Category
Systems & Compliance
Publish Date
9 July 2026
One unregistered text campaign or one sloppy consent checkbox can turn a $200 lead into a $1,500 liability. This is an educational overview of how the Telephone Consumer Protection Act applies to mortgage outreach, not legal advice, and any brokerage building or scaling automated calling and texting should confirm specifics with qualified counsel before relying on it.
Why a lending business has to think about TCPA at all
The TCPA governs how businesses can call and text people on their cell phones, and it was written broadly enough to cover almost every channel a mortgage brokerage uses to reach a fresh lead: autodialed calls, prerecorded voice messages, and SMS or MMS text messages. If a brokerage runs a CRM that fires an automated text the moment a form comes in, or a voice system that dials a lead within seconds of submission, that system sits squarely inside TCPA’s reach.
The stakes are not abstract. The statute allows for damages of 500 dollars per violation, and a court can raise that to 1,500 dollars per violation if the conduct was willful or knowing. Each individual call or text can count as its own violation, there is no cap on total exposure, and a plaintiff does not have to prove any actual harm to collect. A brokerage that texts a list of a few thousand old leads without solid consent on file is not looking at one lawsuit. It is looking at a multiplier problem. That math is exactly why the Empire OS methodology treats compliance as infrastructure built before the first automation fires, not a fix applied after a complaint letter shows up.
Express consent and express written consent are not the same standard
TCPA recognizes more than one tier of consent, and mixing them up is one of the most common mistakes a brokerage makes when it stands up automated outreach.
Prior express consent, which can be given verbally or in writing, is generally sufficient for informational and transactional messages, the kind tied directly to a service the person already asked for: an appointment confirmation, a document request, a status update on a file already in motion. Prior express written consent is the stricter standard, and it is the one required for marketing and promotional messages sent through an autodialer or prerecorded voice, the category most mortgage nurture and educational-content sequences fall into. Written consent needs a clear, conspicuous disclosure of what the person is signing up for, has to be obtained without bundling it into unrelated fine print, and cannot be a condition of getting a quote or starting an application.
The practical fix, and the one built into the Empire OS methodology, is to separate transactional consent from promotional consent with two distinct opt-in checkboxes instead of one blended agreement. A lead can agree to receive appointment reminders without agreeing to receive a monthly market update text, and treating those as the same consent is where a lot of brokerages get exposed without realizing it. Neither checkbox should be pre-checked by default, and the language for each should say plainly what kind of message is coming and how often.
The one-to-one consent rule that never actually took effect
If a broker has read anything about TCPA in the last two years, there is a decent chance it mentioned a “one-to-one consent” requirement, the idea that a single consent could only cover a single named business rather than a list of partners. That rule was adopted by the FCC but never became enforceable. The Eleventh Circuit vacated it in January 2025 in Insurance Marketing Coalition v. FCC, ruling that the FCC had exceeded its statutory authority, and the FCC has since removed the vacated language from its own rules.
That does not make lead-sharing consent safe by default. It means the one-to-one rule specifically is not the standard to cite, and a brokerage should not tell itself it is protected by a requirement that no longer applies. The prudent posture, and the one the Empire OS methodology defaults to, is still to treat consent as tied to the entity that collected it. If a brokerage shares leads with a partner loan officer team, the safer assumption is that each entity needs its own explicit opt-in rather than one borrowed from the original source. Regulations in this area have moved twice in two years already, and a rule read from a year-old blog post is not something to build a compliance program on.
Revocation has to work through any reasonable channel, not just the one you pick
Consent is not permanent, and the rules around taking it back have gotten more specific. Under the FCC’s Opt-Out Rule, adopted in February 2024, a consumer can revoke prior express consent through any reasonable means, meaning a business can no longer tell a lead that the only valid way to opt out is by replying STOP to that specific number, or by using one particular web form. Texting STOP, QUIT, CANCEL, UNSUBSCRIBE, or a similar word is automatically treated as reasonable, and revocation through a channel the business itself designated is automatically reasonable too. The full “reasonable methods” piece of that rule had its effective date pushed back by the FCC more than once, most recently to April 2026.
Once a revocation request comes in, it applies broadly. A lead who opts out of texts has typically opted out of calls tied to that same consent as well, not just the specific channel they used to say stop. The business then has to honor that request quickly, and the standard the FCC set is as soon as practicable, with an outer limit of ten business days. This is why the Empire OS methodology keeps STOP, HELP, and START handling live at all times as its own small system, with every inbound STOP routed straight to a suppression tag that blocks future sends immediately rather than at the next campaign refresh.
Consent you cannot prove is consent you do not have
A brokerage can do everything right at the point of collection and still lose a dispute months later if it cannot produce the record. The safest practice is to log, for every opt-in, the exact language the lead agreed to, the timestamp, the source of the lead, and the IP address or call recording tied to the moment consent was given. That record needs to survive as long as the brokerage might reasonably text or call that person again, which in mortgage timelines can be well over a year for a lead that goes cold and later re-engages.
This is also where automated outreach needs a second guardrail: every message a system sends should be restricted to leads in states where the brokerage is actually licensed. Consent does not fix a licensing problem, and a compliant opt-in on a lead in a state the brokerage cannot originate in is still a message that should not have gone out. Treating licensed-state data as the routing source of truth for every automated send closes that gap before it becomes a pattern across thousands of messages.
Compliance built once is not compliance that stays built
Nothing in this space has stayed still for more than about a year at a time. The one-to-one rule rose and fell inside twelve months. The revocation rule has had its effective date moved more than once. A brokerage that registers its funnel, writes its consent language, and never looks at it again is treating a moving target like a fixed one. The safer habit is a fixed cadence, quarterly at minimum, where someone actually re-reads the current consent and revocation requirements against what the CRM is doing today.
This is exactly the kind of infrastructure work Empire OS builds before a single ad dollar goes live. Every engagement stands up two separate opt-in checkboxes, a suppression flow that catches every STOP within seconds, and a client portal where a broker can see registration status and consent handling instead of guessing about it. Compliance is not the interesting part of scaling a mortgage brokerage’s outreach, but it is the part that determines whether the rest of the system is even allowed to run. If your current texting and calling setup was built once and never revisited, book a call with Empire OS and we will walk through where it stands today.
