The MCA Lead Buyer's Compliance Checklist for 2026

Why does compliance matter for MCA lead buyers, not just sellers?

Compliance matters for buyers because the company that places the call or sends the text is usually the one exposed to liability. A lead provider can capture consent properly, but if your team dials a number on the Do Not Call Registry, ignores an opt-out or uses an artificial voice without the required consent, the risk sits with you.

The stakes are real. The Telephone Consumer Protection Act lets individuals sue for $500 per violation, and courts may increase that up to $1,500 per violation when the violation is willful or knowing. With dialers making thousands of calls, small process gaps can add up quickly.

This checklist is a general overview as of 2026. It is not legal advice, and rules change often. Have counsel review your scripts, consent language, dialing technology and state obligations before you scale.

What happened to the FCC one-to-one consent rule?

The one-to-one consent rule never took effect. Here is the timeline:

1. December 2023: The FCC adopted a rule requiring that prior express written consent cover only one seller at a time, and that calls be "logically and topically associated" with the website where consent was given. It targeted lead-generation and comparison sites.
2. January 24, 2025: The FCC postponed the effective date, and the same day the Eleventh Circuit, in Insurance Marketing Coalition v. FCC, vacated both requirements as exceeding the FCC's authority under the TCPA.
3. April 30, 2025: The court issued its mandate, making the vacatur final.
4. July 14, 2025: The FCC's Consumer and Governmental Affairs Bureau issued Order DA 25-621, repealing the vacated text and restoring the prior version of the consent definition in 47 CFR 64.1200(f)(9).

What this means for you: the pre-2023 prior express written consent standard still applies to the calls it covered, and consent still needs to be clear about who may contact the consumer. State laws may impose their own requirements. For how this affects leads sold to more than one buyer, see exclusive vs shared MCA leads.

One more 2025 development matters. In McLaughlin Chiropractic Associates v. McKesson Corp. (June 2025), the Supreme Court held that federal district courts are not bound by the FCC's interpretations of the TCPA in private lawsuits. Courts now interpret the statute themselves, which can make outcomes less predictable.

What should you check about consent on every lead?

Check that consent exists, that it covers your company and your channel, and that you can prove it.

• Consent language. Read the exact disclosure the merchant agreed to. Does it identify your company, or a clear category of companies that includes you? Does it cover calls and texts using the technology you use?
• Proof. Can the seller provide a consent record for a specific lead, such as a timestamp, IP address, the page and the disclosure text shown?
• Technology match. Prior express written consent is generally required for telemarketing calls and texts made with an autodialer or an artificial or prerecorded voice to wireless numbers, and for prerecorded telemarketing calls to residential lines.
• Retention. Keep consent records for as long as counsel advises, since claims can surface years later.

LoanLeads.io captures TCPA consent on every lead and reviews each affiliate's consent language, privacy policy and traffic sources before they run. You can read our TCPA consent and privacy page for details.

How should you handle Do Not Call lists and opt-outs?

Scrub before you dial, honor opt-outs fast and keep records of both.

• National Do Not Call Registry. Scrub your call lists against the registry on a regular schedule, and keep proof of when you did it.
• Internal do-not-call list. Federal rules require telemarketers to keep their own list of people who asked not to be called and to honor it.
• State lists and rules. Several states run their own do-not-call lists or add stricter requirements. Check the states you call into.
• Calling hours. Federal rules limit telephone solicitations to between 8 a.m. and 9 p.m. in the called party's local time, and some states set narrower windows or limit call frequency.
• Revocation of consent. FCC rules that took effect in April 2025 allow consumers to revoke consent by any reasonable means, such as replying STOP or saying so on a call, and require callers to honor the request within 10 business days. A related provision that would apply one opt-out to all of a caller's unrelated messages, often called "revoke-all," was delayed and, as of early 2026, was scheduled for January 31, 2027.
• Reassigned numbers. Numbers change hands. The FCC's Reassigned Numbers Database can help you check whether a number still belongs to the person who consented, and using it properly can provide a safe harbor.

What rules apply to texts and AI voices?

Texts are generally treated like calls under the TCPA, and AI-generated voices are treated like artificial or prerecorded voices.

• Texting. Marketing texts sent with automated systems typically need the same consent as autodialed calls. Include opt-out instructions and process STOP replies immediately.
• State text rules. States keep adding their own requirements. For example, Texas SB 140, effective September 1, 2025, extended the state's telephone solicitation law to cover text and image messages, which can bring registration duties and private lawsuits under the Texas Deceptive Trade Practices Act.
• AI voices. In February 2024 the FCC issued a declaratory ruling confirming that AI-generated voices are "artificial" under the TCPA, so calls using them need the consent required for prerecorded or artificial voice calls, plus the usual identification and opt-out disclosures.
• Live transfers. If you buy live transfers, ask how the original call was placed and what consent supports it.

Which state commercial financing laws affect MCA offers?

A growing number of states regulate the offer itself, separate from telemarketing rules. As of 2026, California, New York, Utah, Virginia, Florida, Georgia, Connecticut, Kansas, Missouri, Texas and Louisiana have enacted commercial financing or sales-based financing laws that require disclosures to the merchant, and some, such as Virginia, Connecticut, Missouri, Utah and Texas, also require providers or brokers to register. Vermont enacted a licensing law in 2026 with commercial financing provisions taking effect July 1, 2027.

These laws generally apply whether or not you call the product a loan. A merchant cash advance is a purchase of future receivables, not a loan, but most of these statutes expressly cover sales-based financing. We break down each state's rules, dates and thresholds in our guide to state commercial financing disclosure laws.

The 2026 checklist

Use this as a starting point for a review with counsel:

1. Read the consent language on every lead source, and confirm it covers your company, channel and technology.
2. Confirm you can obtain a consent record for any individual lead.
3. Scrub against the National Do Not Call Registry, applicable state lists and your internal do-not-call list.
4. Restrict dialing to permitted hours in the merchant's time zone, including any state limits.
5. Process opt-outs from every channel within the required time, and sync them across all systems.
6. Check reassigned numbers before calling older records.
7. Review any use of prerecorded, artificial or AI voices against consent requirements.
8. Map which states you make offers in and meet their disclosure and registration rules.
9. Describe MCAs accurately: a purchase of future receivables, never a loan with an interest rate.
10. Protect bank statements and applications with access controls, and follow CAN-SPAM for marketing email.
11. Ask every lead provider how it vets affiliates, as covered in how to choose an MCA lead provider.