VICIdial for Financial Services: TCPA, GLBA, and Compliant Dialing for Lending and Banking

TCPA violations cost financial services companies $500-$1,500 per call. The average TCPA class action settlement in financial services exceeds $8 million. The Ninth Circuit ruled in January 2026 that texts qualify as “calls” under the TCPA. If your financial services call center is dialing without a compliance-first configuration, you’re running a liability generator, not a revenue operation.

---

Financial services — mortgage lending, personal loans, auto financing, credit cards, debt consolidation, insurance cross-selling, investment advisory — is the most heavily regulated industry for outbound dialing. The TCPA provides the baseline, but financial services operations face additional layers: the Gramm-Leach-Bliley Act (GLBA) for customer data protection, state licensing requirements for loan solicitation, FINRA rules for securities-related calls, two-party recording consent in 12+ states, and the Do Not Call rules that hit harder when the caller is a financial institution.

VICIdial is used extensively in financial services call centers, particularly in mortgage and personal lending operations where lead costs run $15-50 per contact and per-seat dialer costs directly erode margins. But the cost savings only matter if the configuration prevents the compliance violations that can wipe out a year’s profit in a single lawsuit.

This post covers VICIdial configuration for financial services: TCPA compliance for lending calls, GLBA data handling, recorded line disclosures, state-specific rules, and the campaign architecture for mortgage, loan, and banking outreach.

The Regulatory Stack for Financial Services Dialing

Financial services call centers operate under at least four overlapping federal frameworks plus state-level regulations. Understanding where they overlap — and where they conflict — is the foundation for a compliant dialer setup.

TCPA (Telephone Consumer Protection Act)

The baseline for all outbound dialing. Key provisions for financial services:

• Prior express written consent required to call or text mobile numbers using an autodialer or prerecorded message for telemarketing
• Calling hours: 8 AM — 9 PM in the called party’s local time zone
• Abandonment rate: No more than 3% of answered calls per campaign per 30-day period
• DNC compliance: Must scrub against the National Do Not Call Registry and maintain an internal DNC list honored for 5 years
• Consent revocation: Must be honored within 10 business days through any reasonable method (effective April 2025)

Financial services nuance: The TCPA’s established business relationship (EBR) exemption allows calls to existing customers for 18 months after the last transaction. This is critical for mortgage servicers calling existing borrowers about refinancing opportunities — you don’t need new consent for every call if the EBR is active.

GLBA (Gramm-Leach-Bliley Act)

GLBA governs how financial institutions handle customer nonpublic personal information (NPI). For dialer operations:

• Prohibits sharing customer account numbers with non-affiliated third parties for telemarketing purposes
• Requires privacy notices informing customers about data sharing practices
• Safeguards Rule requires administrative, technical, and physical protections for customer data

In VICIdial terms: if your lead data includes account numbers, loan balances, credit scores, or Social Security numbers, GLBA restricts who can access that data and how it’s stored. This is similar to HIPAA’s minimum necessary standard but applied to financial data.

TSR (Telemarketing Sales Rule)

The FTC’s Telemarketing Sales Rule applies to telemarketing calls (which includes most financial services outbound):

• Abandoned call safe harbor: Play a recorded message within 2 seconds of answer
• Caller ID transmission: Must transmit a number that answers and identifies your business
• Prohibition on deceptive statements: Cannot misrepresent terms, conditions, or identity
• Advance fee prohibition: Cannot collect fees for credit repair, debt relief, or loan modifications before services are performed

State Licensing and Call Restrictions

Mortgage loan officers must be licensed (NMLS-registered) in the state where the consumer resides. If your VICIdial campaign routes a California consumer to a loan officer not licensed in California, that’s an unlicensed solicitation — a state regulatory violation separate from any TCPA issue.

Many states also require registration to make telemarketing calls, with bond requirements in some cases:

State	Requirements
California	State registration + bond
Florida	State registration, 8 PM cutoff
New York	State registration
Texas	State registration + bond
Indiana	State DNC registration
Pennsylvania	State registration
Georgia	State registration, 8 PM cutoff

VICIdial Configuration for Financial Services

Campaign Setup: Mortgage Lead Campaigns

Mortgage call centers typically run three types of outbound campaigns:

Campaign 1: Purchase Lead Follow-Up

Campaign: MORT_PURCHASE
  Dial Method:            ADAPT_HARD_LIMIT
  Auto Dial Level:        2.5
  Maximum Adapt Level:    4.0
  Drop Percentage:        2.0
  Available Only Ratio:   Y
  Agent Pause After Call:  15
  Campaign Recording:     ALLCALLS
  Campaign Recording Type: ALLFORCE

Purchase leads (consumers actively looking to buy a home) need fast follow-up and consistent quality. ADAPT_HARD_LIMIT prevents drop rate violations, and the 15-second pause gives loan officers time to review the next lead’s data before the call connects.

Campaign 2: Refinance Outreach (Existing Customers)

Campaign: MORT_REFI
  Dial Method:            RATIO
  Auto Dial Level:        1.5
  Drop Percentage:        0
  Agent Pause After Call:  10

Refinance calls to existing borrowers fall under the EBR exemption. Use a lower dial ratio with zero drops — these are relationship calls to customers who already know your institution. Predictive dialing with drops signals “you’re just another telemarketer” to your own customers.

Campaign 3: Trigger Lead Campaigns

Campaign: MORT_TRIGGER
  Dial Method:            ADAPT_HARD_LIMIT
  Auto Dial Level:        3.0
  Maximum Adapt Level:    5.0
  Drop Percentage:        2.5
  Agent Pause After Call:  5

Trigger leads — generated when a consumer’s credit is pulled for a mortgage application — are time-sensitive and highly competitive. Multiple lenders receive the same trigger simultaneously. Speed to contact determines who wins the deal.

Important compliance note on trigger leads: As of 2026, Congress has been debating legislation to restrict trigger lead practices. Several bills have been introduced to close the “trigger lead loophole.” Monitor this closely — the regulatory landscape could change mid-campaign.

Speed-to-Lead for Financial Leads

Financial services leads degrade fast. A consumer who requests a mortgage quote online is typically shopping 3-5 lenders simultaneously. First contact wins.

API Lead Injection:
  POST /vicidial/non_agent_api.php
  Parameters:
    function=add_lead
    phone_number=5551234567
    first_name=Michael
    last_name=Johnson
    list_id=30001
    campaign_id=MORT_PURCHASE
    hopper_priority=99
    source=lending_tree
    vendor_lead_code=LT-293847
    custom_1=purchase
    custom_2=375000
    custom_3=TX
    custom_4=740

hopper_priority=99 pushes the lead to the top of the queue. Custom fields carry the loan type, amount, state, and credit score range — data the loan officer needs on screen when the call connects.

Recorded Line Disclosure

Financial services calls in two-party consent states require explicit disclosure that the call is being recorded. But even in one-party consent states, many financial institutions record all calls and disclose proactively — it’s both a risk management practice and a regulatory expectation.

Two-party consent states (where all parties must consent to recording):

California, Connecticut, Delaware, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, Nevada, New Hampshire, Oregon, Pennsylvania, Vermont, Washington

Build the recording disclosure into your agent script as a mandatory read:

Script: FINANCIAL_DISCLOSURE

[Opening - After identity confirmation]
"Before we continue, I want to let you know that this call
may be recorded for quality assurance and compliance purposes.
Is that okay with you?"

[If Yes → Continue]
[If No → Proceed without recording]
  → Agent dispositions: NORECORD
  → Supervisor reviews non-recorded calls for quality

VICIdial Recording Configuration

Campaign Settings:
  Campaign Recording:          ALLCALLS
  Campaign Recording Type:     ALLFORCE
  Recording Filename:          FULLDATE_CUSTPHONE_CAMPAIGN_AGENT

ALLFORCE ensures recordings can’t be paused or stopped by agents. In financial services, selective recording creates liability — if a borrower claims the loan officer made a verbal promise about rates or terms, an incomplete recording is worse than no recording at all.

Handling Two-Party Consent Refusals

When a consumer in a two-party consent state declines recording, the loan officer has two options:

1. Continue the call unrecorded — the agent notes the refusal, and the call proceeds normally. The agent must be trained to document the conversation in notes instead.

2. Transfer to a callback — the agent explains that they’ll need to call back from a non-recorded line (if your operation supports that).

VICIdial can handle option 1 through agent-controlled recording pause, but this conflicts with ALLFORCE. The better approach: run two-party consent states through a separate campaign where recording is set to ALLCALLS (not ALLFORCE), and train agents on the disclosure-and-consent process.

Campaign: MORT_2PARTY (Two-party consent states only)
  Campaign Recording:      ALLCALLS
  Campaign Recording Type: ONDEMAND
  Allowed States:          CA, CT, DE, FL, IL, MD, MA, MI, MT, NV, NH, OR, PA, VT, WA

ONDEMAND recording lets agents start recording only after obtaining verbal consent. This satisfies two-party consent laws while maintaining the option to record.

GLBA Compliance in VICIdial

Protecting Nonpublic Personal Information

GLBA defines nonpublic personal information (NPI) as any personally identifiable financial information provided by a consumer to a financial institution, resulting from a transaction, or otherwise obtained. This includes:

• Social Security numbers
• Account numbers
• Loan balances
• Credit scores
• Income information
• Tax return data

Minimum Necessary Data in VICIdial

Don’t load NPI into VICIdial lead fields unless the agent needs it during the call. For most outbound campaigns, the agent needs:

Lead Fields:
  first_name:          Consumer name
  last_name:           Consumer name
  phone_number:        Primary phone
  alt_phone:           Secondary phone
  address1:            Address
  city, state, zip:    Location
  custom_1:            lead_type (purchase / refi / heloc)
  custom_2:            loan_amount_range (not exact amount)
  custom_3:            state_of_property
  custom_4:            credit_score_range (not exact score)
  vendor_lead_code:    CRM lead ID

Notice: loan_amount_range and credit_score_range instead of exact figures. The agent doesn’t need to see “credit score: 742” on their VICIdial screen — they need to know the general qualification tier. Exact figures should be discussed during the call and recorded in the LOS (Loan Origination System), not stored in the dialer.

Access Controls

VICIdial User Configuration:
  Loan Officers:        User Level 1 (agent)
    - Can view assigned lead data during active calls
    - Cannot export lists or download recordings
    - Cannot view other agents' call records

  Team Leads:           User Level 2 (supervisor)
    - Can monitor live calls and view campaign reports
    - Cannot export full lead databases
    - Can access recordings for QA purposes

  Compliance Officer:   User Level 7 (manager)
    - Can pull recordings for compliance review
    - Can run disposition reports
    - Can access DNC management

  IT Administrator:     User Level 9 (admin)
    - Full system access
    - Responsible for access logging
    - Background check required (GLBA Safeguards Rule)

Data Retention and Disposal

GLBA requires financial institutions to have a data disposal policy. When leads age out of your dialer (no longer being actively dialed), remove them from VICIdial:

• Active leads: Retain in VICIdial for the life of the campaign
• Converted leads (loan closed): Remove from dialer, retain in LOS per regulatory requirements
• Dead leads (no conversion after max attempts): Purge from VICIdial after 90-180 days
• DNC leads: Retain in VICIdial’s DNC list for 5 years (TCPA requirement), but remove the lead record

Run a monthly cleanup script that purges aged lead data from VICIdial’s database while preserving DNC entries and call disposition history.

DNC Management for Financial Services

Three-Layer DNC System

Layer 1: National DNC Registry
  - Scrub lists externally before import
  - Update scrub at least every 31 days
  - EBR exemption: existing customers (18-month window)

Layer 2: Internal DNC (VICIdial)
  Campaign Setting: Use Internal DNC List: Y
  - Company-wide DNC across all campaigns
  - Honored for 5 years minimum

Layer 3: Campaign DNC (VICIdial)
  Campaign Setting: Use Campaign DNC List: Y
  - Product-specific DNC
  - Consumer who says "don't call about mortgages" stays
    callable for auto loan campaigns (with valid consent)

EBR Exception Handling

The TCPA’s Established Business Relationship exemption is critical for financial services. Existing customers can be called without new consent for 18 months after their last transaction. But:

• The EBR applies only to the specific financial institution, not affiliated companies
• An EBR with a bank’s mortgage division doesn’t extend to its credit card division (unless the customer consented to cross-marketing)
• The EBR is a defense, not a license — document it carefully

Track EBR status in your lead data:

Custom Fields:
  custom_5:  ebr_status (active / expired / none)
  custom_6:  last_transaction_date
  custom_7:  institution_relationship (mortgage / checking / credit_card)

Filter your dialing lists:

• Cold leads (no EBR): Must be scrubbed against National DNC + have explicit consent
• EBR leads: Exempt from National DNC, but still honor internal DNC requests

State Call Time Configuration

Federal Baseline with State Overrides

Admin > Call Times:
  Call Time Name:         financial_national
  Start Time:             0800
  End Time:               2100

State-specific overrides:

Admin > State Call Times:
  FL:  0800-2000  (Florida 8 PM cutoff)
  GA:  0800-2000  (Georgia 8 PM cutoff)
  OR:  0800-2000  (Oregon)
  WA:  0800-2000  (Washington)
  OK:  0800-2100  (Oklahoma, max 3 attempts)

Sunday and Holiday Calling

Some states restrict Sunday calling for telemarketing. Many financial institutions avoid Sunday calls as a matter of policy even where legally permitted. Configure VICIdial’s call time definitions to exclude Sundays if that’s your policy:

Call Time Definition:
  Sunday Start:           0000
  Sunday End:             0000
  (Zero-length window = no Sunday calls)

Agent Licensing Compliance

NMLS Routing for Mortgage

Every mortgage loan officer must be registered with NMLS and licensed in the states where they solicit. VICIdial doesn’t have native NMLS awareness, so you need to enforce this through campaign structure:

Option 1: State-Specific Campaigns

Create separate campaigns for each state or state group, and assign only licensed agents:

Campaign: MORT_CA     (Agents licensed in California)
Campaign: MORT_TX     (Agents licensed in Texas)
Campaign: MORT_FL     (Agents licensed in Florida)
Campaign: MORT_MULTI  (Agents licensed in 10+ states)

Option 2: Agent-Lead Matching via Middleware

Build middleware that checks the lead’s state against the agent’s license list before allowing the call:

Lead Assignment Logic:
  1. Lead enters hopper with state = TX
  2. Middleware checks available agents for TX license
  3. Only TX-licensed agents receive the lead
  4. If no licensed agent available, hold lead in queue

This is more complex but avoids the proliferation of state-specific campaigns.

Unlicensed Activity Disposition

Disposition: NOLIC
  - Agent realizes they're not licensed in the consumer's state
  - Lead is returned to the queue for a licensed agent
  - The call is documented but no solicitation occurs

Train agents to check the lead’s state before discussing loan products. An unlicensed solicitation is a state regulatory violation that can result in fines, license revocation, and personal liability for the loan officer.

Caller ID and STIR/SHAKEN

Financial Services Caller ID Requirements

The TSR requires that financial services callers transmit a caller ID number that:

• Is registered to the calling entity
• Rings back to a working number
• Can be used by the consumer to contact the business

STIR/SHAKEN Attestation

Financial services call centers need A-level (full) STIR/SHAKEN attestation to avoid spam labeling. B-level or C-level attestation signals to carriers that the calling identity isn’t fully verified, which triggers “Spam Likely” labels on consumer phones.

Configure VICIdial CID groups with verified, A-attested numbers:

CID Group: financial_cid_pool
  Entry 1: 5551001234 (main office number, A-attested)
  Entry 2: 5551001235 (secondary line, A-attested)
  Entry 3: 5551001236 (branch number, A-attested)

Local Presence for Lending

Local area code display improves answer rates by 40-60% for financial services calls. Consumers are more likely to answer a call from their own area code than an 800 number or an out-of-state number.

CID Group with Area Code Matching:
  214*  →  2145551001  (Dallas)
  713*  →  7135551002  (Houston)
  512*  →  5125551003  (Austin)
  Default → 8005551000  (Toll-free fallback)

Each number must be a real DID registered to your business with A-level STIR/SHAKEN attestation. Using numbers that aren’t yours is caller ID spoofing under the TRACED Act — penalties up to $10,000 per violation.

Quality Assurance and Monitoring

Real-Time Monitoring

Campaign Settings:
  Supervisor Barge:            Y
  Supervisor Whisper:          Y
  Supervisor Monitor:          Y

Financial services calls require compliance monitoring for:

• TILA disclosures: Are agents quoting APRs and terms accurately?
• Fair lending: Are agents treating all consumers equitably regardless of protected class?
• Recording disclosure: Are agents announcing the recording in two-party states?
• No misleading statements: Are agents making promises about approval, rates, or terms that can’t be guaranteed?

Call Review Cadence

For financial services compliance, review a minimum of:

• 5 calls per agent per week for new loan officers (first 90 days)
• 3 calls per agent per week for experienced loan officers
• 100% of complaint calls and calls dispositioned as escalations
• Random sample of 2% of all calls for quarterly compliance audit

Reporting for Regulatory Examinations

Financial institutions are subject to examination by their prudential regulator (OCC, FDIC, Fed, CFPB, state regulators). Maintain exportable reports from VICIdial:

1. Call volume by state: For state licensing compliance verification
2. Drop rate by campaign: For TSR safe harbor compliance
3. Calling hours report: Verify no calls outside permitted windows
4. DNC compliance report: Show scrub dates and DNC list management
5. Agent activity report: Per-agent dials, contacts, talk time, dispositions
6. Recording index: Searchable by date, agent, phone number, campaign

Common Financial Services Dialer Mistakes

1. Ignoring the EBR expiration date. An existing customer relationship exempts you from the National DNC for 18 months. On month 19, that customer is subject to full DNC rules. If your lead data doesn’t track transaction dates, you can’t enforce this boundary.

2. Loading credit scores and SSNs into VICIdial. Your dialer is not your Loan Origination System. Load only the data agents need to qualify interest and route the call. Exact financial details belong in the LOS, not in a lead database that dozens of agents can access.

3. Same campaign for licensed and unlicensed staff. Customer service representatives can handle inbound calls from existing customers without NMLS licensing. But outbound solicitation requires licensing. Don’t mix service agents and sales agents in the same outbound campaign.

4. Not separating two-party consent states. An agent in Texas (one-party consent) calling a consumer in California (two-party consent) must announce the recording and obtain consent. If your campaign covers all states with the same recording settings, you’ll either over-restrict one-party states or under-comply in two-party states.

5. Using aggressive predictive dialing for refinance calls to existing customers. Your own customers deserve better than a 2-3 second delay followed by “please hold for the next available representative.” Use power dialing (RATIO at 1.0-1.5) with zero drops for relationship-based outreach.

6. No safe harbor recording for dropped calls. Every abandoned call must play a TSR-compliant message within 2 seconds. The message must identify your institution and provide a callback number. Financial services drops without a safe harbor message are TSR violations at $53,088 per incident.

7. Caller ID numbers that don’t ring back. If a consumer calls back the number displayed on their caller ID and gets a “this number is not in service” message, you’ve violated the TSR caller ID requirement. Every number in your CID group must answer and identify your business.

---

What We Found Running Financial Services Campaigns

We’ve deployed VICIdial (version 2.14-917a through current builds) for mortgage shops, fintech lenders, and banking outreach operations. A few things we learned in production:

The vicidial_list table stores all your lead data, including the custom fields where you’re putting loan type and credit tier. For GLBA compliance, we found that running a nightly purge of aged leads from the database is non-negotiable. VICIdial doesn’t auto-expire leads — they sit in vicidial_list until you delete them. We run a cron job via /usr/share/astguiclient/ADMIN_archive_log_tables.pl to archive old call logs, but the lead data requires a separate cleanup script.

# Purge leads older than 180 days from inactive financial campaigns
mysql -u cron asterisk -e "
  DELETE FROM vicidial_list
  WHERE list_id IN (30099,30098)
    AND modify_date < DATE_SUB(NOW(), INTERVAL 180 DAY)
    AND status NOT IN ('DNC','DNCC');"
# Keep DNC entries -- TCPA requires 5-year retention

The AST_VDadapt.pl adaptive algorithm struggles with mortgage campaigns because talk times are wildly bimodal — 45-second “not interested” calls mixed with 20-minute qualification conversations. In our experience, setting Adapt Intensity to 1 (low) and Adapt Calc Weight to 6 (heavier weighting on recent calls) smooths this out better than the defaults.

For state licensing compliance, we use VICIdial’s allowed_campaigns setting on each user record. Loan officers licensed only in Texas and Florida get assigned to MORT_TX and MORT_FL campaigns. The user_group field in vicidial_users controls which campaigns appear in the agent’s login dropdown — agents can’t accidentally log into a campaign for states where they lack licensing.

The /var/spool/asterisk/monitor/ directory fills up fast on financial services campaigns with ALLFORCE recording. At 50 seats, plan for 1.2-1.5 TB per month. We mount this as a separate RAID-10 array and rsync nightly to off-server encrypted backup. Financial regulators (OCC, CFPB) expect you to produce specific recordings within days of a request — the filename convention FULLDATE_CUSTPHONE_CAMPAIGN_AGENT makes searching by any of those fields trivial.

---

Originally published at vicistack.com/blog/vicidial-financial-services-dialing.

Running a financial services call center on VICIdial? ViciStack builds and manages VICIdial deployments for mortgage lenders, banks, fintech companies, and lending operations — TCPA and GLBA compliance, NMLS routing, state call time configuration, STIR/SHAKEN setup, and two-party consent state handling. $5K flat fee, $1K down, and we guarantee a 50% improvement in contact rates within 2 weeks. Schedule a consultation and get your dialer configured by people who understand financial services compliance.