> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Assembling a Debt-Collection and Receivables Compliance Posture End to End

> Connect the collections controls Orbit ships — the 10DLC collections use case, the payment-collection voice agent with its mini-Miranda opening, the PCI-safe payment bundle, DNC and reassignment scrubs, frequency caps, quiet hours, revocation logging, and KYC verification — into one tenant-owned receivables posture.

# Assembling a Debt-Collection and Receivables Compliance Posture End to End

Orbit documents each collections-adjacent control on its own page: the
payment-collection voice agent, the disclosure scanner, the PCI-safe
payment bundle, the suppression scrubs, the frequency caps, and the
evidence binder. This guide is the sequence across all of them — the
order a tenant that works past-due balances actually assembles the
posture in, and what each step leaves behind as evidence. It extends
the financial-services row of
[Vertical bundles by industry](https://docs.orbit.devotel.io/compliance/vertical-bundle-industry-guides.md)
into a full walkthrough for receivables, and it is the deep page for
the collections traffic named in
[Restricted & Prohibited Industries](https://docs.orbit.devotel.io/compliance/restricted-industries.md).

> [!WARNING]
>
> This page assembles Orbit's platform controls. It is **not legal
> advice,** and activating everything on it does not make your program
> compliant. Whether your traffic satisfies the FDCPA, Regulation F,
> the TCPA, state mini-TCPA and two-party-consent statutes, or a state
> debt-collector licensing regime depends on your practices, your
> recipients, and your jurisdictions. Confirm with qualified counsel.

## The tenant-owned framing

Read this first, because it shapes everything below:

* **Every control on this page defaults open or off.** A new workspace
  has no collections use case registered, no disclosure phrases
  queued, no recording announcement configured, and no caps set. You
  assemble the posture; the platform enforces what you set, not a
  posture it picked for you.
* **Your FDCPA and Reg F posture is yours.** Orbit carries the
  traffic, enforces the gates you configure, and keeps the auditable
  record. Whether a disclosure is adequate, a cadence is harassing, or
  a voicemail is an improper communication is your call with your
  counsel — the controls below help you execute that decision, not
  make it.
* **Collections is a vetted vertical, not a banned one.** US carriers
  allow debt-collection traffic with clear disclosures and the right
  registration; high-cost payday lending is prohibited. See
  [Restricted & Prohibited Industries](https://docs.orbit.devotel.io/compliance/restricted-industries.md).
* **The evidence reflects what you did.** An unset cap exports as
  unset; an uncleared checklist item exports as open. Assemble the
  posture first; export second.

***

## Section 1 — Register the traffic under the collections use case

Collections traffic rides on your 10DLC brand and campaign
registration, so the posture starts at the carrier filing, not at the
first dial.

* **Vet the vertical before you file.** The registration wizard checks
  your brand and sample content against the carriers' restricted and
  high-risk categories before the filing is submitted, and a failed
  pre-flight comes back as a fix card you can re-scope. Read
  [10DLC brand & campaign profiles](https://docs.orbit.devotel.io/compliance/10dlc-brand-campaign-profiles.md)
  for what the vetting looks at, and keep the
  [loans, credit & debt collection rules](https://docs.orbit.devotel.io/compliance/restricted-industries.md)
  in view: clear APR disclosure for credit traffic, and no high-cost
  payday lending on US carriers.
* **File under the business campaign use case.** The
  `pci_payment_collection` bundle seeds its draft compliance profile
  on `sms_10dlc_campaign_us`, the US 10DLC business campaign
  registration — the same primary use case every vertical bundle
  provisions on. Preview the manifest with
  `GET /api/v1/compliance/vertical-bundles/pci_payment_collection`
  before you activate.
* **Submit sample messages that already carry your disclosures.** The
  sample messages TCR reviews are part of your filing; draft them from
  the bundle's templates and run them through
  `POST /api/v1/messages/lint` while you build them, so restricted
  content and missing disclosure language fail in your editor rather
  than at carrier review.
* **Plan throughput for AR-pool burstiness.** Dunning sequences dial
  and message in bursts at the top of the month and after statement
  cycles. Size your expected volume against your carrier-assigned
  message class before the first campaign, with
  [10DLC carrier-assigned throughput planning](https://docs.orbit.devotel.io/guides/10dlc-carrier-assigned-throughput-planning.md).

***

## Section 2 — The voice leg: disclosure before discussion

The voice surface is where most collections exposure concentrates —
what you say at the top of the call, who you say it to, and what the
recording captures.

### Deploy the payment-collection voice agent with its mini-Miranda opening

The Payment Collection voice agent template ships with a
jurisdiction-sensitive mini-Miranda placeholder in its system prompt.
When you instantiate the template, the placeholder is substituted from
your workspace's jurisdiction setting: the US default renders the
FDCPA-style mandatory opening verbatim at the top of every call, while
jurisdictions without an equivalent clause suppress it. The same
prompt carries the rules that keep the call inside your posture:

* Identity is verified before any amount, invoice number, or due date
  is spoken; a failed verification ends the call politely rather than
  disclosing the debt to a wrong party.
* Disputes ("not mine", "I dispute this") route to a human instead of
  being argued on the line.
* A request to stop is logged on the spot and ends the call within
  one turn, with no retried disclosure.
* Card numbers, CVVs, account numbers, and full SSNs are never read,
  recorded, or repeated; a caller who starts dictating card data is
  redirected to the secure payment link.

Treat the seeded prompt as your floor, edit it with counsel's
language, and keep the verified-debtor-only rule and the opening
disclosure untouched unless counsel replaces them.

### Queue disclosure phrases for your human agents

Human collectors carry the same disclosure obligation. Set the queue's
`disclosure_required_phrases` so every collector call opens with the
language your counsel approves, and rely on the disclosure scan:
recorded calls are checked against the phrases you queued, and
omissions are recorded so a missing disclosure shows up as a finding,
not as silence. The ledger model is described in
[AI disclosure ledger](https://docs.orbit.devotel.io/concepts/ai-disclosure-ledger.md), and the
supervisor side — alerting when a monitored call drifts from its
required language — is in
[Live compliance monitoring](https://docs.orbit.devotel.io/guides/live-compliance-monitoring.md).

### Set the recording mode before you record collector calls

A collections recording is evidence in both directions: it proves the
disclosure was given, and it proves whatever else happened on the
call. Where a two-party-consent state reaches your calls — by
recipient location or by the state overlay your counsel maps — set the
consent announcement mode to `announce_all` so every party hears the
announcement on every recorded call, per
[Call recording consent](https://docs.orbit.devotel.io/compliance/recording-consent.md). Pair the
announcement decision with your retention window: a recording you keep
is a recording you can be asked to produce.

***

## Section 3 — The payments leg: card data never rides the channel

The payment half of the posture is one rule with three
enforcements: card data does not travel in SMS, in chat, or on the
recording.

* **Activate `pci_payment_collection`.** Its four draft campaigns —
  payment link request, invoice reminder, payment confirmation, failed
  payment retry — all point at a hosted link and none carry card data.
  Activation also puts the `confirm_hosted_payment_page` item on your
  go-live checklist: the attestation that every payment link routes to
  a PCI-DSS-compliant hosted checkout, such as your processor's hosted
  page. Clear it deliberately; it is the gate that keeps your
  collections traffic out of PCI scope. See
  [PCI-DSS posture](https://docs.orbit.devotel.io/compliance/pci-dss.md).
* **Take payment by hosted link on voice too.** The payment-collection
  agent texts the secure checkout link and does not stay on the line
  while the caller pays; installment plans and partial payments are
  scheduled as agreements, not as card reads. If a caller offers card
  digits verbally, the agent interrupts and redirects to the link.
* **Let masking catch the accident.** When a card number nonetheless
  appears in a message body, the dispatch scan's sensitive-data
  detection masks it before handoff, and your policy scan mode decides
  whether the send proceeds. See
  [PCI-DSS posture](https://docs.orbit.devotel.io/compliance/pci-dss.md) and
  [Restricted & Prohibited Industries](https://docs.orbit.devotel.io/compliance/restricted-industries.md)
  for the scan's verdicts.

***

## Section 4 — Contact hygiene before every dial and send

AR pools decay faster than marketing lists: numbers reassign, debtors
move, and third parties answer. Run the hygiene layer on every segment
before it enters a dial or send window.

* **Scrub suppression and reassignment.** The DNC scrub removes
  numbers on your suppression lists and registered do-not-call
  sources, and the reassignment scrub removes numbers ported or
  disconnected since your list was built — the wrong-party calls that
  drive most collections complaints. Run both before every campaign,
  per [DNC scrub](https://docs.orbit.devotel.io/compliance/dnc-scrub.md) and
  [RND scrub](https://docs.orbit.devotel.io/compliance/rnd-scrub.md).
* **Cap the AR segment, not just the program.** Set a per-recipient
  voice cap of 2–3 calls per rolling day and a matching SMS cap on the
  segments that carry past-due balances. The cap is your
  litigation-risk layer against the repeated-calls pattern; it is
  tenant-owned, fail-closed once created, and composes with the
  when-controls rather than replacing them. See
  [Frequency caps as a TCPA litigation-risk control](https://docs.orbit.devotel.io/compliance/frequency-caps-compliance-posture.md).
* **Hold the quiet-hours window.** The federal 8 AM to 9 PM voice
  window is a platform floor; your tenant quiet-hours gate layers on
  top of it for the windows your counsel sets — including stricter
  state windows and your own business rules. Configure it per
  [TCPA quiet hours and windows](https://docs.orbit.devotel.io/guides/tcpa-quiet-hours-and-windows.md).
* **Log revocation the moment it arrives, on any channel.** A "stop"
  by text, a revocation spoken on a collector call, and a wrong-party
  contact who says the number is not the debtor's are all records you
  must keep and honor. The voice section of
  [Opt-out entry points by channel](https://docs.orbit.devotel.io/compliance/opt-out-entry-points-by-channel.md)
  is the runbook for capturing spoken revocations, and
  [TCPA reasonable revocation](https://docs.orbit.devotel.io/compliance/tcpa-reasonable-revocation-2025.md)
  covers what counts as a valid revocation. A wrong-party result is
  also a suppression write, not just a note in the dialer.
* **Keep voicemails to a callback request.** You cannot verify who
  listens to a voicemail, so the verified-debtor-only rule extends to
  it: no debt amount, no creditor name beyond your own, no
  mini-Miranda substitute, no urgency language. Decide with counsel
  whether your program leaves voicemails at all; restraint is a
  practice you set, and Orbit enforces the caps and windows around
  whichever practice you choose.

***

## Section 5 — Verify the debtor without over-collecting

Identity verification is the hinge of the whole posture: too little
and you disclose a debt to a stranger; too much and you collect
identity data you had no need of.

* **Activate `fintech_kyc` alongside `pci_payment_collection` when you
  onboard debtors.** Its drafts and gates keep security and
  transactional messaging separate from promotional messaging, and its
  assistant never collects full government ID numbers, card numbers,
  passwords, or one-time passcodes over chat.
* **Attach only the documents your verification actually needs.**
  [KYC documents](https://docs.orbit.devotel.io/compliance/documents-kyc.md) lists the document
  classes the profile accepts; map your verification flow to the
  minimum of them, and pair that choice with your retention window so
  identity documents do not outlive the purpose that collected them.
  The identity model behind the flow is in
  [KYC identity model](https://docs.orbit.devotel.io/compliance/kyc-identity-model.md).
* **Verify on the call with data you already hold.** The
  payment-collection agent confirms identity against the account
  record before it discloses anything — the debtor proves who they
  are, rather than reciting identifiers into the recording.

***

## Section 6 — Evidence and audit: assemble the trail last

Every step above leaves a record; the binder reads them back in one
export for the examiner, auditor, or buyer who asks.

* **Consent and suppression history.** Opt-ins, revocations, DNC and
  RND scrub results, and wrong-party suppression writes form the
  contact-hygiene trail.
* **Disclosure history.** The disclosure scan's per-call results —
  which required phrases a recorded call carried and which it missed —
  are the record that your Section 2 language was actually spoken.
  See [AI disclosure ledger](https://docs.orbit.devotel.io/concepts/ai-disclosure-ledger.md).
* **Payment-scope evidence.** The cleared `confirm_hosted_payment_page`
  checklist entry and the hosted-link payment flow document that card
  data never touched your channel.
* **Assemble with the evidence binder.** Generate the binder from
  Settings → Compliance → Binder (or
  `POST /api/v1/compliance/binder/generate`) after the posture is
  assembled, not before: it reports what you configured, and an
  unconfigured control exports as an open item. See
  [Evidence binder](https://docs.orbit.devotel.io/compliance/evidence-binder.md) and
  [Audit ledger posture rollup](https://docs.orbit.devotel.io/compliance/audit-ledger-posture-rollup.md).

***

## Section 7 — What this page does not do

Boundary conditions, stated once and plainly:

* **No voicemail-count control is shipped.** Nothing on this page
  counts, caps, or reports voicemails left; the voicemail restraint in
  Section 4 is a practice for your scripts and QA, not a platform
  gate. Do not represent any Orbit setting as a voicemail cap.
* **No cadence is picked for you.** The caps, windows, and scrubs all
  default open; a posture you did not configure is not a posture Orbit
  chose.
* **No disclosure text is prescribed.** The template's US default
  opening and the bundle's drafts are starting copy for your counsel
  to review, not regulatory language.
* **Activation is not certification.** An activated bundle is drafts
  plus a checklist; your audit trail is the submitted profile, the
  cleared gates, and the records in Section 6.
* **This is not legal advice.** Whether the assembled posture
  satisfies the FDCPA, Reg F, the TCPA, or your state's collection
  laws is a call for your counsel.

***

## Related references

* [Vertical bundles by industry](https://docs.orbit.devotel.io/compliance/vertical-bundle-industry-guides.md) —
  the decision guide this page extends; the financial-services row is
  the entry point for collections.
* [Restricted & Prohibited Industries](https://docs.orbit.devotel.io/compliance/restricted-industries.md) —
  the loans, credit & debt collection rules and the carrier content
  floors.
* [Vertical compliance bundles](https://docs.orbit.devotel.io/compliance/vertical-bundles.md) — the
  catalog, activation endpoints, and the draft-only contract.
* [PCI-DSS posture](https://docs.orbit.devotel.io/compliance/pci-dss.md) — hosted checkout and card
  data out of the channel.
* [KYC documents](https://docs.orbit.devotel.io/compliance/documents-kyc.md) — verification documents
  without over-collection.
* [Call recording consent](https://docs.orbit.devotel.io/compliance/recording-consent.md) — the
  `announce_all` mode for two-party-consent states.
* [DNC scrub](https://docs.orbit.devotel.io/compliance/dnc-scrub.md) and [RND scrub](https://docs.orbit.devotel.io/compliance/rnd-scrub.md) —
  the pre-dial suppression and reassignment layer.
* [Frequency caps as a TCPA litigation-risk control](https://docs.orbit.devotel.io/compliance/frequency-caps-compliance-posture.md) —
  per-recipient caps on AR segments.
* [TCPA quiet hours and windows](https://docs.orbit.devotel.io/guides/tcpa-quiet-hours-and-windows.md) —
  the when-layers that compose at the dial and send site.
* [Opt-out entry points by channel](https://docs.orbit.devotel.io/compliance/opt-out-entry-points-by-channel.md) —
  capturing spoken and wrong-party revocations.
* [AI disclosure ledger](https://docs.orbit.devotel.io/concepts/ai-disclosure-ledger.md) and
  [Live compliance monitoring](https://docs.orbit.devotel.io/guides/live-compliance-monitoring.md) —
  the disclosure scan and supervisor alerting behind Section 2.
* [Evidence binder](https://docs.orbit.devotel.io/compliance/evidence-binder.md) — the export that
  reads everything above.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.