# Compliance basics Commercial debt collection is regulated. The rules vary by state, by debtor type (business versus sole proprietor), and by channel (voice, email, SMS). ai-collect's compliance engine handles the day-to-day decisions automatically — but you should understand what's happening so you can answer questions from your team or your debtors. > This page is general information, not legal advice. For your specific situation, talk to a lawyer. ## What we do automatically For every placement, the compliance engine evaluates (per the rules baked into `src/services/compliance/` and `config/compliance/states.json`): 1. **Creditor verification.** The engine refuses outreach when the creditor's status is anything other than `verified`, when `risk_flags.blocked` is set, or when `sandbox_mode` is on. 2. **State licensing.** Some states require collectors to be licensed. We hold the licenses we need for the states we operate in. If a state requires a license we don't yet hold, we won't make outreach in that state. 3. **Debtor type.** A debt owed by a corporation is "B2B" and is regulated less strictly than a debt owed by a sole proprietor (which is treated like consumer debt under FDCPA). Our enrichment system tries to determine the entity type; if it's ambiguous, we **conservatively treat it as a sole proprietor** and apply the stricter rules. 4. **Contact hours.** No calls before 8am or after 9pm in the debtor's time zone, with state-specific exceptions. 5. **Frequency caps.** No more than the legal maximum contact attempts per state's rule, evaluated against the recent contact history. 6. **Recording disclosure.** Where state law requires two-party consent for recording, our agent discloses the recording at the start of the call. 7. **AI disclosure.** Where state law requires it (a growing list), our agent discloses that it is an AI. 8. **Dispute and cease-of-contact honoring.** If a debtor disputes the debt or requests we stop contacting them, we immediately pause and notify you. 9. **Volume + pile-on policy.** Bulk-upload abuse and round-robin abuse (same debtor placed by ≥ 3 distinct creditors in 30 days) get a `volume_quota_exceeded` safety flag, which the compliance engine refuses outreach on. The compliance engine returns a fresh decision per attempt (CLAUDE.md rule 1 — no outreach without a fresh decision; decisions expire after 24 hours by default). Outcomes the planner acts on: * **Allowed** — `can_call=true`; the planner schedules the attempt. * **Channel-restricted** — only some channels permitted at this moment (e.g., email but not voice given the time window). * **Blocked** — the planner records the decision and waits. A blocked placement isn't moved to a special status — it simply doesn't advance through outreach until the next compliance evaluation says otherwise. ## What you stay responsible for (3P) Even in third-party mode, a few things are still on you: * **The debt is real and accurate.** Don't place a debt you know is disputed or paid. If you do and the debtor disputes, we'll pause and ask you to verify, but we can't tell from outside whether the underlying invoice is correct. * **You have the right to collect.** Don't place a debt you assigned to someone else, or a debt that's barred by the statute of limitations. * **You provide accurate debtor information.** If you give us a wrong address or phone number, we may end up calling a third party. We try to verify, but we trust your data. * **Bankruptcy notice.** If you know the debtor has filed for bankruptcy, tell us immediately — we'll pause. (We also auto-detect bankruptcy mentions during calls.) ## What you stay responsible for (1P, future) If you use ai-collect's software in your own name, **you take the compliance risk**. You're responsible for: * Your own state licenses where required. * Your own AI disclosure obligations. * Your own recording-consent disclosures (the software will assist, but you decide the policy). * Reviewing and applying compliance decisions. 1P is for creditors with a compliance officer in place. If you don't have one, stay in 3P. ## What if I think a debt I placed is going to cause a compliance problem Tell us. The earlier the better. You can mark a placement as "review me" before outreach starts, and we'll have a human look at it. See [Pausing or recalling a placement](/for-creditor-partners/creditor-operations/pausing-or-recalling-a-placement.md). You can also recall the placement at any time — no penalty. We'd rather you recall an iffy placement than have us call on it and create a problem for both of us. ## Want to learn more * [Recording consent by state](/for-debtors/compliance-and-rights/recording-consent-by-state.md) — where two-party consent applies. * [AI disclosure](/for-debtors/compliance-and-rights/ai-disclosure.md) — which states require it and what we say. * [Frequency of contact](/for-debtors/compliance-and-rights/frequency-of-contact.md) — how often we'll reach out. * [Debtor rights overview](/for-debtors/compliance-and-rights/debtor-rights-overview.md) — what your debtors can expect. *** Last reviewed: 2026-05-24 by Compliance Lead. **TODO: external counsel sign-off.** --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://help.moderncollections.io/for-creditor-partners/creditor-onboarding/compliance-basics.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.