This guide is general legal information, not legal advice, and does not create an attorney–client relationship. Rules change and vary by state — verify current requirements with official sources or a licensed attorney.
Two questions decide most debt collection compliance problems, and lending platforms often answer only the first. The first is: does federal debt collection law apply to us? The second, and usually the costlier one, is: does any state require us to hold a licence before we contact a borrower about an overdue account?
The answers diverge. The federal Fair Debt Collection Practices Act is aimed primarily at third parties collecting debts owed to someone else, so a creditor collecting its own loans often sits outside it. State licensing statutes follow no such uniform rule. Some cover only third-party agencies, some sweep in debt buyers explicitly, and some reach first-party collection or servicing activity as well.
Key takeaways
- The FDCPA generally regulates parties collecting debts owed to another, with the CFPB's Regulation F supplying detailed conduct rules — call frequency presumptions, validation notice content, electronic communication rules, and limits on time-barred debt.
- State collection agency licensing varies dramatically: coverage of debt buyers, servicers, and original creditors differs, as do bond amounts, and no state's approach should be treated as the national rule.
- A first-party creditor outside the FDCPA is still exposed under unfair and deceptive practice authority, state mini-FDCPA statutes, and telephone and privacy laws.
- Outsourcing collections does not outsource risk: regulators expect the creditor to select, contract with, and monitor its collection vendors.
- Collection activity feeds credit reporting, so furnishing duties and dispute handling need to be designed as part of the same programme.
The federal layer: FDCPA and Regulation F
The FDCPA has been in force since the late 1970s, but for four decades it lacked implementing regulations. That changed with Regulation F, which the CFPB issued to interpret and operationalize the statute. The rule addresses several areas that had generated decades of litigation.
Call frequency and communication limits
Regulation F establishes a presumption of compliance where a collector places no more than seven calls in seven consecutive days regarding a particular debt, and does not call within seven days after a telephone conversation about that debt. Exceeding those figures creates a presumption of violation. The rule also preserves the statutory prohibitions on contacting a consumer at unusual or inconvenient times or places, and on contacting a consumer known to be represented by counsel.
Limited-content messages and the validation notice
The rule defines a "limited-content message" — a voicemail containing only specified elements — that does not count as a communication about a debt, giving collectors a safer way to request a callback. It also prescribes the content of the validation notice, including information identifying the debt, an itemization reference date, and a description of the consumer's dispute rights. The bureau published a model form; use of it carries a safe harbour.
Email, text, and opt-outs
Regulation F contemplates electronic communication with procedures for a reasonable and simple opt-out method in each electronic message, and sets expectations around email and text addresses that reduce the risk of disclosing a debt to third parties. Collectors are also barred from suing or threatening suit on debt they know or should know is beyond the limitations period.
Practical note: Regulation F sets a federal floor. Several states impose additional restrictions on contact frequency, communication channels, or required disclosures, and those apply on top of the federal rule. Complying with Regulation F alone does not establish compliance in a state with stricter requirements.
Who is covered — and who thinks they are not
| Role | FDCPA / Regulation F | State licensing exposure |
|---|---|---|
| Third-party collection agency | Squarely covered | Licence commonly required; bonds and registered agents typical |
| Debt buyer collecting purchased defaulted debt | Generally covered, because the debt was in default when acquired | Many states licence debt buyers expressly; some added categories in recent years |
| Original creditor collecting its own current loans | Usually outside the statute's core definition | Varies widely — some states reach first-party activity, others exempt it |
| Servicer collecting for the loan owner | Depends on default status at the time servicing began and on how the arrangement is structured | May need collection, servicing, or lending licences depending on the state and product |
| Software vendor providing dialers or letters | Depends on the degree of involvement in collection activity | Generally lower, but "collection as a service" models draw scrutiny |
The most common miscalculation is the assumption that being a first-party creditor removes all federal risk. It does not. Unfair, deceptive, or abusive practice authority applies to collection conduct regardless of who owns the debt, as does the FTC's parallel authority over many nonbanks. Numerous state statutes also apply FDCPA-style conduct rules to creditors collecting their own accounts. Our article on UDAAP and CFPB enforcement covers how those theories are constructed.
State licensing: the part that takes the longest
There is no national collection licence. Requirements are set state by state and typically involve some combination of an application with control-person disclosures, background checks, a surety bond scaled to activity, registration to do business, a resident agent, and sometimes an in-state office or trust account for consumer funds. Some states run their applications through the Nationwide Multistate Licensing System; others use their own portals or paper filings. The Conference of State Bank Supervisors is a useful entry point for identifying the regulator in each state, but the statutes themselves must be read individually.
Coverage questions that differ from state to state include whether passive debt buyers who use outside agencies still need a licence, whether collecting on commercial debt is covered, whether a licence is required to collect from residents when the collector has no in-state presence, and whether affiliated collection subsidiaries of a licensed lender are exempt. Several states also require specific disclosures in initial communications, or notices about time-barred debt, that go beyond the federal validation notice.
State variation: A single national letter template and calling script will almost certainly violate some state's rule. Build state-specific variations into the letter engine and the dialer configuration from the outset, and re-check them when entering a new state — the same discipline described in our guide to business licences and permits.
Adjacent regimes that catch collection programmes
- Telephone and text rules. Federal telecommunications restrictions on automated calls and texts, plus state analogues with their own consent requirements and calling windows, frequently generate larger exposure than the FDCPA itself.
- Credit reporting. Reporting a collection account makes you a furnisher with accuracy and investigation duties, including the requirement to report the correct date of first delinquency. The mechanics are set out in our article on FCRA furnisher duties and in Regulation V.
- Privacy and data security. Collection files are dense with sensitive personal information, bringing state security and notification statutes into play — see fintech data privacy and cybersecurity.
- Payments. Taking payments from consumers can raise its own questions about handling customer funds, which we address in money transmitter licensing.
- Servicemember and other protections. Additional federal and state protections apply to particular populations and to specific debt types, with their own notice and rate rules.
Designing a defensible collections programme
- Map, per state, whether your role requires a licence and which conduct rules apply beyond Regulation F.
- Keep a single source of truth for account status, balance, and itemization data feeding validation notices.
- Configure contact-attempt caps below the federal presumption thresholds and honour state-specific windows.
- Capture and honour channel-specific opt-outs, and log the timestamp and method of each request.
- Suppress litigation and litigation threats on debt outside the limitations period, tracked by state.
- Record every consumer dispute and route it into both the collection hold process and the credit reporting dispute queue.
- Audit vendors on the same standards you apply internally, with contractual audit rights and service levels.
Frequently asked questions
We only collect our own loans. Do we need a licence anywhere?
Possibly. Several states define collection activity broadly enough to reach creditors collecting their own accounts, and others license the lending or servicing activity separately. The exemption you may be relying on is a feature of particular state statutes, not a general principle, so the analysis has to be done state by state.
Does the seven-in-seven figure mean seven calls are always permitted?
No. It creates a presumption of compliance under the federal rule for calls about a particular debt. Conduct can still be harassing below that number, other federal telephone statutes impose separate limits, and some states cap contacts more tightly. Treat it as a ceiling to stay well under, not a target.
Can we collect by email and text?
Regulation F contemplates electronic communication, subject to procedures including a clear and simple opt-out in each message and precautions against disclosing the debt to third parties. Consent frameworks under telephone and privacy statutes apply separately, and some states add requirements. Build the channel with all three layers in mind.
What happens if we collect without a required licence?
Consequences vary by state and can include cease-and-desist orders, civil penalties, restitution, and in some places the unenforceability of the debt or of the amounts collected. Unlicensed activity also surfaces in diligence and can jeopardize bank partnerships and financing rounds.
Where to go from here
Start with an honest role assessment: for each portfolio, who owns the debt, was it in default when you took it on, and what exactly do you do to recover it? That answer determines whether federal collection law applies. Then run the licensing question separately in every state where borrowers live, because the federal answer predicts very little about the state one. Finally, build the operational controls before volume arrives — retrofitting call caps, opt-out handling, and state letter variants into a running programme is far more expensive than designing them in. More coverage of related obligations is collected in the fintech law topic hub. This overview is general information rather than legal advice.
