Collections compliance monitoring, explained.

The morning-after check: hearing yesterday's collection calls before a borrower, a court or an examiner does

One collection conversation, from dial to exam file, in five steps

1. The account goes past due and is workedNorthmere Bank's own collectors take the early stages; at around 60 days some auto loans go to Calder & Voss Collections, an outside agency.
2. A collector calls, texts or writesJordan Pike calls Marcus Tellam's number at 6:52 p.m. Phoenix time. His sister answers.
3. Someone checks the conversation afterwardsThe recording, the account facts and the rules side by side. This is where the debt told to the sister at 2:41 is caught, or left unheard.
4. A finding becomes coaching, remediation and a fixThe collector hears his own ten seconds; the agency gets a letter with the clip; the borrower's account is put right.
5. The record goes to the exam fileWho checked what, under which rule version, and who decided. Examiners ask for it, and agencies are scored on it.

Step 3 is the subject of this guide. Live help for collectors during a call is a different job. The people, the bank, the agencies and the figures in this example are fictional.

Four facts about collection conversations that newcomers do not expect

Four collection terms this guide uses on every page

Thirteen terms are defined in the printable checklist at the end.

Debt collection quality assurance covers five channels and three kinds of evidence

In shortA collections monitor checks calls, voicemails, texts, emails and letters. Some breaches are in what was said, some in when and how often the contact happened, and some only show when the words are set against the account record. A program that only listens to calls sees the first kind and misses most of the other two.

Quality assurance in a collections team has two jobs that share one set of recordings. The first is service quality: did the collector verify who was on the line, explain the options and record the promise to pay. The second is compliance: did anything in the contact break a law or the lender's policy. This guide is about the second, done after the fact, which is how examiners and agency auditors do it too.

The CFPB's examination procedures tell examiners to review a firm's "policies and procedures for monitoring both incoming and outgoing communications, attempts to communicate, and other outgoing messages", and then to "listen to a sample of collection calls".7

Three kinds of evidence behind a finding

Two practical points follow. A text or an email is a communication like a call, so it can be sent at the wrong time and must carry the debt-collector disclosure; the CFPB's own summary of the time-of-day rule says it covers communicating "including electronically".11 And letters, which feel safe because they come from a template, are where the wrong amount usually appears: 91% of 2024 complaints about false statements were about collecting the wrong amount.2

The collection rules a monitor tests against in October 2026: Regulation F, the FDCPA, UDAAP, TCPA consent and state caps

In shortRegulation F's rule text, in force since November 30, 2021, is unchanged as of October 29, 2026. The CFPB withdrew 67 guidance documents in May 2025, including its 2013 bulletin on unfair collection practices, and the Federal Trade Commission (FTC) was the only federal agency to announce a public FDCPA enforcement action in 2024. The phone rules moved: since April 11, 2025 consent can be revoked by any reasonable means, and from November 25, 2026 a caller may name its own opt-out method and treat a "stop" as covering only the kind of informational message it answered. New York City's tighter rules took effect on September 1, 2026.

A few federal laws carry most of the weight. The Fair Debt Collection Practices Act (FDCPA) governs collectors who collect debts owed to someone else.12 Regulation F, 12 CFR 1006, is the CFPB's rule under it and sets the call counts, calling hours and message rules.8

The Telephone Consumer Protection Act (TCPA), with rules written by the Federal Communications Commission (FCC), governs autodialed and prerecorded calls and texts.9 The ban on unfair, deceptive or abusive acts and practices (UDAAP) reaches every lender, including one collecting its own loans.4 The Servicemembers Civil Relief Act (SCRA) and the bankruptcy automatic stay decide when collecting must change or stop.13,14

First-party and third-party collectors answer to different laws for the same sentence

In shortThe FDCPA and Regulation F apply to "debt collectors", which mostly means agencies and debt buyers collecting for someone else. A bank's own collectors answer to the unfair, deceptive or abusive practices law, to state laws written for creditors and, in New York City since September 1, 2026, to the city's contact cap. Many lenders apply Regulation F to their own staff as policy, so one rulebook can score both.

The FDCPA defines a debt collector as a person whose principal business is collecting debts, or who regularly collects debts "owed or due or asserted to be owed or due another".12 A bank calling about its own car loan in its own name is usually outside that definition. The CFPB's examination procedures spell out the consequence: the FDCPA and Regulation F apply only "if the entity is a 'debt collector' under the FDCPA, while the prohibition on unfair, deceptive, or abusive acts and practices applies to all supervised entities".7

Why a lender answers for its agencies' calls

The bank chose the agency, wrote the placement contract and owns the customer relationship. The interagency third-party guidance is direct: "the use of third parties does not diminish or remove banking organizations' responsibilities".25 Agencies also face their own clients' checks. In the CFPB's 2016 study of 58 collection firms, 44 had clients that audit their compliance, by reviewing batches of call recordings remotely or by sending auditors for one to four days.26

Auditing a week of attempts: how a monitor counts 7-in-7 per debt, reads the borrower's clock and applies state call caps

In shortRegulation F presumes harassment above seven calls in seven consecutive days about one debt, or any call within seven days after a phone conversation about it. Time is the borrower's local time, and a collector with two possible locations must be inside the window in both. States are stricter: Massachusetts allows two telephone contacts in seven days, New York City three per account by any medium except mail, Washington three a week.

What the federal count includes

• Calls placed count, answered or not. The presumption is about placing a telephone call "more than seven times within seven consecutive days".8
• A conversation starts a seven-day pause. No call "within a period of seven consecutive days after having had a telephone conversation" about the debt; the day of the conversation is day one.8
• Per debt. A borrower with an auto loan and a credit card in collection has two counts.8
• Some calls are left out: calls placed with the person's prior consent within seven days of that consent, calls that never connected, and calls to the borrower's attorney or the creditor.8
• Staying within the count only presumes compliance. Over 100 calls after a stop request overcame it in the CFPB's 2024 exam findings.2

A worked week on one auto loan

An illustrative week; it matches the call pattern of one account in the example in Part B. If two of Monday's calls had been about the borrower's credit card, a second debt, the auto loan count would be six and the federal presumption would not apply.

The clock is the borrower's: when the address and the area code disagree, both windows apply

The time-of-day presumption is "before 8:00 a.m. and after 9:00 p.m. local time at the consumer's location".8 Phone numbers move with people, and when the collector's information points to two places, such as an address in one time zone and an area code in another, the official commentary says the contact must fall inside the window in both.8

A borrower who moved from Sacramento to Richmond, Virginia keeps a 916 number; a dialer that schedules by area code alone calls at 6:18 p.m. Pacific, which is 9:18 p.m. at her door. The CFPB found collectors sending payment reminder emails before 8 a.m. in the consumer's time zone, a reminder that the rule covers messages as well as calls.11 Massachusetts asks for 8 a.m. to 9 p.m. absent known waking hours; Washington's presumption at a residence runs from 9:00 p.m. to 7:30 a.m.5,22

Voicemails, texts, emails and letters: limited-content messages, opt-outs, validation notices and TCPA consent

In shortA voicemail is safe only when it says nothing about a debt. Every text and email must offer a simple opt-out. A validation notice must follow the first contact within five days. Letters must state the amount the agreement or the law allows. Autodialed and prerecorded calls and texts to cell phones need consent. Since April 11, 2025 a borrower can take it back by any reasonable means; from November 25, 2026 a caller may instead name its own opt-out methods.

TCPA consent for collection calls and texts: revocation since 2025 and the FCC's November 2026 change

The TCPA requires prior express consent for calls to a cell phone made with an autodialer or "an artificial or prerecorded voice".9 The FCC's February 2024 order lets a consumer revoke that consent "by any reasonable means" and requires callers to honor the request "within a reasonable time not to exceed 10 business days"; a reply of "stop", "quit", "end", "revoke", "opt out", "cancel" or "unsubscribe" to a text is a reasonable means per se.15 Those rules have applied since April 11, 2025.

The part that would have made one revocation cover all of a caller's robocalls and robotexts on unrelated matters was waived to April 11, 2026 and then to January 31, 2027.16,17 On September 30, 2026 the FCC replaced it.

From November 25, 2026, a caller may treat a revocation sent in answer to an informational call or text, such as a payment reminder, as covering only that category of messages, and may name an exclusive way to revoke (a key-press opt-out on the call, a standard reply word such as "stop" to a text, or a website or phone number), disclosed clearly on the call or in the text. A caller that names none must still accept any reasonable means, and every revocation must still be honored within 10 business days.20

A monitor checks that the opt-out method the lender chose is disclosed on every call and text, and that a "stop" ends the category of messages it answered.

Two other changes matter to a monitor. In February 2024 the FCC confirmed that AI-generated voices are "artificial or prerecorded" voices, so a voice bot that calls borrowers needs the same consent.21 And in June 2025 the Supreme Court held that district courts are "not bound by the agency's interpretation" in TCPA enforcement cases, so a court may read the statute differently from the FCC.19

Military service and bankruptcy stop the usual script

Which CFPB debt collection complaints trace back to a call, text or letter a monitor could have caught

In shortPublished debt collection complaints rose from 68,107 in 2023 to 283,203 in 2025, and the first nine months of 2026 are 20% above the same months of 2025. Most are about debts people do not recognize, many on credit reports. The complaints a call or message monitor can catch are smaller in number and sharper in content: frequent calls, contact after a stop request, third parties told, abusive language and the wrong amount.

The CFPB's own reading of 2025 is that "a principal reason for the observed increase in debt collection complaints is credit reporting": people "increasingly complained about collections they did not recognize appearing (or reappearing) on their reports".1 The fault sits in the account data. It still matters to a monitor, because a polite, well-timed call about a debt the borrower does not owe can be a breach that no amount of listening detects without the account record beside it.

The CFPB's 2024 shares tell the same story in percentages. Among communication tactics complaints, 51% were about frequent or repeated calls and 34% about contact after a request to stop; among electronic communication complaints, 58% about frequent messages and 32% about messages after a stop request; among complaints about sharing information, 56% said the collector talked to a third party; and among false statement complaints, 91% were about the wrong amount.2

Companies have 15 calendar days to respond to a complaint the CFPB sends, or 60 if they ask for more time; in 2025 companies gave no timely response to 3% of the debt collection complaints sent to them.1

Where weak monitoring turned into penalties, settlements and FDCPA and TCPA lawsuits

In shortPublic cases share a pattern: a practice that monitoring should have caught, repeated across thousands of accounts. Agencies broke earlier orders, a credit union made false threats, an auto lender called too often under a state cap, a finance company repossessed servicemembers' cars. Private lawsuits keep coming: WebRecon, a firm that tracks consumer lawsuits, counted 3,246 FDCPA and 2,128 TCPA suits in the first nine months of 2025.

In Armata v. Target, Massachusetts' Supreme Judicial Court read the two-in-seven rule to count collection attempts whether or not the borrower was reached, and later settlements follow that reading.31

A single FDCPA plaintiff can recover actual damages, up to $1,000 more, and attorney's fees; a class can recover up to the lesser of $500,000 or 1% of the collector's net worth.12 The TCPA allows $500 for each call or text, up to three times that when the violation is willful or knowing, which is why most TCPA suits are filed as class actions.9,32,33

Why a 2% call sample misses 98% of serious collection breaches, worked through

In shortA random sample hears, on average, the same share of breaches as the share of conversations it covers. Breaches are rare per conversation, so even a night with dozens of them can pass a sample unheard, and a small audit of an agency almost never meets its worst conduct. Samples are good at describing the typical call and poor at finding the rare bad one.

Why a 20-call quarterly agency audit ranks a careful agency and a careless one the same

Suppose a lender audits each agency by hearing 20 of its calls a quarter, an illustrative but common shape. An agency with 2.79 serious findings per 1,000 conversations, like the worst agency in this guide's example, gives that audit a 5.4% chance of containing even one. An agency at 0.40 per 1,000 gives it 0.8%. Both audits most likely come back clean, and the scorecard ranks the two agencies the same.

Checking the checker: the random slice of clean conversations

With full coverage, sampling takes on a new job: testing the checks. A review of flagged conversations shows how many flags were right. Only listening to conversations the checks called clean shows how many breaches were missed. A program that checks everything should still draw a random slice of clean conversations each day for a person to hear without looking at the result, and report the misses found.

The AI Risk Management Framework of the National Institute of Standards and Technology (NIST) asks for "formalized reporting and documentation of results" and adds that independent review "can improve the effectiveness of testing".34

What examiners and the 2026 model guidance expect of debt collection speech analytics, and what still needs a person

In shortSoftware can transcribe every call, read every message, place each attempt on the borrower's clock, count across channels and flag the moment that may break a rule. Regulators leave the choice of tool to the lender and keep the responsibility with it. The limits are the ones a person knows: context, consent given earlier, facts that live in the account, and errors nobody measured.

Collection firms have used speech analytics for a decade. In the CFPB's 2016 survey, 17 of 58 collection firms used it, all of them larger firms, the smallest with 83 employees; the software identified "key words, the timing of the words, and the volume of the conversation" to test script adherence and spot disputes.26 What has changed is the reach: modern transcription and language models can read whole conversations and messages, tie them to account facts and explain a finding in words a reviewer can check.

What software still cannot do alone

• Know consent given earlier. A borrower who asked to be called after 9 p.m. made that hour convenient; the exception is in the rule, and the evidence is in another recording.8
• Know who answered. "I'm his wife" and "I'm his sister" decide whether a disclosure is lawful. Transcripts misheard on a noisy line change the answer.
• See the account. Whether a repossession is assigned, a bankruptcy filed, an attorney named or an amount right is recorded in the servicing system, which the audio never shows.
• Prove its own miss rate. Only people listening to a random slice of clean conversations can say how many breaches the checks missed.34

Collections QA by hand: random scorecards, call calibration, agency audits and the listening that fills an analyst's week

In shortQuality analysts pull a small random sample of recordings, score each on a form, meet to calibrate, and pass findings to team leads for coaching. Agency managers audit each agency from recordings the agency sends. Most of the analyst's time goes to listening in real time and gathering account facts. Messages and letters get the least attention.

Five roles share a collections QA program

From recording to borrower fix: a sampled call's hand-offs

Where a quality analyst's review minutes go

Hand sampling, agency audits or speech and text analytics: three ways teams monitor

The recordings usually exist. In the CFPB's 2016 study, 48 of 58 firms recorded all calls, two recorded some, and 33 of the 48 kept recordings two years or more.26 The gap is the hours to hear them.

The sister at 2:41: one red finding among 41,286 conversations, confirmed, coached and charged to the agency's score by mid-morning

In shortThis is the example from the top of the page, inside the product. Overnight, six agents check every call, voicemail, text, email and letter against 41 rules and pin each finding to the second or the sentence where it happened. Red findings are likely serious breaches that a person confirms one by one; amber findings are lesser ones reviewed in weekly batches. In the morning Dana Whitlock, the bank's collections compliance analyst, hears the flagged moment of the Tellam call, confirms it, and the finding becomes a coaching item for the collector, a change in the agency's score and a line in the review log.

1

The night's 38 red findings, by rule and by team

The findings page opens on the totals: 41,286 conversations checked against 41 rules, 1,214 with a finding, 38 red, 412 amber, 764 vulnerability signals and 40,072 clean. The grid shows where the red findings sit: nine third-party disclosures, seven contacts outside the allowed hours, six accounts over seven calls in seven days, five threats or false statements, four contacts after an attorney, a stop request or a bankruptcy, four vulnerable borrowers pressed, three wrong amounts in letters.

By team, the bank's own collectors had 8, Corvane Recovery 7, Brindlemoor Receivables 9 and Calder & Voss Collections 14.

2

The Tellam call as a waveform, with a flag at each moment that matters

Dana opens the first open red finding. The call is drawn as a waveform, collector and borrower's side in two colors, with flags above it: the recording notice at 0:00, "third party answers" at 0:14, a hardship and health mention at 1:02, the red "mentioned debt to a third party" at 2:41 and the amber "repossession by Friday, not on the account" at 3:04. She clicks the red flag and the playhead jumps to 2:41; the caption shows the words being spoken.

Under the player, the coverage line reads "41,286 of 41,286 conversations checked overnight", split by channel.

3

The transcript and the finding, side by side

The transcript scrolls to the same second. At 2:11 Jordan said, correctly, "I can only discuss it with Marcus, I'm sorry." At 2:41 he named the lender, the loan, the payments missed and the amount to the sister. The finding card quotes the sentence, cites Regulation F 1006.6(d) and FDCPA 805(b), and lists the facts behind it: third party identified at 0:14, debt named at 2:41, no consent on the account to discuss it with family, and the amount matching the bank's record of $1,284.50.

4

Confirmed at 9:12 a.m., with the way it was checked on the record

Dana confirms the red finding. The card records it: "Confirmed by Dana Whitlock · 9:12 am", a coaching item for Jordan with this moment, Calder & Voss's score moving from 91.4 to 91.3, and the entry in the review log. She keeps the 3:04 repossession statement as amber for the agency letter, since the account has no repossession assignment and the bank's policy sends a right-to-cure letter at 75 days, and she refers the hardship mention to the hardship team.

Below the card, "How this call was checked" lists each agent's step and its time; any step can be run again.

5

The agency's score, its red rate and the remediation queue

On the agencies page the four teams are scored on the same checks of every conversation: the bank's own team 97.8, Corvane Recovery 96.9, Brindlemoor Receivables 95.2 and Calder & Voss 91.3, out of 100 over 30 days. Red findings per 1,000 conversations yesterday were 0.40, 0.74, 1.29 and 2.79.

Beth Okafor, the agency management lead, has four remediation items open: Calder & Voss's third-party disclosures and threats (draft ready, clips attached, a retraining plan due in 10 days), a collection fee added to 214 letters in batch 1012-A (two mailed, template stopped at 8:55 a.m.), Brindlemoor's dialer time zones, and a follow-up with Corvane on wage garnishment statements.

The solution's design target: every call, voicemail, text, email and letter checked every night. In this worked example all 38 serious breaches were found by the next morning and the agency letter was drafted the same morning; it is an example, to be measured on your own conversations.

A voicemail on a work line, a $120 letter fee and a dialer's time zones: the rest of the night on screen

In shortOne call is the story. These screens show the rest of the night: a voicemail that named the debt on a work line, a letter $120 higher than the bank's record, five late contacts traced to one dialer's time zones, coaching items built from confirmed moments, the append-only review log and its exam package, the second signature a dismissal needs, and the versioned rules.

Select any screen to open it larger. The bank, agencies, borrowers, collectors and figures are fictional.

An analyst confirms every red finding and a manager co-signs every dismissal: what the six agents may and may never do

In shortEach agent does one job. None of them decides a breach, contacts a borrower, blocks a call or writes to an agency. People confirm, dismiss, coach and send. Rules are versioned, and every check records the version it ran under.

Six checkers, each with one job and a line it never crosses

Four people who confirm, co-sign, check the checks and write to agencies

The review log is append-only: conversation, checks, rule version, finding, decision, who and when. Agents' steps and people's decisions are recorded apart. Audio and transcripts are kept under the bank's retention schedule; Regulation F requires a debt collector that records calls to keep each recording for three years after the call.

Dana, Theo, Beth and Jordan: the fictional team on these screens

What the monitoring reads from your dialer, letter vendor and servicing system, and the findings, clips and exam log it leaves

In shortThe monitoring reads the conversations the bank and its agencies already keep, with the account facts beside them, and leaves behind one finding per conversation with the quoted moment, coaching items per collector, agency scores on the same checks, remediation drafts and an append-only review log. The dialer, the servicing system and the agencies' platforms stay as they are.

Eight systems the nightly checks draw on

For each, check whether it has an API, a file feed, or only screens, and who owns it. Agency recordings need a contract term that gives the bank the recordings and messages themselves.

What every finding carries: its moment, the account record and a person's decision

The price of a breach nobody heard: damages per call or text, class actions, and one template error repeated across thousands of letters

In shortStart from your own numbers. The law sets the price of a single breach: up to $1,000 plus fees under the FDCPA, $500 to $1,500 for each call or text under the TCPA. What multiplies it is repetition, because a dialer setting or a letter template repeats the same breach across thousands of accounts before anyone hears one.

Measure your coverage, review time and hidden breaches in a week

Harms that review hours never show

Review hours against breaches heard: the arithmetic of a 2% sample and full coverage at your volume

In shortPut in your own numbers. The calculator compares hand-sampling with checking everything and having people hear the flags: the review hours each takes, and how many serious breaches each would hear in a year. Every default is an assumption or the guide's fictional example; replace them.

Six places full coverage pays back, each with its formula

Calculate breaches heard and reviewer hours for your conversation volume

A lender with 500,000 conversations a year and the same rate has 460 serious breaches; its 2% sample hears about 9. The numbers shrink, the share stays the same.

Eight questions that show whether your collections QA program can move from samples to every conversation

In shortPick the answer closest to your team today. Eight questions score 0 to 2; the last is for reflection. The meter adds up your score as you go, and each question says why it matters and what a strong answer sounds like.

Explore, pilot or implement: what your QA readiness score means

Fifteen vendor questions that separate collections monitoring that reads the account from keyword spotting

In shortAsk every vendor the same questions, us included. The answers show what is read, how it is judged against the account, what evidence each finding carries, who decides, and how you would measure the tool on your own conversations.

We found no published independent test of any collections monitoring vendor's accuracy, as of October 2026. A test on your own conversations, with planted breaches and a clean slice heard by people, is the fairest comparison, and the same test measures your current sampling.

Planted breaches and a blind clean slice: piloting full-coverage monitoring on one agency and one in-house team

In shortMeasure your sampling first, then run every conversation from one agency and one team through the tool with planted breaches and a clean slice heard by people, then decide with four numbers. None of these steps commits you to a vendor.

1. Measure today: coverage by channel and agency, ten timed reviews, and last quarter's complaints matched to conversations.
2. Write the rulebook the pilot will use: Regulation F, the FDCPA, the TCPA consent rules, your state overlays and your own policy, with severity and a version.
3. Prepare the data: four weeks of conversations from one agency and one team, the account facts beside them, and 60 planted test conversations across the rules.
4. Run nightly for six weeks, with your analysts confirming every red finding and a quality analyst hearing 1% of clean conversations blind.
5. Decide with four numbers: catch rate by rule on the planted set, false alarms, misses found in the clean slice, and review minutes per day.

Five measures that settle the monitoring pilot

A planted set of 60 is enough to see whether each rule works at all. Catching all 20 planted breaches of one rule still allows a miss rate up to about 14% at 95% confidence (1 − 0.05^(1/20)), so the daily clean slice matters as much as the planted test.

The 7-in-7 rule, talking to family, voicemail wording, TCPA revocation and QA sample size: answers for collections compliance teams

In shortThe questions collections and compliance teams search for most, each answered on its own.