency, law firm, or vendor collecting for the lender
Rules that apply: The FDCPA and Regulation F, the TCPA, state licensing, and CFPB supervision once annual receipts from consumer debt collection pass $10 million
What changes the picture: Nothing. This is the core case
Debt buyer
Rules that apply: The FDCPA and Regulation F for debts already in default when bought, where collecting debts is its principal business, plus the TCPA
What changes the picture: A debt bought while still current falls outside the definition
Placing accounts with an agency brings Regulation F into your program without taking your own responsibility away. The CFPB’s examination manual says an institution cannot outsource the responsibility for complying with federal consumer financial law, so you’re accountable for how every vendor calls your borrowers, whether that’s an agency’s staff or automated debt collection calls placed on your behalf.
State law can also pull an in-house team in: California’s Rosenthal Act holds lenders collecting their own consumer debts to most of the FDCPA’s conduct rules.
For anyone bound by Regulation F, the rule a dialer has to enforce on every attempt is the 7-in-7 call cap.
What Is the 7-7-7 Rule for Debt Collectors?
The 7-7-7 rule is Regulation F’s call-frequency limit: a debt collector is presumed to be harassing a borrower if it places more than seven calls about a particular debt within seven consecutive days, or calls within seven days after having a phone conversation about that debt.
The rule is 12 CFR 1006.14, and its official commentary settles the details a dialer has to get right:
- The count follows the person and the debt, so a borrower with two loans in collection has a separate count for each, across every number you hold for them.
- Attempts count, whether or not anyone answers. Only a call that never connects to the dialed number, such as a busy signal, is left out.
- A ringless voicemail counts as a call. Texts and emails don’t.
- The day of a conversation is day one, so the next call about that debt can go out on day eight.
- Calls the borrower agreed to in the past seven days are excluded.
Because it’s a presumption, a collector under the cap can still be found to have harassed someone, and one over it can still rebut it.
Under 12 CFR 1006.6, calls before 8 a.m. or after 9 p.m. at the borrower’s location are presumed inconvenient unless the borrower says otherwise. When your records point to two time zones, say an Eastern mobile number and a Pacific address, you call only in the hours that fit both.
Whether an automated system may place the call at all is a TCPA question.
TCPA Consent for Automated Collection Calls
Under the TCPA, an autodialed, prerecorded or artificial-voice call to a mobile number needs the borrower’s prior express consent, and that includes every call an AI voice agent places. For collections, consent usually comes from the loan itself. The FCC ruled in January 2008 that a mobile number the borrower gave the creditor in the transaction that created the debt counts as prior express consent to calls about that debt.
That consent doesn’t stretch to every number. A number found through skip tracing starts without that consent. Consent also belongs to the person, not the number: if a borrower’s number is reassigned to someone else, the old consent no longer covers calls to it. Checking the FCC’s Reassigned Numbers Database before you call protects you if the database wrongly reports the number as unchanged.
Landlines work differently. An artificial-voice collection call to a residential line can go out without consent, but the FCC's rule caps those calls at three in any 30 days and requires you to honor an opt-out, which is a tighter limit than Regulation F's 7-in-7.
Borrowers can take consent back by any reasonable method, such as replying “stop” to a text or telling the agent on a call, and you have up to 10 business days to honor it. The FCC adopted an order (FCC 26-67) letting callers set an exclusive opt-out method.
- You’ll be able to name the opt-out method borrowers must use, such as a key press on the call, a reply word like STOP, or a website or number you choose, as long as you disclose it clearly on every call or text.
- For informational calls like collections, an opt-out will cover only the category of calls it responds to, so a borrower who stops collection calls can still get fraud alerts.
California’s Penal Code 632 makes it an offense to record a confidential call without the consent of everyone on it, and section 632.7 requires the same consent for any call involving a mobile phone, confidential or not, so an agent that records every call should say so at the start.
How an AI Voice Agent Follows the Rules on a Collection Call
An AI voice agent stays inside the collection rules by checking each call before it dials, saying what the law requires once someone answers, and handing the hard cases to a person. On a single call, that runs in this order:
- Before dialling, the system confirms consent for that number, counts the attempts already made on that debt in the past seven days, and checks the borrower’s local time. If any check fails, the call waits.
- When someone answers, the agent confirms it’s speaking with the borrower before mentioning the debt, since Regulation F bars discussing it with third parties. It also says the call is recorded.
- It identifies itself as a debt collector attempting to collect a debt. On a first contact, it can give the validation information out loud, at a volume and speed the borrower can follow.
- When a borrower disputes the debt, mentions hardship or bankruptcy, or says a lawyer is handling it, the agent passes the call to a person. Once you know a lawyer represents the borrower on that debt, and can find out who, Regulation F bars contacting the borrower directly unless the lawyer agrees or doesn’t respond.
- After the call, the recording, the outcome and every check the system ran go into the account record.
Step four needs the most testing. The CFPB warned in 2023 that automated systems that keep people from reaching a human can lead to violations.
Vector is Synthflow's AI agent platform for consumer lending. For lenders running collections through AI voice agents, Vector checks each proposed call or message against the contact windows, frequency limits, consent, and permissions you configure, blocks or escalates the action when a check fails, and records each decision.
The account record from step five is what an examiner reviews, which makes retention the next thing to get right.
The Records That Prove Debt Collection Compliance
Under 12 CFR 1006.100, a debt collector keeps evidence of compliance until three years after its last collection activity on a debt, and each call recording for three years from the call. Keep consent records longer: TCPA claims can be filed up to four years after a call, so proof of where each number came from has to outlast Regulation F’s minimum.
For each account, the file should hold:
- Scripts and disclosure wording, by version: What the agent said on every call
- Validation notices: What the borrower was told, and when
- Dispute log: Each dispute and when collection paused
- Call attempt log, per debt: That the 7-in-7 cap and calling hours held
- Consent records, by number: Where each number came from
- Opt-out requests on every channel: When each arrived and when it was honored
- Call recordings: What was actually said
- Credit reporting history: That contact came before reporting
- Fee records: That every fee was allowed by the loan agreement or by law
- State licenses: Where you're licensed to collect
- Training and QA reviews: That people and systems are checked
CFPB examiners read those records as evidence of a compliance management system: board and management oversight, policies, training, monitoring or audit and complaint handling. For automated tools, the manual tells examiners to check that they were reviewed for compliance before going live and approved by the board or a board committee for the job they do, so an AI rollout needs a paper trail of its own: test results, the approval, and the version of the rules each call ran under.
Federal rules set the floor for all this, and state law decides how much higher it goes.
State Laws a Collections Team Should Check
State law adds a second rulebook, and the first question in any state is whether its collection statute covers a lender collecting its own loans. In California it does, and since July 1, 2025 the Rosenthal Act also reaches commercial debts of $500,000 or less where a person, typically a guarantor, is personally liable, for debts entered into, renewed, sold or assigned from that date.
For each state you collect in, check four things:
- Coverage: whether the statute reaches creditors collecting their own debts, and commercial debts as well as consumer ones.
- Licensing: whether your business needs a collection license. California requires one for most collectors but exempts FDIC-insured banks, credit unions and DFPI-licensed finance lenders.
- Contact limits: some states set tighter call caps than Regulation F. Massachusetts limits creditors to two calls, texts or recorded messages in seven days per debt to a borrower’s home, mobile or other personal number.
- Recording consent: whether every party has to agree before a call is recorded.
Whatever the state, the core conduct bans look much the same.
What Do Debt Collection Harassment Laws Prohibit?
Debt collection harassment laws prohibit any conduct whose natural result is to harass, oppress or abuse the person on the other end, and Regulation F spells out the specific bans. A script or an AI agent has to avoid all of these:
- Threatening violence or harm to a person, their reputation or their property: 12 CFR 1006.14
- Obscene, profane or abusive language: 12 CFR 1006.14
- Calling repeatedly to annoy or harass: 12 CFR 1006.14
- Falsely implying that a lawyer or a government agency is involved: 12 CFR 1006.18
- Calling someone at work when their employer forbids it: 12 CFR 1006.6
- Posting about the debt on social media where the public or the borrower's contacts can see it: 12 CFR 1006.22
Crossing any of these lines creates exposure from more than one enforcer.
Who Enforces the FDCPA?
The FDCPA is enforced by the CFPB and the FTC, by the federal banking regulators for the institutions they supervise, and by borrowers themselves through private lawsuits.
- Federal regulators: the FDCPA gives the FTC general enforcement authority, assigns banks and federal credit unions to their own regulators, and gives the CFPB authority over most other collectors.
- Borrowers: an individual can sue for actual damages, up to $1,000 in additional damages and attorney’s fees. In a class action, the additional damages can reach $500,000 or 1% of the collector’s net worth, whichever is less.
- State attorneys general: they enforce their own states’ collection laws and, under Dodd-Frank section 1042, can also sue under the Consumer Financial Protection Act and the rules issued under it, including its ban on unfair, deceptive or abusive practices, though against national banks and federal savings associations only to enforce CFPB rules such as Regulation F.
For a collections team, that adds up to three separate risks: exam findings, state actions and class actions, each running its own timetable.
How Debt Collection Rules Are Changing
Regulation F’s call, validation and record rules are the same today as when the rule took effect in November 2021. What has moved since 2025 is the guidance around them, a few neighboring rules, and who is doing the enforcing:
- May 2025: The CFPB withdrew 67 guidance documents, six of them on the FDCPA, including its opinions on pay-to-pay fees and time-barred debt
- July 2025: A federal court vacated the CFPB's medical debt credit-reporting rule
- July 2025: California's Rosenthal Act began covering some commercial debts
- September 2026: The FCC voted to let callers set an exclusive opt-out method
Withdrawn guidance leaves the regulation and its official commentary in force, so every Regulation F requirement still applies. State law and state enforcers are unaffected by the federal withdrawals.
The core rules themselves haven’t moved, so the work is building them into every call.
Put the Rules Into Every Borrower Call
Before an AI voice agent places its first collection call, settle three things:
- Which rulebook binds you: whether you collect in-house, through an agency or as a debt buyer, and which states your borrowers live in.
- A control for each rule: consent by number, the 7-in-7 count per debt, calling hours by time zone, the required disclosures and the hand-off triggers, each checked before the call goes out.
- The record that proves it: what gets logged, where it’s kept and for how long.
This is general information about US collection rules, not legal advice, so confirm your program with counsel before you automate it.
If you’re putting AI voice agents on collections, book a Vector demo. The team will build a working agent on one of your collection use cases, with the cadence, consent and escalation controls set to your rules.
