Ask a finance leader which federal law governs how a servicing partner talks to a customer about a past due balance, and most will answer correctly: the Fair Debt Collection Practices Act, enforced by the Consumer Financial Protection Bureau. That answer is right, but it is also incomplete, and the gap between “right” and “complete” is where exposure lives.
The FDCPA is a floor, not a ceiling. The federal regulations set minimum federal rules for how an account servicer communicates, discloses information, and resolves a balance. In 2021, the CFPB updated those rules through Regulation F, which took effect on November 30, 2021 and modernized how communication limits and disclosures apply to newer channels like text and email. That update matters. It is also the last major federal overhaul of the rulebook, and it only ever applied within the FDCPA’s own definition of who counts as a “debt collector” in the first place.
That definition has a real gap in it. In 2017, the U.S. Supreme Court ruled in Henson v. Santander that a company calling on an account it purchased for its own portfolio, rather than on behalf of someone else, can fall outside the FDCPA’s definition entirely. The ruling narrowed federal coverage. It did nothing to narrow state coverage. Many states responded on their own terms, writing statutes that explicitly reach account purchasers and servicers regardless of how the federal definition reads. Some require a license to operate, some require a bond, and the stricter ones set communication rules that go beyond anything in Regulation F. None of it runs through Washington.
The practical stakes of that gap are not theoretical. A licensing lapse in a single state can render every balance touched from that state unenforceable in court, regardless of how compliant the underlying account is everywhere else. Several state statutes also give consumers a private right of action independent of anything the CFPB does, which means a violation can turn into litigation with no federal agency involved at any point. A bank or capital partner reviewing your servicing relationships will ask about this before they ask about FDCPA training, because it’s the failure mode that actually shows up in due diligence.
There’s a second shift worth naming plainly, because it changes the math for anyone assuming the CFPB is the backstop. Through 2025, the CFPB moved to cut its own staff by roughly 88 percent, with the supervision division targeted for a 90 percent reduction, according to a Government Accountability Office report issued in early 2026. Congress also cut the agency’s funding cap nearly in half. Examinations have been closed or curtailed, and a number of pending enforcement actions have been dismissed or resolved rather than pursued. Federal oversight has not disappeared, but it has gotten thinner, and thinner federal oversight does not make state law go away. If anything, it puts more relative weight on the fifty state attorneys general and state regulators who were never dependent on CFPB staffing levels to do their jobs.
Put the pieces together and the real compliance map for a company operating nationwide looks nothing like “are we FDCPA compliant.” It looks like a federal floor that just got thinner, a Supreme Court carve-out that federal law never closed, and fifty state legislatures that each decided independently how to fill that space. A company can be fully compliant with the FDCPA and Regulation F on paper and still be exposed in a state whose licensing statute, communication rule, or definition of a covered account looks nothing like the federal one.
We are not going to walk through fifty of those statutes here. That would be exactly the wrong lesson to take from this. The point isn’t for your finance team to become experts in state-by-state consumer law. The point is that someone has to be, and that job belongs to your servicing partner, not to you.
“Clients ask us if we’re compliant with the FDCPA, and the honest answer is that’s the easy part,” said Nathaniel Lucas, Chief Revenue Officer at Servana Financial. “The harder question, and the one we actually get paid to answer, is whether every account, in every state, can survive an audit today. That has to be true continuously. Not just on the day a regulator happens to call.”
“Audit proof” isn’t a slogan we reach for lightly. It’s a specific operating standard: documented account-level processes, defensible records of every communication, licensing and bonding tracked jurisdiction by jurisdiction rather than in a spreadsheet someone updates twice a year, and a servicing team built to change practice the moment a state amends a statute or a court narrows a federal definition. When Henson v. Santander came down, the companies that got hurt weren’t the ones who read the opinion. They were the ones who assumed a federal ruling meant the question was settled everywhere.
None of this requires your team to track any of it directly. That’s the entire premise. A regulator doesn’t care whether your finance department read the latest amendment to a state licensing statute. A regulator cares whether the account in front of them was handled correctly, in that state, under the rule that applied on that date. Getting that right, every time, in every state, is a full-time discipline. Servana treats it as one.
For a CFO or VP of Finance, none of this is abstract. It’s the difference between adding headcount to a compliance function and not adding it. It’s the hours your team spends tracking fifty state legislative sessions instead of running the business. It’s walking into a board meeting able to say, honestly, that a regulatory inquiry from a state you’ve never set foot in will not turn into a material problem, because someone was already tracking that state before the inquiry arrived.
Servana was built on the idea that a company shouldn’t need to know fifty states’ worth of law to operate confidently in fifty states. You know your customers, your product, and your business. We know the current rule in every jurisdiction where your accounts live, and we know what changes when it changes. That division of labor isn’t a nice extra on top of servicing. It’s the actual product.
Nationwide operation shouldn’t mean nationwide exposure. Let’s talk about what your portfolio looks like state by state today, and what it would take to make every account in it audit proof.