Direct answer: Under the CFPB debt collection rule, a debt collector is generally presumed to violate the FDCPA if it places more than seven telephone calls within seven consecutive days about a particular debt, or calls within seven days after a telephone conversation about that debt. The rule contains details, exclusions and exceptions, so teams must configure controls with counsel.
This guide translates Reg F call limits into controls that operations, compliance, legal, IT and vendor teams can review together.
Quick-reference framework
| Control | What to implement | Evidence to retain |
|---|---|---|
| 1 | Count calls by particular debt, not only consumer | Configuration, test result, event log and named owner |
| 2 | Track the rolling seven-day period | Configuration, test result, event log and named owner |
| 3 | Start the post-conversation waiting period correctly | Configuration, test result, event log and named owner |
| 4 | Apply exclusions and exceptions only when validated | Configuration, test result, event log and named owner |
| 5 | Coordinate automated and human calls in one ledger | Configuration, test result, event log and named owner |
How to operationalise it
1. Count calls by particular debt, not only consumer
Translate the requirement into a deterministic trigger, system action, owner and exception route. Test it with representative accounts and adversarial scenarios. Evidence should show what the system knew, which policy version applied, what action occurred and whether a human intervened.
2. Track the rolling seven-day period
Translate the requirement into a deterministic trigger, system action, owner and exception route. Test it with representative accounts and adversarial scenarios. Evidence should show what the system knew, which policy version applied, what action occurred and whether a human intervened.
3. Start the post-conversation waiting period correctly
Translate the requirement into a deterministic trigger, system action, owner and exception route. Test it with representative accounts and adversarial scenarios. Evidence should show what the system knew, which policy version applied, what action occurred and whether a human intervened.
4. Apply exclusions and exceptions only when validated
Translate the requirement into a deterministic trigger, system action, owner and exception route. Test it with representative accounts and adversarial scenarios. Evidence should show what the system knew, which policy version applied, what action occurred and whether a human intervened.
5. Coordinate automated and human calls in one ledger
Translate the requirement into a deterministic trigger, system action, owner and exception route. Test it with representative accounts and adversarial scenarios. Evidence should show what the system knew, which policy version applied, what action occurred and whether a human intervened.
What the audit trail should contain
- Account, debt, channel, time zone and jurisdiction context used
- Consent, preference, frequency, dispute and suppression status
- Approved script or policy version active at the time
- Interaction transcript or recording, system events and write-backs
- Escalation, override, reviewer and final resolution
Measurements that belong on the same dashboard
- calls per debt
- days since conversation
- suppressed attempts
- override reasons
- control failures
- wrong-party contacts, disputes and complaints
- unreconciled records and repeat failures
Failure modes to test before launch
- Stale balance or newly paid account
- Shared telephone number or failed identity verification
- Dispute, hardship, attorney representation or cease request
- Unavailable CRM, payment service or write-back endpoint
- Conflicting instructions across voice, SMS and human teams
How DROS should be evaluated
For this use case, assess DROS as a controlled engagement layer rather than a free-form conversation tool. Require current context, explicit permissions, policy-bound actions, immediate suppression, human escalation and exportable evidence. Confirm every material legal interpretation with qualified counsel.
Frequently asked questions
Can software guarantee compliance?
No. Software can enforce approved controls and produce evidence, but the organisation remains responsible for legal analysis, configuration, vendor oversight and monitoring.
Should an AI agent decide ambiguous cases?
No. Ambiguity should trigger a safe response and human review, especially where rights, restrictions, hardship or disclosure are involved.
How often should controls be reviewed?
Review before launch, after material legal or workflow changes, after incidents, and on a documented recurring schedule based on risk.
Conclusion
Under the CFPB debt collection rule, a debt collector is generally presumed to violate the FDCPA if it places more than seven telephone calls within seven consecutive days about a particular debt, or calls within seven days after a telephone conversation about that debt. The rule contains details, exclusions and exceptions, so teams must configure controls with counsel. The durable approach connects policy, live context, enforceable controls, trained people and evidence.
This material is general operational information, not legal advice. Laws and requirements vary by jurisdiction and facts.
