FCC Docket 02-278 Compliance Checklist for Outbound Voice 2026

Reviewed for operational accuracy by Miki Furman, Founder and CEO.

CG Docket No. 02-278 is the FCC's main TCPA docket. The rules adopted there, under the TCPA itself (47 U.S.C. section 227), govern consent, revocation, Do Not Call and calling hours for calls to US consumers, wherever the agent sits. Two recent developments matter for vendor reviews. The FCC's February 2024 order (FCC 24-24) made clear that consumers can revoke consent in any reasonable manner and that callers must honor the request within 10 business days; those rules took effect April 11, 2025. And in March 2026 the FCC proposed, but has not adopted, an offshore call center disclosure (FCC 26-16). For procurement teams using offshore or nearshore outbound voice vendors in regulated verticals (debt collection, insurance lead-gen, financial services outbound, ACA and Medicare front-end work), older vendor agreements may not reflect the revocation rules, and no vendor should present the proposal as an adopted requirement. This checklist is designed to be run alongside legal review, not as a substitute for it.

What CG Docket 02-278 covers, and what is only proposed

CG Docket No. 02-278 is the FCC's long-running TCPA proceeding on autodialed, prerecorded and telemarketing calls, and the rules adopted in it are in force now. The February 2024 Report and Order (FCC 24-24) is the recent one that changes day-to-day vendor operations: consumers can revoke consent in any reasonable manner, callers must honor do-not-call and revocation requests within a reasonable time not to exceed 10 business days, and a caller may send one confirmation text. Those rules took effect April 11, 2025. A narrower revoke-all piece, under which a stop request on one type of informational message would apply to all unrelated robocalls and robotexts from the same caller, is delayed to January 31, 2027 (Order DA 26-12). The FCC's 2023 one-to-one consent rule is not in force: the Eleventh Circuit vacated it on January 24, 2025, and the FCC removed it in July 2025 (Order DA 25-621).

The offshore disclosure is different: it is a proposal. In FCC 26-16, a notice of proposed rulemaking adopted March 26, 2026 and published in the Federal Register on April 23, 2026, the FCC proposed that telecom, wireless, VoIP, cable and satellite TV providers and their affiliates tell customers at the start of each call handled outside the United States where it is being handled and transfer the call to a US-based representative on request. The notice also proposes English proficiency requirements for offshore representatives, a cap on the share of calls handled outside the United States, routing of calls involving sensitive account or financial information to US-based representatives, a bar on representatives in foreign adversary nations, and compliance reporting. It asked whether to extend the rules to other companies. As proposed, the rules would cover any representative outside the United States, Caribbean nearshore included. The notice was filed in CG Docket 26-52 and also in 02-278, which is why it gets described as a 02-278 rule. Reply comments closed June 29, 2026, and no final rule had been published as of October 11, 2026. It does not itself create a disclosure obligation for anyone.

The checklist matters most in verticals where outbound voice is load-bearing for customer acquisition and where consumer trust is regulator-relevant. Debt collection sits inside the FDCPA and CFPB perimeter. Insurance lead-gen, ACA, and Medicare front-end work sit inside the FCC perimeter and, in the Medicare case, also inside CMS Marketing Guidelines. Financial services outbound sits inside the FCC perimeter and the GLBA safeguards regime (15 U.S.C. section 6801 et seq.). Healthcare-adjacent voice work sits inside HIPAA (45 CFR section 164). The checklist sets out how procurement should document that an offshore or nearshore voice vendor is operating inside these frameworks.

The FCC's Consumer and Governmental Affairs Bureau publishes the docket activity and consumer complaint patterns that drive enforcement priority. Procurement teams running quarterly vendor reviews should be watching Bureau output, not just headline rulings, to spot interpretation drift before it becomes an enforcement action. For the broader regulatory stack that sits on top of CG Docket 02-278, see our FCC outbound calling regulations for 2026 reference, covering the federal rules in force, calling windows, consent after the vacated one-to-one rule, and the status of the FCC's offshore disclosure proposal.

The 12 compliance checkpoints

Each item below is one verification step. A "fronter" is an offshore agent who pre-qualifies a prospect and warm-transfers the call to the client's licensed US staff for closing, rather than handling the regulated portion of the conversation directly. The checkpoints apply whether the vendor uses fronters or runs end-to-end offshore voice.

1. Get the vendor's agent locations in writing, and decide whether to use a voluntary location disclosure. Readiness item, not a rule. Why it matters: no final federal rule requires telemarketers to disclose that an agent works outside the United States, but the FCC has proposed a disclosure for communications providers (FCC 26-16, March 2026, not adopted) and asked whether to extend it to other companies. As proposed, it would cover any representative outside the United States, nearshore included. Get the country of every agent on the program in writing. If you use a voluntary disclosure, put it in the opening script verbatim and score it in QA, for example: Some of our customer service agents may be located outside the United States. Train agents to answer truthfully if a consumer asks where they are, and keep agent location by campaign and any transfer path to US-based staff on file.
2. Verify written consent capture for every dialed contact, traceable to source, timestamp, and method. Why it matters: the TCPA places the burden of proving prior express written consent on the calling brand, and offshore vendor logs are often incomplete on source attribution.
3. Audit how revocation and do-not-call requests are captured and honored across every campaign and channel. Why it matters: the FCC's February 2024 order (FCC 24-24, CG Docket 02-278) made clear that consumers can revoke consent in any reasonable manner, and that callers must honor do-not-call and revocation requests within a reasonable time, no later than 10 business days. Those rules took effect April 11, 2025. A narrower revoke-all piece, under which a stop request on one type of informational message would apply to all unrelated robocalls and robotexts from the same caller, is delayed to January 31, 2027 (Order DA 26-12).
4. Inspect dialer configuration for autodialer classification under current FCC interpretation, callee-time-zone calling-hour gating, and Do Not Call suppression. Why it matters: predictive and progressive dialer settings can fall inside the TCPA's autodialer definition depending on configuration, the federal calling window is 8 AM to 9 PM in the called party's local time with stricter state windows on top, and an offshore vendor's default config may not match the brand's compliance posture.
5. Confirm 100 percent call recording with retention aligned to regulator expectations. Why it matters: in debt and financial services, recordings are the primary evidence in dispute resolution, and offshore retention windows often default below US regulator expectations.
6. Document supervisor monitoring frequency with a written cadence and sampling methodology. Why it matters: side-by-side and silent monitoring at a documented sampling rate is what auditors look for, and "as needed" is not a defensible cadence.
7. Verify agent training records covering TCPA consent, calling-hour, Do Not Call and revocation rules, vertical regulations, and the opening script, including any location disclosure. Why it matters: training documentation establishes the brand's good-faith reliance defense, and offshore vendors often retain training records only in-country.
8. Require a signed BAA where HIPAA-regulated data is in scope under 45 CFR section 164. Why it matters: any voice work touching protected health information without an executed Business Associate Agreement is a per-incident HIPAA exposure for the covered entity, not the vendor.
9. Require a current SOC 2 Type II report and review the trust services criteria coverage. Why it matters: a SOC 2 Type I or a stale report is not evidence of operating controls, and procurement teams routinely accept stale reports without flagging the gap.
10. Verify geographic call routing transparency and ANI presentation rules. Why it matters: caller ID presentation rules and call routing transparency feed directly into FCC consumer-complaint patterns, and STIR/SHAKEN attestation expectations apply to the calls regardless of origin.
11. Inspect the vendor's consumer complaint log and escalation path. Why it matters: complaint trend data is the earliest warning signal of compliance drift, and brands that read complaint logs quarterly catch issues before regulators do.
12. Confirm the vendor's regulatory horizon-scanning process for FCC, CFPB, FTC, and CMS rule changes. Why it matters: a vendor without an active regulatory watch function will be running on whichever interpretation was current when the contract was signed. Open proposals belong on that watch list, labeled as proposals: the FCC's offshore disclosure (FCC 26-16, CG Docket 26-52) had no final rule as of October 11, 2026, and a vendor should be able to say what it would change if one is adopted.

Checkpoint 4 (dialer configuration) is where the FCC's calling-window rules are enforced, and checkpoint 1 (agent location) tells you which time zones the agents work from. For the standalone reference on permitted dialing hours under FCC rules and how time zone alignment changes the operational risk, see our breakdown of the FCC call time rules for outbound voice.

Where the fronter model changes the compliance posture

A fronter, as defined above, is not a closer. The offshore portion of the call is restricted to pre-qualification: confirming intent, verifying basic eligibility against unregulated criteria, and warm-transferring the qualified prospect to the client's licensed US staff to complete the conversation. Regulated handling (rate quotes, plan enrollment, binding adjustments, debt validation, financial product disclosures) sits with the licensed US agents on the receiving end of the warm transfer.

The compliance consequence is straightforward. The offshore surface area is smaller, so the regulatory exposure on the offshore side is smaller. If the program uses a voluntary location disclosure, the fronter's opening is short, so the disclosure is easy to script and score in QA. Recording, supervisor monitoring, and training cadence still apply, but the regulated content is handled by US licensed staff under the client's existing compliance regime. The fronter model is not a compliance loophole. It is a structural way to keep regulated handling inside the brand's existing licensed perimeter while still capturing the unit-economics benefit of offshore pre-qualification.

Call Force Global runs fronter-only teams in Jamaica, Trinidad, Saint Lucia, Belize, Guyana, and Colombia, with a Toronto HQ. Our agents are not licensed. Call Force Global does not bind insurance, does not enroll Medicare beneficiaries, and does not adjust accounts. The model is built around the warm transfer for exactly this reason. For a full view of how a Caribbean fronter nearshore outsourcing provider sequences pre-qualification, warm transfer, and licensed handoff, see the services overview. Buyers narrowing down Medicare call center outsourcing companies for AEP front-end work can use the same artifact list to qualify shortlist vendors.

Documentation procurement should require from any voice vendor

The artifacts list below is the minimum package a procurement team should hold in the vendor file before a 2026 program goes live. Anything less is a procurement gap, regardless of how the vendor presents in interviews.

• Signed BAA where HIPAA-regulated data touches the call, executed before the first dial.
• Current SOC 2 Type II report, dated within the last 12 months, covering relevant trust services criteria.
• Call recording retention policy with retention windows aligned to FCC, FDCPA, GLBA, and HIPAA expectations as applicable.
• Supervisor monitoring cadence document stating sampling frequency, methodology, and escalation triggers.
• Agent location statement naming the country every agent on the program sits in, plus the opening script if it carries a voluntary location disclosure.
• Agent training program covering TCPA consent, calling-hour, Do Not Call and revocation rules (including the FCC 24-24 revocation rules), vertical-specific rules (CMS Marketing Guidelines for Medicare, GLBA for financial services, HIPAA for healthcare-adjacent), with completion records.
• Dialer configuration attestation documenting autodialer status under current FCC interpretation.
• Quarterly compliance re-audit attestation against the 12 checkpoints in this article.

Quarterly compliance review cadence

TCPA rules have moved several times in the last two years: the FCC 24-24 revocation rules took effect April 11, 2025, the 2023 one-to-one consent rule was vacated in January 2025 and removed in July 2025, the revoke-all piece is delayed to January 31, 2027, and the offshore disclosure proposal (FCC 26-16) is still open. A vendor that was compliant in Q1 of a calendar year may not be compliant in Q4 without remediation. Procurement teams that re-audit only annually are running on stale evidence and are exposed during the months between audits.

A defensible cadence in 2026 looks like this. Quarterly, run the 12-checkpoint review in writing, with the vendor producing artifacts against each item. Monthly, review the consumer complaint log and any rule-change horizon items the vendor has flagged. Annually, run a deeper-dive review with outside counsel and refresh the SOC 2 and BAA documentation. Events such as a new FCC order on the docket, a final rule in CG Docket 26-52, a CFPB or FTC enforcement action on voice, or a CMS guidance update for Medicare programs should trigger an interim review regardless of the calendar.

For buyers running regulated outbound voice today, the practical action is to run the 12-checkpoint review against current vendors this quarter, then build the artifact list into the renewal cycle. The Call Force Global outsourcing calculator models the unit-economics piece. The compliance piece is harder to recover after the fact than the cost piece is.

Sources

1. Federal Communications Commission. Notice of Proposed Rulemaking, Improving Customer Service and Protecting Consumers Through Onshoring, FCC 26-16, CG Docket No. 26-52 (adopted March 26, 2026; a proposal, not a final rule). Published in the Federal Register April 23, 2026 (91 FR 21761); comment dates extended by Order DA 26-510.
2. Telephone Consumer Protection Act, 47 U.S.C. section 227.
3. Federal Communications Commission, Consumer and Governmental Affairs Bureau. Docket activity and consumer complaint guidance.
4. Federal Communications Commission. Report and Order and Further Notice of Proposed Rulemaking, Strengthening the Ability of Consumers To Stop Robocalls, FCC 24-24, CG Docket No. 02-278, adopted February 15, 2024. Revocation rules effective April 11, 2025 (effective-date notice).
5. Federal Communications Commission. Order, DA 26-12, January 6, 2026. Extended the delay of the revoke-all requirement to January 31, 2027.
6. Federal Communications Commission, Consumer and Governmental Affairs Bureau. Order, DA 25-621, July 14, 2025. Removed the one-to-one consent text vacated by the Eleventh Circuit on January 24, 2025.
7. Health Insurance Portability and Accountability Act privacy and security rules, 45 CFR section 164.
8. Gramm-Leach-Bliley Act, 15 U.S.C. section 6801 et seq.
9. Centers for Medicare and Medicaid Services. Medicare Communications and Marketing Guidelines, current edition.

Frequently Asked Questions