By Alexander Flores, Debt Buyer & Triton Financial Solutions, LLC · Level 1: Beginner · Last updated: October 29, 2026
If you are starting a collection agency or buying your first charged-off portfolio, the software you run accounts on will shape almost everything that follows: how many consumers you reach, how fast payments post, and how easily you can prove you followed the rules. Pick well and compliance becomes a setting. Pick poorly and it becomes a spreadsheet someone forgets to update.
This guide is a checklist, not a ranking. We don’t name a “best” collection CRM, and we don’t quote vendor prices, because pricing is usually contract-based and changes. Instead, we walk through the features that matter most in 2026, tie each one to the federal rule behind it, and give you the questions to ask on every vendor demo. Each regulation cited below was checked live on October 29, 2026.
One note on terms. Our existing Debt Buyer CRM notes cover the deal side: tracking NDAs, data tapes, bids and boarded files. This article covers the operations side, meaning the system of record an agency or debt buyer uses to work consumer accounts after a portfolio closes.
What is collection agency software?
Collection agency software is the system of record for working debts: it stores account data, schedules and logs contacts, generates letters, takes payments and keeps the audit trail. Most products bundle CRM, dialer integration, a payment portal and reporting.
Vendors call it many things: collection CRM, debt collection software, receivables management platform, or simply “the system.” The labels matter less than the jobs it has to do. For a small agency or a first-time debt buyer, those jobs usually are:
- Account management: loading placements or purchased files, tracking balances, interest and fee rules, and status codes.
- Contact management: calls, emails, texts and letters, with every attempt logged against the right account and the right person.
- Compliance controls: rules engines that block a contact the law doesn’t allow.
- Payments: card, ACH and portal payments, payment plans and posting.
- Reporting: liquidation, contact rates, client remittance, and the records you’ll need in an audit or a lawsuit.
Why does software choice matter so much for compliance?
Regulation F turns many FDCPA duties into measurable limits, such as call counts, contact hours, opt-outs and record retention. Software is usually where those limits are enforced, so a weak rules engine can turn into a compliance problem at scale.
The CFPB’s Regulation F (12 CFR Part 1006) took effect in November 2021 and is the baseline for third-party collectors and debt buyers that collect. Our Regulation F guide covers it in depth. For software selection, five provisions do most of the work:
| Reg F provision | What it requires (plain English) | What your software should do |
|---|---|---|
| § 1006.14(b) call frequency | Presumed compliant if calls about a particular debt don’t exceed 7 in 7 consecutive days, and no call within 7 days after a phone conversation about that debt | Count calls per person, per debt, on a rolling 7-day window and block the dialer when a cap is hit |
| § 1006.6(b)(1)(i) inconvenient times | Absent knowledge to the contrary, before 8:00 a.m. and after 9:00 p.m. local time at the consumer’s location is inconvenient | Use consumer time zone (not office time zone) for calls, texts and emails; honor “don’t call me at work” flags |
| § 1006.6(e) electronic opt-out | Every email or text must include a clear, simple way to opt out of further electronic messages to that address or number | Insert opt-out language automatically and suppress the channel when a consumer opts out |
| § 1006.34 and § 1006.42 validation notices and delivery | Provide required validation information, and send required disclosures in a way reasonably expected to give actual notice | Generate validation notices from account data, track delivery method and returned mail, and start dispute windows correctly |
| § 1006.100 record retention | Keep records that evidence compliance from when collection starts until three years after the last collection activity on the debt | Retain call logs, recordings, letters and notes for the full period, with export for audits |
Source: CFPB, Regulation F, 12 CFR Part 1006, sections linked above, checked October 29, 2026. Section 1006.14(b)(3) excludes certain calls from the count; read it before configuring caps.
Two things beginners often miss. First, the call cap is counted per debt, which matters when one consumer has several accounts in your system. Ask the vendor how it counts calls when a consumer has multiple debts. Second, the time-of-day rule applies to electronic messages too. The CFPB’s official interpretation says an email or text is treated as sent when the collector sends it, not when the consumer opens it.
What features should collection agency software have in 2026?
At minimum: a Reg F rules engine, consent and channel preference tracking, letter generation with the model validation notice, secure payments, a complete audit trail, role-based access, and reporting you can hand to clients or regulators.
Here is the checklist we’d use. Treat “must have” as the floor for any agency or debt buyer working consumer accounts.
| Feature | Must have | Why it matters |
|---|---|---|
| Configurable call-frequency caps (per person, per debt) | Yes | Reg F § 1006.14(b) presumption |
| Consumer-local time zone logic for every channel | Yes | Reg F § 1006.6(b) |
| Channel preferences, opt-outs, cease-communication and attorney-represented flags | Yes | Reg F § 1006.6; FDCPA |
| Validation notice generation and dispute tracking | Yes | Reg F § 1006.34 |
| Immutable audit trail (who did what, when) | Yes | Reg F § 1006.100; client audits |
| Fee and interest rules by account and state | Yes | Reg F § 1006.22(b); state law |
| Payment portal, card and ACH, payment plans | Yes | Liquidation and consumer self-service |
| Role-based permissions and multi-factor login | Yes | Data security; client requirements |
| Skip tracing and data vendor integrations | Recommended | Right-party contact; see our skip tracing guide |
| Bankruptcy, deceased and military (SCRA) scrubs | Recommended | Removing accounts you shouldn’t work |
| Client remittance and placement reporting | Recommended for agencies | Contingency billing accuracy |
| Portfolio-level reporting (by purchase, vintage, state) | Recommended for debt buyers | Tracking returns on each file you bought |
| Open API and flat-file import/export | Recommended | Boarding new portfolios and leaving a vendor someday |
How do payments and fees affect your software choice?
Your software should only post fees and interest the original agreement or law allows, and your payment setup must meet card-network security standards. Convenience fees are a common risk area, so configure them carefully, state by state.
Both the FDCPA, at 15 U.S.C. 1692f(1), and Reg F, at § 1006.22(b), prohibit collecting “any amount” unless it is expressly authorized by the agreement creating the debt or permitted by law, and both define that term to include fees. A good system lets you switch fees on or off by client, account type and state, rather than applying one global setting.
A regulatory note for 2026: the CFPB’s 2022 advisory opinion on pay-to-pay (convenience) fees, 87 FR 39733, was among the guidance documents the Bureau withdrew on May 12, 2025. The withdrawal did not change the statute or the regulation quoted above, and state laws on convenience fees still apply. Many agencies keep fee settings conservative for that reason.
On security, if you take card payments, the PCI Data Security Standard (now the v4.x series) applies to how card data is handled. Ask whether the vendor’s payment module keeps card numbers out of your environment, for example through a hosted payment page or tokenization, because that can shrink the part of your business PCI applies to. Ask for the vendor’s current PCI attestation.
Collectors may also be covered by the Gramm-Leach-Bliley Act. The FTC’s Safeguards Rule (16 CFR Part 314) sets standards for protecting customer information for the non-bank businesses it covers. Confirm with your counsel whether it applies to you. If it does, your software vendor is a service provider you need to oversee.
What about dialers, texting and AI features?
Treat dialers, texting and AI tools as add-ons that must obey the same rules engine. Ask whether call caps, time-of-day limits and opt-outs apply across every channel and integration, not only inside the core CRM.
A common setup gap is a dialer or texting tool that runs outside the CRM’s rules. If the CRM counts seven calls but a separate dialer campaign adds two more, the count is wrong. Ask vendors to show, live in the demo, how a dialer attempt, a text and an email each update the same contact history.
Telephone and text outreach also falls under the TCPA. The FCC’s implementing rule is 47 CFR 64.1200, which governs autodialed and prerecorded or artificial-voice calls and texts. If a vendor pitches AI voice agents or automated texting, ask how consent is captured and stored, and how the product handles revoked consent. We’ll cover AI in collections in a separate article.
How do you evaluate collection software vendors?
Shortlist three vendors, run scripted demos against the same scenarios, check references from agencies your size, and read the contract for data ownership, exit terms and security commitments before signing.
A practical seven-step process for a new agency or first-time debt buyer:
- Write down your volume and mix. How many accounts, which asset classes (credit card, medical, utilities, auto deficiency and so on), and which states. These drive licensing, letter templates and fee rules.
- Decide hosting. Cloud-hosted products shift infrastructure and patching to the vendor. Self-hosted gives more control but makes security your job.
- Script the demo. Give every vendor the same five scenarios: a consumer with two debts hitting the call cap, a text opt-out, a dispute received on day 20, a returned validation notice, and a payment plan with a missed payment.
- Ask for documents. Request a current SOC 2 report if available, the PCI attestation for payments, the data retention policy, and a sample audit-trail export.
- Check references. Talk to two or three customers with a similar account volume and asset mix, not the vendor’s largest client.
- Read the exit clause. Confirm you own your data, how you get it back (format and timeline), and what happens to recordings and letters if you leave.
- Plan the boarding. Ask how a purchased portfolio’s data tape maps into the system, how long a typical import takes, and who fixes mapping errors.
What should debt buyers look for that agencies might not?
Debt buyers need portfolio-level tracking: each purchase’s cost, collections, placements to agencies or law firms, and buybacks or putbacks under the purchase agreement. Agency-focused systems may handle clients well but track owned paper less clearly.
If you buy charged-off debt, the system should let you tag every account to the portfolio it came from, record the purchase price, and report collections by that purchase over time. That is how you tell whether a file performed the way you priced it. It also helps to track media requests and chain-of-title documents per account, because sellers and courts will ask for them.
Buyers that place accounts with outside agencies also need placement and recall tracking, so you always know who holds an account and when it comes back.
What did we not cover?
We didn’t review or rank specific vendors, test any product, or publish pricing. Contract terms, prices and feature sets vary by customer and change often, so confirm every claim on the vendor’s own documentation and in your contract.
This article is also not a full compliance program. State licensing, state-specific contact rules and letter requirements sit on top of the federal rules above. Our How to Start a Collection Agency guide covers licensing and setup, and our compliance overview links to the related rules.
How does this connect to buying and selling portfolios?
Sellers often ask buyers how they’ll work the accounts after the sale, and your software is part of that answer. A clean, auditable system makes you easier to approve for the next file.
Creditors selling charged-off portfolios, and the brokers that represent them, often review a buyer’s operations and compliance before awarding a file. Being able to show call-cap controls, dispute handling and retention policies in your own system is a practical advantage. Our DebtHub buyer tools and the wider DebtHub collect related checklists.
DebtMarket, the confidential debt brokerage desk of Triton Financial Solutions, LLC, takes portfolios NDA-first to 200+ qualified buyers, with no public auction. When a file is complete, closings typically take 1-14 days. Creditors can start at /sellers/, and qualified buyers can review working files under NDA at /buyers/. We are a marketplace and broker, not a collection agency.
Key takeaways
- Collection agency software is your system of record, and under Reg F it is also where most compliance limits are enforced.
- Must-haves: per-debt call caps, consumer-local time zones, opt-out and consent tracking, validation notices, fee controls, secure payments and a full audit trail.
- Reg F requires keeping records evidencing compliance until three years after the last collection activity on a debt.
- The CFPB withdrew its 2022 pay-to-pay fee advisory opinion in May 2025, but the FDCPA and Reg F limits on collecting unauthorized amounts still apply.
- Dialers, texting and AI tools must follow the same rules engine as the core CRM.
- Script demos, ask for security documents, check references and read the exit clause before you sign.
Related reading on DebtMarket
- Regulation F Guide
- How to Start a Collection Agency in 2026
- Skip Tracing for Debt Buyers
- Debt Buyer CRM Notes
Sources (each checked live on October 29, 2026)
- CFPB, Regulation F, 12 CFR Part 1006, including § 1006.6, § 1006.14, § 1006.22, § 1006.34, § 1006.42 and § 1006.100.
- FDCPA, 15 U.S.C. 1692f (Cornell LII).
- Federal Register, Debt Collection Practices (Regulation F); Pay-to-Pay Fees, 87 FR 39733 (July 5, 2022).
- Federal Register, Interpretive Rules, Policy Statements, and Advisory Opinions; Withdrawal, 90 FR 20084 (May 12, 2025).
- PCI Security Standards Council, PCI DSS.
- eCFR, 16 CFR Part 314, Standards for Safeguarding Customer Information.
- eCFR, 47 CFR 64.1200, Delivery restrictions.
This article is general industry information as of the date above. It is not legal advice or an endorsement of any software vendor.