TCPA compliance checklist for credit and collection teams

In debt collection, one wrong contact rule can repeat thousands of times before anyone notices: a number that should have been suppressed stays in the dialer queue, a vendor keeps using outdated consent data, a reassigned number remains attached to an account. What begins as a small process gap can quickly become a pattern of unwanted contacts, consumer complaints, legal exposure, and costly remediation.

That is why Telephone Consumer Protection Act (TCPA) compliance in collections needs more than the standard marketing checklist of "get written consent, scrub the Do Not Call registry, and don't call after 9 p.m. in the recipient's time zone". Recovery teams require controls that reflect how debt-related communications actually move through creditors, agencies, dialing technology, messaging platforms, and third-party vendors.

The checklist in this article can help turn that complexity into a process your team can actually use to stay efficient and compliant.

Quick answer

For debt collection teams, TCPA compliance means controlling how calls and texts are placed, documenting the basis for consent, honoring revocations, suppressing ineligible numbers, and keeping records that show why a communication was allowed. A collections-specific checklist helps turn those obligations into repeatable operational practices across campaigns, systems, and vendors.

This text is intended as general information, not legal advice. Rules vary by jurisdiction, and teams operating outside the US answer to different regulations entirely. Last verified 28 September 2026.

Which TCPA rules apply to a collections call?

Most collections exposure sits in section 64.1200(a)(1). It prohibits calls to a mobile number placed with an autodialer, or carrying an artificial or prerecorded voice, unless the consumer gave prior express consent. In collections, this normally means the consumer supplied the number themselves, usually on the original credit application, and that someone can still produce the document showing it.

Section 64.1200(a)(2) sets a higher bar when the call carries an advertisement. Add a consolidation product, a refinance, or a settlement loan to a collections script, and the call is now considered an advertisement. If it's autodialed or leaves a prerecorded message, TCPA requires prior written consent, naming the phone number, stating the debtor accepts receiving autodialed or prerecorded marketing calls on it, and making it clear the agreement wasn't a condition of buying anything. A credit application signed years earlier to service an account does not meet that description.

Two rules most people associate with the TCPA rarely apply to collections at all. The national Do Not Call registry and the 8 a.m. to 9 p.m. calling window attach to a "telephone solicitation", which the rules define as a call encouraging someone to buy, rent, or invest in something. A conversation about a balance already owed doesn't encourage any purchases. Most available TCPA guides lead with these rules, which is why a checklist written for marketers points a collections company at the wrong compliance settings.

What could a TCPA violation cost you?

TCPA gives consumers a private right of action for actual monetary loss or $500 per violation, whichever is greater, and lets a court increase the award up to three times for a willful or knowing violation. Per call, many businesses can afford the fine, but one mis-scoped campaign can grow into a certified class, increasing the potential costs.

Statistics show this happens more often than not: the Consumer Financial Protection Bureau (CFPB) received approximately 387,400 debt collection complaints in 2025, while WebRecon's March 2026 report stated that of 283 TCPA suits filed that month, 220 were putative class actions, or 77.7%. About 43% of the consumers who filed had done it at least once before.

Your TCPA checklist

To effectively manage TCPA compliance across your collection calls and texts, you should:

☐ Know exactly which communications use regulated automation or artificial/prerecorded voice.

☐ Track manual, automated, SMS, prerecorded, and AI permissions separately where appropriate.

☐ Document consent logic for every automated campaign.

☐ Preserve the source of each consumer's telephone number.

☐ Associate consent with the relevant account and communication purpose.

☐ Remove wrong and reassigned numbers from automated campaigns.

☐ Capture and enforce revocations easily.

☐ Ensure agent-recorded revocations automatically trigger suppression.

☐ Make suppression the same across every calling and texting platform.

☐ Apply state-specific restrictions before campaign execution.

☐ Produce an auditable record for every covered communication.

The actions below set the operational decisions and software configurations to ensure consistent compliance across campaigns, communication workflows, and vendors. They follow the checklist's order, with some covering more than one item.

Log dialing method per campaign

The TCPA regulates certain calls made using an automatic telephone dialing system, and calls using an artificial or prerecorded voice. Note: A system counts as an automatic telephone dialing system only if it stores or produces numbers with a random or sequential number generator (Facebook v. Duguid, 2021). Most collection dialers don't, but not every debt recovery operation is automatically excluded from this regulation.

For every campaign, document:

• How numbers are selected;
• How calls are initiated (e.g., manually, using a list-based dialer or a predictive one);
• Whether random or sequential number generation is used;
• Whether any prerecorded or artificial voice plays at any point (including voicemail drops);
• Whether each number is wireless or a residential landline.

Together, these say whether the campaign needs prior express consent for every mobile number it dials, or falls outside 64.1200(a)(1) altogether.

A common pitfall to watch for is a collector dialing manually, reaching voicemail, and leaving a pre-recorded message. While a person initiated the interaction, the message is still considered a recorded call, so prior consent is required. To comply with TCPA regulations, restrict voicemail drops to numbers that have given explicit permission.

Record where the number and the consent came from

Consent applies to the phone number the consumer gave, not to their account. For written consent, section 64.1200(f)(9) says so outright: the signed agreement has to name the telephone number. For ordinary prior express consent, the FCC has long recognized that a consumer who wrote a mobile number on a credit application gave consent for certain autodialed or prerecorded collection calls relating to that debt, and the creditor bears the burden of demonstrating that consent was obtained. Numbers you found later, through a skip trace, a credit header, or a referral, for example, carry no consent.

To comply with TCPA regulations, log for each number:

• Where it came from,
• The date it was added to your system,
• The artifact behind it (e.g., signed application, recording of the servicing call, client's consent field).

Then set a load rule that numbers with all three can go to automated campaigns, while those missing any of the fields are reserved for manual dialing.

Here's an example of a consent record that clearly shows where the number came from and why your organization believes the communication is permitted:

Often, collection agencies receive files without clear indication where the contact information came from, so numbers from origination and any added later arrive in one column with nothing separating them. To avoid TCPA violations, ask your clients for a source field or, if one cannot be provided, dial the list manually.

Query the Reassigned Numbers Database

Numbers often change hands, and your records may show valid consent from the original consumer while the number now belongs to somebody else.

To avoid wrong-party calls in your collections:

• Register at the Reassigned Numbers Database as a Caller if you dial your own collection accounts or a Caller Agent if you dial for clients.
• File a letter of authorization for each client before you query that client's numbers.
• Buy a prepaid block of queries.
• Submit each number with the date you obtained consent for it.

After acquiring search queries, check every mobile number on your list, submitting each one with the day you obtained consent for it rather than today's date. The database shows if a U.S. phone number has been permanently disconnected and reassigned to a new person since a specific day, answering Yes, No, or No Data. Only numbers with a "No" are safe to dial automatically.

Keep the response file for verification purposes, because section 64.1200(m) gives you a defense against a claim if the database returned a wrong answer. It only applies if you can show the query actually happened.

On an operational level, adding a permanent field "NUMBER OWNERSHIP DISPUTED / WRONG PARTY" should automatically prevent covered automated activity until the number is validated.

Keep offers out of collection scripts

A script that discusses a balance and pitches a consolidation product, a refinance, or a settlement loan turns a debt collection into a marketing call. This requires prior express written consent, which a credit application signed years ago for servicing doesn't cover.

To keep a collections campaign from becoming a marketing campaign:

• Tag every campaign in your dialer as collections or offer-carrying.
• Ask your client for signed written consent records covering the numbers in scope before any campaign begins.
• Run the offer only against numbers that have those records.
• Check the SMS workflow and the Interactive Voice Response (IVR) settings, since an offer kept out of the call script often reappears in a follow-up text or menu.

Check out our collection call scripts guide to see practical examples of compliant and effective call structures for overdue balance recovery.

Route every opt-out to suppression

TCPA requires you to accept an opt-out expressed with "stop", "quit", "end", "revoke", "opt out", "cancel", "unsubscribe", or anything else the debtor says that plainly states their request. Opt-outs go missing when a collector can type them into a free-text note, so to comply with the regulations:

• Add a disposition code that writes straight into your suppression list.
• Accept an opt-out in any channel: on a call, by text, by email, by letter, and through a web form.
• Set an internal target well inside the required ten business days, and measure the gap between when a request arrives and the number gets excluded from campaigns.
• Give any recorded message a voice or keypress opt-out within two seconds of the caller identification.
• Record which accounts a single opt-out covers across your clients, and who on your team owns changing that.

Build the suppression process so its scope can widen without a complete restructuring. Today, an opt-out stops automated and recorded contact about the account the consumer was called on. From 31 January 2027, TCPA regulation is set to extend that to every other matter you would dial that consumer about, though the FCC has pushed the starting date back twice and may do so again.

The new rule leaves it to you whether an opt-out on one client's accounts suppresses the debtor's number in campaigns across your whole operation. The orders address lenders syncing across their own divisions, not agencies working several clients' books, so most operators suppress everywhere. Record which option you chose and who owns changing the process down the line.

Split Do Not Call status from withdrawn consent

A Do Not Call registration covers sales calls, so it generally doesn't stop you dialing a debtor about a balance. Withdrawn consent does prevent calling, but only for automated and recorded calls, and not for manual collector dialing. If you collapse the two into one "do not contact" tickbox, you get both wrong at the same time.

To keep the Do Not Call and consent fields distinct:

• Hold a registry field and a withdrawn-consent field separately on the account record.
• Keep a registry hit dialable for collections campaigns.
• Block automated and recorded calls on withdrawn consent, and leave manual dialing open.
• Apply a withdrawal that arrives by text to your calls as well as your texts.

Our guide to do-not-call compliance covers the registry side in detail.

Control AI agents like prerecorded voice

If your collections operation uses AI voice agents, they fall within the TCPA's "artificial or prerecorded voice" restrictions. That means every mobile number they dial needs prior express consent, no matter how it was selected.

To keep AI campaigns inside TCPA limits:

• Create a distinct campaign type, for example AI / ARTIFICIAL VOICE, so nobody can move a manual-call portfolio into an AI campaign without a compliance review.
• Verify consent as a condition of entry into the campaign, rather than at the moment of dialing.
• Give the agent the same opt-out handling a prerecorded message needs: a voice or keypress opt-out within two seconds of the caller identification.
• Point the agent's suppression check at the same suppression list your dialer uses to ensure compliance.
• Keep the vendor's documentation of how the agent works and all call logs.
• Define when the AI voice agent transfers the debtor to a human specialist, and log every handoff.

Monitor state laws separately

Federal TCPA compliance should be your baseline, not the end of your review, because states may impose additional restrictions affecting calling hours, consent, registration, disclosures, call frequency, recording, or telephone solicitation practices, which follow the recipient's location.

To stay compliant:

• Create a state-law matrix tied to the debtor's applicable jurisdiction, with a column for each restriction type you track, and update it when laws change.
• Drive the applicable state from the address on the account rather than the area code.
• Add a state restriction layer before each campaign activation, so a federally permissible campaign cannot go live where a state restricts it.
• Name who from your team reviews the matrix, and the evaluation cycle duration.

This will prevent teams from assuming that a federally permissible communication is automatically allowed everywhere.

Keep dated procedures and vendor terms

To demonstrate compliance, your audit log must identify who performed each action and when. This matters most in operations where a third party performs part of the collection work, because those records then sit outside your own systems.

To create a suitable compliance log:

• Keep one written procedure per checklist item, each carrying the date it took effect, and reissue it when the process changes.
• Train collectors when they first join your team and again after each policy change, recording who attended the sessions and when.
• Name in each client and vendor contract who runs the reassigned-number queries, who holds the opt-out list, and how often it syncs to your dialer.
• Set a retention period for call logs, consent artifacts, and query responses that outlasts your longest limitation period.

Which of these steps can your platform enforce?

Some checklist items are settings: dialing method and line type, opt-out routing, suppression fields, and campaign tagging are all configuration. Cold calling software that enforces them removes the most common risks of compliance violations. Squaretalk's contact center software for debt collection, for example, offers contact caps and logs every call with a timestamp, a disposition, and a recording. The power and predictive dialer have campaign-level dial settings and role-based permissions. To see them in action, book a demo with our team.

Bottom line: Make TCPA compliance part of your workflow

TCPA compliance is easier to manage when it's built into the systems your credit and collection teams already use. This largely means documenting where consent came from, separating permissions by communication channel, capturing revocations immediately, synchronizing suppression lists, monitoring wrong and reassigned numbers, and maintaining an audit trail for every automated call or text.

The most effective approach to TCPA compliance, however, is to determine whether a communication is permitted before the debtor's number enters a campaign, rather than trying to identify compliance problems after contact has already occurred.

Frequently asked questions

Does the TCPA apply to third-party collection agencies? Yes, it applies to whoever places the call, and there is no exemption for collecting a debt owed to someone else. An agency is liable as the party that placed the call, and its client can be liable for calls placed on its behalf, so one call can produce claims against both.

Do TCPA calling hours apply to collection calls? Mostly not. The 8 a.m. to 9 p.m. rule in 64.1200(c)(1) covers sales calls to residential subscribers, and a call about a balance owed is not subject to it.

Does the national Do Not Call registry stop collection calls? Generally no. The registry covers sales calls, and collecting an existing debt is not the same, so a registration does not bar the call. Withdrawn consent, however, stops automated and recorded calls, but that is a separate record from the registry.

Is a predictive dialer TCPA-compliant? No dialer is compliant or non-compliant on its own. Compliance depends on how you configure settings and manage customer consent, do-not-call lists, calling hours, opt-outs, and call recordings.

Do we have to check the Reassigned Numbers Database? No rule requires it, but the protection 64.1200(m) affords you is not available without the check. Wrong-party contacts are the basis of most TCPA claims against collections operations, and aged portfolios are full of numbers that have changed hands, so skipping the query means carrying the whole risk yourself.

What are TCPA penalties per call? $500 per call, or actual losses if greater, with a court able to treble it for a knowing or willful violation. Per-call is the wrong unit to plan around, though, as in March 2026, 77.7% of TCPA suits were putative class actions.