Internal DNC Policy for Insurance Agencies: What to Write and Enforce

An internal DNC policy is your agency’s written procedure for recording and honoring “stop calling me” requests. Under the FCC’s TCPA rules, any company making telemarketing calls needs one. It must be available to consumers on demand, it must be backed by a list you actually maintain, and your people must be trained on it. The National Do Not Call Registry is a separate list and does not replace it.

This guide covers what the policy has to say, how to run it on a live call floor, and where agencies get burned: lead vendors, live transfers, downlines and dialer settings.

TL;DR

• Your internal DNC list is entity-specific. A consumer asking your agency to stop calling is a different event from a consumer signing up on the National Registry.
• Honor each request within a reasonable time, never more than 30 days. If your system can suppress the number immediately, do it immediately.
• Keep a written policy, train everyone who dials, document the training, and retain DNC records for five years.
• Outsourcing the list to a lead vendor, call center or dialer does not move the liability. The agency still owns it.
• The FCC floated repealing parts of the internal DNC rules in 2025, then dropped that proposal from the final notice. Plan as if the rules stay.

Table of Contents

• Internal DNC list vs. the National Do Not Call Registry
• Which rules apply to an insurance agency
• What your written policy must contain
• The 30-day window in practice
• Lead vendors, live transfers and downlines
• What the 2025 FCC proposal means for your policy
• Our perspective
• Putting the policy into the dialer
• A rollout checklist
• FAQ
• Sources

Internal DNC list vs. the National Do Not Call Registry

The FCC’s TCPA rules treat these two lists in separate paragraphs. The registry rule is 47 CFR 64.1200©. The company-specific rule is paragraph (d), which requires procedures for maintaining a list of people who ask not to receive telemarketing calls from you.

The practical difference:

Attorneys flag the same trap again and again: a consumer’s registration on the National Registry is not a request to be placed on your internal list, and mixing the two up produces compliance errors. The reverse is also true. A prospect who tells your agent “take me off your list” is on your internal list even if the number was never on the registry, and even if you hold an inquiry relationship with them.

For the registry side, see our walkthrough of DNC list scrubbing. This article stays on the internal list.

Which rules apply to an insurance agency

Two federal regimes matter.

FCC / TCPA. Paragraph (d) of 64.1200 applies to calls made for telemarketing purposes to residential and wireless subscribers. The FDIC’s examination manual summarizes it: the caller must have procedures for an internal list, including a written policy available on demand. It also requires the caller to give their name, the name of the entity on whose behalf the call is made, and a phone number or address where that entity can be reached.

FTC / Telemarketing Sales Rule (TSR). Insurance gets a wrinkle here. The FTC says the TSR applies to the business of insurance only to the extent state law does not regulate it, and where state regulation of insurance telemarketing would conflict with TSR enforcement, the TSR may not apply. Do not read that as a pass. The FCC’s TCPA rules still reach your calls, and the FTC points callers to state attorneys general and consumer-protection agencies for state telemarketing law.

State rules are where agencies get surprised. Many states run their own do-not-call lists, calling-hour limits and licensing-linked telemarketing rules. Have your compliance counsel or state insurance department confirm what applies in each state where your agents hold licenses and where your leads live.

What your written policy must contain

The rule asks for a written policy. A defensible one is short, specific and assigns owners. Build it around these sections.

1. Scope and definitions

State which entity the policy covers, by legal name, and which calls: outbound sales calls, follow-ups, texts sent for marketing purposes, and calls made by third parties on your behalf. Define what counts as a request. Be generous: “stop calling,” “remove me,” “don’t call this number,” “I’m not interested, don’t contact me again.”

2. How requests are captured

Say where agents log a request (disposition code in the CRM, a one-click DNC button in the dialer) and how requests arriving by other channels reach the same list: inbound voicemail, reply texts, email, web forms, and requests made to your office staff. A request is a request whatever the channel.

3. The suppression deadline

The law gives you a reasonable time, not more than 30 days. Industry guidance on the FCC and FTC rules puts it this way: keep a written list and add the name within a reasonable time, immediately if your system permits. Your policy should commit to the stricter standard. If a dialer can block a number at the moment of disposition, 30 days is not a target, it is a liability.

4. What gets recorded

The TSR’s recordkeeping rule, 16 CFR 310.5, requires DNC request records to include the consumer’s name, telephone numbers, the seller, the telemarketer, the date of the request and the goods or services offered, per the FTC’s business guidance. Even where the TSR’s reach over insurance is uncertain, this is a sensible minimum record. Add the agent who took the request and the call or text ID.

5. Retention

Keep DNC records for five years. Legal commentators describe five-year retention for internal DNC requests as the standard, and the TSR requires telemarketing records to be kept for five years. Treat a deleted or reset suppression list as a compliance event.

6. Training

Personnel engaged in any part of telemarketing must be informed and trained on the existence and use of the internal list. Keep documentation: the training date and a roster of who was trained. New hire onboarding counts. So does the licensed agent who dials twice a week.

7. Availability on demand

The policy has to be available to consumers who ask. Decide who answers that request and how fast, and keep a clean public-facing version.

8. Ownership and audit

Name a person. Give them a monthly check: sample the suppression list against the dial log and confirm no suppressed number was called.

The 30-day window in practice

The 30-day ceiling is the number agencies quote, and it is the wrong number to plan around. Here is how a call floor actually leaks:

• Batch uploads. An agent logs the request, but the suppression file syncs to the dialer overnight or weekly. A callback list dials the number in between.
• Multiple lists. The same lead sits in three campaigns. Only one gets flagged.
• Texts. Someone replies STOP to a marketing text, and the voice team never sees it.
• Re-purchased leads. You buy the number again from a vendor next month. Without a master suppression check at import, it goes straight back into rotation.

The fix is structural: one suppression list, checked at lead import, at campaign load, and at the moment of dial. Suppress at disposition, not at end of day.

Lead vendors, live transfers and downlines

This is where most internal DNC exposure sits for agencies that buy leads.

Lead vendors and purchased leads

A request made to the vendor is not a request made to you, but a request made to you is yours, whatever the lead’s source. Industry experts stress that relying on lead vendors or dialer providers does not shield an agency from liability for failing to honor a request. Run every purchased batch against your suppression list before it touches a dialer, and make vendor contracts say who must pass DNC requests along and how fast.

Live transfers

When a call is transferred, the call record needs the number or IP address it was transferred to and the name of the receiving company if it differs from the caller, per FTC order recordkeeping requirements. That order is specific to one company, but it shows what regulators expect a defensible record to look like. If a transfer buyer hears “don’t call me,” your agreement should require that request to come back to the party who owns the relationship.

Affiliates, hierarchies and downlines

An internal request generally applies to the specific entity that made the call. It does not automatically extend to affiliates unless the consumer would reasonably expect them to be included given the caller’s identity and the product advertised. For an IMO, FMO or agency with downlines, that means two decisions:

1. Does each downline agency keep its own list, or does the upline run a shared one?
2. If lists are shared, does the call identification make the consumer’s expectation match? A consumer who tells “Agency A” to stop and then hears from a branded sibling with the same name and offer has a fair claim that the request covered both.

The safe default for related entities selling under one brand is a shared suppression list. Document the choice in the policy.

Third parties holding your list

If an outsourced call center or vendor maintains the list, you remain on the hook. Absent a clear written allocation, both the seller and the telemarketer are responsible for recordkeeping. Write the allocation down and test it.

What the 2025 FCC proposal means for your policy

In 2025, an early draft of an FCC notice of proposed rulemaking suggested repealing or streamlining the internal DNC rules, which prompted headlines that the list was “cancelled.” The final notice did not include that proposed change, and the guidance from counsel was to keep honoring internal requests and keeping five years of records.

The same proceeding is looking at how revocation of consent applies across calls and texts, which touches your opt-out handling. Rules like this move, so check the FCC’s TCPA pages and your counsel for the current state before you revise the policy. Do not loosen your practice on a proposal.

Related reading on our blog: TCPA compliance for insurance agents, the express written consent playbook and DNC compliance rules for compliance officers.

Our perspective

We talk to agency owners who have a clean policy PDF and a messy floor. The PDF says requests are honored immediately. The floor has agents typing “DNC” into a notes field that no dialer reads.

Here is what we tell them. A policy is only as good as the weakest handoff: agent to CRM, CRM to dialer, dialer to texting, and vendor file to all of the above. If any handoff is manual, you have a gap measured in days, and a plaintiff’s lawyer only needs one call inside that gap.

Three habits separate agencies that stay out of trouble:

1. One list, many checks. One suppression source, checked at import, campaign load and dial.
2. Disposition equals suppression. The act of logging “do not call” is the act of blocking the number. No second step.
3. Evidence on file. Date, time, agent, channel and the call record, kept for five years and retrievable in minutes.

The same logic covers call data from your ad and marketing channels. If you pull inbound call data into your CRM, call tracking and CRM imports have to respect the same suppression list as your dialer, or a number you promised to stop calling reappears from a different source.

— Marc

Putting the policy into the dialer

A written policy gets you half way. The other half is software that cannot violate it. When we built compliance into RevRing.com, the rule was simple: the check happens before the dial, not after the call. DNC and litigator checks run before every call, calling-hours rules apply by time zone, and consent records and recording notices are stored with the contact.

If you run power dialing or predictive dialing, this matters more, not less. Higher dial volume means a stale suppression list gets hit many times faster. Agencies that keep their existing CRM can connect it to RevRing.com so the suppression check follows the lead, and agencies that want everything in one place can run on the RevRing CRM. For the recording side of the record, see call recording compliance.

Current plans and per-seat pricing are on revring.com/pricing. Pricing page figures are the only numbers to rely on, so check there before you budget.

A rollout checklist

Use this to move from policy to practice in about two weeks.

1. Inventory every place a request can land. Dialer dispositions, SMS replies, voicemail, email, front desk, vendor portals.
2. Pick one master suppression list and route all of them into it.
3. Set suppression to immediate. Any batch process needs a written exception and a deadline well under 30 days.
4. Scrub purchased leads on import against that master list.
5. Write the policy using the eight sections above, and publish a consumer-facing copy.
6. Train and document. Date, trainer, roster, sign-off. Repeat for new hires.
7. Amend vendor and transfer agreements so DNC requests flow back to you.
8. Decide on affiliates and downlines. Shared list or separate, in writing.
9. Run a monthly audit. Compare the suppression list to the dial log and investigate any hit.
10. Store everything for five years. Requests, training rosters, audit results.

FAQ

Does an internal DNC policy apply if the number is not on the National Registry?

Yes. The internal list rule is triggered by making telemarketing calls, not by registry status. If a person asks your agency to stop calling, you must honor that request whether or not their number is registered anywhere.

How fast do we have to stop calling after a request?

Within a reasonable time, and no more than 30 days. If your systems allow it, suppress the number immediately. Treat 30 days as the outer legal limit and design your process to be far faster.

How long do we keep internal DNC records?

Five years is the standard retention period cited for DNC requests and for telemarketing records under the TSR. Keep the request, the date, the number, and your training documentation for that long.

Does a lead vendor’s DNC list cover our agency?

No. A vendor’s suppression list does not replace yours, and using a vendor does not move your liability. Run every purchased batch against your own list before dialing, and set the handoff in your contract.

Do we need a different policy for each state?

You need one core policy, plus state-specific rules where they are stricter. Many states have their own telemarketing and do-not-call laws, so have counsel or your state attorney general’s office confirm the requirements in each state you call into.

Sources

• 47 CFR 64.1200, Delivery restrictions (Cornell Legal Information Institute)
• 64.1200© and 64.1200(d): Understanding TCPA Do-Not-Call Rules (Roth Jackson)
• Telephone Consumer Protection Act, FDIC Consumer Compliance Examination Manual
• Complying with the Telemarketing Sales Rule (FTC)
• FCC and FTC Do Not Call FAQ for telemarketing (Independent Insurance Agents)
• DNC Compliance: The 2026 Guide to Do-Not-Call Rules (Henson Legal)
• Attachment to Stipulated Order (FTC)
• FCC Proposes Amendments to TCPA Consent Revocation Rules (Privacy World)
• Call Tracking for Ads: CRM Imports, Privacy, and 60 Day GFNs