Last updated: September 12, 2026
What a call center compliance checklist covers
A call center compliance checklist covers consent to record or monitor, outbound calling rules including TCPA consent and do not call scrubbing, the industry rules that attach to whatever the calls are about, and records handling: retention, deletion, and who can play a recording back. Which rules apply turns on where the caller sits more often than where you sit.
None of this is legal advice. A checklist cannot see the facts that decide most of these questions, so every line below carries a source you or your counsel can go read.
Picture a twenty seat board answering for two medical offices, an insurance agency selling Medicare plans, and a plumbing contractor. Four sets of obligations land on one floor in one shift, and nobody sends over the list. Most owners learn which rules applied when a client's auditor asks, so the checklist below sorts by what switches an obligation on rather than by the agency that wrote it.
Which rules follow the caller, and which follow you
Where is the person on the other end of the line. Consent to record is state law and the state that counts is usually the caller's, so a Texas floor taking calls from eleven states inherits the strictest of the eleven.
What is your operation doing on its own account. Federal outbound rules attach to you as the caller: a written do not call policy, a training record, a scrub log, an abandonment rate. None of it is visible to anybody on the phone, and all of it is what an auditor asks for first.
What are the calls about. Health information, Medicare plans, card numbers, and securities carry rules that follow the subject rather than the seat, so one agent can cross two of them in an afternoon without moving.
Services and outsourcers get a fourth question that eats part of the other three. You answer for clients under obligations that belong to them, so their retention clause and their approved script become facts about your floor whether or not a statute names you. A real board also puts one call in two families often enough that you read both sets of rows and take the longer.
Recording and monitoring consent
Federal law sets a floor and the states set the obligation. Under 18 USC 2511(2)(d) a party to the call may record it, and your agent is a party. The requirement to say anything out loud comes from state law, which splits between states satisfied by one participant and states wanting everybody on the line informed.
Two things belong on a checklist rather than in an essay: the disclosure gets delivered, and it arrives before the conversation turns substantive. Wording and the five script versions live on call recording disclosure scripts, and the supervisor side sits on monitoring disclosure in practice. Any page handing you the all party consent states with no date beside it cannot support what it is telling you, which is why the row below asks for the date you checked.
Outbound calling rules
Most floors have never read this part end to end, and nearly all of it sits in one section: 47 CFR 64.1200.
Start with the clock. Solicitations go out between 8 a.m. and 9 p.m., local time at the called party's location, so a Nevada floor dialing the east coast at 6:30 in the morning is already outside the rule.
Scrubbing has four parts and most write ups describe one. The safe harbor wants a registry version obtained no more than 31 days before the call, written procedures, trained personnel, and records showing the process ran.
Your own list runs on a shorter clock. A request not to be called gets recorded when it is made and honored within 10 business days, and the written policy behind it has to be available on demand.
Revocation is the piece that shows up in the audio. Somebody saying take me off your list halfway through a friendly conversation has made a request, it counts regardless of channel, and you cannot point them at a form as the only way to do it. Whether that moment reached the list is invisible unless a human listens.
Dialer settings carry the rest. Abandoning more than 3 percent of live answered calls, measured per campaign over 30 days, is a violation, where abandoned means nobody picked up within two seconds of the caller's completed greeting. The FTC telemarketing rule wants five years of call records on top, including the script used.
Industry specific obligations
Medicare and TPMO
CMS requires third party marketing organizations to record marketing, sales, and enrollment calls in their entirety, with the disclaimer reaching the beneficiary before any discussion of plan benefits. Wording and timing are on what the TPMO rules require, retention is on CMS call recording requirements, and a requirement becomes a scored line on the Medicare sales call scorecard. Answering the phone for an agency rather than selling plans puts you where counsel draws the line.
Health information
A service taking calls for a covered entity generally acts as a business associate under a signed agreement, and the same logic runs downstream to every vendor touching the audio. Inside your own building the minimum necessary standard applies to playback. No software is certified under HIPAA, so a vendor advertising a certification is describing a datacenter. Questions worth asking one are on HIPAA and recorded calls.
Card numbers taken by phone
PCI DSS v4.0 Requirement 3.3.1 prohibits storing sensitive authentication data after authorization, and PCI SSC FAQ 1210 addresses recordings directly: stop the capture, and delete securely on authorization where that fails. Transcripts count as storage, so a verification code scrubbed out of the audio and left in a searchable transcript is still a number you keep. The full treatment, including which of the three prevention approaches actually holds up, is in what PCI DSS requires of recorded calls.
Financial services
Brokers and dealers under SEC recordkeeping hold communications for three years, the first two easily accessible, and the rule reaches sales scripts. State insurance regulators add requirements that vary too much to summarize here. The shortest block on the page, because the rest belongs to a compliance officer.
Records, retention, and access
Retention gets set by whichever rule on your list runs longest, and the periods with their citations are on call recording retention by industry. The half that gets skipped is access.
Who can play a recording back is a compliance control rather than a convenience setting. A patient call sitting in a folder the whole floor can open fails the minimum necessary standard no matter how carefully the retention policy reads. Role based accounts and a record of who exported what are testable by a client's auditor in about five minutes. CallSniper scopes access by organization and keeps audio inside Trinsic's own cloud on a private model instead of a public one, covered on where call data lives and who can reach it.
The compliance checklist
Thirty four items, grouped by the thing that switches them on. The last column is what to read rather than what we say it says.
| Trigger | Item | What satisfies it | Primary source |
|---|---|---|---|
| You record calls | Notice reaches the caller before the conversation turns substantive | The disclosure line in each account's script, with a transcript timestamp showing it landed first | 18 USC 2511(2)(d) and each state's wiretap statute |
| You record calls | The consent standard you write to is the strictest state on your list | One script that asks rather than announces, or a routing table by state | State wiretap statutes, checked on a date you print |
| You record calls | Monitoring with nothing retained is handled as its own case | Script wording and supervisor practice matching what actually gets kept | State statutes and your counsel |
| You record calls | Agents know their own calls are recorded and reviewed | A dated acknowledgment in the employee file | State law and your employment counsel |
| You record calls | A written recording policy carries a version and a date | One document: what is recorded, why, and how long it is held | Your own policy |
| Calls cross state lines | You can name every state you call into or take calls from | A quarterly pull of caller geography from the phone platform | Internal record |
| Calls cross state lines | All party consent states are identified, with the date checked | A dated survey or the statutes, stored beside the policy | State wiretap statutes |
| Calls cross state lines | A call crossing a border satisfies the rule at both ends | The conservative script everywhere, proven by sampling calls | State wiretap statutes |
| You call out | Solicitations go out only between 8 a.m. and 9 p.m. at the called party's local time | A dialer window set on the called party's time zone | 47 CFR 64.1200(c)(1) |
| You call out | The registry version used was obtained no more than 31 days before the call | A scrub log carrying the download date per campaign | 47 CFR 64.1200(c)(2)(i)(D) |
| You call out | Written registry procedures exist and staff are trained on them | The procedures document and a dated training roster | 47 CFR 64.1200(c)(2)(i)(A) and (B) |
| You call out | A written do not call policy is available on demand | One page you can hand to a client or a regulator | 47 CFR 64.1200(d)(1) |
| You call out | A request not to be called is recorded when it is made | The number on the internal list, honored within 10 business days | 47 CFR 64.1200(d)(3) |
| You call out | The agent gives a name, the entity called for, and a contact number | A script line, scored against the recording | 47 CFR 64.1200(d)(4) |
| You call out | Revocation is accepted in any reasonable manner | Revocation captured from the call and honored within 10 business days | 47 CFR 64.1200(a)(10) |
| You call out | Abandonment stays under 3 percent of live answered calls per campaign | The dialer's per campaign report, retained | 47 CFR 64.1200(a)(7) |
| You call out | Telemarketing records are kept five years | Call detail, the script used, the identification transmitted | 16 CFR 310.5(a) |
| Health information | A business associate agreement with each covered entity | The current agreement in that account's file | 45 CFR 164.502(e), 164.504(e) |
| Health information | An agreement with every vendor that touches the audio | Signed agreements with the recording, storage, and review vendors | 45 CFR 164.502(e) |
| Health information | Playback is limited to the people who need it | Role based accounts scoped to the accounts each supervisor covers | 45 CFR 164.502(b), minimum necessary |
| Health information | Documentation kept six years from creation or last effect | Policies, the risk analysis, the agreements themselves | 45 CFR 164.316(b)(2)(i) |
| Medicare products | Marketing, sales, and enrollment calls recorded in their entirety | Recording on for the whole call, web enrollment audio included | 42 CFR 422.2267, 423.2267 |
| Medicare products | The disclaimer is delivered before any discussion of benefits | A timestamp putting it ahead of the first benefit sentence | 42 CFR 422.2267(e)(41)(ii) |
| Medicare products | Marketing and sales recordings retained for the CMS period | A schedule written against the rule instead of an internal default | 42 CFR 422.2274(g)(2)(ii) |
| Medicare products | Scope of Appointment obtained and documented beforehand | The dated record, matched to the call it belongs to | 42 CFR 422.2264 |
| Card numbers by phone | Verification codes never land in a stored recording | Pause and resume on the payment step, or tone masking | PCI DSS v4.0 Requirement 3.3.1, FAQ 1210 |
| Card numbers by phone | Secure deletion on authorization where prevention fails | A documented deletion step with evidence it ran | PCI DSS v4.0 Requirement 3.3.1 |
| Card numbers by phone | Transcripts get the same treatment as the audio | Redaction applied to the text and the search index | PCI SSC FAQ 1210 |
| You answer for clients | Every retention clause is read and written down | A table of accounts against the period each one demands | Your master services agreements |
| You answer for clients | Client obligations are carried into the account script | Per account instructions, scored against that account's rubric | The contract and the rules binding that client |
| You answer for clients | Offshore or subcontracted handling is permitted in writing | The clause allowing it, plus the downstream agreement | The contract and any business associate terms |
| Always | One retention schedule, written to the longest rule that applies | The schedule, with the rule named on every line | Your policy, built from the retention citations |
| Always | Deletion happens when the schedule says it does | A deletion log somebody reviews | Your own policy |
| Always | Export is controlled and logged | Named users with export rights and a record of what left | Your policy and your client contracts |
Download the checklist
The checklist downloads as a CSV with the source column intact and no form in front of it.
Turning a checklist item into a scored criterion
Some items leave evidence on a recording and the rest are program controls no call level rubric can see.
Evidenced on the call: the recording notice and where it fell, the identification an outbound agent gave, the disclaimer landing ahead of benefits, a do not call request made out loud, a card number read back on a line still recording. Each is a line in a transcript at a specific second, which is why they score reliably and usually belong in the auto fail column rather than as a deduction.
Invisible to the call: the scrub log, the training roster, the retention schedule, the signed agreements, who holds an export right. A perfect QA score across a thousand calls says nothing about those, and they get checked by auditing the QA program instead.
Say a floor makes 3,000 outbound calls a month and two percent of callers ask to be taken off the list. That is 60 moments that have to reach your internal list, and scoring two percent of the calls puts about one in front of a human.
Scoring establishes that words were said and nothing about whether the caller heard or understood them. Rule based criteria hold up better under machine scoring than anything involving tone, which Aircall and StackAI both note, so compliance rows are the strongest lines on a scorecard.
Who holds this checklist, and when it goes stale
Compliance checklists rot faster than anything else on a site, and a stale one holds up only until people stop reading the sources.
Once a year, three things get another look. The state consent list gets a fresh check date whether or not anything moved. Citations get read again, because the Medicare rules changed in consecutive cycles and the TCPA revocation provisions moved recently enough that the dates are worth confirming. Retention periods get compared against the schedule you actually run.
Every new client triggers a shorter pass. Read their retention clause, find out what binds them, get their script into the account instructions, and settle whether a business associate agreement is needed before the first call.
One person holds this document, with a name on it rather than a department. Usually the owner or the operations manager, while the QA lead holds the subset that became scored criteria, since the two drift apart the moment somebody edits a rubric quietly. A quarterly comparison catches it. A call review runs six months of your own recordings against the compliance rows above and shows where the disclosure actually fell.
Frequently asked questions
What regulations apply to call centers?
Recording and monitoring consent under state wiretap law, outbound rules under the TCPA and the FTC telemarketing rule, and whatever attaches to the subject of the calls, usually health information, Medicare marketing, or card data. Which of those reach you depends on where your callers are and what your clients sell.
Do I need to tell callers the call is recorded?
Some states accept one participant's consent, and your agent counts as that participant. Others want every person on the line informed, and a call crossing a border puts two rules in play. The conservative practice is a disclosure on every call, ahead of the substance.
How long do call recordings have to be kept?
It depends on your industry and your contracts. CMS sets a period for Medicare marketing and sales calls at 42 CFR 422.2274(g)(2)(ii), the FTC telemarketing rule wants five years of call records, and client contracts routinely demand longer. Periods and citations sit on CMS call recording requirements.
What is the difference between a compliance checklist and a QA audit?
This page asks whether your operation is legal. A QA audit asks whether your quality program holds up: versioned scorecard, calibration on a cadence, every deduction evidenced. The program side lives on auditing the QA program.
Does call recording software make you compliant?
No. Software records, stores, transcribes, and restricts access, and none of that satisfies an obligation on its own. What a recording and a speaker separated transcript give you is evidence: the disclosure at a timestamp, the request a caller made at 1:42 on a Tuesday.
Sources
- 47 CFR 64.1200, read from eCFR on 2026-09-12. Verified for calling windows, scrubbing, do not call procedures, identification, revocation, and abandonment.
- 16 CFR 310.5(a), FTC telemarketing records. Primary text mirror, 2026-09-12.
- 18 USC 2511(2)(d). Not read for this page, cited from the disclosure article.
- 42 CFR 422.2267, 423.2267, 422.2274(g)(2)(ii), and 422.2264. Read for the Medicare articles here. Verify again against the CY2027 final rule.
- 45 CFR 164.502, 164.504, and 164.316(b)(2)(i). Not read for this page, cited from the HIPAA article.
- 17 CFR 240.17a-4(b) and (b)(4), SEC recordkeeping. Primary text mirror, 2026-09-12.
- PCI DSS v4.0 Requirement 3.3.1 and PCI SSC FAQ 1210, dated June 2025, retrieved 2026-09-12. Verified from the standards body.
- State wiretap statutes and all party consent lists. Deliberately not published here without a check date.
- Aircall and StackAI on rule based scoring holding up better than tone scoring. Third party, unverified.
- Trinsic feature sheet and call notes, 2026-08-27 and 2026-09-03, for organization scoped access and the Trinsic hosted model. Verified internally.