The Fair Debt Collection Practices Act (FDCPA) has been the bedrock of US collections regulation since 1977. It has been updated, reinterpreted, and extended repeatedly — most recently and meaningfully by the CFPB's Regulation F, which took effect November 2021 and has reshaped daily operations at every third-party debt collector in the country.
This guide is the complete 2026 compliance reference for collections agency owners, operations leads, and compliance officers. It covers what the FDCPA actually prohibits, what Reg F added, what changed in 2024–2025 enforcement posture, and the operational checklist that keeps agencies out of consent decrees.
This is educational content — not legal advice. Consult a collections attorney for specific questions.
Table of Contents
- What the FDCPA Covers
- Regulation F — What Changed in 2021+
- The 7-in-7 Rule Explained
- Required Disclosures and the Model Validation Notice
- Electronic Communications (Email/SMS)
- Common FDCPA Violations and How to Prevent Them
- The Operational Compliance Checklist
- Frequently Asked Questions
What the FDCPA Covers
The FDCPA applies to third-party debt collectors collecting consumer debt (personal, family, household — not business debt). Original creditors collecting their own debt are generally exempt from FDCPA, though state laws often impose similar rules.
Core prohibitions in the original FDCPA:
- No harassment or abuse — no threats of violence, no obscene language, no repeated calls intended to annoy
- No false or misleading representations — can't misrepresent debt amount, legal status, or consequences
- No unfair practices — can't collect fees or charges not authorized by the agreement or law
- Contact limits — generally no contact before 8 AM or after 9 PM consumer's local time
- Workplace contact restrictions — if the collector knows the employer prohibits personal calls, contact is prohibited
- Cease communication requests — consumer can demand in writing that the collector stop contacting them
- Dispute and validation rights — consumer can request verification of the debt within 30 days
Violations carry statutory damages up to $1,000 per consumer per lawsuit, plus attorney's fees. The FTC, CFPB, and state AGs can also bring enforcement actions carrying penalties in the millions.
The most authoritative reference is the CFPB's FDCPA resource page and the official FTC FDCPA text.
Regulation F — What Changed in 2021+
The CFPB finalized Regulation F in 2020, effective November 30, 2021. It modernized and operationalized the FDCPA for digital-era collections. The key changes:
1. Call frequency caps (the "7-in-7 rule"). No more than 7 calls to a consumer about a particular debt within 7 consecutive days. After a telephone conversation, no calls for 7 days on that debt.
2. Clear rules for electronic communications. Email and SMS are now explicitly permitted, provided the collector offers opt-out mechanisms and complies with specific disclosure requirements.
3. Validation notice modernization. Reg F introduced a model validation notice with required content: itemized debt, account info, creditor history, consumer rights disclosure, and response deadlines.
4. Time-barred debt warnings. For debts beyond the statute of limitations, collectors must include specific disclosure language if suing or threatening to sue.
5. Consumer's right to restrict channels. Consumers can specify that certain communications channels (email, text) shouldn't be used.
Reg F didn't replace the FDCPA — it layered on top. Collectors must comply with both.
The 7-in-7 Rule Explained
The most operationally consequential Reg F rule. The plain-English version:
Rule 1: Call attempt cap. In any 7-consecutive-day period, a collector can make no more than 7 call attempts to a consumer about a particular debt. Attempts include calls that don't connect — voicemails, no-answers, busy signals.
Rule 2: Post-conversation cap. After the collector has a telephone conversation with the consumer about a particular debt, the collector cannot call that consumer again about that debt within 7 days of the conversation — even if the 7-attempts cap hasn't been reached.
Key nuance: the rules are per-debt, not per-consumer. If a consumer has three separate debts with your agency, the 7-in-7 applies separately to each. In practice, most agencies implement the stricter per-consumer rule to avoid edge-case violations.
Enforcement is strict. Agencies running outbound campaigns without automated 7-in-7 tracking get into violation territory quickly. A collections-compliant dialer enforces the rule at the platform level, blocking calls that would violate.
Required Disclosures
Every collections communication has minimum required content. The big ones:
The mini-Miranda (every call):
"This is an attempt to collect a debt. Any information obtained will be used for that purpose."
Validation notice (initial communication):
Reg F introduced a model form with 8 required elements:
- Debt collector's name + consumer's contact info
- Itemization date + amount on that date
- Itemized breakdown of interest, fees, payments, credits
- Current debt amount
- Creditor history (current + original creditor)
- Account number / identifier
- Consumer rights (dispute rights, validation rights)
- Response options (dispute, identify original creditor, etc.)
Using the exact model form shields agencies from claims that disclosures were deficient. Deviations create litigation risk.
State-required additions. Many states (California, New York, Massachusetts, Washington) require additional disclosures — sometimes in specific fonts, sometimes translated. Modern collections platforms handle state-specific disclosure logic automatically.
Electronic Communications
Reg F explicitly permits email and SMS collection communications, with guardrails:
Email requirements:
- Opt-out mechanism included in every email
- No third-party disclosure (can't email a work address if the collector knows it's monitored)
- Subject line cannot contain information that would disclose the debt to a third party
SMS requirements:
- Consumer consent or a "reasonable procedure" for verifying the number belongs to the consumer
- Opt-out instructions in every message ("Reply STOP to opt out")
- Time-of-day rules apply (no texts before 8 AM or after 9 PM consumer local time)
- CTIA/carrier rules also apply — short codes require specific language
The "Safe Harbor" Email Rule. Reg F provides a safe harbor for email communications: if the collector sends to an email address the consumer has used to communicate with the creditor (or has been confirmed by the consumer), the collector is presumed compliant on the unauthorized-third-party-disclosure risk.
Common FDCPA Violations
Paraphrased from CFPB enforcement orders and plaintiff's-bar litigation patterns:
1. Calling a consumer who has requested cease communication. The "do not call" list must be enforced across all agents, all systems, permanently. One missed update on a cease letter = statutory damages.
2. Calling outside permitted hours. 8 AM–9 PM consumer's local time — not the agent's local time. Auto-enforce based on the consumer's zip code or area code. TCPA compliance guides cover the time-of-day rules in more depth.
3. Disclosing the debt to third parties. Includes family members, employers, neighbors. The only permissible third-party contact is to locate the consumer, and even that is tightly limited.
4. Misrepresenting legal consequences. Saying "if you don't pay by Friday we will sue" when there's no actual intent to sue is a clear violation. Scripts should specify what action will be taken, not what might be threatened.
5. Failure to honor dispute periods. Consumer disputes within 30 days of validation notice trigger a communication pause until verification is sent. Systems must gate this automatically.
6. Continuing after attorney representation. Once a consumer says they're represented by counsel, all consumer contact must stop — attorney contact only.
7. Violating 7-in-7. Most common modern violation. Manual tracking doesn't work at scale. Platform-enforced.
The Operational Compliance Checklist
A working FDCPA/Reg F compliance program needs these controls, either in-platform or via supplementary tooling:
Call controls
- [ ] Automated time-of-day enforcement by consumer zip/state
- [ ] Automated 7-in-7 call attempt counter per debt
- [ ] Automated post-conversation 7-day cooldown
- [ ] Cease communication list integrated with dialer
- [ ] Attorney representation flag that blocks all consumer contact
Disclosure controls
- [ ] Mini-Miranda auto-played or scripted on every call
- [ ] Validation notice templated to Reg F model form
- [ ] State-specific disclosure logic automated
- [ ] Time-barred debt disclosures auto-applied where relevant
Electronic communication controls
- [ ] Opt-out link in every email, opt-out text in every SMS
- [ ] Email safe-harbor tracking for consent/reliable-use
- [ ] Time-of-day rules applied to SMS
- [ ] Opt-out requests honored within 24 hours across all channels
Recording and QA controls
- [ ] 100% call recording
- [ ] AI QA scoring for script adherence and disclosure compliance
- [ ] Auditable log of consumer contacts with timestamps
- [ ] Manager review of flagged calls within 48 hours
Training controls
- [ ] Every new collector passes FDCPA/Reg F certification before taking live calls
- [ ] Annual recertification
- [ ] Incident-driven training updates when violations occur
- [ ] Script library with state/debt-type variations
Agencies running all of this manually spend 15–20% of ops time on compliance overhead. Platform-enforced compliance reduces that to 2–5%.
People Plus Platform
The single biggest source of FDCPA violations isn't bad policy — it's agent training gaps. An agent who hasn't been trained on the exact mini-Miranda, who doesn't know state-specific disclosure rules, who doesn't understand 7-in-7 will violate by accident.
For agencies scaling collections headcount, ScaleOps BPO provides nearshore collectors trained on FDCPA, Reg F, and state-specific collections rules before they ever take a live US call. Pairing trained agents with platform-enforced compliance controls is how modern collections agencies cut violation rates by 70%+ in the first quarter.
Frequently Asked Questions
Does the FDCPA apply to original creditors?
Generally no. The FDCPA applies to "debt collectors" — third parties collecting on behalf of another entity. Original creditors collecting their own debts are typically exempt. However, many states have mini-FDCPA laws that do apply to original creditors, and the CFPB's UDAAP authority covers both.
What are the penalties for FDCPA violations?
Individual consumer lawsuits: up to $1,000 statutory damages per consumer plus actual damages plus attorney's fees. Class actions: up to $500,000 or 1% of the collector's net worth. CFPB or FTC enforcement: no statutory cap — penalties have run into the tens of millions.
How long do I have to respond to a validation request?
The consumer has 30 days from receipt of the validation notice to dispute the debt. During the dispute period, collection activities must pause until verification is sent. There's no hard deadline for when you must send verification — but case law supports "reasonable time," generally interpreted as 30–60 days.
Can I text consumers about debts in 2026?
Yes, under Reg F — with opt-out language in every message, consent or reasonable procedure for the number, and compliance with time-of-day rules. Also consider TCPA implications and CTIA carrier rules. Most agencies use dedicated short codes or 10DLC numbers with registered campaigns.
What's the difference between FDCPA and TCPA?
FDCPA governs debt collection practices (what you can say, when, to whom). TCPA governs telemarketing and autodialed calls (what technology you can use to reach consumers). Collections calls can violate both — FDCPA for content, TCPA for using an autodialer to call cell phones without consent. See the TCPA compliance checklist for the telephony-side rules.
The Bottom Line
FDCPA and Reg F compliance isn't optional — it's the price of operating a collections agency. Agencies that treat it as a checklist exercise pay penalties. Agencies that operationalize it through platform controls, trained agents, and 100% call recording stay out of court and keep the business scaling.
See how platform-enforced compliance works → or book a walkthrough to see a collections agency run end-to-end on OPSYNC.