Watch the full series: ACE – Reg F Feature Additions (8 videos) →
More than seven calls to the same consumer in seven days is now presumed to be harassment. That one rule changed how agencies run outreach, and it's just one piece of Reg F. Here's the part that actually matters day to day: a rule only helps you if your platform can prove it followed it. That's worth a hard look before you count on any system.
This guide breaks down what Reg F changed for third-party collection agencies, requirement by requirement, and exactly what your collections platform needs to do for each one. You'll leave with a checklist you can hold your technology to.
Regulation F (12 CFR Part 1006) is the Consumer Financial Protection Bureau's rule implementing the Fair Debt Collection Practices Act. It took effect November 30, 2021, and set concrete standards for call frequency, debt validation, electronic communications, voicemail, time-barred debt, and credit reporting. For collection agencies, compliance is now an operational and software problem: the platform has to enforce limits, capture consent, and produce audit evidence.
Regulation F is the CFPB rule that implements the FDCPA and governs how debt collectors communicate with consumers, validate debts, and report to credit bureaus. It took effect November 30, 2021.
Before Reg F, the FDCPA set the principles but left many specifics, like how many calls is too many, open to interpretation and litigation. Reg F replaced much of that ambiguity with bright lines and safe harbors. For agencies, that's good news: clear rules are easier to operationalize than vague ones, as long as your systems can actually apply them.
Who it applies to: Reg F, like the FDCPA, generally applies to third-party debt collectors: agencies, collection law firms, and debt buyers collecting on accounts they don't own. First-party creditors collecting under their own name are usually outside FDCPA coverage, though many adopt the same standards as a best practice and to satisfy CFPB expectations around unfair, deceptive, or abusive acts. Confirm your coverage with counsel for your specific jurisdiction and business model.
Reg F introduced enforceable standards in six areas that directly shape agency operations: call frequency, debt validation, electronic communications, limited-content voicemails, time-barred debt, and credit reporting. Each one carries a workflow and a recordkeeping obligation.
Here's what it comes down to: a policy isn't enough on its own anymore. You have to enforce the rule at the moment of contact, and still be able to show, months later, that you did. Getting from a written policy to enforcement you can actually prove is the real work, and it's what your platform should be doing for you.
Under Reg F, a collector is presumed compliant when it calls a consumer about a particular debt no more than seven times within seven consecutive days, and not at all within seven days after speaking with the consumer about that debt. Exceed those limits and you're presumed to be harassing.
VIDEO: 7-in-7 Firewall and Restricting Tools feature
This presumption, at 12 CFR § 1006.14(b), is the most operationally demanding part of Reg F. The count is per debt, per consumer, not per account and not per phone number, and the seven-day clock resets with each qualifying contact. Manual tracking across dialers, agents, and campaigns is where agencies get caught.
What your platform needs: automatic, per-debt call counting that blocks or warns before an agent places call number eight; a "no contact" window that triggers after a live conversation; and a timestamped log you can produce on demand. If a dialer can dial past the limit, the limit is only a suggestion.
Reg F requires collectors to provide specific validation information in the initial communication or within five days of it: the debt amount, the creditor, an itemization from a defined "itemization date," and the consumer's dispute rights.
VIDEO: Model Validation Letter for Print, Itemization Dates, and Validation Period
Section 1006.34 defines the itemization date as one of five reference points (last statement, charge-off, last payment, transaction, or judgment date) and offers a safe harbor for collectors who use the CFPB's Model Validation Notice (Model Form B-1). Using the model form correctly is the cleanest path to defensible validation.
What your platform needs: the ability to generate the validation notice with accurate, per-account itemization pulled from creditor data; support for the model-form safe harbor; delivery by the consumer's chosen channel; and a stored copy of exactly what was sent and when.
Reg F expressly permits collecting by email and text message, but requires a "clear and conspicuous" way for consumers to opt out of a given channel using a reasonable and simple method. It also preserves time-of-day limits, generally 8 a.m. to 9 p.m. in the consumer's local time.
VIDEO: Opt In/Out of Digital Communication
Section 1006.6 is what makes modern, consumer-preferred outreach possible under the rule, but only if opt-outs are honored instantly and permanently across every channel and campaign. A consumer who opts out of texts and then receives one has handed you a violation.
What your platform needs: channel-level consent and opt-out tracking that applies in real time everywhere; local-time-zone awareness so messages and calls respect the 8 a.m. to 9 p.m. window; and per-message audit records. Many agencies deliver these channels through existing messaging vendors, so your platform should support your current vendors through a best-fit integration rather than forcing a switch.
Reg F created the limited-content message, a voicemail a collector can leave without it counting as a communication that triggers third-party disclosure concerns, as long as it contains only the specific elements the rule allows.
Defined at § 1006.2(j), a limited-content message includes a business name that doesn't indicate you're a debt collector, a request for the consumer to reply, a contact name and number, and optional elements like a callback time. Step outside those bounds and the message loses its protected status.
What your platform needs: voicemail templates that conform to the limited-content definition and prevent agents from ad-libbing non-compliant content.
Reg F prohibits a collector from suing or threatening to sue on a debt when the collector knows or should know the statute of limitations has expired.
Section 1006.26 draws a firm line around time-barred debt. For agencies handling aged portfolios, the risk is usually inadvertent: an agent or a letter template that implies legal action on debt that can no longer be litigated.
What your platform needs: portfolio and account-level flags for statute-of-limitations status, and controls that keep litigation language and workflows off time-barred accounts.
Reg F requires a collector to communicate with the consumer about a debt before furnishing information about it to a consumer reporting agency.
Section 1006.30 effectively ends "parking" a debt on a credit report before any consumer contact. The collector must first speak or write to the consumer, or attempt delivery, and allow a reasonable period before reporting.
What your platform needs: a sequencing control that won't release an account to credit reporting until a qualifying communication is logged, plus the evidence trail to prove the order of operations.
The TCPA governs how you dial and text; Reg F governs how often and what you say. Collection agencies have to satisfy both, since they're separate laws with separate penalties.
The Telephone Consumer Protection Act (47 U.S.C. § 227), implemented by FCC rules at 47 CFR § 64.1200, requires prior express consent to place autodialed or prerecorded and artificial-voice calls, and texts, to a consumer's cell phone. It enforces the same 8 a.m. to 9 p.m. local-time window, requires national Do-Not-Call compliance, and lets consumers revoke consent by any reasonable method (including replying "STOP"), which you have to honor within 10 business days. Unlike Reg F's presumptions, the TCPA carries private statutory damages of $500 per violation, and up to $1,500 for willful or knowing violations, which is why TCPA class actions are a leading litigation risk for agencies.
What your platform needs: consent capture and proof at the phone-number level (whether consent was given, when, and for which channel and purpose); Do-Not-Call scrubbing; instant, permanent revocation handling across every channel; and the audit trail to prove consent existed for every automated call or text.
Look for a platform that enforces each rule automatically at the point of contact and produces timestamped audit evidence for every action. Enforcement plus evidence is the standard.
Here's the checklist to hold your technology to:
Treat compliance and security as design inputs, not afterthoughts. Built on AWS, with [security certifications and audit artifacts](INTERNAL-LINK: Security page) available for your due diligence, [InterProse ACE](INTERNAL-LINK: ACE platform overview) is designed so the controls above are enforced by the system rather than left to memory.
ACE builds Reg F requirements into daily workflows and ships improvements continuously, so the platform keeps pace as guidance and interpretation evolve. Compliance is enforced, logged, and updated, not bolted on.
When the Reg F rules were finalized, ACE rolled out the supporting features across eight deployments in three months, the same continuous-improvement model that makes monthly update releases part of the platform rather than a disruptive upgrade project. (Those deployments are exactly what the ACE - Reg F Feature Additions series walks through.)
Modernize collections with a web-based platform built for today's compliance and consumer expectations. ACE also includes the [Virtual Agent Collector (consumer self-service portal)](INTERNAL-LINK: Virtual Agent Collector) and [Self Service for Client Access (business self-service portal)](INTERNAL-LINK: Self Service for Client Access). Use self-service as a secure way to access and pay, shift routine requests away from agents, and reduce avoidable inbound calls. Its [vendor-agnostic integrations](INTERNAL-LINK: Integrations) support your existing payments and messaging vendors: where a vendor offers an API, ACE prefers an API-based connection; where it doesn't, integration can run through automated batch file exchange, so you can keep current contracts and still modernize.
Reg F turned collection compliance into a systems problem: enforce the rule at contact, and prove it later. Run your current platform against the checklist above. Every gap is exposure.
Want to see the controls in action? Request a demo.