A third-party debt collection agency needs two things to operate legally in the United States: compliance with the federal Fair Debt Collection Practices Act (and the CFPB’s Regulation F built on top of it), plus a state license in roughly 36 of the 50 states. Collection agency licensing requirements are set at the state level, so an agency working across state lines usually needs a portfolio of licenses, each with its own surety bond, documentation, and renewal cycle. Original creditors collecting their own accounts under their own name are generally outside both the FDCPA and state licensing regimes, so what follows is aimed at third-party collectors and debt buyers.
Who Actually Needs a License
The FDCPA defines a debt collector as someone whose principal business is collecting debts owed to another, or who regularly collects on another party’s behalf.1Office of the Law Revision Counsel. 15 USC 1692a – Definitions That definition matters for licensing too, because states generally borrow the same line. If a bank, hospital, or card issuer is chasing its own past-due accounts under its own name, it is usually neither an FDCPA “debt collector” nor a licensee under state collection statutes. The moment a third party steps in, both layers apply.
Debt buyers who purchase delinquent portfolios sit on the collector side of that line in most jurisdictions. They are treated as debt collectors under the FDCPA even though they own the debt, and states that license collection agencies typically require them to license too. The consumer’s experience is the same whether the caller bought the debt or was hired to collect it, and the licensing framework tracks that reality.
A few categories fall out of the federal definition: government employees collecting in their official capacity, process servers, and nonprofit credit counselors. State exemptions do not always mirror the federal list, so an agency planning to operate in a given state needs to read that state’s statute rather than assume the FDCPA carve-outs carry over.
The Federal Layer: FDCPA and Regulation F
Every third-party collector, licensed or not, has to follow the FDCPA. The statute regulates when contact can happen, what can be said, and what disclosures the consumer is entitled to.
Contact and Conduct Rules
Calls outside 8 a.m. to 9 p.m. local time are presumed inconvenient. Once a consumer is represented by an attorney, communications go to the attorney. Contacting a consumer at work is off-limits if the collector knows the employer prohibits it.2Office of the Law Revision Counsel. 15 USC 1692c – Communication in Connection With Debt Collection Threats, obscene language, and repeated calls meant to annoy or harass are prohibited outright,3Office of the Law Revision Counsel. 15 USC 1692d – Harassment or Abuse as are unfair tactics like collecting unauthorized fees or threatening to seize property the collector has no right to take.4Office of the Law Revision Counsel. 15 USC 1692f – Unfair Practices
The Validation Notice
Within five days of first contact, a collector must send a written validation notice showing the amount owed, the current creditor, and the consumer’s right to dispute within 30 days.5Office of the Law Revision Counsel. 15 USC 1692g – Validation of Debts A written dispute during that 30-day window freezes collection activity until the collector provides verification. Regulation F expanded this notice to require an itemized breakdown tied to a specific reference date (last statement, charge-off, or last payment), identification of the original and current creditor, a specific end date for the dispute window, and a tear-off response section.6eCFR. 12 CFR 1006.34 – Notice for Validation of Debts Getting the validation notice wrong is where a large share of enforcement begins.
Call Frequency and Digital Contact
Regulation F sets a numerical presumption around harassment: no more than seven call attempts within seven consecutive days about a particular debt, and no calls within seven days after an actual conversation about that debt.7eCFR. 12 CFR 1006.14 – Harassing, Oppressive, or Abusive Conduct The limits run per person, per debt, regardless of how many numbers the collector has. Calls with direct prior consent and calls that never connect do not count.
Email and text messages are allowed, but with conditions. Email requires prior consent, prior use of that address by the consumer to discuss the debt, or a documented handoff from the original creditor who used the address and gave the consumer at least 35 days to opt out. Texts require similar authority plus a check within the past 60 days confirming the phone number has not been reassigned. Every electronic message needs a simple opt-out method, and the collector cannot charge a fee or demand extra information to process it.8Consumer Financial Protection Bureau. 12 CFR Part 1006 – Communications in Connection With Debt Collection
Agencies that report to credit bureaus also fall under the Fair Credit Reporting Act, which requires accurate reporting and gives consumers direct dispute rights against the furnisher.9Office of the Law Revision Counsel. 15 USC 1681 – Congressional Findings and Statement of Purpose
State Licensing: Where It Is Required
Approximately 36 states require a specific license, registration, or certificate before a third-party agency can collect from residents. The rest allow collection activity without a dedicated license, though state consumer protection statutes still apply. The trigger in most licensing states is collecting from a resident of the state, not maintaining an office there. An agency that calls or writes into a state to collect generally needs that state’s license even with no physical footprint.
The Surety Bond
Almost every licensing state requires a surety bond as a financial guarantee. If the agency violates the law, consumers or creditor-clients can file claims against the bond. Amounts generally run from $5,000 to $50,000, with higher figures for high-volume operations depending on the state’s formula. Obtaining the bond means an underwriting review of company credit and financials by a licensed surety.
Documentation the Application Requires
Beyond the bond, expect to file:
- A designated registered agent authorized to accept legal service in the state.
- Criminal background checks and fingerprints for principal officers and owners.
- Business formation documents showing ownership and management structure — articles of incorporation, LLC operating agreements, or partnership certificates.
- Audited or certified financial statements in states that require proof of operating capacity.
Filing and Timing
Many states accept collection agency applications through the Nationwide Multistate Licensing System (NMLS), which lets a multi-state applicant upload core documents once and manage renewals in one portal. Others run their own systems. Application fees range from under $100 to more than $1,000 depending on the state. Some regulators still require the original surety bond, with a physical embossed seal, to be mailed separately from the electronic filing.
Review typically takes 30 to 90 days. Examiners verify background results, review financials, and confirm the bond. If they need something more, they issue a formal request through the filing system; ignoring that request is a fast route to denial or abandonment. Approval produces a state license number authorizing collection within that state.
What Can Disqualify an Applicant
Felony convictions are the most common disqualifier, though the analysis is rarely automatic. Regulators weigh the nature of the offense, its relationship to the collection business, elapsed time, and post-conviction conduct. Fraud, embezzlement, and theft convictions carry the most weight because they go directly to the trust the role requires. Misdemeanors involving dishonesty or financial misconduct can also sink an application if closely tied to collection work. Outstanding unsatisfied civil judgments for fraud or consumer harm often trigger mandatory denial.
Data Security: The Safeguards Rule
Federal law treats collection agencies as financial institutions for data security purposes. The Gramm-Leach-Bliley Act’s Safeguards Rule (16 CFR Part 314) requires a written information security program, and it is not optional.10eCFR. 16 CFR Part 314 – Standards for Safeguarding Customer Information
The program starts with a designated Qualified Individual who owns information security. That person can be an employee, an affiliate, or an outside service provider. From there, the agency needs a written risk assessment identifying foreseeable threats to consumer data and a mitigation plan for each risk.
On the technical side, the rule requires encryption of consumer information in transit and at rest, multi-factor authentication for anyone accessing information systems, access controls that limit exposure to employees who need the data, and regular penetration testing or continuous monitoring. Data no longer needed must be securely disposed of within two years of last use unless a legal hold or business necessity applies. The Qualified Individual must report at least annually to the governing body on the program’s status and any material concerns.10eCFR. 16 CFR Part 314 – Standards for Safeguarding Customer Information
Ongoing Obligations After Licensing
Trust Accounts
Licensed agencies must keep client funds separate from operating capital. Money collected for creditors goes into dedicated trust accounts and cannot pay business expenses. Most licensing states require remittance to clients within a defined window, commonly 30 to 45 days. Intentional misappropriation of trust funds is prosecuted as embezzlement in some jurisdictions, with felony exposure.
Records and Change Reporting
Communication logs and call recordings must be retained for a period set by state law, commonly two to three years, and serve as the evidence base during audits and complaint responses. Significant changes — ownership, corporate officers, business addresses — typically must be reported to each licensing state within 30 days. Missing that window can produce compliance actions even where the underlying change was routine.
Renewals
Renewal cycles are annual or biennial depending on the state, and require updated financials, a renewed surety bond, and payment of renewal fees. A lapsed license means the agency is operating without authorization, and the penalties for unlicensed collection are often harsher than the penalties for a compliance violation by a licensed agency. Renewal deadlines belong at the top of the compliance calendar.
What Noncompliance Costs
At the state level, administrative penalties for late filings or minor recordkeeping gaps are the lighter end of the range. Collecting without a required license can void the agency’s standing to pursue the debts entirely. State regulators can issue cease-and-desist orders, mandate restitution or disgorgement, and refer matters for civil injunction. Criminal prosecution is reserved for the worst conduct: embezzlement of client funds, systemic fraud, or continuing to operate after being ordered to stop.
Federal exposure stacks on top. An individual FDCPA suit caps statutory damages at $1,000 plus actual damages and attorney fees. Class actions can reach the lesser of $500,000 or one percent of the collector’s net worth, on top of individual damages for named plaintiffs.11Office of the Law Revision Counsel. 15 USC 1692k – Civil Liability CFPB enforcement against agencies with systemic problems has produced multi-million-dollar penalties and operational restrictions that can end a company’s ability to keep operating. Compliance infrastructure is a survival requirement, not a bookkeeping preference.