FDCPA, TCPA & Regulation F: The Collections Compliance Playbook for 2026

Part 1: The FDCPA — The Foundation Every Collections Operation Must Know

What Is the FDCPA?

The Fair Debt Collection Practices Act (FDCPA) was enacted in 1977 and remains the foundational federal law governing debt collection in the United States. It is enforced by both the Federal Trade Commission (FTC) and the Consumer Financial Protection Bureau (CFPB). A critical distinction: the FDCPA applies to third-party debt collectors — meaning collection agencies, debt buyers, and collection law firms — not to original creditors collecting their own debts.

However, many states have extended FDCPA-equivalent protections to original creditor collections as well. Organizations in multiple states must be aware of these nuances to avoid exposure.

Core FDCPA Prohibitions

The FDCPA establishes four primary categories of prohibited conduct:

• Harassment or Abuse: Collectors cannot use threatening, obscene, or abusive language. They cannot call repeatedly with the intent to annoy. They cannot threaten violence or publish debtors’ names as refusal to pay.
• False or Misleading Representations: Collectors cannot misrepresent the amount owed, falsely imply they are attorneys or government representatives, threaten arrest for debts, or misrepresent the nature of any document.
• Unfair Practices: Collectors cannot collect amounts not authorized by the original agreement, deposit post-dated checks prematurely, use deceptive means to locate consumers, or communicate by postcard (which exposes debt to third parties).
• Communication Restrictions: Collectors may only contact consumers between 8:00 AM and 9:00 PM in the consumer’s local time zone. They must cease communication if the consumer sends a written cease-and-desist request.

FDCPA Penalties and Litigation Risk

The statutory damage for an individual FDCPA violation is $1,000, plus attorney fees and actual damages. While the per-violation amount appears modest compared to TCPA, FDCPA class actions can result in aggregate damages of up to $500,000 or 1% of the defendant’s net worth. The deeper risk is reputational: FDCPA complaints to the CFPB are publicly searchable, and patterns of violations can trigger regulatory enforcement actions.

Part 2: TCPA — The Highest Financial Exposure in Collections Compliance

What Is the TCPA?

The Telephone Consumer Protection Act (TCPA), enacted in 1991 and updated multiple times since, regulates how businesses use automated technology to contact consumers by phone and text. For collections operations, the TCPA is arguably the most financially dangerous regulatory framework because its penalties apply per call or message, scale instantaneously with volume, and attract class action attorneys who specialize in TCPA litigation.

The TCPA Penalty Schedule (2026)

To illustrate the financial scale: a mid-size collections operation sending 100,000 text messages to a list with consent documentation gaps faces potential liability of $50 million at the $500 standard rate — and $150 million if violations are deemed willful. These are not theoretical numbers; multiple nine-figure TCPA settlements have been reached in the debt collection industry over the past five years.

Key TCPA Rules for Collections Operations

• Prior Express Consent: Before using an Automated Telephone Dialing System (ATDS) or pre-recorded voice to contact a consumer’s mobile phone, collections operations must have documented prior express consent. Consent obtained at account opening may not satisfy TCPA requirements if the original language did not specifically authorize collection calls.
• Revocation of Consent: Consumers can revoke TCPA consent at any time, through any reasonable means. Once revoked, subsequent automated contact is a violation. Systems must be in place to immediately honor revocation across all contact channels.
• The Reassigned Number Problem: If a phone number has been reassigned to a new consumer who never gave consent, calling that number is a TCPA violation. The FCC maintains a Reassigned Numbers Database (RND) to help callers verify current number ownership.
• Text Messaging: SMS and MMS messages sent using automated systems are subject to the same TCPA consent requirements as calls. Marketing texts require express written consent; purely informational texts may require less, but the distinction is not always clear.

Do Not Call (DNC) Registry: Collections calls to numbers on the National DNC Registry without prior consent or an established business relationship are separate TCPA violations.

Part 3: Regulation F — CFPB’s Modern Interpretation of the FDCPA

Background and Effective Date

Regulation F (12 CFR Part 1006) was issued by the CFPB on November 30, 2020, and took effect on November 30, 2021 — the most significant update to federal debt collection regulation in more than 40 years. It does not replace the FDCPA; rather, it implements and modernizes the FDCPA for the realities of 21st-century communication channels, establishing specific rules where the statute was silent or ambiguous.

In 2025–2026, with the CFPB operating under reduced staffing and enforcement capacity due to budget disputes and organizational changes, the practical enforcement of Regulation F has shifted meaningfully toward state attorneys general and private litigation. The regulatory framework remains fully in force; what has changed is who is most likely to bring an enforcement action.

The 7-in-7 Rule: Understanding the Call Frequency Cap

This distinction — ceiling, not quota — is one of the most common operational compliance failures. Operations leaders who treat the 7-in-7 rule as permission to make seven calls per week on every account will eventually face enforcement actions. The rule establishes a presumption of harassment; regulators retain authority to pursue violations at lower frequencies if other evidence of harassment is present.

Regulation F’s Expanded Communication Channel Rules

Regulation F was specifically designed to address the reality that debt collection no longer happens exclusively by phone and letter. Key provisions include:

• Electronic Communications: Collectors may now contact consumers via email and text message, provided they include a clear opt-out mechanism in every electronic message and use electronic communication methods that the consumer has provided for use in connection with the debt.
• Social Media: Regulation F permits contact via social media only through private, direct channels that are not visible to the consumer’s social network. Given the third-party disclosure risk (which constitutes an FDCPA violation), most sophisticated compliance programs prohibit social media contact entirely.
• Voicemail: Voicemail messages, including ringless voicemails, must not disclose the debt to third parties while still providing the consumer with enough information to understand a debt collector is attempting to reach them.
• Model Validation Notice: Collectors who use the CFPB’s model validation notice receive a safe harbor from certain disclosure-related FDCPA claims. The notice must include the debt amount, the creditor’s name, an itemized breakdown, and instructions for disputing the debt. It must be delivered within five days of initial contact.
• Time-Barred Debt: Under Regulation F, it is a federal violation to sue or threaten to sue over a debt where the statute of limitations has expired. This significantly affects how collectors manage aged portfolios.

Part 4: State-Level Compliance — The Increasingly Active Enforcement Layer

As federal enforcement has contracted, state-level debt collection regulation has expanded significantly. Organizations operating nationally must now maintain compliance frameworks that accommodate both federal rules and a growing body of state-specific requirements.

Part 5: How AI and Automation Enforce (Not Replace) Compliance

Technology does not solve a compliance gap — it operationalizes a compliance strategy. Organizations that deploy AI and automation correctly can significantly reduce violation risk while maintaining effective collection operations. Key applications include:

Call Frequency Management

AI-driven contact management systems can enforce the 7-in-7 rule at the account level in real time, preventing agents or auto-dialers from exceeding permitted call attempts. These systems can also track the seven-day post-conversation lockout period, which is one of the most commonly violated Regulation F provisions.

Consent Documentation and Revocation Handling

Automated consent management platforms log prior express consent at the point of collection, track consent type (oral vs. written vs. electronic), and immediately flag revocations across all communication channels. In a compliance audit or litigation proceeding, this documentation is often the difference between a defensible position and a settlement.

Reassigned Number Verification

Integration with the FCC’s Reassigned Numbers Database before each campaign prevents the most common source of TCPA exposure: calling a number that has been assigned to a new consumer since consent was obtained.

Real-Time Compliance Scoring

AI-powered QA platforms can score every agent interaction against FDCPA and Regulation F requirements in real time, flagging potential violations before they are completed and triggering supervisor review for high-risk interactions.

Part 6: What to Demand From a Third-Party Collections BPO Partner

If your organization outsources any portion of your ARM operations, your compliance exposure does not transfer with the contract. BPOs can be held directly liable for FDCPA and TCPA violations, but client organizations are also frequently named in consumer lawsuits and CFPB complaints. When evaluating a third-party collections partner, require documentation and audit rights covering:

• FDCPA and Regulation F training programs and frequency, with agent certification records
• TCPA consent management system with real-time revocation handling and reassigned number verification
• 7-in-7 enforcement technology at the dialer and campaign management level
• AI-powered quality assurance with compliance scoring on 100% of recorded interactions
• Documented state-specific compliance protocols for jurisdictions where your accounts are located
• Errors and Omissions (E&O) and TCPA insurance coverage amounts
• Most recent third-party compliance audit results and any regulatory actions or consent orders
• Data security certifications relevant to consumer financial data (SOC 2 Type II, PCI DSS)