Paying a bill or have a question about your account? Make a paymentConsumer help
Paying a bill or have a question about your account? Make a paymentConsumer help
ComplianceThe FDCPA mostly covers the agencies you hire. Creditors still answer to federal unfairness rules, the TCPA, credit reporting law and a long list of state laws reach creditors directly, and regulators hold you responsible for what your agencies do. Here's the map.
As of November 2026, the federal Fair Debt Collection Practices Act (FDCPA) and Regulation F cover third-party collectors, not creditors collecting their own debts in their own name. Creditors still answer to federal unfair, deceptive or abusive practices (UDAAP) rules, the TCPA, credit reporting law and state collection laws, and regulators hold them responsible for the agencies and law firms they hire.
Most creditor compliance trouble in collections starts in one of two places: a state law that covers creditors directly, or an agency doing something in the creditor's name that the creditor never checked.
| Law | Covers creditors collecting their own debts? | Covers third-party agencies? | What it governs |
|---|---|---|---|
| FDCPA (15 U.S.C. 1692 and following) | Generally no; yes if you collect under a different name that suggests a third party is involved | Yes | Harassment, false statements, unfair practices, validation of debts, contact rules |
| Regulation F (12 CFR 1006) | No | Yes | How the FDCPA works in practice: the 7-in-7 call presumption, validation notices, email and text rules, time-barred debt |
| UDAAP (Dodd-Frank, 12 U.S.C. 5531 and 5536) | Yes, if you offer a consumer financial product | Yes | Any unfair, deceptive or abusive act, including by your service providers |
| FTC Act Section 5 | Yes | Yes | Unfair or deceptive practices, for companies outside the CFPB's reach |
| TCPA | Yes | Yes | Autodialed and prerecorded calls and texts to cell phones, and consent revocation |
| FCRA and Regulation V | Yes, as a furnisher | Yes, as a furnisher | Accuracy of what you report to credit bureaus, and handling disputes |
| State collection laws | Often yes (see below) | Yes | Contact rules, disclosures, licensing, interest and fees |
| Bankruptcy Code (11 U.S.C. 362) | Yes | Yes | The automatic stay stops collection once a consumer files |
| Servicemembers Civil Relief Act | Yes | Yes | Interest caps and protections for active-duty servicemembers |
The FDCPA's definition of "debt collector" excludes a creditor collecting its own debts, unless the creditor "uses any name other than his own which would indicate that a third person is collecting or attempting to collect such debts" (15 U.S.C. 1692a(6)). That's the trap with an in-house "recovery department" that writes to customers under a different brand.
State law is where creditors get caught. Several large states apply their collection rules to anyone collecting a consumer debt, including the original creditor:
The Rosenthal Fair Debt Collection Practices Act defines a debt collector as anyone who, in the ordinary course of business, regularly collects debts "on behalf of that person or others" (Cal. Civ. Code 1788.2), so it covers creditors.
The Debt Collection Licensing Act, in force since Jan 1, 2022, can require a license from the Department of Financial Protection and Innovation for first-party collection too, with exemptions for banks and some other licensees.
The Texas Debt Collection Act (Finance Code chapter 392) covers creditors as well as agencies, and third-party collectors must file a surety bond with the Texas Secretary of State.
The Florida Consumer Collection Practices Act's prohibited practices begin "In collecting consumer debts, no person shall" (Fla. Stat. 559.72), so they apply to creditors.
The Attorney General's regulations for creditors (940 CMR 7.04(1)(f)) limit a creditor to starting 2 calls, texts or recorded messages to a debtor's home, cell or personal number in each 7-day period. That's tighter than Regulation F's presumption for agencies, and the state's highest court held in 2018 that unanswered calls count (Armata v. Target Corp.).
Other states and some cities add licensing, bonding and disclosure rules for agencies. New York City's Department of Consumer and Worker Protection licenses collection agencies collecting from city residents. TSI is licensed or registered in every state that requires it and authorized to collect in all 50 states, DC and Puerto Rico; this page explains how agency licensing works.
When you place accounts, these are the rules your agency works under. Your contract and your audits should check each one.
| Rule | What it says | Citation |
|---|---|---|
| Call frequency | A collector is presumed to violate the rule by calling more than 7 times in 7 days about a debt, or within 7 days after a phone conversation about it | 12 CFR 1006.14(b) |
| Contact hours | No contact before 8 a.m. or after 9 p.m. in the consumer's time zone, unless the consumer agrees | 15 U.S.C. 1692c(a)(1) |
| Validation notice | Within 5 days of first contact, the collector sends the amount, the creditor and the consumer's dispute rights, usually on the CFPB's model form | 12 CFR 1006.34 |
| Disputes | After a timely written dispute, collection stops until the collector mails verification | 15 U.S.C. 1692g(b) |
| Third parties | No discussing the debt with anyone other than the consumer, their spouse or attorney, with narrow exceptions | 15 U.S.C. 1692c(b) |
| Email and texts | Every electronic message has a clear way to opt out | 12 CFR 1006.6(e) |
| Credit reporting | A collector can't report a debt before it has communicated with the consumer about it | 12 CFR 1006.30(a) |
| Time-barred debt | No suing, or threatening to sue, on a debt past the statute of limitations | 12 CFR 1006.26(b) |
| Recordings | A collector that records calls keeps each recording for 3 years | 12 CFR 1006.100(b) |
Call limits have their own rule brief, and the FCC's consent revocation order for calls and texts is covered on the TCPA page.
Under UDAAP, the CFPB can hold a covered company responsible for what its service providers do on its behalf. Bank regulators expect a written third-party risk program: due diligence before you hire an agency, contract terms that require compliance, monitoring after you hire it, and a way to end the relationship. Where that guidance stands now is on the vendor oversight page.
In practice, the 4 things examiners and plaintiffs' lawyers look for are the same:
These questions come from consumers as often as from creditors, so here are the short answers.
Yes, if the debt isn't past the statute of limitations. The agency or a law firm it works with files suit, usually in the consumer's county. A judgment is what allows most wage garnishment and bank levies.
Only after a court judgment, for most consumer debts. Federal law caps ordinary garnishment at 25% of disposable earnings or the amount above 30 times the federal minimum hourly wage, whichever is less (15 U.S.C. 1673). Some debts, like defaulted federal student loans, taxes and child support, have their own collection rules.
Each state sets a statute of limitations for suing on a debt, usually 3 to 6 years and longer in some states. Separately, most negative items, including collection accounts, can stay on a credit report for 7 years from the original delinquency (15 U.S.C. 1681c).
Harass, threaten action it can't take, misstate the amount, call at unreasonable hours, tell your employer or neighbors about the debt, or ignore a written dispute.
If you're a consumer with a TSI account, the Consumer Support Hub explains your rights and how to dispute a debt.
Hospitals and health systems collecting patient balances add 2 more sets of rules. Tax-exempt hospitals must follow IRS Section 501(r), which requires a financial assistance policy and limits extraordinary collection actions, including those taken by the agencies they hire. HIPAA governs the patient information the agency handles.
Credit reporting of medical debt is now mostly a state question. A federal court vacated the CFPB's medical debt credit reporting rule on Jul 11, 2025, and a growing number of states limit medical debt reporting on their own.
Where the rule stands
General information, current as of Nov 5, 2026. It isn't legal advice. Rules change and differ by state, so check the sources linked here and talk to your own counsel before you act on it.
The full set of questions to put in an agency RFP, with weights, is in what a collection services RFP should include. How TSI records, scores and root-causes calls is on the call monitoring page.
Generally no. The FDCPA covers third-party debt collectors. It reaches a creditor that collects its own debts under a different name suggesting a third party is collecting. State laws in California, Texas, Florida, Massachusetts and elsewhere do cover creditors.
At the federal level: the FDCPA and Regulation F for third-party collectors, UDAAP and the FTC Act for unfair or deceptive practices, the TCPA for calls and texts, and the FCRA for credit reporting. Each state adds its own collection, licensing and limitations laws.
It can be. Under UDAAP, the CFPB can hold a covered company responsible for its service providers, and bank regulators expect creditors to oversee the agencies they hire. Some state laws also make creditors liable for their agents.
Following the FDCPA and Regulation F in every contact with a consumer: limits on calls and contact times, a validation notice, honoring disputes and opt-outs, no false or harassing statements, and keeping records that prove it.
The Recovery Performance Diagnostic is a side-by-side read of your placements, liquidation and complaints against what your agencies report, with the changes worth making first.
