Source: site
New York City’s SHIELD Rule is driving a major compliance build-out ahead of its September 1, 2026 effective date, and the Department of Consumer and Worker Protection (DCWP) has begun publishing guidance and rule text that collection stakeholders should be using now to prepare.
Overview: SHIELD Rule and Timeline
On February 26, 2026, DCWP announced its finalized Stopping Harassment and Intimidation and Ensuring Lawful Debt (SHIELD) Collection Rule, describing it as providing New Yorkers with the “strongest protections in the country” against debt collector harassment.
The SHIELD Rule becomes effective September 1, 2026, giving creditors, agencies, and debt buyers a limited runway to align policies, technology, and training with the new framework.
DCWP emphasizes that the SHIELD Rule goes beyond the federal Fair Debt Collection Practices Act (FDCPA) and Regulation F by expanding dispute and verification rights, tightening communication limits, and creating first‑of‑its‑kind protections for medical debt.
Importantly for the industry, the rule reaches “original creditors like financial institutions and hospitals when they collect on their own debt,” not just licensed third‑party agencies and debt buyers.
What the SHIELD Rule Changes
DCWP’s announcement and the rule text make clear that SHIELD is not a technical tweak—it rewrites core expectations for collection activity in the five boroughs.
Key substantive changes include:
-
Hard cap on communications
The rule defines “excessive frequency” as more than three communications or attempted communications within any seven‑consecutive‑day period per distinct account, across all media, excluding specified categories such as mailed letters and consumer‑initiated contacts.
This three‑in‑seven cap applies to calls, texts, emails, and other outreach, and requires unified cross‑channel tracking per account rather than per consumer. -
Expanded dispute and verification rights
Consumers may dispute a debt at any point in the collection lifecycle and in any mode of communication the parties are using.
Once a consumer disputes or requests verification, the collector must provide documentation substantiating the debt within 60 days; if it cannot, third‑party debt collectors and debt buyers must issue a Notice of Unverified Debt and lose the ability to continue collection on that account. -
Medical debt protections
For hospital‑related placements, collectors must inform consumers about and promote the medical facility’s financial assistance policy at all phases of the collection process.
The rule also requires policies addressing medical debt, including financial assistance programs, to be documented and retained for extended periods. -
Electronic communication and consent
Collectors may only use specific email addresses, text numbers, social media accounts, or other electronic media to collect if they obtain revocable consent under detailed conditions, or meet narrow alternative criteria such as the consumer’s recent use of that channel.
Every electronic communication must include a clear opt‑out disclosure and a simple method—such as replying “stop”—that the collector must honor, including in non‑English languages used in collection. -
Recordkeeping and operational requirements
Debt collection agencies must maintain separate, searchable files for each consumer debt, including copies of all communications and attempted communications, payment records, settlement agreements, and evidence of compliance.
Agencies must also keep monthly logs of all communications, consumer complaints, disputes, cease‑communication requests, litigation records, training materials, and policies on time‑barred debt, verification, credit reporting, and medical debt, with retention periods of three to six years depending on the record type.
These requirements apply when an entity becomes “engaged in debt collection procedures,” a status that attaches when periodic statements cease, balances are accelerated, or legal action is taken or threatened.
DCWP Guidance and Compliance Resources
In announcing the SHIELD Rule, DCWP framed the changes as a response to rising complaints about harassment and excessive contact, including a sharp increase in CFPB complaints from New York City consumers since Regulation F took effect.
While the city’s press release is primarily directed at consumer advocates, it functions as an early compliance roadmap, highlighting the areas DCWP is most likely to scrutinize: communications volume, dispute handling, medical debt, and language access.
The Notice of Adoption and proposed rule text published on DCWP’s website serve as detailed operational resources, spelling out:
-
Definitions for “communication,” “attempted communication,” “limited‑content message,” “debt collection procedures,” and “covered medical entity.”
-
How to calculate the seven‑day contact window and which communications are excluded from the frequency cap.
-
Requirements for recording oral communications (including at least 5% random samples if not recording all calls) and preserving those recordings for three years.
-
Expectations for language preference tracking and language access services, including translated letters, multi‑language customer service, and real‑time interpretation.
DCWP also emphasizes that financial institutions subject to the federal Fair Credit Billing Act (FCBA) are exempt from SHIELD’s validation and verification requirements, a key nuance for credit card issuers and other FCBA‑covered creditors.
As with prior NYC debt collection rules, DCWP retains licensing, investigation, and enforcement authority, with the ability to conduct audits and seek penalties and injunctive relief for violations.
Operational Implications for Collectors and Creditors
DCWP and industry commentators are clear: SHIELD is a “configuration + workflow change,” not simply another policy update.
To be ready by September 1, organizations collecting from New York City consumers should already be working through several high‑impact operational shifts.
Priority areas include:
-
Dialer and channel controls
Outbound systems must enforce the three‑contact‑per‑seven‑day limit per account across all channels, with logic to exclude consumer‑initiated contacts and legally required notices.
Attempted communications (including limited‑content messages) count toward the cap, so dialer strategies and scripting will need adjustment to avoid inadvertent violations. -
Dispute intake and verification workflows
Dispute handling processes must support disputes at any time via any used channel, feed disputes into centralized tracking, and trigger 60‑day verification SLAs.
Third‑party collectors and debt buyers need clear pathways for issuing Notices of Unverified Debt and permanently suppressing accounts that cannot be verified within the required timeframe. -
Medical debt programs and disclosures
Agencies collecting for hospitals or other covered medical entities must integrate financial assistance policy disclosures into every stage of their collection scripts, letters, and digital communications.
Internal policies on medical debt and financial assistance must be documented and retained, aligning collection practices with the hospital’s charity‑care framework. -
Language access and validation
Collectors must track consumers’ language preferences and ensure that validation notices and disclosures are provided in any non‑English language used to collect the debt.
Once a notice is sent in a particular language, the collector must be prepared to accept and respond to disputes and communications in that language unless the consumer elects otherwise. -
Credit reporting and time‑barred debt controls
Before furnishing negative information to a consumer reporting agency, collectors must send a clear written notice and wait a 14‑day period while monitoring for undeliverability.
Agencies must maintain policies addressing time‑barred debts, including disclosures and limitations on collection efforts when the statute of limitations has expired.
For national portfolios, many compliance advisors are recommending that New York City be treated as its own configuration “zone,” with separate rulesets for dialer contact limits, dispute routing, language access, and medical‑debt handling.
Action Steps Before September 1
With the effective date approaching, DCWP’s materials and the SHIELD rule text point to practical steps that debt collectors, debt buyers, and original creditors should prioritize now.
Near‑term action items include:
-
Mapping existing FDCPA/Reg F programs against SHIELD’s expanded communications, dispute, verification, and medical‑debt requirements.
-
Updating compliance policies, call‑center scripts, and letter templates to reflect the three‑contact cap, omnichannel dispute rights, and mandatory medical financial assistance disclosures.
-
Reconfiguring dialers, text and email platforms, and CRM systems to track communications per account and enforce the seven‑day cap automatically.
-
Building or enhancing verification workflows to meet the 60‑day documentation requirement and generate mandated Notices of Unverified Debt.
-
Implementing comprehensive recordkeeping protocols, including call recording strategies, monthly communication logs, complaint and dispute registries, and litigation tracking.
-
Reviewing language access capabilities and ensuring translated validation notices and opt‑out mechanisms are available in the languages used for collection.
As DCWP continues to frame SHIELD as a national model, New York City compliance is likely to become a benchmark for consumer advocates and regulators evaluating collection practices in other jurisdictions.
For credit and collection professionals, leveraging DCWP’s guidance and the published rule text now will reduce risk when enforcement begins later this year.
Upcoming Events
