Once a bank hands a delinquent account to an outside collector, most people assume the risk transfers along with the file. It doesn’t. If that collector calls too often, texts without consent, or fails to send the right notice at the right time, examiners and regulators hold the bank accountable too, not just the agency making the call. That is why a collection partner’s compliance record deserves the same scrutiny as its recovery rate, and why understanding what the law actually requires matters before a single account changes hands.
What Every Collector Working With Your Bank Must Follow Under Regulation F
The Fair Debt Collection Practices Act establishes the basic rules for debt collection, and in 2021 the Consumer Financial Protection Bureau completed Regulation F to explain how those rules apply to modern communication methods. A number of provisions are at the heart of this regulation:
- It is assumed to be harassment if a consumer is contacted more than seven times within any seven-day period about the same debt. After a live conversation with a collector, the collector must wait an additional seven days before contacting them again about that debt.
- Contact hours are such that calls are not accepted before 8 a.m. or after 9 p.m. in the consumer’s local time zone, and in several states narrower time windows take precedence when they are stricter.
- Notice of validation: Send a written notice listing the debt and the consumer’s rights within five days of the first contact, and the consumer must then have 30 days to dispute the debt before any further collection activity can proceed unchecked.
- Cease and desist. A written request to stop contact must be honored immediately, with only narrow exceptions such as confirming receipt of the request.
- These are not optional best practices. They are the baseline a bank’s examiners will expect any collection partner to meet.
Email and Text Rules That Trip Up Legacy Collection Processes
Most of the compliance risk banks actually run into today doesn’t come from phone calls; it comes from email and text. Regulation F requires consent before contacting a consumer through either channel, and that consent has to be checked periodically to confirm the number or address still belongs to the same person. Every message also needs a simple, working way for the consumer to opt out of that specific channel entirely.
A collection process built around calls and paper letters doesn’t automatically become compliant just because it starts sending texts. This is the gap where a lot of otherwise well-run agencies get exposed, and it’s worth asking any prospective partner to show, not just describe, how their system handles consent and opt-out at the message level.
Time-Barred Debt Disclosures Are Easy to Miss and Costly to Get Wrong
Debt that has passed its statute of limitations can sometimes still be collected, but consumers cannot be misled about their legal position. The CFPB requires specific disclosures whenever an agency pursues time-barred debt, and skipping that disclosure is one of the more common ways collectors end up in regulatory trouble. For a bank, a single missed disclosure on a portfolio of aged accounts can quickly become a pattern-and-practice finding.
Regulation F Compliance Is a Vendor-Management Issue as Much as a Legal One
Interagency guidance from the OCC, the Federal Reserve, and the FDIC is explicit: a bank’s use of a third party does not reduce its responsibility for that activity. In practice, banks can’t leave Regulation F compliance solely to legal or compliance teams that review a contract only once a year; they should build it into the same due diligence process they already use when evaluating any important vendor. This involves assessing the partner’s compliance program before entering the agreement, including the right to audit and the timeline for reporting incidents in the contract, and continuously monitoring performance and complaint patterns rather than running checks only once a year.
What to Ask Before Signing With a Collection Partner
A short list of questions tends to separate a compliance-first partner from one that treats it as paperwork:
- Can they provide documentation showing that their system enforces the 7-in-7 rule and the contact-hour limits automatically, rather than relying on staff discipline?
- What is the procedure for recording and updating consent for email and text messages, and how quickly can a consumer withdraw their consent?
- What is their procedure for sending validation notices and disclosing time-barred debt, and can they provide the relevant records when requested?
- Are they paid on a contingency basis, so their incentives favor resolving accounts the right way rather than generating contact volume?
- How do they track state-specific rules, given that states are increasingly setting their own standards, California’s SB 1286 now extends consumer-style protections to commercial debts of $500,000 or less, which matters directly for a bank’s small-business portfolio.
Enforcement Is Shifting to the States, Not Going Away
Federal oversight has become less predictable, with CFPB funding and authority facing ongoing legal challenges through early 2026. That has not made the environment safer. It has pushed more enforcement activity to state attorneys general and state regulators, who tend to move in when federal supervision pulls back. For a bank, that means the compliance bar isn’t lowering; it’s just being set by more regulators at once, which makes a well-documented, contingency-aligned collection partner more valuable, not less.
How Kollecta Builds Regulation F Into Every Recovery
Kollecta treats contact hours, consent, and disclosure as part of how every channel is built, not a review that happens after the fact. Whether an account is worked by SMS, voice, email, or a digital interaction, the same compliance standard applies, and the same documentation is available to the banks and lenders Kollecta works with. Recovery and reputation aren’t treated as a trade-off. That’s what Regulation F compliance looks like in practice: a standard held on every contact, not a policy filed away until an exam.
The Bottom Line
Regulation F isn’t going away, and neither is a bank’s responsibility for what happens after an account leaves the building. The agency’s compliance record deserves the same weight in a vendor decision as its recovery rate, because both determine what a bank is actually exposed to once collection begins.
