NYC SHIELD Rule Takes Effect January 1, 2027: What Financial Services Businesses Need to Know

The New York City Department of Consumer and Worker Protection (DCWP) has finalized amendments to its debt collection regulations under the Stopping Harassment and Intimidation and Ensuring Lawful Debt Collection (SHIELD) Rule.

Originally scheduled to take effect September 1, 2026, the implementation date was extended to January 1, 2027, to allow additional time for regulatory guidance and operational adjustments.

The requirements extend beyond traditional collection agencies. Depending on their activities, debt buyers, original creditors, and other financial services businesses may also be subject to the rule.

Which Businesses Are Subject to the SHIELD Rule?

The SHIELD Rule applies to debt collection activities involving New York City consumers, including those conducted by businesses located outside the city.

Covered businesses may include:

• Third-party debt collection agencies

• Debt buyers collecting directly or through third parties

• Original creditors collecting their own debts

• Lenders and financial institutions engaged in covered collection activities

• Debt collection attorneys and law firms, subject to applicable exceptions

Importantly, the SHIELD Rule's conduct requirements are broader than New York City's debt collection agency licensing requirements. A business that does not require a DCWP debt collection agency license may still be subject to the rule when engaging in covered debt collection activities.

The distinction between routine account servicing and debt collection is particularly important for lenders and creditors.

According to DCWP guidance, debt collection procedures generally begin when a creditor stops sending routine statements or bills, takes or threatens legal action, accelerates the unpaid balance, or demands payment of the full outstanding balance.

Ordinary billing, customer service, and servicing activities on accounts that are not subject to debt collection procedures are not covered.

1. Collection Communications Are Limited to Three Within Seven Days

One of the most significant operational requirements is a limit of three collection communications or attempted communications per distinct consumer account within a seven-day period.

The restriction applies across communication channels, including telephone calls, text messages, emails, and qualifying voicemail messages.

The limit is calculated per account rather than per consumer.

Certain communications are excluded, including mailed letters, responses to consumer inquiries, and an initial electronic message sent solely to obtain consent for electronic communications. Litigation-related communications also have specific exceptions.

These limits apply to covered collection activity beginning January 1, 2027, regardless of when an account was purchased, charged off, or entered collections.

Businesses using multiple communication platforms should ensure their systems can track activity across channels and prevent contacts that would exceed the permitted frequency.

2. Electronic Collection Communications Require Appropriate Consent

The rule establishes specific conditions for contacting consumers electronically.

Generally, debt collectors must obtain direct, revocable written consent for the particular debt account and communication method before using email or text messaging for collection purposes.

There are limited exceptions, including certain prior consents obtained by original creditors and situations in which consumers have recently initiated electronic communications about the debt.

Under guidance updated October 22, 2026, DCWP clarified that consent may be obtained through an electronic confirmation link if applicable requirements are satisfied.

The initial electronic message must be used solely to request consent, not to collect the debt. The consumer must affirmatively agree, such as by selecting an "I Consent" button, and the electronic signature must comply with applicable laws.

Electronic collection communications must also disclose the consumer's right to revoke consent.

Additional restrictions apply to employer-provided email addresses and telephone numbers.

Organizations should review existing consent records to determine whether they meet the rule's requirements and whether consent can be documented for each account and communication channel.

3. Consumers Can Dispute Debts at Any Time

The SHIELD Rule expands consumers' ability to dispute debts and request verification.

Consumers may submit disputes verbally or through any communication method the debt collector uses. For accounts subject to the new verification requirements, a consumer's first dispute or verification request generally requires the collector to stop collection activity until the required written verification has been provided.

Debt collectors generally have 60 days from receipt of the first dispute or verification request to provide supporting documentation.

If the debt cannot be verified within that period, the rule requires a Notice of Unverified Debt, with different consequences for original creditors and other collectors.

For original creditors, collection cannot resume until written verification has been provided. Other debt collectors subject to these provisions must cease collection efforts after issuing the required notice.

These verification requirements have important exceptions and transition provisions. For example, certain requirements do not apply to accounts purchased before January 1, 2027, or accounts whose validation notices were required before that date. Specific exceptions also apply to certain accounts governed by the Fair Credit Billing Act.

Businesses should review how disputes are identified, documented, escalated, and resolved. A consumer does not necessarily need to use the word "dispute" to trigger the applicable process.

4. Validation Notices Must Include Additional Information

Debt collectors generally must mail a validation notice within five days of their initial collection communication, subject to applicable exceptions.

Under the SHIELD Rule, notices must include required disclosures concerning consumers' rights, debt verification, language services, and other account information.

Required information may include the collector's applicable DCWP license number, a named individual and telephone number for account inquiries, and an itemization of the debt, including the basis for additional interest or fees.

Sending the validation notice exclusively by email does not satisfy the rule, even when the consumer has consented to electronic communications.

The updated DCWP guidance also addresses requirements for assigned callback personnel. Licensed debt collection agencies must maintain telephone systems that connect consumers to a qualified person within the applicable 120-second connection window.

Businesses should review their validation notice templates, account information, and callback procedures to determine whether changes are necessary.

5. Additional Rules Address Medical Debt, Credit Reporting, and Time-Barred Accounts

The SHIELD Rule also contains provisions affecting specific types of collection activity.

Medical debt: Additional protections address medical debt disputes, insurance coverage, hospital financial assistance, and related medical accounts. Validation notices must include a disclosure that medical debt cannot be reported to a consumer reporting agency, even when the collector is collecting a different type of debt.

Credit reporting: Subject to specified exceptions, debt collectors must provide consumers with notice before furnishing negative collection information to consumer reporting agencies and wait at least 14 consecutive days after sending that notice.

Time-barred debt: Collectors must maintain reasonable procedures for identifying debts beyond the applicable statute of limitations. When collecting time-barred debt, the rule generally requires a mailed notice and a waiting period of at least 14 consecutive days before contacting the consumer to collect.

These provisions may require updates to notices, account classification processes, and collection workflows.

6. Recordkeeping and Third-Party Oversight Requirements

Businesses must also maintain records demonstrating adherence to applicable NYC debt collection requirements.

The SHIELD Rule requires monthly logs or records covering consumer complaints, disputes, verification requests, and requests to stop communication.

Records must identify relevant account information, the nature and source of the request, and the response provided.

Additional recordkeeping requirements apply to licensed collection agencies, including records of incoming and outgoing oral communications.

The rule also addresses the transfer of account information when debts are sold, reassigned, or placed with another collection agency or attorney.

DCWP has confirmed that debt collectors are responsible for violations committed by employees, contractors, and agents acting on their behalf.

Businesses using outsourced collection services should account for these requirements when reviewing vendor procedures and account transfers.

What Financial Services Businesses Should Review Before January 1

With implementation approaching, affected organizations should evaluate the following:

• Applicability and licensing: Determine which activities fall within the SHIELD Rule and separately confirm whether a NYC debt collection agency license is required.

• Communication systems: Review contact frequency tracking, electronic consent records, and restrictions on employer-provided contact information.

• Dispute and verification procedures: Confirm that employees can recognize disputes, suspend collection when required, and meet applicable verification deadlines.

• Notices and account documentation: Review validation notices, debt itemizations, consumer disclosures, and supporting account records.

• Staff and vendor procedures: Update training, recordkeeping, and third-party collection workflows to reflect applicable requirements.

Preparing for the January 1 Deadline

The SHIELD Rule establishes additional responsibilities for businesses collecting consumer debts from New York City residents. Its requirements may affect both licensed debt collection agencies and financial institutions collecting their own accounts.

The effective date is January 1, 2027, but businesses should pay close attention to the rule's transition provisions, particularly those governing existing accounts and verification requirements.

DCWP has published updated FAQs, sample notices, and recordkeeping resources to help businesses understand the requirements.

For businesses conducting debt collection activities in New York City, confirming licensing obligations remains an important part of the review.

Cornerstone Licensing helps debt collection businesses, debt buyers, lenders, and other financial services companies navigate state and local licensing requirements. If your business is evaluating its NYC licensing obligations or expanding collection activities into new jurisdictions, contact our licensing specialists.

Official Resources

NYC DCWP: Adopted SHIELD Rule

NYC DCWP: Updated SHIELD Rule FAQs (October 22, 2026)

NYC DCWP: SHIELD Rule Effective Date