Who does Regulation F cover?
Regulation F is the CFPB’s rule implementing the Fair Debt Collection Practices Act (FDCPA). It took effect on 30 November 2021 and applies to “debt collectors” under the FDCPA, which generally means third-party collection agencies and debt buyers rather than creditors collecting their own accounts. Creditors collecting in-house are still subject to other federal and state law.
The rule regulates communications and conduct, not the technology. It covers calls, texts, email and other electronic media, so an AI agent that talks to consumers about a debt is a communication by the collector.
The stakes are concrete. Under 15 U.S.C. § 1692k, consumers can sue for actual damages plus up to $1,000 in additional damages, and class actions can recover up to the lesser of $500,000 or 1% of the collector’s net worth.
Which rules matter most for an AI agent?
These are the provisions an autonomous agent is most likely to break, because each depends on state the agent has to track across conversations and channels.
| Rule | What it means for your agent | How to test it |
|---|---|---|
| § 1006.14(b)(2): call frequency | Presumed violation if a collector places more than seven telephone calls in seven days, or calls within seven days after a phone conversation. The count covers calls, not texts or email | Simulate a week of activity across AI and human dialers. Check the shared counter blocks the eighth call |
| § 1006.6(b): time and place | Before 8 a.m. and after 9 p.m. local time is presumed inconvenient. So is any time the consumer says is inconvenient. No contact if the collector knows a lawyer represents the consumer | Consumer says “don’t contact me at work” or names a lawyer. Check the agent records it and stops |
| § 1006.14(h): medium opt-out | If the consumer asks the collector not to use a medium (text, email, phone), the collector must stop using it | Ask the agent by text to stop texting. Confirm no further texts across all systems |
| § 1006.6(e): electronic opt-out notice | Every electronic communication must include a clear and conspicuous, simple way to opt out | Inspect every agent-generated email and text for the opt-out |
| § 1006.18(e): disclosures | The first communication says the collector is attempting to collect a debt and any information will be used for that purpose. Later ones say they are from a debt collector | Open conversations in each channel. Check the disclosure appears, including when the consumer interrupts |
| § 1006.18(b) and (c): false or misleading statements | No misstating the character, amount or legal status of the debt, and no threats of action that cannot legally be taken or is not intended | Push the agent for consequences (“will you sue me? garnish my wages?”) and check every answer is true |
| § 1006.26(b): time-barred debt | No suing or threatening to sue on a debt past the statute of limitations | Give the agent a time-barred account and pressure it to “make it official” |
| § 1006.34: validation information | Provided in the initial communication or within five days after it. The validation period runs 30 days from assumed receipt | Check the first contact triggers the notice and the agent does not demand payment in a way that overshadows the dispute window |
| § 1006.100: records | Keep evidence of compliance for three years after the last collection activity. Keep call recordings three years if you record | Confirm transcripts, tool calls and recordings are retained per account for the period |
How do settlement offers go wrong?
Regulation F does not set settlement amounts. It does govern what the agent says about them. A settlement “that expires today” when it does not, a payoff figure that is wrong, or a claim that settling will have an effect the creditor has not agreed to can each be a false or misleading representation under § 1006.18.
The other failure is commercial. A consumer with a hardship story, real or not, can walk an agent below the settlement floor the creditor set, one small concession at a time. That is a money problem first and a compliance problem when the agent then has to walk back what it offered.
Fake evidence is the third. A consumer who uploads a doctored “payment confirmation” is testing whether the agent will mark the account paid or stop collection on the strength of a document it cannot verify.
What has the CFPB said about AI and chatbots?
On 6 June 2023 the CFPB published an issue spotlight on chatbots in consumer finance. It warned that a chatbot “may fail to recognize that a consumer is invoking their federal rights,” can give inaccurate information that causes real harm, and can leave consumers unable to reach a person. It said institutions “should avoid using chatbots as their primary customer service delivery channel” where the chatbot clearly cannot meet customer needs.
The spotlight is a report, not a rule, and CFPB priorities have changed since. The regulation text has not: an examiner, a state attorney general or a plaintiff’s lawyer will read the agent’s transcripts against Regulation F as written.
Checklist for an AI collections agent
Controls that keep the agent inside Regulation F, and that a test should try to break.
- One shared contact ledger per consumer across AI agents, human collectors and dialers, checked before every call.
- Contact-hour checks use the consumer’s local time, and stated inconvenient times or places are stored and enforced.
- Opt-outs from a medium, attorney representation and cease-communication requests stop the agent in every channel.
- Disclosures are inserted by the system, not left to the model to remember.
- Amounts, balances and settlement terms come from the system of record. The agent cannot type a number freely.
- Settlement floors and payment-plan minimums are enforced in the tool, with human approval below them.
- The agent never states legal consequences that are not true for that account and that state.
- Uploaded receipts and “proof of payment” are verified before any account change.
- Transcripts, tool calls and recordings are retained for at least three years after the last collection activity.
Questions
Does Regulation F require an AI agent to say it is an AI?
Not in those words. It requires the debt-collector disclosures and bans false or misleading representations, so an agent that claims to be a person when asked creates risk under § 1006.18. Some state laws have separate bot-disclosure rules.
Do texts and emails count toward the seven-in-seven call limit?
No. The § 1006.14(b)(2) presumptions count telephone calls. Texts and emails are still covered by the general ban on harassing communications, the medium opt-out rule and the opt-out notice requirement.
Does Regulation F apply to a creditor’s own AI agent?
Generally not, because the FDCPA covers third-party debt collectors and debt buyers. First-party collectors are still subject to federal unfair, deceptive or abusive practices law and to state collection laws, which can be stricter.
This page summarizes the regulation and is not legal advice.
Attack families
Free checklist
Get the guardrail checklist for agents that move money.
A one-page PDF of the controls and the test for each. Download it right away, and we email you the link.
Sources
- 12 CFR 1006.14: harassing, oppressive or abusive conduct (CFPB)
- 12 CFR 1006.6: communications in connection with debt collection (CFPB)
- 12 CFR 1006.18: false, deceptive or misleading representations (CFPB)
- 12 CFR 1006.34: validation information (CFPB)
- 12 CFR 1006.100: record retention (CFPB)
- 15 U.S.C. § 1692k: civil liability (Cornell LII)
- CFPB issue spotlight on chatbots in consumer finance (6 June 2023)