> For the complete documentation index, see [llms.txt](https://docs.moderncollections.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.moderncollections.io/compliance-for-integrators/overview.md). # Overview {% hint style="warning" %} **This is not legal advice.** Material in this section is informational only. Debt collection is heavily regulated at federal, state, and (sometimes) municipal levels. Engage your own counsel before launching any production integration. Modern Collections cannot indemnify you for compliance decisions you make on your side of the integration. {% endhint %} ## Why this section exists Our compliance engine gates outreach decisions on our side. But your integration touches debtor data, may trigger outreach by filing placements, may store transcripts, may forward debtor communications, and may surface compliance-sensitive information in your own dashboards. Your side of the integration has its own obligations. This section walks through what those obligations look like for an integrator. **It is not exhaustive.** It catches the common pitfalls. ## Read in this order 1. [FDCPA for integrators](/compliance-for-integrators/fdcpa-for-integrators.md) — federal Fair Debt Collection Practices Act. Most B2B is out of scope, but sole proprietors and personally-guaranteed B2B fall in. 2. [TCPA for integrators](/compliance-for-integrators/tcpa-for-integrators.md) — federal Telephone Consumer Protection Act. Restricts what you can do with phone numbers. 3. [Recording consent](/compliance-for-integrators/recording-consent.md) — one-party vs. two-party state laws. Affects whether you can store or forward transcripts. 4. [AI disclosure](/compliance-for-integrators/ai-disclosure.md) — emerging state laws (CA, IL, others) requiring disclosure that an AI is on the call. 5. [Data handling and PII](/compliance-for-integrators/data-handling-pii.md) — what you can store, for how long, and what protections you need. ## Third-party vs. first-party posture | | Third-party (we collect for you) | First-party (you collect on our platform) | | ------------------------------------------------ | -------------------------------- | ----------------------------------------- | | Who carries primary compliance risk | Modern Collections | You | | Who needs collections licenses | Modern Collections | You | | Who carries TCPA risk on outbound calls | Modern Collections | You | | Who carries recording-consent risk | Modern Collections | You | | Integrator-side obligations (data handling, PII) | Always present | Always present | If you operate in third-party mode, the integration burdens are mostly about handling the webhook payloads we send you responsibly. The outreach legal risk is ours. If you operate in first-party mode, you carry the full collections compliance burden. Our platform gives you tools; you carry the liability. ## What our compliance engine does — and doesn't — do for you **Does:** * Refuses to call or email if the debtor's state, time, or status doesn't allow it. * Refuses to escalate language without explicit creditor authorization (posture is the only knob; see [Configure negotiation strategy](/integration-guides/configure-negotiation-strategy.md)). * Pauses outreach when a placement transitions to `disputed`, when a `cease`/attorney/bankruptcy signal is captured during a call, or when the SOL gate fires. * Hard-blocks all outreach once a placement is `paid` or reaches any other terminal status (`recalled`, `resolved`, `resolved_out_of_band`, `withdrawn_by_creditor`, `closed_uncollected`), and once a debtor opts out of a channel — even if a previously issued decision hasn't hit its TTL yet. A dispute, cease request, or payment event force-expires any in-TTL decision so a stale `can_call=True`/`can_email=True` row can never survive it. * Logs every compliance decision with reasoning — reproducible and auditable via `GET /v1/placements/{id}/audit`. * Re-evaluates compliance before every action; decisions expire after `compliance_decision_ttl_hours` (default 24 hours, configurable via env) and refresh automatically. **Doesn't:** * Determine that the underlying debt is valid. The creditor stands behind the debt. * Manage debtor consent that lives on your side (e.g. an opt-in you collected for marketing calls does not translate to collections calls). * Replace your duty to honor cease requests routed through your channels — if a debtor emails you asking us to stop, you must forward that to us or pause on your side. * Provide legal advice. ## Quiet hours and time zones Most state collections laws restrict calls to specific hours (typically 8am-9pm local to the debtor). The compliance engine computes debtor local time from `debtor.state` and a ZIP / area-code timezone lookup. The dual-state evaluator picks the stricter of the platform's calling state and the debtor's state. If the data you send has inaccurate state or phone, calls may happen at the wrong local time. Send accurate `state`. ## Cease-contact handling Federally and in most states, a debtor's request to cease contact must be honored promptly. The platform pauses outreach immediately on: * A dispute being filed (placement transitions to `disputed`; outreach blocks until resolution). * A `capture_cease` voice-tool call fired by the agent when the debtor uses one of the hard-stop phrases ("stop calling me", "cease and desist", "remove me from your list"). * A `capture_attorney` tool call (FDCPA §805(a)(2) prohibits further direct contact once attorney representation is named). * A `capture_bankruptcy` tool call (automatic stay under 11 U.S.C. §362 fires the instant the debtor names a filing). * A `debtor_sanctions_hit` safety flag from the high-value sanctions screen. If a debtor contacts you directly asking to cease, forward to us promptly. The agent's own hard-stop captures are immediate; debtor-to-creditor channel routing is on you. ## Audit data retention The platform's audit trail is append-only, enforced at the database level — updates and deletes are blocked by the database itself. Default retention is the lifetime of the account plus seven years. Most state regulators expect at least five years of records. Your side should retain at least as long. DSAR deletion requests honor a regulator-aligned retention exception — DSAR responses are due within 45 days. ## When in doubt * Get an attorney involved. * Email for clarifications — our answers are not legal advice. * Use the `demo` environment to test compliance edge cases — the seeded demo scenarios cover high-regulation states. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.moderncollections.io/compliance-for-integrators/overview.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.