​

Assembling a Debt-Collection and Receivables Compliance Posture End to End

Orbit documents each collections-adjacent control on its own page: the payment-collection voice agent, the disclosure scanner, the PCI-safe payment bundle, the suppression scrubs, the frequency caps, and the evidence binder. This guide is the sequence across all of them — the order a tenant that works past-due balances actually assembles the posture in, and what each step leaves behind as evidence. It extends the financial-services row of Vertical bundles by industry into a full walkthrough for receivables, and it is the deep page for the collections traffic named in Restricted & Prohibited Industries.

​

The tenant-owned framing

Read this first, because it shapes everything below:

• Every control on this page defaults open or off. A new workspace has no collections use case registered, no disclosure phrases queued, no recording announcement configured, and no caps set. You assemble the posture; the platform enforces what you set, not a posture it picked for you.
• Your FDCPA and Reg F posture is yours. Orbit carries the traffic, enforces the gates you configure, and keeps the auditable record. Whether a disclosure is adequate, a cadence is harassing, or a voicemail is an improper communication is your call with your counsel — the controls below help you execute that decision, not make it.
• Collections is a vetted vertical, not a banned one. US carriers allow debt-collection traffic with clear disclosures and the right registration; high-cost payday lending is prohibited. See Restricted & Prohibited Industries.
• The evidence reflects what you did. An unset cap exports as unset; an uncleared checklist item exports as open. Assemble the posture first; export second.

---

​

Section 1 — Register the traffic under the collections use case

Collections traffic rides on your 10DLC brand and campaign registration, so the posture starts at the carrier filing, not at the first dial.

• Vet the vertical before you file. The registration wizard checks your brand and sample content against the carriers’ restricted and high-risk categories before the filing is submitted, and a failed pre-flight comes back as a fix card you can re-scope. Read 10DLC brand & campaign profiles for what the vetting looks at, and keep the loans, credit & debt collection rules in view: clear APR disclosure for credit traffic, and no high-cost payday lending on US carriers.
• File under the business campaign use case. The pci_payment_collection bundle seeds its draft compliance profile on sms_10dlc_campaign_us, the US 10DLC business campaign registration — the same primary use case every vertical bundle provisions on. Preview the manifest with GET /api/v1/compliance/vertical-bundles/pci_payment_collection before you activate.
• Submit sample messages that already carry your disclosures. The sample messages TCR reviews are part of your filing; draft them from the bundle’s templates and run them through POST /api/v1/messages/lint while you build them, so restricted content and missing disclosure language fail in your editor rather than at carrier review.
• Plan throughput for AR-pool burstiness. Dunning sequences dial and message in bursts at the top of the month and after statement cycles. Size your expected volume against your carrier-assigned message class before the first campaign, with 10DLC carrier-assigned throughput planning.

---

​

Section 2 — The voice leg: disclosure before discussion

The voice surface is where most collections exposure concentrates — what you say at the top of the call, who you say it to, and what the recording captures.

​

Deploy the payment-collection voice agent with its mini-Miranda opening

The Payment Collection voice agent template ships with a jurisdiction-sensitive mini-Miranda placeholder in its system prompt. When you instantiate the template, the placeholder is substituted from your workspace’s jurisdiction setting: the US default renders the FDCPA-style mandatory opening verbatim at the top of every call, while jurisdictions without an equivalent clause suppress it. The same prompt carries the rules that keep the call inside your posture:

• Identity is verified before any amount, invoice number, or due date is spoken; a failed verification ends the call politely rather than disclosing the debt to a wrong party.
• Disputes (“not mine”, “I dispute this”) route to a human instead of being argued on the line.
• A request to stop is logged on the spot and ends the call within one turn, with no retried disclosure.
• Card numbers, CVVs, account numbers, and full SSNs are never read, recorded, or repeated; a caller who starts dictating card data is redirected to the secure payment link.

Treat the seeded prompt as your floor, edit it with counsel’s language, and keep the verified-debtor-only rule and the opening disclosure untouched unless counsel replaces them.

​

Queue disclosure phrases for your human agents

Human collectors carry the same disclosure obligation. Set the queue’s disclosure_required_phrases so every collector call opens with the language your counsel approves, and rely on the disclosure scan: recorded calls are checked against the phrases you queued, and omissions are recorded so a missing disclosure shows up as a finding, not as silence. The ledger model is described in AI disclosure ledger, and the supervisor side — alerting when a monitored call drifts from its required language — is in Live compliance monitoring.

​

Set the recording mode before you record collector calls

A collections recording is evidence in both directions: it proves the disclosure was given, and it proves whatever else happened on the call. Where a two-party-consent state reaches your calls — by recipient location or by the state overlay your counsel maps — set the consent announcement mode to announce_all so every party hears the announcement on every recorded call, per Call recording consent. Pair the announcement decision with your retention window: a recording you keep is a recording you can be asked to produce.

---

​

Section 3 — The payments leg: card data never rides the channel

The payment half of the posture is one rule with three enforcements: card data does not travel in SMS, in chat, or on the recording.

• Activate pci_payment_collection. Its four draft campaigns — payment link request, invoice reminder, payment confirmation, failed payment retry — all point at a hosted link and none carry card data. Activation also puts the confirm_hosted_payment_page item on your go-live checklist: the attestation that every payment link routes to a PCI-DSS-compliant hosted checkout, such as your processor’s hosted page. Clear it deliberately; it is the gate that keeps your collections traffic out of PCI scope. See PCI-DSS posture.
• Take payment by hosted link on voice too. The payment-collection agent texts the secure checkout link and does not stay on the line while the caller pays; installment plans and partial payments are scheduled as agreements, not as card reads. If a caller offers card digits verbally, the agent interrupts and redirects to the link.
• Let masking catch the accident. When a card number nonetheless appears in a message body, the dispatch scan’s sensitive-data detection masks it before handoff, and your policy scan mode decides whether the send proceeds. See PCI-DSS posture and Restricted & Prohibited Industries for the scan’s verdicts.

---

​

Section 4 — Contact hygiene before every dial and send

AR pools decay faster than marketing lists: numbers reassign, debtors move, and third parties answer. Run the hygiene layer on every segment before it enters a dial or send window.

• Scrub suppression and reassignment. The DNC scrub removes numbers on your suppression lists and registered do-not-call sources, and the reassignment scrub removes numbers ported or disconnected since your list was built — the wrong-party calls that drive most collections complaints. Run both before every campaign, per DNC scrub and RND scrub.
• Cap the AR segment, not just the program. Set a per-recipient voice cap of 2–3 calls per rolling day and a matching SMS cap on the segments that carry past-due balances. The cap is your litigation-risk layer against the repeated-calls pattern; it is tenant-owned, fail-closed once created, and composes with the when-controls rather than replacing them. See Frequency caps as a TCPA litigation-risk control.
• Hold the quiet-hours window. The federal 8 AM to 9 PM voice window is a platform floor; your tenant quiet-hours gate layers on top of it for the windows your counsel sets — including stricter state windows and your own business rules. Configure it per TCPA quiet hours and windows.
• Log revocation the moment it arrives, on any channel. A “stop” by text, a revocation spoken on a collector call, and a wrong-party contact who says the number is not the debtor’s are all records you must keep and honor. The voice section of Opt-out entry points by channel is the runbook for capturing spoken revocations, and TCPA reasonable revocation covers what counts as a valid revocation. A wrong-party result is also a suppression write, not just a note in the dialer.
• Keep voicemails to a callback request. You cannot verify who listens to a voicemail, so the verified-debtor-only rule extends to it: no debt amount, no creditor name beyond your own, no mini-Miranda substitute, no urgency language. Decide with counsel whether your program leaves voicemails at all; restraint is a practice you set, and Orbit enforces the caps and windows around whichever practice you choose.

---

​

Section 5 — Verify the debtor without over-collecting

Identity verification is the hinge of the whole posture: too little and you disclose a debt to a stranger; too much and you collect identity data you had no need of.

• Activate fintech_kyc alongside pci_payment_collection when you onboard debtors. Its drafts and gates keep security and transactional messaging separate from promotional messaging, and its assistant never collects full government ID numbers, card numbers, passwords, or one-time passcodes over chat.
• Attach only the documents your verification actually needs. KYC documents lists the document classes the profile accepts; map your verification flow to the minimum of them, and pair that choice with your retention window so identity documents do not outlive the purpose that collected them. The identity model behind the flow is in KYC identity model.
• Verify on the call with data you already hold. The payment-collection agent confirms identity against the account record before it discloses anything — the debtor proves who they are, rather than reciting identifiers into the recording.

---

​

Section 6 — Evidence and audit: assemble the trail last

Every step above leaves a record; the binder reads them back in one export for the examiner, auditor, or buyer who asks.

• Consent and suppression history. Opt-ins, revocations, DNC and RND scrub results, and wrong-party suppression writes form the contact-hygiene trail.
• Disclosure history. The disclosure scan’s per-call results — which required phrases a recorded call carried and which it missed — are the record that your Section 2 language was actually spoken. See AI disclosure ledger.
• Payment-scope evidence. The cleared confirm_hosted_payment_page checklist entry and the hosted-link payment flow document that card data never touched your channel.
• Assemble with the evidence binder. Generate the binder from Settings → Compliance → Binder (or POST /api/v1/compliance/binder/generate) after the posture is assembled, not before: it reports what you configured, and an unconfigured control exports as an open item. See Evidence binder and Audit ledger posture rollup.

---

​

Section 7 — What this page does not do

Boundary conditions, stated once and plainly:

• No voicemail-count control is shipped. Nothing on this page counts, caps, or reports voicemails left; the voicemail restraint in Section 4 is a practice for your scripts and QA, not a platform gate. Do not represent any Orbit setting as a voicemail cap.
• No cadence is picked for you. The caps, windows, and scrubs all default open; a posture you did not configure is not a posture Orbit chose.
• No disclosure text is prescribed. The template’s US default opening and the bundle’s drafts are starting copy for your counsel to review, not regulatory language.
• Activation is not certification. An activated bundle is drafts plus a checklist; your audit trail is the submitted profile, the cleared gates, and the records in Section 6.
• This is not legal advice. Whether the assembled posture satisfies the FDCPA, Reg F, the TCPA, or your state’s collection laws is a call for your counsel.

---

​

Related references

• Vertical bundles by industry — the decision guide this page extends; the financial-services row is the entry point for collections.
• Restricted & Prohibited Industries — the loans, credit & debt collection rules and the carrier content floors.
• Vertical compliance bundles — the catalog, activation endpoints, and the draft-only contract.
• PCI-DSS posture — hosted checkout and card data out of the channel.
• KYC documents — verification documents without over-collection.
• Call recording consent — the announce_all mode for two-party-consent states.
• DNC scrub and RND scrub — the pre-dial suppression and reassignment layer.
• Frequency caps as a TCPA litigation-risk control — per-recipient caps on AR segments.
• TCPA quiet hours and windows — the when-layers that compose at the dial and send site.
• Opt-out entry points by channel — capturing spoken and wrong-party revocations.
• AI disclosure ledger and Live compliance monitoring — the disclosure scan and supervisor alerting behind Section 2.
• Evidence binder — the export that reads everything above.