AI Voice Agent Compliance Checklist

On every collection call, the agent must disclose their name, the name of the lending institution they represent, the purpose of the call (recovery), and the loan-account context before discussing repayment.

Recovery and collection calls must occur between 8:00 AM and 7:00 PM local time of the borrower. Calls outside this window are prohibited unless the borrower has explicitly consented.

Tone, language, and call frequency must not constitute harassment. Recovery agents (including voice bots) must not threaten the borrower or contact third parties about the debt.

Promotional calls must not be made to numbers registered in the National Customer Preference Register (NCPR / DND). Service / transactional calls have separate carve-outs but must still respect customer preferences.

In two-party-consent states / countries (e.g., California, Florida, most of the EU), all parties must be informed that the call is being recorded before recording begins.

Set an explicit retention window for call recordings and transcripts aligned with regulatory minimums (e.g., 5-year SEBI / 3-year IRDAI / 6-year HIPAA / minimal for marketing).

All PII captured during voice interactions (names, numbers, IDs, account details) must be encrypted at rest using current industry standards and in transit via TLS 1.2+.

When interacting with a person, the AI voice agent should disclose that it is an automated system and offer escalation to a human, especially when the user explicitly asks.

Card numbers, government IDs, and other sensitive identifiers should be redacted from exported transcripts and analytics unless explicitly required for the audit trail.