For consumer debt sales, the durable lesson is that sound records, buyer oversight, and fair collection controls matter more than a one-time transaction. The OCC's 2014 consumer-debt-sale bulletin is risk-management guidance for OCC-supervised banks—not a blanket rule for every creditor or debt buyer—but its focus on accurate information, due diligence, and clear contracts remains a useful operating framework. OCC Bulletin 2014-37.

What the OCC guidance actually covers

The Office of the Comptroller of the Currency issued Bulletin 2014-37 for banks it supervises that sell consumer debt. The bulletin describes practices the OCC considers consistent with safety and soundness; it does not itself create a universal rule governing every originator, purchaser, collection agency, or law firm. A careful reading is important because the scope of the guidance and the scope of consumer-protection law are not the same. Read the OCC's consumer debt-sales guidance.

The bulletin calls on covered banks to establish policies for debt-sale arrangements, evaluate whether a sale is preferable to other collection options, identify account types that should not be sold, and monitor results such as complaints, repurchase requests, and losses. It also calls for involvement from relevant functions such as compliance, legal, risk management, collections, audit, information technology, and information security.

Four controls that reduce risk at sale and after transfer

1. Perform meaningful buyer due diligence

A seller should understand the prospective buyer's experience, financial condition, licensing and insurance where applicable, complaint-handling practices, collection model, and use of downstream agencies or law firms. For OCC-supervised banks, the bulletin specifically calls for due diligence before entering a debt-sale arrangement and periodically during forward-flow relationships. The goal is not simply to approve a counterparty once; it is to assess whether the relationship can be monitored and ended when appropriate. OCC Bulletin 2014-37.

2. Transfer a usable, accurate account file

Collection activity can only be as reliable as the records supporting it. The OCC guidance says a covered bank should provide accurate, complete information needed for collections to comply with applicable law and consumer protections. Its account-level examples include evidence of the consumer's liability, account statements, account identifiers, an itemization of amounts claimed, payment and default information, and unresolved disputes or fraud claims.

This approach corrects a common oversimplification: a paper “wet” signature is not the only potentially relevant record. The OCC refers to a signed contract or other documents that provide evidence of liability. Whether a particular electronic record is sufficient in a dispute or lawsuit depends on the governing contract, evidence rules, applicable law, and the facts of the account; it should not be assumed from the format alone. OCC Bulletin 2014-37.

3. Put accountability and data handling in the contract

A debt-sale contract should state who is responsible for compliance, confidentiality, information security, consumer communications, record retention, repurchases, and complaint escalation. The OCC also advises banks to address whether resale is permitted. Each transfer can increase the risk that key information is lost or corrupted, or that a later party attempts to collect from the wrong person or for the wrong amount. Where resale is permitted, the guidance calls for due diligence on the subsequent purchaser and transfer of the available account information and documentation. OCC Bulletin 2014-37.

4. Keep the sale population defensible

Quality control begins before the sale file is delivered. The OCC identifies certain accounts as inappropriate for sale because they may not represent an ongoing legal debt, including settled accounts, accounts involving a deceased holder, accounts tied to bankruptcy protection, accounts in litigation with the institution, fraud-related accounts, and accounts lacking clear evidence of ownership. That list is risk-management guidance for covered banks, not a substitute for account-specific legal analysis. It nevertheless illustrates why a portfolio-level data scrub and documented exceptions process are important.

Consumer protection is a separate operational requirement

A sale of an account does not remove applicable consumer protections. At the federal level, the Fair Debt Collection Practices Act (FDCPA) regulates debt collectors as the statute defines that term. The current CFPB Regulation F similarly applies to debt collectors as defined in the FDCPA and covers subjects including communications, validation information, disputes, time-barred debt, and record retention. Whether a particular debt buyer is a debt collector for these purposes depends on the statutory definition and the buyer's activities; it should be assessed, not assumed. Current Regulation F text in the eCFR.

For example, the FDCPA requires a qualifying debt collector to provide a validation notice within five days after an initial collection communication unless the required information was included initially. The statute describes information about the amount of the debt and the creditor, along with dispute and original-creditor information. Regulation F adds detailed rules for validation notices and disputes. These federal provisions do not displace every state requirement; state laws, licensing rules, court procedures, and account facts may add obligations or remedies. FDCPA statutory text, 15 U.S.C. 1692g; 12 CFR part 1006.

Litigation should not be treated as a portfolio setting

The OCC bulletin does not impose a categorical ban on debt-buyer litigation. Instead, it says contracts with debt buyers should address the volume of accounts and the reasons the buyer can litigate. That is a contractual risk-control expectation in the OCC guidance, not an authorization to sue or a determination that a particular claim is enforceable. OCC Bulletin 2014-37.

Federal law also draws an important boundary: the FDCPA states that it does not authorize debt-collection lawsuits, while setting venue requirements when a debt collector brings a covered action. The availability of a lawsuit may depend on ownership evidence, the underlying agreement, the limitations period, state licensing requirements, procedural rules, defenses, and other account-specific facts. Parties should obtain jurisdiction-specific legal review rather than relying on a debt-sale contract or a general article as an answer. FDCPA statutory text, 15 U.S.C. 1692i.

A practical review sequence

  1. Classify the account population. Exclude or separately review accounts with disputes, fraud indicators, bankruptcy signals, settlement activity, litigation, or unclear ownership.
  2. Reconcile the data. Check balances, dates, account identifiers, payment history, creditor information, supporting records, and chain-of-title materials against the sale schedule.
  3. Evaluate the buyer and its vendors. Document diligence, applicable licensing, complaint controls, security practices, and permitted downstream activity.
  4. Make the contract operational. Allocate responsibilities for compliance, data security, consumer notifications, resale, records, repurchase, complaints, and termination.
  5. Monitor after closing. Review complaints, disputes, repurchase requests, data errors, and collection conduct to identify weaknesses in future sale files or counterparties.

For broader operational context, see The Debt Buying Ecosystem: Market Analysis & Operational Frameworks and The Acquisition Doctrine: Practical Frameworks for Debt Portfolio Buying.

Frequently asked questions

What is a debt buyer?

A debt buyer is an entity that purchases an account or portfolio of accounts and may collect the accounts itself or use collection agencies, law firms, or other providers. Whether a debt buyer is a “debt collector” under the FDCPA and Regulation F is fact-specific and depends on the statutory definition and the buyer's activities. 12 CFR part 1006.

Can accounts receivable be sold?

Yes. A creditor may sell eligible accounts, but a sale should be supported by accurate account data, documented transfer terms, and appropriate compliance controls. For OCC-supervised banks selling consumer debt, the OCC guidance describes expectations for due diligence, contracts, information provided at sale, and ongoing oversight. OCC Bulletin 2014-37.

Bottom line

Responsible consumer debt sales depend on evidence, governance, and ongoing accountability. The OCC guidance is best read as a framework for covered banks to manage the risks of a sale, while collection conduct after transfer must be evaluated under the FDCPA, Regulation F where applicable, and relevant state law. Because legal status and litigation rights vary by jurisdiction and account facts, this material is educational and not legal advice.