Collections & dunning agents.
In collections the model is the cheap part and the counter is the product: federal Regulation F lets you place seven calls per debt per seven days, New York City's SHIELD rule cuts that to three communications of any kind per account, and the fastest way to convert an automation win into a statutory-damages case is to let your email agent and your voice agent each believe it owns the budget. Build the contact governor first, put every channel behind it, and only then argue about the conversation.
One governor, keyed to the account, decremented before anything leaves.
The rules do not agree with each other, so you must build to their intersection rather than to any one of them. Three differences drive the design:
- The federal count is per debt and calls only. Regulation F, in force since late 2021, presumes a violation above seven telephone calls to a consumer about a particular debt within seven consecutive days, and bars calling again within seven days of an actual telephone conversation about that debt. Emails and texts do not consume that budget.
- The local count can be per account and channel-agnostic. New York City's SHIELD rule caps attempts at three per account in any seven days across channels, extends the regime to original creditors rather than only third-party collectors, and — after a postponement — takes effect on 1 January 2027. A consumer with three debts is not three budgets.
- Consumer responses reset the clock. A conversation, a dispute, a cease request or a callback each changes what is permitted next, and it changes it immediately rather than at the next batch run.
Which means the governor is not a rate limiter in your outbound service. It is a single authoritative counter, keyed to consumer × account × jurisdiction, that every channel — dialler, SMS, email, in-app nudge — must call and decrement before the message is composed, and that any inbound event can update within seconds. Put it behind one API, make bypassing it structurally impossible rather than discouraged, and treat its logs as the primary compliance artefact. This is the concrete form of policy enforcement: a rule you can only obey.
Two implementation details cause most real violations. Time zone: contact windows are the consumer's local time, and area code is not location — a mobile number that moved states will call someone at 6 a.m. Idempotency: a retried send after a timeout is a second attempt in the eyes of a regulator even though your system thinks it made one, which is the collections-specific edge of idempotency and retries.
Right-party contact comes before content, and an LLM is exactly the wrong thing to trust with that order.
Disclosing a debt to a third party is a violation in itself, so the agent may not say why it is calling until it knows who it is talking to. That ordering is unnatural for a language model: asked "who's calling and what's this about?" by whoever picked up, a helpful assistant answers both halves. It must answer neither until identity is established.
- Structure the opening as a gate, not a prompt instruction. Until the identity check passes, the agent's available actions are limited to a fixed set: ask for the named consumer, leave a limited-content message, or end the call. There is no generation path that can emit the creditor's name or the word "debt" — the same argument as guardrails, applied to the action space rather than the text.
- Use the limited-content message deliberately. Regulation F defines a voicemail that names the individual, gives a callback number and a request to call back but references no debt, so it does not count as a communication to a third party. It still consumes call-attempt budget.
- Authenticate at the level the balance requires. Confirming a name is enough to continue talking; taking a payment or disclosing an amount needs more. The techniques are in caller authentication, and here the asymmetry runs the other way from support — you are calling them, so knowledge-based questions you supply are also a script a fraudster can replay.
The wrong-number path deserves as much design as the happy path. "This isn't me" must suppress the number across every channel and every account immediately, not flag it for review, because the second call to a wrong number is the one that generates the complaint.
Disclose the machine, and get the recording question right per state.
Three separate obligations converge on the first fifteen seconds of a call, and none of them is a place for the model to improvise:
- The AI itself. The FCC's 2024 declaratory ruling treats AI-generated voices as "artificial" under the TCPA, which pulls consented-robocall rules over your outbound agent, with statutory damages commonly cited at $500 to $1,500 per call. California's bot-disclosure law adds an explicit duty to say a machine is speaking in commercial contexts. Say it plainly, first, in a fixed string.
- The collector disclosure. The statutory notice that this is a communication from a debt collector, plus the validation information regime the consumer is entitled to, is prescribed text — render it from a template with verified merge fields, never from a generation.
- Recording consent. All-party-consent states such as California and Florida require the disclosure before the recording starts, which for an agent means the audio pipeline must be able to begin a call unrecorded and start recording on consent — an architectural requirement, not a script one.
Two consequences for the stack. Your telephony layer must carry jurisdiction into the session so the right opening is selected before the first word, and every disclosure must be retained as delivered audio and text, tied to the attempt record — see audit trails, because in this domain the audit is adversarial and the plaintiff picks the call.
The regulated parts are a state machine; the model earns its keep in between.
Draw the line by consequence: anything that is prescribed text, a number, or an authority to commit belongs to code; everything about understanding a person in financial distress belongs to the model.
- Code owns: disclosures, balances, itemisation, interest and fee arithmetic, settlement authority ranges, payment-plan terms, and the boundaries of what may be offered. The agent may present these; it may never compute or paraphrase them. A model that rounds a balance has misstated a debt.
- The model owns: intent and objection classification ("I already paid this", "I lost my job", "this isn't my account"), hardship detection, choosing which pre-approved plan to offer next, tone, and rendering the arithmetic into a sentence a person can act on.
- Negotiation is a bounded search, not a conversation. Give the agent a policy-derived offer ladder — minimum acceptable instalment, maximum term, settlement floor — and let it choose within it. Anything outside the ladder is a handoff, per human in the loop.
Threats are the failure mode that ends programmes. An agent must have no path to state or imply legal action, credit-report consequences, or wage garnishment, whether or not those are true — the safest construction is that these phrases are not in the reachable action space at all, and that any consumer question about them is a scripted deflection to a human. The generic version of this argument is in finance agents; here the difference is that a single sentence is a statutory violation rather than a bad answer.
Disputes, cease requests and hardship are hard stops that must propagate in seconds.
Four consumer signals change your legal position the moment they are uttered, and each must halt the machine everywhere rather than in the channel that heard it:
- Dispute. Collection on the disputed portion pauses until verification is provided; the SHIELD regime goes further and requires cessation if a disputed debt is not verified within a set window. The agent's job is to recognise a dispute in any phrasing — "that's not mine", "I paid that in March", "the amount is wrong" — and to over-trigger rather than under-trigger.
- Cease communication. Stop, in every channel, immediately, and record the request verbatim.
- Attorney representation or bankruptcy. An instant, total stop on direct contact, routed to a human queue. There is no clarifying question worth asking after the word "attorney".
- Vulnerability and hardship. Bereavement, illness, domestic abuse, suicidal statements. These need a named path with a human at the end and a script that does not attempt to collect — and they need to be detected by a classifier tuned for recall, since the cost of a missed signal is not symmetric with a false positive.
The engineering requirement is propagation latency. A dispute captured by the voice agent at 10:02 must suppress the 10:05 dunning email, which means these events cannot ride a nightly batch into your CRM. Treat suppression as a write to the same authoritative store the governor reads, and test it by asserting on the store, not on the transcript.
Log the classifier's decision, its confidence and the utterance that triggered it, for every hard stop and every near miss. When a regulator or a plaintiff asks why the agent kept calling, "the model did not classify that as a dispute" is only survivable if you can show the threshold, the review process and what you did with the near misses.
Measure net recovery and complaint rate together, never contact volume.
Dialler-era metrics — attempts, connect rate, minutes — reward exactly the behaviour that creates liability, and an agent can produce them at a volume no call centre could. Report the pair that cannot be gamed against each other:
- Recovery per account, net of cost and of complaint handling, against a matched control of accounts worked the old way. Gross recovery rate with the legal cost booked to a different team is not a result.
- Right-party contact rate, which is the real efficiency number and the one the agent genuinely moves, since patient retries within the budget beat a human's abandonment.
- Promise-to-pay kept rate — the metric that separates a persuasive agent from an effective one. A high promise rate with a low kept rate means you are extracting commitments people cannot meet, and it shows up next quarter as roll-rate.
- Complaints and disputes per thousand attempts, as a hard guardrail with a rollback threshold, not a quarterly report.
- Self-service deflection. The cheapest resolution is a payment link the consumer uses without speaking to anyone. If the agent's best play is to send that link and stop talking, the metric set has to reward it.
Ship in this order and the programme survives contact with a regulator. One: build the governor — a single counter keyed to consumer, account and jurisdiction that every channel must decrement before composing anything, with contact windows in the consumer's local time. Two: make the identity gate structural, so no generation path can name the debt before the right party is confirmed. Three: put disclosures, balances and offer ladders in code, and let the model handle only intent, tone and choice within bounds. Four: wire dispute, cease, attorney and hardship signals to a suppression store that every channel reads within seconds. Only then tune the conversation — and measure it as net recovery against complaints, never as attempts.
Related: outbound voice agents for the calling mechanics this sits on, public benefits casework agents for the adjacent problem of talking to people under financial stress, and the regulatory landscape for how these regimes stack.