A collection agency due-diligence review should verify the proposed work, regulatory footprint, consumer-communication controls, information-security practices, financial safeguards, and performance reporting before accounts are placed. The goal is not to select the lowest fee or the highest claimed recovery rate; it is to determine whether an agency can perform the contracted work reliably and provide records that support meaningful oversight.
Start with the assignment, not the sales presentation
Write down the scope before comparing vendors: the account type, states involved, ownership of the accounts, expected communication channels, litigation authority, reporting cadence, remittance terms, consumer-dispute handling, and data that will be shared. This makes the diligence questions proportionate to the actual engagement and gives both parties a common operating definition.
Separate the federal baseline from state-specific requirements
Regulation F implements the federal Fair Debt Collection Practices Act and prescribes federal rules for entities that meet the statute's definition of a debt collector. It is not a complete nationwide license, insurance, or procurement checklist. Confirm the agency's legal authority and obligations for each relevant jurisdiction and activity with current regulator records and qualified counsel. For example, the Maryland State Collection Agency Licensing Board licenses and supervises collection agencies operating in Maryland; that example should not be treated as a rule for every state.
Build an evidence-based due-diligence file
Ask for documents and test them against the planned scope. A useful review is specific enough to identify a gap, an expiration, or an unresolved question; it is not a request for a generic assurance that the agency is compliant.
| Review area | Evidence to request or confirm | Why it matters |
|---|---|---|
| Regulatory standing | Legal entity names, relevant registrations or licenses, expiration dates, and the jurisdictions covered | The vendor's authority may depend on where it acts and the work it performs. |
| Financial protection | Current insurance certificates, bonding information where applicable, remittance controls, and escalation contacts | These records help the client evaluate contractual and operational risk; requirements should be confirmed for the specific engagement. |
| Ownership and operations | Control persons, related entities, years in operation, service locations, subcontractor use, and client references | Identity and operating-history checks make reference checks more meaningful and help identify who will handle the work. |
| Consumer communications | Written policies, staff training, quality-assurance samples, complaint escalation procedures, and record-retention practices | Oversight should test actual processes, not just a policy statement. |
| Information security | Data-flow description, access controls, incident-response contacts, encryption practices, and subcontractor safeguards | Collection work can require sensitive account information to move between organizations. |
Review complaints and public records with context
Public complaints can be a useful screening input, but they are not a verdict on an agency. The CFPB Consumer Complaint Database states that its published complaints are not a statistical sample of consumers' marketplace experiences and that a low complaint count does not necessarily mean little or no consumer harm. Review patterns by issue, time period, account volume, agency response process, and corrective action. Pair that review with relevant regulator disciplinary records, client references, and the agency's own quality-assurance evidence.
Give the agency an opportunity to explain a documented issue and ask for the remediation record. A consistent explanation supported by dates, process changes, and follow-up monitoring is more useful than an unsupported assurance. Conversely, avoid treating an isolated allegation or a raw complaint total as automatic proof of a violation.
Use KPIs that can be defined and audited
Recovery metrics are meaningful only when the numerator, denominator, timing, exclusions, and attribution rules are agreed in writing. The client and agency should be able to reproduce each report from the same placement and remittance records.
| Measure | Definition to agree in advance | Oversight question |
|---|---|---|
| Placement-to-first-action time | What counts as a first action, the start date, and any allowed exceptions | Are new accounts being worked according to the agreed workflow? |
| Collections and remittances | Whether the report uses gross collections, net remittances, fees, returns, adjustments, and a cash-receipt or posting date | Can the client reconcile the figures to cash and account-level records? |
| Liquidation or recovery rate | The balance population, account age, exclusions, observation period, and treatment of recalls and returns | Is the comparison like-for-like across agencies and portfolios? |
| Disputes and complaints | Categories, intake source, substantiation process, resolution time, and corrective action | Does the agency identify trends and close the feedback loop? |
| Quality-assurance results | Sample method, review criteria, defect severity, coaching, and retest procedure | Does monitoring show that written controls are operating in practice? |
Do not let a single recovery percentage override quality, consumer outcomes, or reconciliation discipline. A high-level report without account-level support is not a substitute for an auditable result.
Use phased onboarding and routine governance
When an agency is new to the program, a limited, risk-appropriate initial placement can help test file transfer, reporting, remittances, consumer-dispute routing, and escalation paths. Establish decision points in advance: who reviews the reports, what evidence is required, which events trigger remediation, and when additional placements may be considered. Continue periodic license and insurance checks, complaint-trend reviews, quality reviews, and reconciliation after onboarding; diligence is a control process, not a one-time questionnaire.
Frequently asked questions
Can a collection agency contact an employer?
Federal rules do not create a blanket permission to contact a consumer at work. Under 12 CFR 1006.6, a debt collector must not communicate or attempt to communicate at a consumer's workplace when it knows or has reason to know the employer prohibits those communications, subject to specified exceptions such as prior consent given directly to the debt collector or a court's express permission. The federal rule applies to covered debt collectors; state law and the facts of the particular communication may add requirements, so this is not individualized legal advice.
Related reading
For adjacent operational topics, see Surety & E&O Mandates: Risk Transfer Requirements for Agencies and Business Continuity Planning: Operational Resilience in Down-Cycles.