The Telephone Consumer Protection Act (TCPA) is a common worry for cold callers. There are a lot of sales teams who think that TCPA is only for B2C. But it’s not, TCPA covers B2B calls as well.
This is important for business loan brokers, independent sales organizations (ISOs), merchant cash advance (MCA) funders and commercial lenders. The rules can cover calls and text messages about working capital, SBA loans, equipment loans and MCA funding.
For lenders working with business loan leads, these rules apply prior to the initial call (or text messages). In this session today, we are going to explain every related TCPA in simple words.
Does the TCPA Apply to Calls to Business Owners?
Definitely yes. The TCPA applies even when you call a business owner. The answer to whether a cold call is legal or not completely depends on who you are calling. Also, how you call and where the phone is.
Note: Automated calls to mobile phones, like autodial, prerecorded or AI voice, need consent.
The Do Not Call (DNC) Registry and calling-hour rules mostly protect residential numbers. What’s challenging is that some businesses use a cell phone as their work phone and private phone. This creates real compliance risks under the TCPA.
Three Number Types, Two Rule Sets
| Number type | Live call, dialed by hand | Autodialer, prerecorded or AI voice | Text message |
| Business landline | Usually lower TCPA risk. State laws still apply | Other rules apply | Usually not applicable |
| Business cell | Live manual calls do not need consent under Section 227(b) | Consent is needed. Marketing calls generally need written consent | Consent rules apply |
| Personal or mixed-use cell | Do Not Call and calling-hour rules apply | Consent is needed | Consent and Do Not Call rules apply |
On creating a business loan prospect list, your lead list might show a number belonging to a business entity. That doesn’t prove the owner uses this phone only for business.
Mixed-Use Cell Phones and the Do Not Call List
A mixed-use cell phone is used for both work and personal calls. The FTC says the National Do Not Call Registry covers personal numbers rather than normal business lines. But courts have allowed some Do Not Call claims involving mixed-use phones.
This is so important for lenders because there are a lot of small to medium-sized businesses that use the same number for customer, family and personal calls.
How Do You Tell a Business Line From a Personal Cell?
There’s no perfect way to know. But a few simple steps can lower your risk.
- Ask if this is their best number for work.
- Write down their answer in your CRM system.
- Be careful with owners who run small, one-person shops.
- Check every cell number against the Do Not Call list.
- Look for numbers that now belong to someone new.
Keep these records with your campaign data. They show what your team checked before the call.
Who Is Liable When Someone Else Makes the Calls?
You can be vicariously liable for calls others make for you. Using a vendor, lead seller or outside call center doesn’t remove your TCPA liability.
Outsourced vendors are helpful, but using an outside team for B2B cold calling still doesn’t relieve you of your responsibility for consent or Don’t Call rules. Keep track of which company contributed the leads and how calls are being made.
What Ties a Caller to You
Your relationship with the caller matters. A few things show that the vendor is calling on your behalf:
- They use your company name
- They use your systems
- You approve their scripts
- You control how the campaign runs
The more control you have, the harder it can be to say the caller acted completely on their own.
Vendor Due Diligence Checklist
If you buy lead lists in the US or work with a lead seller, check the source and vendor first. Ask for:
- Consent records for the leads
- Approved call or text scripts
- Do Not Call scrub records
- Call recordings
- An indemnity clause that covers TCPA claims
Keep all of it in one place. If consumer complaints show up later, you will have a clear record of what happened.
Consent Wording for Business-Loan Forms
Good privacy and consent for lead capture starts with being clear. Tell the person who contacted you and how you will use their phone number. If automated technology will be used for marketing calls or texts, the form should normally include:
- The lender’s name
- Permission for calls or texts
- A note that automated technology will be used
- The phone number
- A statement that consent is not required to apply
- A written or electronic signature
A line that only says “partners contact me” is too broad. The person should be able to see which company is getting permission.
Written Consent Versus Plain Prior Express Consent
| Prior express consent | Prior express written consent | |
| Used for | Some non-marketing automated or prerecorded calls | Automated or prerecorded marketing calls and texts |
| Main requirement | Permission to contact | Signed permission with required information |
| Typical use | Service or non-marketing messages | Telemarketing calls and loan offers |
A business loan offer is a way to sell financial services. So if you use automated tools for marketing, written consent really matters.
Is Consent From a Partner or Purchased Lead Valid?
It can be, but the consent should clearly name your company. A form that only says “partners” may not give you a strong record.
Here’s a clearer example:
“I agree that {{Lender Name}} may call and text me at {{number}}, including with automated technology, about business financing. I do not have to agree to apply.”
This is just sample wording. Ask a lawyer to review the final version before you use it.
What to Keep for Each Consent
Don’t save just the phone number. Keep enough details to show when and how the person said yes.
Save:
- The form wording
- Date and time
- Phone number
- IP address, if you have it
- Written or electronic signature
Keep consent records for at least four years, since that’s how long people usually have to file a TCPA lawsuit. Keep your internal Do Not Call records for at least five years.
Do Not Call, Opt-Outs and Calling Hours
The better your B2B outbound compliance is, the more it’s accounted for before you make the first call, so scrub your lists before you call. You need to cross-reference the National Do Not Call Register, where it applies, and your own internal Don’t Call list.
If someone asks you to stop, treat it seriously. Words such as “stop,” “quit,” “cancel,” and “unsubscribe” can count as opt-outs.
Covered opt-out requests must be handled within a reasonable time and no later than 10 business days.
Federal calling-hour rules generally allow covered residential calls between 8 a.m. and 9 p.m. local time. Some states set stricter call-time restrictions.
How to Scrub a List Before Dialing
Before your SDRs start calling:
- Use a National Do Not Call Registry version no more than 31 days old, as the Telemarketing Sales Rule requires.
- Check your internal Do Not Call list.
- Check applicable state lists.
- Record the scrub date.
- Keep the record with the campaign.
Do this before the first call goes out.
Which State Rules Add to the TCPA?
States can add their own rules on top of the federal TCPA. Florida, Oklahoma and Texas are three examples business loan teams should know.
| State | Calling hours | Call cap | Notes |
| Florida | 8 a.m. to 8 p.m. | Certain calls limited to 3 in 24 hours | Extra state rules apply |
| Oklahoma | 8 a.m. to 8 p.m. | More than 3 calls on the same subject may be restricted | Covers certain automated and recorded calls |
| Texas | Check applicable rules | Varies | Registration is required |
State laws can be stricter than federal rules. Always check the state before starting a new campaign.
Florida and Oklahoma
Florida and Oklahoma both have stricter rules for certain solicitation calls. For some calls, both states use an 8 p.m. cutoff. They also have limits on repeated calls. These rules can matter even when a business call falls outside part of the federal Do Not Call rules.
Texas Registration
Texas asks telemarketers to register before they make sales calls. Texas lists a $200 fee and a $10,000 security deposit, unless an exemption applies. Some regulated lenders qualify for one. Brokers and ISOs should check their status before running a Texas B2B campaign.
Other States
Florida, Oklahoma and Texas aren’t the only states with their own telemarketing rules. Plenty of others have them too. So before you dial, look up each state’s rules on calling hours, call limits, registration and consent.
What Does a TCPA Violation Cost?
You can pay $500 to $1,500 for every call, text or voice message that breaks the rules. And there’s no limit on the total. Each illegal call or text starts at $500. If a court decides you did it on purpose or knew better, it can climb to $1,500 each.
What to Do if You Get a Demand Letter
Do not ignore it. If you receive a TCPA demand letter:
- Check every deadline.
- Save your consent records.
- Keep scrub logs and call recordings.
- Stop contacting the number.
- Add it to your internal Do Not Call list.
- Send the letter to legal counsel.
- Tell any vendor involved.
Do not delete records after receiving a complaint.
AI Voice Agents, Dialers and the Rules Still in Flux
AI voice calls can fall under TCPA artificial-voice rules. In 2024, the FCC said AI-generated voices can count as artificial voices. So an AI voice agent calling a business owner’s cell phone needs consent. If the call is marketing, written consent is required. AI calls also need to give the caller’s name and an opt-out mechanism.
Dialers After Duguid
In Facebook v. Duguid, the Supreme Court narrowed the automatic telephone dialing system (ATDS) definition. A dialer now qualifies only if it uses a random or sequential number generator. Yet, that wouldn’t eliminate every TCPA regulation.
Pre-recorded voices, AI voices, Don’t Call rules and state auto dialer laws can all be relevant. Find out from your dialer provider how the technology actually makes its calls. Know what your dialer technology is capable of doing before you begin your campaign.
Rules in Flux (Status as of October 13, 2026)
Some TCPA rules are still changing. Five areas stand out:
- The FCC’s one-to-one consent rule was vacated in 2025.
- Covered opt-outs still have to be handled within 10 business days.
- FCC revocation rules, including the “revoke all” rule, continue to change.
- Courts review some older FCC interpretations differently.
- Courts do not always agree on how TCPA rules apply to texts.
Because these rules can change, lenders should review their TCPA process regularly.
FAQs
Are B2B calls exempt from the TCPA?
No. A business call isn’t automatically safe. You still face TCPA risk when you call cell phones or mixed-use numbers. The same goes for auto dialers, prerecorded messages and AI voices.
Does the Do Not Call Registry cover business numbers?
Not usually, if it’s a real business line. But some owners use one phone for work and family. That number can still bring Do Not Call (DNC) risk, so scrub your business cell lists before you dial.
Does texting a business owner about a working capital loan count as telemarketing?
Usually, yes. If your text pushes a working capital loan, it’s selling something. That can make it telemarketing. Automated marketing texts need prior express written consent.
How long do we have to honor an opt-out?
Do it as soon as you can. You have a reasonable amount of time, but never more than 10 business days for a covered opt-out.
What is prior express written consent?
It’s a signed “yes” that lets a seller send certain automated marketing calls or texts. It has to name the seller and the phone number. It also has to say the person doesn’t need to agree in order to apply.
Can a lender be sued for a vendor’s calls?
Yes. If a vendor or lead seller calls for you, you can still be held liable. So, keep your consent records, scripts, scrub logs and vendor agreements in one place.
