Collections rules are easy to state and easy to break at volume: how often you may call, what hours, what the first letter must say, what happens when a consumer disputes. When an AI agent drafts the letter, schedules the call or reads the dispute, the same rules apply to its output.
This guide is for the head of collections or compliance at a US bank, credit union, fintech lender or collection agency. It covers who the FDCPA and Regulation F reach, the specific Reg F rules an automated system should enforce, and which decisions stay with people. It is operational guidance, not legal advice.
Where do AI agents fit in FDCPA and Reg F compliance?
Who counts as a debt collector under the FDCPA?
The statute defines a debt collector as a person who uses the mail or interstate commerce in a business whose principal purpose is collecting debts, or who regularly collects debts owed to another (15 U.S.C. 1692a(6)). Only consumer debts count: the underlying obligation must be primarily for personal, family or household purposes, which is why most commercial collections sit outside the FDCPA.
That makes the answer depend on who holds the account:
- A third-party agency or debt buyer collecting for others is generally a debt collector, and Reg F applies to its communications.
- A bank, credit union or fintech lender collecting its own originated debt is generally outside the FDCPA definition. There is one notable exception: a creditor that, while collecting its own debts, uses a name other than its own that would suggest a third party is collecting is treated as a debt collector (12 CFR 1006.2(i)).
Being outside the FDCPA does not mean being outside federal law. The Consumer Financial Protection Act lets the CFPB act against unfair, deceptive or abusive acts or practices (12 U.S.C. 5531) and makes it unlawful for a covered person or service provider to engage in them (12 U.S.C. 5536). Many first-party teams apply Reg F standards to their own collections anyway so one set of controls serves every portfolio. That is a design choice, not a legal requirement.
What does Regulation F require that a system can enforce?
Regulation F is 12 CFR Part 1006, the CFPB's implementation of the FDCPA. Several of its rules are numeric or form-based, which makes them good candidates for automated enforcement.
Call frequency.
A collector is presumed to comply with the FDCPA's harassment prohibition if it calls a particular person about a particular debt neither more than seven times within seven consecutive days, nor within seven consecutive days after having a telephone conversation with that person about the debt. Exceeding either limit is a presumed violation (12 CFR 1006.14(b)). The count is per debt and per person, and paragraph (b)(3) lists exclusions, so the system needs the rule's logic and not only a counter.
Inconvenient times.
Without knowledge of circumstances to the contrary, a time before 8:00 a.m. or after 9:00 p.m. at the consumer's location is inconvenient. A time the collector knows or should know is inconvenient is also barred (12 CFR 1006.6(b)(1)). The system needs each consumer's local time, not the lender's.
Validation notice.
The collector must give validation information in the initial communication or send a notice within five days of it (12 CFR 1006.34). The notice must state an itemization date, the amount owed, and the date the validation period ends, which is 30 days after the consumer receives or is assumed to receive the information. Model Form B-1 in Appendix B is a safe harbor, and a form that stays substantially similar to it is also permitted.
Electronic communications.
Email and text are allowed only on defined grounds, for example an email address the consumer gave the collector prior consent to use for the debt, or a number the consumer used to text the collector about the debt. Each electronic message must carry a clear opt-out method that costs the consumer nothing (12 CFR 1006.6(d) and (e)).
Voicemail.
A limited-content message is a voicemail with a business name that does not indicate debt collection, a request to reply, the name of a person to contact and a callback number, and no other content (12 CFR 1006.2(j)). It is a fixed template.
Time-barred debt.
A collector must not bring or threaten to bring legal action to collect a time-barred debt, meaning one whose statute of limitations has expired (12 CFR 1006.26). The system has to know the limitation period for the account, which varies by state and debt type.
Disputes.
After a timely written dispute, the collector must stop collecting the debt, or the disputed part, until it sends verification or a copy of a judgment. A dispute the collector reasonably determines is duplicative can be answered by referring to the earlier response (12 CFR 1006.38(d)).
Records.
Collectors keep records that evidence compliance or noncompliance until three years after the last collection activity on the debt, and keep any call recordings they make for three years after the call (12 CFR 1006.100). The CFPB lists call logs and copies of documents sent to consumers as examples.
What about AI voice calls and the TCPA?
Reg F is not the only constraint on an AI agent that dials. In a February 2024 declaratory ruling, the FCC confirmed that the TCPA's restrictions on an "artificial or prerecorded voice" cover current AI technologies that generate human voices, so calls using them require the prior express consent of the called party unless an emergency or an exemption applies (FCC 24-17). A consent record by number and by channel therefore becomes a precondition for an AI voice agent, separate from every Reg F control above. Whether your consent evidence is sufficient is a question for counsel.
Which collections tasks suit an AI agent?
These fit best, because the rule is written down and the evidence is in your systems:
- Contact scheduling.
Check the proposed contact against the seven-in-seven count, the post-conversation wait, the consumer's local hours and any stated inconvenient times before anything is queued. Block the contact if it fails. - Validation notice preparation.
Pull the itemization-date balance, compute the validation end date, populate the form and flag any account missing a required field. - Channel eligibility.
Confirm email or text consent exists, attach the opt-out language and suppress addresses that have led to a prohibited disclosure. - Dispute intake and tracking.
Log the dispute, pause collection activity on the account, assemble the verification package from the file and track the response. - Hardship routing.
Recognize hardship language in a call or message and move the account to a human queue with the context attached. - Quality review.
Read call and message logs against the rules above at full volume and surface the exceptions.
Where do people decide?
An agent can prepare and check. These calls stay with named staff:
- Settlements and payment plans.
Discount approvals and any term that changes what the consumer owes. - Hardship outcomes.
Whether to forbear, modify or charge off. - Legal action.
Any suit or threat of suit, after a check that the debt is not time-barred. - Complaint responses.
What you tell a consumer or a regulator who is already unhappy. Our guide to CFPB complaint handling automation for banks shows how that split works.
How do the rules map to controls?
Rule | Requirement | Automated control | Human decision |
|---|---|---|---|
1006.14(b) call frequency | No more than seven calls in seven days per debt, and none within seven days after a conversation, to stay inside the presumption | Per-debt contact counter with a hard stop before the call is queued | Policy owner sets any stricter internal cap and approves exceptions |
1006.6(b)(1) inconvenient times | Presumed inconvenient before 8 a.m. and after 9 p.m. local time, and at times known to be inconvenient | Local-time lookup per consumer, window check, suppression of stated bad times | Compliance decides how to treat uncertain location data |
1006.34 validation notice | Notice in the initial communication or within five days, with itemization and validation end date | Field population, date calculation, completeness check, send tracking | Compliance approves the template and any departure from Model Form B-1 |
1006.6(d), (e) electronic channels | Permitted grounds for email and text, and a free opt-out method | Consent lookup, opt-out text insertion, opt-out suppression | Counsel signs off on consent evidence standards |
1006.2(j) limited-content message | Four required voicemail elements and nothing else | Fixed voicemail template with no free-text fields | Compliance owns the approved wording |
1006.26 time-barred debt | No suit or threat of suit on a time-barred debt | Limitation-date flag per account, block on legal-action queues | Legal confirms the state limitation period before any action |
1006.38(d) disputes | Stop collecting until verification or a judgment copy is sent | Dispute logged, account paused, verification package assembled | Analyst reviews the verification and approves the response |
1006.100 records | Keep compliance evidence three years after last collection activity, recordings three years from the call | Complete event log with timestamps for each contact decision | Compliance sets the retention and legal-hold policy |
How Zamp Approaches Collections Operations
Zamp builds AI employees that run back-office jobs end to end, with human approval gates and a full audit trail. For a collections queue, the work is written into an Agent Operating Procedure, the document the AI employee follows. It would hold the contact rules your compliance team approves, the sources of truth for balances and consent, the templates the agent may use and the cases it may not touch.
Cases the agent cannot resolve inside that scope go to a person through Needs Attention, with the evidence already assembled. A settlement or hardship decision is a human-in-the-loop gate by design, and every step the agent takes is written to an audit trail that your examiners or your own QA team can read. For the wider banking picture, see our US compliance guide to AI employees in banking and financial services, the 20 banking use cases by department and the view for credit unions.
Neighboring dispute workflows with the same clocks and sign-offs: Reg E dispute investigation and Reg Z billing error disputes.
How should you start?
Start with a queue where the controls are checks and not conversations. Contact-cap enforcement and validation notice completeness are good first jobs: the rules are numeric, the failures are visible and nobody is negotiating. Run the agent beside your current process and review every disagreement. Keep disputes, hardship and anything legal with staff until compliance has tested the agent's handling and approved it in writing.
