FDCPA Compliance for Collections Calling (2026)

For a debt-collection agency, the phone is still the core of the operation — and it is also the single biggest source of regulatory risk. The Fair Debt Collection Practices Act (FDCPA) and its implementing rule, the Consumer Financial Protection Bureau's Regulation F, set out detailed limits on how, when, and how often collectors may call consumers. Getting the dialer configuration wrong is not a technicality: it can expose an agency to statutory damages, class actions, and reputational harm. This guide walks through the FDCPA calling rules that matter most in 2026 and shows how compliance-supporting dialer controls help operators build the right guardrails into their outbound workflow.

A note before we start: this article is general information, not legal advice, and debt-collection law evolves through new rulemaking and court decisions. Every collection program should be reviewed with qualified counsel before it goes live.

What the FDCPA Is and Who It Binds

The FDCPA is a federal consumer-protection statute enacted in 1977 to eliminate abusive, deceptive, and unfair debt-collection practices. It is enforced by the Federal Trade Commission and the CFPB, and it also gives consumers a private right of action.

Crucially, the FDCPA generally applies to third-party debt collectors — agencies collecting debts owed to another party, debt buyers, and collection law firms — rather than to a creditor collecting its own debts in its own name. That said, first-party creditors and BPOs collecting on behalf of others should treat FDCPA-style rules as a baseline, because many states extend similar requirements to first-party collection and because the TCPA and state mini-FDCPA statutes apply regardless of who owns the debt. The safest posture for any regulated contact center is to build the controls in once and apply them consistently.

Regulation F Call-Frequency Limits

The most consequential change to collections calling in recent years came with Regulation F, which took effect in November 2021 and remains in force in 2026. Regulation F introduced concrete, numeric call-frequency limits where the FDCPA previously offered only a general prohibition on calls "repeatedly or continuously" intended to annoy or harass.

• The seven-in-seven rule. A collector is presumed to violate the frequency limit if it places telephone calls to a person more than seven times within a seven-day period regarding a particular debt. The count is per debt, so a consumer with multiple accounts is analyzed account by account — a detail your dialer needs to track carefully.
• The seven-day rule after a conversation. A collector is presumed to violate the limit if it calls a person about a particular debt within seven days after having a telephone conversation with that person about the debt. The clock starts at the conversation, not at the last dial.
• Presumptions, not safe harbors. Staying under these numbers creates a presumption of compliance, and exceeding them creates a presumption of a violation — but both are rebuttable. Certain call attempts may be excluded from the count in specific circumstances, so agencies should document how they count and why.

Because these limits are counted per debt and per consumer across a rolling window, manual tracking is error-prone at scale. This is exactly the kind of rule that belongs in automated frequency-cap enforcement rather than a spreadsheet.

Inconvenient Times and Places

The FDCPA prohibits communicating with a consumer at any time or place the collector knows or should know is inconvenient. Absent knowledge to the contrary, the statute sets a presumptively convenient window.

The local-time requirement is a common failure point for multi-state campaigns: a call placed at 8:30 p.m. from the agency's headquarters may be well after 9 p.m. where the consumer lives. Time-zone-aware dialing that keys off the consumer's actual location — not the agency's clock — is the control that prevents this. You can sanity-check specific numbers against local windows with our calling-hours checker tool.

Required Disclosures and the Mini-Miranda

Collectors must identify themselves and the nature of the communication in specific ways:

• The "mini-Miranda" notice. In the initial communication (and, under the FDCPA, in subsequent communications), the collector must disclose that it is attempting to collect a debt and that any information obtained will be used for that purpose. Many programs deliver this on every call to be safe.
• Meaningful disclosure of identity. The caller must meaningfully identify who is calling. Hiding the collector's identity or leaving deceptive messages is prohibited.
• Truthful, non-deceptive statements. The FDCPA broadly prohibits false or misleading representations about the amount, legal status, or consequences of the debt.

Third-Party Contact and Disclosure Limits

The FDCPA sharply restricts what a collector may say to anyone other than the consumer (and, generally, the consumer's spouse or attorney). When contacting third parties — for example, to obtain location information such as a phone number or address — the collector generally may not:

• State that the consumer owes any debt;
• Communicate with any third party more than once, unless requested or reasonably necessary;
• Use language or symbols on an envelope or in a caller ID that indicate the caller is in the debt-collection business.

In practice this means agents need scripts and screen prompts that behave differently depending on who answers the phone, and dispositions that record third-party contacts distinctly. That kind of structured, prompt-driven workflow is easier to enforce when it is built into the dialer rather than left to agent memory.

Debt Validation Notice

Within five days after the initial communication, the collector must send the consumer a validation notice (unless the required information was already provided in the initial communication). Regulation F prescribes the content and provides a model validation notice. The notice generally must include:

• The amount of the debt and information about the current creditor;
• An itemization of the debt as of a reference date;
• A statement of the consumer's right to dispute the debt and to request the name of the original creditor within the 30-day validation period;
• Consumer-response prompts (tear-off or equivalent) that make it easy to dispute or request information.

During the 30-day validation window, if the consumer disputes the debt in writing, the collector must cease collection until it obtains and mails verification of the debt.

Cease-Communication and Dispute Handling

Two consumer requests carry immediate operational consequences for your dialing lists:

• Cease-communication requests. If a consumer notifies the collector in writing that they refuse to pay the debt or that they wish the collector to stop communicating, the collector must stop — with narrow exceptions (for example, to advise that collection efforts are being terminated or that a specific remedy may be invoked). A number under a cease request must be suppressed from further campaigns immediately.
• Attorney representation. If the collector knows the consumer is represented by an attorney regarding the debt and can readily obtain the attorney's contact information, the collector generally must communicate with the attorney instead.
• Dispute suppression. A timely written dispute pauses collection on that account until verification is provided.

Each of these is fundamentally a suppression event: a signal that a number or account must be pulled from active dialing. Handling them reliably requires DNC/cease suppression that propagates across every campaign in real time, which is a core reason agencies move suppression logic out of manual list edits and into the platform.

Electronic Communications and Opt-Out Under Regulation F

Regulation F also modernized the rules for email and text messages. Collectors may communicate through these channels, but they must provide a reasonable and simple method for the consumer to opt out of receiving communications through that channel. Once a consumer opts out of a channel, the collector must honor it. Regulation F also addresses limited-content messages and safe-harbor procedures for reducing the risk of unintended third-party disclosure when using electronic channels. As with voice suppression, opt-outs across channels should feed the same suppression system so a text opt-out is respected everywhere.

Recordkeeping and Audit Trails

Because so many FDCPA and Regulation F requirements turn on what happened and when — how many calls were placed in the rolling window, whether a conversation occurred, when a cease request arrived, whether the validation notice was sent — defensible recordkeeping is the backbone of any collections compliance program. Regulation F includes record-retention obligations, and in practice agencies want complete, tamper-evident logs of every dial, disposition, and consent or suppression event. If you cannot reconstruct a call's history, you cannot rebut a presumed violation. Our outbound dialer compliance checklist covers the audit-trail fields worth capturing on every attempt.

How the FDCPA Interacts With the TCPA

The FDCPA and the TCPA are separate laws that frequently apply to the same collection call. The FDCPA governs collector conduct — frequency, disclosures, harassment, third-party contact. The TCPA governs the technology and consent — autodialers, prerecorded voices, calls and texts to wireless numbers, and the Do Not Call framework. A collection call can satisfy the FDCPA and still violate the TCPA (for example, an autodialed call to a cell phone without the required consent), or vice versa. Multi-state agencies must also layer in state mini-FDCPA and mini-TCPA statutes, several of which are stricter than the federal baseline. Treat federal law as a floor and build to the strictest applicable rule. For a deeper look at the consent side, see our 2026 TCPA compliance guide.

Dialer Controls That Support Compliance

No software can guarantee compliance — compliance is an outcome of policy, training, legal review, and consistent execution. What a well-designed dialer can do is provide compliance-supporting controls that make the right behavior the default and the wrong behavior hard. DialerBee, built by BroadNet Technologies, is a multilingual AI outbound dialer for collections agencies and other regulated contact centers, and its compliance-supporting controls include:

• Calling-window enforcement. Time-zone-aware dialing that keys off the consumer's local time and blocks attempts outside the permitted 8 a.m.–9 p.m. window (and any tighter state windows) automatically.
• Frequency-cap enforcement. Configurable per-debt and per-consumer caps that support the seven-in-seven and post-conversation seven-day presumptions, counted across a rolling window so agents cannot inadvertently over-dial.
• DNC and cease suppression. Real-time suppression that removes numbers under cease-communication requests, disputes, attorney-representation flags, and channel opt-outs across every active campaign at once.
• Disposition and audit logging. Structured dispositions and complete, time-stamped call records — including third-party contacts and consent events — to support defensible recordkeeping.
• Language-aware AI. Language-aware AI that helps agents deliver required disclosures and channel opt-out information clearly to consumers across languages, keeping scripts consistent.

Used together, these controls help operators reduce the manual, error-prone steps that most often lead to violations. They support compliance; they do not replace your policies, your counsel, or your training. To see how these controls fit an end-to-end program, explore compliance autopilot and the broader compliance feature set.

Frequently Asked Questions

How many times can a debt collector call under the FDCPA?

Under Regulation F, a collector is presumed to violate the frequency limit if it places more than seven telephone calls about a particular debt within a seven-day period, or if it calls within seven days after having a telephone conversation about that debt. These are rebuttable presumptions counted per debt, not absolute hard caps, so agencies should document how they count attempts.

What are the legal calling hours for collections calls?

The FDCPA presumes that calls before 8:00 a.m. or after 9:00 p.m. in the consumer's local time zone are inconvenient and therefore prohibited, unless the consumer agrees otherwise. If a collector knows a particular time or place is inconvenient for a specific consumer, it must avoid that time even within the 8-to-9 window.

Does the FDCPA apply to first-party creditors?

The FDCPA generally applies to third-party debt collectors, debt buyers, and collection law firms rather than to creditors collecting their own debts in their own name. However, many states extend similar requirements to first-party collection, and the TCPA applies regardless of who owns the debt, so first-party operations often build to the same standards.

What is a debt validation notice and when is it required?

A validation notice is a written notice, prescribed in content by Regulation F, that must be sent within five days after the initial communication unless the information was already provided. It states the amount and creditor, itemizes the debt, and explains the consumer's 30-day right to dispute the debt or request the original creditor's name. A timely written dispute pauses collection until verification is mailed.

Can a dialer make my agency FDCPA compliant?

No software can make an agency compliant on its own. A dialer can provide compliance-supporting controls — such as calling-window enforcement, frequency caps, cease and DNC suppression, and audit logging — that make compliant behavior the default and give you defensible records. Compliance still depends on your policies, training, and review with qualified counsel.