Third Party Co-Liability: You May Be Liable for Your Collector

One of the most persistent misconceptions in collections management is that outsourcing creates a clean legal firewall. The assumption is straightforward: a third-party collector violates the law, the collector bears the liability, and the hiring business walks away unaffected. Courts and regulators have been steadily dismantling this assumption. Third Party Co-Liability has become an increasingly important legal reality, with an evolving body of case law, supported by CFPB enforcement actions, establishing that businesses can be held co-liable — sometimes even vicariously liable — for the FDCPA and CFPA violations committed by the collection agencies they hire.[1][2]

Understanding where this liability originates, when it attaches, and how to structure BPO relationships to minimize it is not just a legal exercise — it is a core business risk management decision. This page explains the legal landscape in plain terms and provides a practical framework for protecting your business through contract structure, oversight practices, and partner selection.

The Legal Foundation of Third Party Co-Liability

Vicarious Liability Under the FDCPA

The FDCPA applies directly to “debt collectors” — entities whose principal purpose is debt collection or who regularly collect debts owed to others. Original creditors are generally excluded from direct FDCPA liability. However, courts have recognized that vicarious liability can still attach to creditors under certain conditions, creating the foundation for Third Party Co-Liability in outsourced collection relationships.[3]

The key legal theory: if a creditor exercises sufficient control over a third-party debt collector’s operations, a court may find that an “agency relationship” exists — and under agency law, the principal (the creditor) can be held responsible for the agent’s (the collector’s) conduct.[4]

In practice, the control threshold has been applied broadly. In McAdory v. M.N.S. & Associates, the Ninth Circuit held that a debt buyer that purchased consumer debt and outsourced collection to a separate agency could be held liable under the FDCPA as a “debt collector” — even though the debt buyer had no direct communication with the consumer whatsoever. The court reasoned that the company’s principal purpose was debt collection, regardless of whether it made any calls itself.[5][6]

The CFPB’s Theory of Vicarious Liability

The CFPB has pursued a parallel and potentially broader liability theory under the Consumer Financial Protection Act (CFPA). In a 2023 enforcement action, a New York federal court declined to dismiss a CFPB lawsuit against debt buyer defendants based on vicarious liability for violations committed by their third-party collection vendors. The court held that:[2]

• Companies can be “covered persons” under the CFPA even if their third-party vendors, not they themselves, actually conducted the collections[2]
• Company owners and officers can be personally liable if they had actual knowledge of the underlying unlawful conduct[2]
• CFPA deceptive acts liability does not require the same elements as common law fraud[2]

This enforcement posture signals that the CFPB views the company that benefits from a collections program as responsible for ensuring that program is conducted lawfully — regardless of who makes the calls.

When Does Co-Liability Attach?

Co-liability risk is highest when one or more of the following conditions are present:

Condition	Risk Level	Why
Creditor provides detailed scripts or call guides that the collector must follow verbatim	High	Implies direct control over collector conduct
Creditor has real-time access to collector call logs and can direct remediation	High	Suggests principal-agent relationship
Creditor agreement requires collector to act exclusively on creditor’s behalf	Medium-High	Exclusivity can imply control
Collector uses creditor’s brand name or presents itself as creditor on calls	High	Consumer may not know a third party is involved
Creditor knew of prior violations and continued the relationship	Critical	Knowledge of unlawful conduct is a core CFPB liability theory[28]
No written compliance requirements or audit rights in the BPO contract	High	Absence of oversight can constitute negligent entrustment

How Businesses Can Limit Third Party Co-Liability Risk

While co-liability risk cannot be eliminated entirely, it can be significantly reduced through three mechanisms:

1. Contract Structure

The BPO agreement should include:

• Explicit compliance warranties: The BPO represents and warrants ongoing compliance with the FDCPA, Regulation F, TCPA, and applicable state laws
• Indemnification clause: The BPO indemnifies the client for any claims, settlements, or regulatory penalties arising from the BPO’s violations
• Audit rights: The client has the right to inspect call recordings, compliance reports, agent training records, and complaint logs upon reasonable notice
• Immediate notice provision: The BPO must notify the client within 24–48 hours of any CFPB complaint, regulatory inquiry, or lawsuit naming either party in connection with the collections program
• Termination for cause: The agreement specifies that documented compliance violations are grounds for immediate termination without penalty

2. Ongoing Oversight — Without Crossing Into Control

The challenge in preventing Third Party Co-Liability is balancing oversight with legal independence. Exercising too much control over how a collector makes calls can inadvertently establish an agency relationship. The right approach is to monitor outcomes and compliance metrics rather than dictating operational procedures:

• Review compliance score reports and complaint ratios regularly
• Conduct periodic audits of call recordings — but focus on compliance, not call handling style
• Establish performance benchmarks that include compliance KPIs alongside recovery rates
• Avoid providing word-for-word scripts or call-handling instructions beyond required disclosures

3. Know-Your-Vendor Due Diligence

Before placement, conduct structured due diligence:

• Verify FDCPA/Regulation F compliance infrastructure (7-in-7 controls, MVN workflow, opt-out systems)
• Request references from current clients and ask specifically about complaint rates and regulatory history
• Confirm adequate Errors & Omissions (E&O) insurance with limits sufficient to cover potential FDCPA class-action exposure
• Ask for a written compliance program document — any reputable BPO will have one

How to evaluate a BPO partner → Use the full 20-point BPO evaluation checklist to structure your vendor due diligence

What the CFPB’s Supervisory Approach Means for 2025–2026

The CFPB’s supervisory priorities have included third-party service provider oversight as a focus area. Supervisory Highlights publications have flagged inadequate compliance management systems and insufficient oversight of collection vendors as recurring examination findings. Even in a period of CFPB institutional transition — the bureau withdrew 67 guidance documents in 2025 as part of a shift toward regulatory restraint — the core FDCPA and CFPA statutory enforcement authority remains intact and active.[7][8]

For businesses, this means that even if the CFPB’s enforcement posture fluctuates, the underlying legal risk of third party co-liability is rooted in statutory and case law that is unaffected by agency rulemaking changes.

How Redial BPO’s Contract and Compliance Structure Protects Clients

Redial’s client agreements are designed with the co-liability framework in mind:

• Compliance warranty: Redial warrants compliance with the FDCPA, Regulation F, and TCPA in every client agreement
• Indemnification: Redial indemnifies clients for violations arising directly from Redial’s collection practices, with E&O insurance backing the commitment
• Client portal access: Clients have access to account-level compliance reporting, dispute records, and complaint tracking in real time
• 48-hour CFPB complaint protocol: When a complaint is filed related to Redial’s activity, Redial delivers full documentation to the client within 48 business hours
• Independent compliance posture: Redial maintains its own compliance program, legal review process, and agent training independent of any single client, reducing the risk that any client relationship is characterized as a control relationship

“The right BPO contract doesn’t just define what they do — it defines what happens when something goes wrong. Redial’s agreements are built to protect clients at every level of the liability chain.”