Insurance Agency Robocall Mitigation and Outbound Calling Compliance

The FCC’s Robocall Mitigation Database is a filing duty for phone providers, not for most insurance agencies. Your agency’s exposure sits one layer down: whether your calls are consented, scrubbed, inside calling hours, recorded correctly and not flagged as spam. This guide splits the two, then walks through the checks a call floor should run before every dial.

TL;DR

• Voice service providers, gateway providers and intermediate providers file in the Robocall Mitigation Database. Your carrier or trunk provider carries that duty, so ask what it signs and files.
• Your own duties are consent, Do Not Call scrubbing, calling hours and records. These apply to every dial, whatever the carrier does.
• Keep consent records for five years under the FTC’s 2024 Telemarketing Sales Rule changes.
• For purchased leads and transfers, verify the consent certificate and match the phone number before dialing. Log it.
• Spam labeling is a reputation problem. Treat it with number hygiene, carrier attestation and clean consent, not workarounds.

Table of Contents

• Robocall mitigation: who files and who does not
• The federal rules that govern your calls
• State rules add a second layer
• Records: what to keep and for how long
• Calling purchased leads and live transfers
• Spam labels and blocked calls
• A pre-dial workflow for your floor
• Perspective
• Where RevRing.com fits
• FAQ
• Sources

Robocall mitigation: who files and who does not

Robocall mitigation is a telecom-provider concept. Under 47 CFR § 64.6305, voice service providers, gateway providers and non-gateway intermediate providers must file certifications in the FCC Robocall Mitigation Database. The filing states their STIR/SHAKEN implementation status and describes their mitigation program. Providers recertify annually on or before March 1.

The same rule says a provider’s program must include reasonable steps to avoid originating illegal robocall traffic. It must also include a commitment to answer traceback requests within 24 hours. Those requests come from the Commission, law enforcement and the industry traceback consortium.

What this means for an agency:

• You are usually the customer, not the filer. If you buy minutes from a carrier or run a dialer on a provider’s network, the provider holds the filing.
• Your traffic is what the provider answers for. If traceback points to your numbers, your carrier will come to you. Expect questions on consent, volume and scripts.
• Your vendor choice matters. Ask your carrier whether it is listed in the database and how it signs your calls. If you run your own phone infrastructure, get counsel to confirm whether the provider rules reach you.

The point of the database is accountability across the calling chain. Agencies that can show clean consent and scrub records are the easiest customers for a carrier to keep.

The federal rules that govern your calls

Three sets of rules do most of the work for an outbound insurance floor.

The TCPA and the technology you dial with

The Telephone Consumer Protection Act, at 47 U.S.C. § 227, makes it unlawful to call a cell number with an autodialer or an artificial or prerecorded voice without prior express consent, subject to stated exceptions. It also restricts prerecorded or artificial-voice calls to residential lines without prior express consent, again with exceptions.

Two practical consequences:

• The dialer mode and the message type matter. Preview dialing, where an agent chooses each call, is a different risk profile from predictive dialing. Your counsel should sign off on the mode you run for each lead type.
• Soundboard and clip-based calling is risky. Where a live operator clicks through recorded clips, the call can still count as prerecorded. A 2020 NorthStar ruling on residential lines said a live operator’s presence does not cancel the prohibition.

Consent for marketing calls

Prior express written consent under 47 C.F.R. § 64.1200(f)(9) requires a signed written agreement. It must clearly authorize the seller to deliver telemarketing messages by autodialer or prerecorded voice. It must identify the phone number and state that consent is not a condition of purchase.

Medicare lines add a stricter layer. CMS bars plans and their agents from unsolicited Medicare Advantage phone outreach, including cold calls, robocalls, texts and voicemails. Contact is not unsolicited when the beneficiary consents or starts it, per the analysis of 42 CFR § 422.2264. We cover the details in our guide to Medicare sales call rules.

Calling hours and Do Not Call

The FTC’s Telemarketing Sales Rule treats calls before 8 a.m. or after 9 p.m. as abusive, as laid out in the FTC’s guide to complying with the rule. The hours are measured at the called person’s location, so a floor in one time zone dialing into another needs a time-zone check on every number. Do not rely on area code alone, since people keep their numbers when they move.

National Do Not Call Registry scrubbing and your own internal DNC list sit beside that. The scrub copy should be fresh. The research we rely on points to a copy no more than 31 days old. An opt-out on one call has to reach the internal list before the next dial.

For a fuller rundown, see our TCPA compliance guide for insurance agents.

State rules add a second layer

Federal law is the floor. Several states go further, and some give consumers a private right of action with fixed damages.

Florida is the usual example. Its Telephone Solicitation Act, Fla. Stat. § 501.059, requires prior express written consent for telephonic sales calls that use an automated system for selecting or dialing numbers, or that play a recorded message. It allows $500 in damages per violation, trebled up to $1,500 for willful or knowing conduct.

A workable way to track state rules:

1. List every state where you hold licenses and every state you actually call into.
2. For each, have counsel confirm consent, calling-hour, recording and registry rules.
3. Set the strictest applicable rule as the dialing rule for that state in your system.
4. Review on a schedule. State law changes, and a policy written once goes stale.

Recording is part of this. Some states require every party to agree to a recording, which changes your opening script and your recording notice. See our breakdown of two-party consent states and call recording.

Records: what to keep and for how long

A rule you followed but cannot prove is a rule you may be treated as having broken. In a TCPA lawsuit the burden of proof often falls on the caller to show proper consent, according to GetInsureLeads.

The federal recordkeeping baseline is 16 C.F.R. § 310.5. Sellers and telemarketers keep specified records for five years. That covers advertising and scripts (five years after they stop being used), call records and records of consent.

The FTC’s 2024 final rule, effective October 15, 2024, adds detail on consent records. They must show:

• the consumer’s name and phone number
• a copy of the consent request, in the format it was presented
• a copy of the consent provided
• the date consent was given
• the purpose for which consent was given
• for website consent, copies of the webpages used to request it
• for verbal consent, a recording of the request and the answer

Retention moved from two years to five, counted from the date the record is made.

Some lead-vendor guidance recommends longer. One FMO guide for vetting vendors suggests keeping certificates, consent-page screenshots, vendor contracts, training materials and audits for at least ten years. That is a cautious internal policy, not the federal minimum. Ask your counsel which period fits your book.

Calling purchased leads and live transfers

Buying leads does not move the consent risk to the vendor. When you dial, you are the caller. A pre-dial verification routine is the practical answer.

What to verify before the first dial

For each purchased lead or transfer, confirm and keep:

1. A consent certificate (TrustedForm or Jornaya LeadiD) that resolves and matches the lead’s phone number, timestamp, IP address and exact disclosure text.
2. Consent language that names your agency, or a clearly identified partner list that includes it.
3. Proof of an affirmative action by the consumer. Implied consent does not count.
4. DNC scrub records against the National Registry and your internal list.
5. Call records: date, time, duration, outcome and any opt-out request.
6. Your own verification log showing the certificate was checked and matched before dialing.

The one check that catches the most

Shane McIntyre of Elevarus writes that the most valuable pre-dial check is confirming the number inside the certificate matches the number on the lead you were posted. A mismatch usually points to a recycled or resold record, per his June 2026 piece on lead-buyer records. He also notes a standard TrustedForm certificate is stored for only 90 days unless the retain option extends it to five years. That gap matters if your retention policy is five years.

His framing is useful for managers: a folder of certificate URLs nobody opened is not a program. A short, timestamped log that says checked, matched, scrubbed, dialed shows diligence. That is the line between a $500 violation and a $1,500 willful one under the TCPA. Pre-dial discipline like this also fits the wider habit of tracking every lead touch consistently, so the record exists when you need it.

If a lead arrives with no certificate, do not call it. Hold it until the vendor supplies proof you can validate.

Texting needs its own consent trail

Text consent is captured separately from call consent in practice, and the enrollment screen is the evidence. A clear SMS enrollment preview shows the kind of opt-in presentation worth documenting. Store the wording, the timestamp and the number, as you would for a call. Our note on consent management for texting covers the workflow.

Spam labels and blocked calls

A flagged number can quietly cut your contact rate. Carrier analytics weigh signals such as call velocity, the attestation level on your calls and consumer complaints. One industry write-up says that once flagged, contact rates fall sharply within a day. Treat any specific figure as a rough guide, since carriers do not publish their scoring.

What an agency controls:

• Attestation sits with your voice provider. It is set by the provider’s infrastructure, not a dialer setting. Ask your provider how it signs your outbound calls.
• Dial volume per number. Spread volume across a pool of numbers rather than hammering one.
• Complaint sources. Calling people who never consented, or who asked to stop, creates the complaints that get numbers labeled. Clean consent and fast opt-out handling are the real fix.
• Identity. Use numbers that return to your agency and keep caller details accurate.

Local presence dialing is a tool many floors reach for. Used to mislead, it creates risk. We lay out where agencies should stop in local presence dialing ethics and the compliant version in our local presence guide.

A pre-dial workflow for your floor

Here is a sequence that works on most outbound floors, whatever software runs it:

1. Source check. Every lead source has a contract, a consent standard and a certificate method.
2. Consent match. The certificate resolves and the number matches.
3. Scrub. National Registry copy is current and the internal DNC list is applied.
4. Time-zone gate. The call is blocked outside 8 a.m. to 9 p.m. at the consumer’s location, plus any stricter state window.
5. Recording notice. The disclosure fits the strictest state involved.
6. Disposition and opt-out. Agents mark outcomes, and a stop request lands on the internal list at once.
7. Retention. Consent, scrub, call and script records are stored for the retention period your counsel sets, five years at minimum.
8. Audit. A manager samples calls and logs monthly.

Most breakdowns happen at steps 3 and 6, where manual lists lag the floor. Automating those two steps removes the largest source of avoidable violations.

Perspective

We see the same pattern on insurance floors. Compliance fails in the gaps between tools: a lead vendor in one place, a dialer in another, a CRM that never sees the opt-out.

Our view is that the checks belong in front of the dial, not in a spreadsheet after it. DNC and litigator checks, calling-hours rules by time zone, consent records and recording notices should run on every call, in the same system where your agents work leads. That is how RevRing.com is built.

We also think agencies should keep the CRM they like. You can run fully on RevRing CRM or connect HubSpot, Pipedrive or GoHighLevel at no extra cost, so the compliance layer does not force a migration.

Tooling supports your program. It does not replace counsel or guarantee legal compliance. Use it to make the right step the default step for every agent.

Marc

Where RevRing.com fits

If you are evaluating dialers and want the pre-dial checks built in, RevRing.com puts DNC and litigator checks, time-zone calling-hours rules, TCPA consent records and recording notices in the dialing workflow. You can pair that with the RevRing dialer in preview, progressive, power or predictive modes, and lead management and routing for purchased leads. AI call scoring runs at 0.20 USD per scored call, so managers can review calls for script and disclosure adherence.

See how the checks run before each dial at RevRing.com.

FAQ

Does my insurance agency have to file in the Robocall Mitigation Database?

Generally the filing duty sits with voice service providers, gateway providers and non-gateway intermediate providers. An agency that buys calling from a carrier is usually a customer of a filer. If you operate your own network, have counsel check your status.

Do I still need consent if my agents dial manually?

Manual dialing changes the autodialer analysis, but not every obligation. Do Not Call rules, calling hours, recording notices and state laws still apply, and Medicare outreach has its own CMS limits. Keep consent records for any lead you did not generate yourself.

How long should we keep consent and call records?

The FTC’s 2024 Telemarketing Sales Rule changes set five years from the date the record is made. Some vendor guidance recommends longer. Your counsel can set the policy that fits your states and lead sources.

What should I do if my numbers get labeled as spam?

Ask your voice provider how it signs your calls, reduce volume per number and check that every lead has valid consent. Pull any source that generates complaints. Report mislabeled numbers through your carrier’s remediation channel.

Sources

• 47 CFR § 64.6305, Robocall mitigation and certification
• 47 U.S.C. § 227, Restrictions on use of telephone equipment
• Insurance Telemarketing and the TCPA: Medicare, ACA, Final Rules
• FTC: Complying with the Telemarketing Sales Rule
• Fla. Stat. § 501.059
• 16 C.F.R. § 310.5, Recordkeeping requirements
• FTC Telemarketing Sales Rule final rule, 2024
• Tips on Vetting Lead Vendors for TCPA and CMS Compliance
• TCPA Consent for Lead Buyers: The 4 Records That Defend
• SMS enrollment preview
• Lead nurturing explained