FDCPA, TCPA & Regulation F — The SMB Collections Compliance Guide

In 2025, CFPB complaint volumes rose 89.1% year over year, and FCRA litigation filings surged by 37.4%. The legal landscape for debt collection has fundamentally shifted, and for SMBs running collections without dedicated compliance infrastructure, the exposure is quantified in the millions. This Compliance Guide explains what the law requires, where businesses commonly run afoul of it, and how outsourcing to a compliant BPO partner can significantly reduce compliance risk.

The numbers are not hypothetical. A single TCPA class action can result in penalties exceeding $15 million. A 29-day delay in reporting a disputed account has been held as an FDCPA violation. CFPB complaint co-liability can reach the original creditor even when a third-party agency is at fault.

Compliance Guide: Why Collections Compliance Risk Has Never Been Higher

Three regulatory developments in the past two years have dramatically raised the compliance burden for any business engaged in debt collection — in-house or outsourced.

CFPB Activity: Consumer Financial Protection Bureau complaint volumes rose 89.1% in 2025. The CFPB has signaled continued enforcement focus on both collection agencies and the original creditors who engage them.

FCRA Litigation Surge: Fair Credit Reporting Act court filings rose 37.4% in 2025. Forty-five percent of CFPB complaints concern debts the consumer claims they do not owe — pointing to systemic data accuracy problems in how accounts are placed and managed.

FCC Consent Revocation Rules (April 2025): New rules require that when a consumer says or texts a standard opt-out phrase during a collection call, consent is revoked in real time. This requires active, technology-enabled compliance monitoring on every single call — not periodic audits.

For SMBs, the challenge is structural: maintaining this level of compliance infrastructure in-house requires dedicated legal counsel, 100% call monitoring technology, real-time consent revocation systems, and staff trained to the current regulatory standard. Most SMBs don’t have any of these.

The Three Federal Laws Every SMB Creditor Must Understand

The FDCPA governs third-party debt collectors — which includes any BPO or collection agency you engage. Key rules:

• Contact frequency: Maximum 7 attempts per week per debt; no more than 1 per day
• Contact hours: Only between 8 AM and 9 PM in the debtor’s local time zone
• Prohibited conduct: Harassment, false representation, unfair practices, threats of action the collector doesn’t intend to take
• Dispute rights: Consumers have the right to dispute a debt within 30 days; collectors must cease collection until the debt is verified
• Violation exposure: Up to $1,000 per named plaintiff plus attorney fees; class action liability up to $500,000 or 1% of net worth

Critical SMB note: When you place accounts with a third-party agency, you can share liability for that agency’s FDCPA violations. Your choice of partner is a direct legal exposure decision.

Compliance Guide: The TCPA (Telephone Consumer Protection Act)

The TCPA may be the single greatest litigation risk for SMBs attempting to run collections without dedicated compliance infrastructure. Key rules:

• Prior express written consent required for autodialed or prerecorded calls and texts to cell phones
• Do Not Call list compliance mandatory
• Per-violation exposure: $500 for unintentional violations; $1,500 per call or text for willful violations
• Class action risk: TCPA class actions regularly settle in the tens of millions. A list of 10,000 non-consented contacts = $5–15 million in potential exposure
• April 2025 FCC update: Real-time consent revocation is now required — consumers can revoke at any time by using standard opt-out language, and that revocation must be honored immediately

Regulation F: The CFPB’s FDCPA Implementation Rule

Regulation F clarified the FDCPA for digital communication channels. Key provisions:

• Email and text message rules: Opt-out requirements, disclosure language, and frequency limits now apply to digital channels
• Social media limits: Collectors may not send public social media messages to debtors about their debt
• Voicemail requirements: Specific disclosures required even in voicemail
• Model validation notice: Standardized disclosure format for initial collection communications
• Safe harbor provisions: Compliance with the model notice provides partial legal protection

Co-Liability: The Risk No One Tells SMBs About

Many SMBs believe that once they hand accounts to a third-party agency, the compliance risk passes entirely to the agency. Courts have consistently ruled otherwise. Original creditors have been held liable for:

• FDCPA violations committed by their collection agency on their placed accounts
• TCPA violations when the creditor’s records (provided to the agency) contained faulty consent documentation
• FCRA violations when inaccurate account data provided at placement led to credit reporting errors

This is why the compliance infrastructure of your outsourcing partner is not a vendor quality issue — it is a direct legal exposure that stays with your business.

The CFPB in 2026: What SMBs Need to Know

The 45% of CFPB complaints concerning disputed debts points to a systemic issue in collections: data accuracy. When an account is placed for collection with incorrect balance information, stale ownership data, or disputed status that has not been properly flagged, the original creditor faces complaint exposure, even if the agency handled the contact correctly. As outlined in this compliance guide, a compliant BPO partner implements data verification during onboarding to identify and flag problematic accounts before contact begins.

How a Compliant BPO Partner Eliminates Your Collections Risk

This is the practical value proposition of outsourcing to a compliance-focused BPO:

What Redial provides:

• 100% call monitoring — every call reviewed against FDCPA, TCPA, and Regulation F requirements in real time, not as a sampling audit
• AI compliance flagging — automated detection of prohibited language, contact frequency violations, and disclosure omissions before they become enforcement actions
• Documented agent training — FDCPA, TCPA, and state-specific compliance training with audit trails
• Real-time consent revocation tracking — FCC April 2025 rules require this; Redial’s systems handle it automatically
• Geographic compliance tracking — state-specific rules (California, Maryland, Oregon, and others) are tracked per debtor jurisdiction
• E&O insurance — documented coverage and clear indemnification terms

The alternative — building this infrastructure in-house — requires dedicated legal counsel, investment in compliance technology, and staff time that most SMBs cannot afford to divert from revenue-generating activities.