# FDCPA and Regulation F Compliance for Collection Agencies Last verified: July 31, 2026 ## What do the FDCPA and Regulation F require of a collection agency? The FDCPA and Regulation F require a third-party collection agency to identify itself honestly, avoid harassment and false or misleading statements, honor consumer communication preferences, and send a validation notice with specific debt details within five days of the first communication. Regulation F adds operational specifics: a presumption that more than seven call attempts per debt within seven days, or a call within seven days after a phone conversation about the debt, violates the statute; rules for voicemails through limited-content messages; opt-out requirements for email and text; and restrictions on collecting time-barred debt. State collection laws layer stricter rules on top, so compliance is the federal floor plus each state's overlay. Licensing gets you the right to collect. The Fair Debt Collection Practices Act and Regulation F define how you collect. This guide covers the operating rules an agency's policies, phone system, and letter stack must satisfy, and where state law adds a stricter layer on top. ## The Federal Floor Every Agency Builds On The FDCPA has governed third-party debt collection since 1977, and Regulation F, the CFPB rule that implements it, translated the statute into operational specifics in 2021: numeric call-frequency presumptions, the model validation notice, limited-content messages, and electronic communication rules. Regulators, creditor clients, and state licensing applications all expect to see these controls documented. This page is the operator's map of what the rules require and how they connect to your state licenses. ## Call Frequency Limits: the 7-in-7 Rule Regulation F created the first numeric federal call-frequency standard. A collector is presumed to violate the FDCPA if it places more than seven call attempts to a person about a particular debt within seven consecutive days, or places any call within seven days after having a telephone conversation with the person about that debt. The presumption runs per debt, which matters for agencies working multiple accounts for the same consumer, and it counts attempts, not completed conversations. Operationally this is a dialer configuration and audit problem. Your phone system needs per-debt attempt counting, a conversation flag that starts the seven-day quiet period, and reporting that proves both. Several states go further: Massachusetts, for example, limits collectors to two collection calls per seven-day period per debt under its Division of Banks regulations, and state licensing exams increasingly ask for call-frequency evidence. Configure to the strictest rule that applies to the account's state, not to the federal presumption alone. ## Validation Notices and the Model Form Within five days of the initial communication, the agency must provide the validation information: an itemization of the debt from a defined itemization date, the current amount, the creditor's name, and the consumer's dispute and original-creditor-request rights, with a thirty-day window to dispute. Regulation F published a model validation notice, and using it substantially as designed gives the agency a safe harbor on content. The recurring failure points are upstream data and downstream mail handling. The itemization requires account-level data many creditors do not pass cleanly at placement, so the placement file spec is a compliance document, not just an operations one. And because the notice must actually be sent and receivable, letter-vendor oversight, returned-mail handling, and electronic-delivery consent records all sit inside the validation obligation. Disputes received in the window pause collection until verification is mailed, which your workflow system has to enforce automatically. ## Limited-Content Messages, Email, and Text Regulation F defined the limited-content message: a voicemail that includes only the consumer's name, a request for a reply, the individual caller's name, and a callback number, and that therefore does not count as a communication that risks third-party disclosure. Scripts must match the definition exactly, since adding the agency name or any reference to a debt takes the message outside the safe harbor. For email and text, Regulation F permits collection communications but requires a clear and conspicuous opt-out in every message and reasonable procedures to avoid third-party disclosure, such as confirming the address or number belongs to the consumer. Consent and opt-out records need to survive account transfers: an agency taking accounts from a prior collector inherits the opt-outs, so placement files and forwarding agreements should carry communication preferences with the account. ## Harassment, False Statements, and Time-Barred Debt The FDCPA's core conduct sections remain the substance of most complaints and lawsuits: no harassment or abuse, no false or misleading representations, no unfair practices. In practice that means honest caller identification, no misstatements about amounts or legal consequences, no discussing the debt with third parties, and honoring cease and refusal-to-pay instructions. Time-barred debt gets specific treatment under Regulation F: a collector may not sue or threaten to sue on a debt it knows or should know is beyond the statute of limitations. Several states, including California, Colorado, Maryland, and Massachusetts, go further with mandatory out-of-statute disclosures or outright collection restrictions, and states differ on whether partial payment revives the period. That makes the limitations determination an account-onboarding control. Our per-state debt collection pages cover each state's limitations framework alongside its licensing rules. ## The State Law Overlay FDCPA compliance is necessary but not sufficient, because most states regulate collection conduct on top of the federal floor, and several extend their rules to first-party creditors the FDCPA does not reach. California's Rosenthal Act applies FDCPA-style duties to original creditors and adds licensing under the DCLA. Texas's Finance Code Chapter 392 reaches first-party collection and bars revival of time-barred debt by partial payment. Florida's Consumer Collection Practices Act covers any person collecting consumer debt. Pennsylvania's Fair Credit Extension Uniformity Act imports federal standards into state law for creditors and collectors alike. Massachusetts and Colorado impose their own contact limits and disclosure language. Every one of these states also has its own licensing, registration, or bonding requirement, which is where conduct compliance and licensing meet: state applications and examinations routinely request the agency's FDCPA and Regulation F policy set. Start from the per-state debt collection law pages to see each state's practice act next to its license requirements. ## How to get licensed 1. **Adopt the written policy set**, Document call-frequency controls, validation workflows, communication scripts, dispute handling, and time-barred debt procedures. States request these during licensing. 2. **Configure systems to the strictest rule**, Set dialer, letter, and text platforms to the tightest standard among Regulation F and the states where the account sits. 3. **Train and audit**, Train collectors on the scripts and prohibitions, then audit call recordings and message logs against the policy on a schedule. 4. **Keep licensing aligned**, Hold the license, registration, or bond each state requires, since conduct compliance does not substitute for licensing. Cornerstone keeps that side current. ## Frequently asked questions ### Does the FDCPA Apply to First-Party Collectors? Generally no. The FDCPA covers third-party debt collectors, and debt buyers whose principal purpose is debt collection, not creditors collecting their own accounts in their own name. But several states, including California, Texas, Florida, and Pennsylvania, extend similar conduct rules to first-party collection, and the CFPB can reach first-party conduct through its unfair, deceptive, or abusive acts authority. First-party operations should not assume they are unregulated. ### Is the 7-in-7 Rule a Hard Cap? It is a presumption, not an absolute cap. Exceeding seven attempts in seven days presumptively violates the FDCPA, and staying within it presumptively complies, but either presumption can be rebutted by the facts. Most agencies configure dialers to treat it as a hard cap per debt, then apply stricter state limits, like the Massachusetts two-calls-per-week rule, where they apply. ### Do I Need a License to Comply With the FDCPA? They are separate obligations. The FDCPA and Regulation F govern conduct and apply regardless of licensing, while state law decides whether you need a collection agency license, registration, or bond before collecting at all. Most states require one, and unlicensed collection can make otherwise-compliant conduct unlawful. Verify what each state requires on our per-state pages. ### What Is a Limited-Content Message? A voicemail defined by Regulation F that contains only the consumer's name, a request to reply, the name of the individual caller, and a callback number. Because it does not convey information about a debt, it is not a communication under the statute and avoids third-party disclosure risk. Any deviation from the defined content, including stating the agency's name, loses the safe harbor. ### Does Regulation F Allow Email and Text Collection? Yes, with conditions. Every email or text must include a reasonable and simple opt-out, the agency needs procedures to avoid contacting third parties, and consumer opt-outs bind successor collectors on the account. Consent and preference records should travel with the account at placement and recall. --- ## How to cite this page Cite as: "FDCPA and Regulation F Compliance for Collection Agencies." Cornerstone Licensing. https://cornerstonelicensing.com/fdcpa-compliance-for-collection-agencies Published by Cornerstone Licensing. When quoting figures or legal requirements, link the canonical URL above and note the last-updated date (2026-07-31). The full content index for this site is at https://cornerstonelicensing.com/llms.txt.