AI Calling Compliance for Consumer Lenders: What to Check First

Before an AI calls a single borrower, you need four things settled with your own counsel.

Consent that covers calls made with an artificial voice. Calling windows. Honest caller ID. And a Do-Not-Call process that actually works.

The first one is the one most people skip. Since February 2024, the FCC has treated AI-generated voices as "artificial" voices under the Telephone Consumer Protection Act (TCPA). So the rules you already know for prerecorded calls now apply to AI voice agents too.

One thing before we go on: this is education, not legal advice. We're pointing you to the primary rules so you know what to ask. Review all of it with your own compliance counsel before you dial anyone.

Why this comes up before the first call, not after

You already know the drill.

Your compliance team signs off on every new product, every new letter, every new script. Calling is no different.

What's new is the voice.

A vendor shows you a demo. The AI sounds great. It handles objections. It even laughs at the right moment. And the conversation turns straight to "how many branches can we launch?"

This is where most pilots get into trouble. Not because the AI said something wrong, but because nobody asked what the AI was allowed to do before it started dialing.

Fixing that after 10,000 calls is a lot harder than fixing it before one.

What the FCC's February 2024 ruling says about AI voices

On February 8, 2024, the FCC released a Declaratory Ruling, FCC 24-17, in CG Docket No. 23-362.

Here's the short version.

The TCPA has long restricted calls that use an "artificial or prerecorded voice." The FCC confirmed that those restrictions cover current AI technologies that generate human-sounding voices. That includes voices that are fully synthetic and voices cloned from a real person.

What follows from that, according to the ruling:

• Calls using an AI voice need the prior express consent of the person called, unless there's an emergency purpose or an exemption.
• If the call includes an advertisement or is telemarketing, the bar is higher: prior express written consent.
• The message has to identify the business responsible for the call, and the rules also spell out opt-out requirements.

You're probably wondering whether offering a pre-approved loan to a past customer counts as telemarketing.

The FCC's rule defines telemarketing as a call made to encourage the purchase of goods or services. A loan offer is the kind of call your counsel should look at under that definition. Don't let a vendor answer that one for you.

Past customers vs. new leads: they're not the same

This is the part lenders care about most, so let's be careful with it.

The FCC's rule, 47 CFR 64.1200, has something called an established business relationship. Roughly: someone who did business with you in the last 18 months, or who applied or asked about your products in the last three months, and hasn't ended the relationship.

That relationship matters for Do-Not-Call rules. A call to someone you have that relationship with isn't a "telephone solicitation" under the FCC's definition.

But here's the catch.

When the rule lists the exceptions to the consent requirement for artificial-voice calls to cell phones, "established business relationship" isn't one of them.

So a relationship and consent are two different things.

A borrower who paid off a loan last year may be your customer. That doesn't automatically mean you hold the consent needed for an AI-voiced call to their cell phone. The FTC says the same thing in plain words on its Do Not Call FAQ: recorded sales calls need written permission from the person, whether or not they're on the Registry.

What this means in practice:

• Past customers. Pull the original loan application and agreements. Look at the exact consent language about calls and the phone numbers it covers. Ask counsel whether it reaches artificial-voice calls for the purpose you have in mind.
• Online applicants. The application form is where consent lives. Read what it actually says, not what you remember it saying.
• Cold, purchased or rented lists. No relationship and, usually, no consent from the person to you. This is the riskiest group for AI-voice calls. Talk to counsel before these numbers go anywhere near a dialer.

Calling hours and caller ID

The 8 a.m. to 9 p.m. window

Both the FCC's rule, 47 CFR 64.1200(c)(1), and the FTC's Telemarketing Sales Rule, 16 CFR 310.4(c), set a window for sales calls. No calls before 8 a.m. or after 9 p.m., local time at the called person's location.

Notice the words "at the called person's location." Your branch in one time zone may be calling a customer who moved to another.

Some states have their own calling-time and telemarketing laws, and they can be stricter. They vary. Ask counsel which ones apply to the states you lend in.

At PTS AI, calls go out only while the branch is open. That's narrower than the legal window, and there's a practical reason: an interested customer should be transferred to a person who is there to answer.

Caller ID that's honest

Telemarketers have to send caller ID: a phone number and, when the carrier makes it available, the name. That number must let a person make a Do-Not-Call request during regular business hours. That's 47 CFR 64.1601(e).

And 47 CFR 64.1604 prohibits knowingly sending misleading or inaccurate caller ID with intent to defraud, cause harm, or wrongly get something of value.

Then there's STIR/SHAKEN. It's a standard carriers use to digitally "sign" caller ID so the next carrier can check it. The FCC required the largest voice providers to use it in their IP networks by June 30, 2021. In its announcement, the FCC was clear that better caller ID "does not mean the call itself is legitimate." It helps verify the number, or flag that it isn't verified, and it feeds blocking tools.

Here's why that matters for a branch network.

If your AI calls from a random number in another area code, three things go wrong. People don't answer. Carriers may label it. And when the customer calls back, they reach nothing useful.

A local number for each branch, showing the branch's real name, fixes all three. The customer sees who's calling. A callback reaches the branch. And a "stop calling me" request lands somewhere a person can act on it.

That's how PTS AI sets it up. Each branch gets its own local number and caller ID, and PTS AI handles the carrier registration for calling.

Do-Not-Call: the national registry and your own list

Two lists. You need both.

The National Do Not Call Registry. The FCC's rule gives a "safe harbor" to callers who have written procedures, train their people, keep a record of Do-Not-Call requests, and use a version of the registry pulled no more than 31 days before the call. The FTC notes that a registration never expires. It also notes that a company you recently did business with can still call you, but has to stop if you ask.

Your internal Do-Not-Call list. Under 47 CFR 64.1200(d), when someone says "don't call me," you must honor it within a reasonable time that can't be longer than 10 business days. And you must honor it for five years.

Now think about a Tuesday afternoon at a busy branch.

A customer tells the AI, "Take me off your list." Does that reach the same list your loan officers use when they call? Or does it sit in a vendor's dashboard nobody checks?

If the answer is the dashboard, you have a gap. The opt-out has to land where every caller, human or AI, checks before dialing.

A quick word on texting

Texting is a separate project with its own rules. Business texts to U.S. numbers from regular 10-digit local numbers require carrier registration, called A2P 10DLC, according to Twilio's documentation. PTS AI is voice only. We don't send texts.

A checklist you can hand to compliance

We ran the Sunset Finance pilot this way: 13,159 calls in the first 14 days, about 100 live transfers across 10 branches, all during branch hours, each branch calling from its own number. The setup work around the call is most of the job, and these questions are where it starts.

Here's the list. Take it to your compliance team as questions, not answers.

1. Which lists will we call? Past customers, recent applicants, anything else. Keep them separate.
2. What consent do we hold for each list? Pull the actual language from applications and agreements.
3. Does that consent cover artificial-voice calls, given FCC 24-17?
4. Is this call telemarketing? If yes, do we hold prior express written consent?
5. Does the AI identify our business at the start of the call and give a way to opt out?
6. What calling window will we use? Inside 8 a.m. to 9 p.m. at the customer's location, and inside any state rule that's stricter.
7. Which state rules apply to the states where our customers live?
8. What number and name show on caller ID for each branch? Can a person call it back and reach us during business hours?
9. How do we check the National DNC Registry? Is our copy less than 31 days old?
10. Where do opt-outs go? Do they reach one internal list, get honored within 10 business days, and stay for five years?
11. Do we have written procedures and training for all of the above?
12. Who reviews call recordings and transcripts, and how often?

None of this is exciting. All of it comes before the first call.

If you want a feel for how the rest of the setup fits together, the Academy's starting module walks through it.

And if you'd like to hear what your borrowers would hear, the AI will call you. Leave your number.