Dunning Compliance Checklist: SMS, Email, Calls

Automating dunning outreach is easy. Automating it carelessly is how a billing problem becomes a legal or deliverability problem: texts sent without proper consent, emails with no working unsubscribe, calls placed at hours no customer should be woken for. This dunning compliance checklist walks the three channels — SMS, email, and calls — plus the record-keeping that ties them together, so you can check your current setup line by line before you scale it.

Important: this page is general information only. It is not legal advice, and it is not a substitute for advice from a qualified lawyer in your jurisdiction. Rules for marketing and billing communications vary by country, state, and industry, and they change. Where this checklist says a practice is commonly required, that means exactly that — commonly required, so check your jurisdiction and your providers' terms before relying on it.

Use the checklist alongside the copy it governs: your dunning SMS templates and your dunning email templates should both pass every item below before either goes live.

Part 1: SMS consent and identity

Text messages carry the strictest expectations of the three channels, because they arrive on a personal device. In many jurisdictions, sending automated texts without prior consent is commonly restricted, and consent for one purpose does not automatically cover another.

• Consent captured before the first automated text. You have a record of the subscriber opting in to receive messages from you — at signup, in account settings, or through an explicit keyword opt-in. Buying a phone number list or scraping numbers is never a substitute.
• Consent scope matches the message. A subscriber who agreed to delivery alerts has not necessarily agreed to billing texts. Keep the wording of the original opt-in and make sure dunning messages fall inside it — billing and account messages are commonly treated differently from marketing, but that distinction is jurisdiction-specific, so check yours.
• Sender identified in the message. Each text names your business clearly. A bare link and "your payment failed" from an unidentified number reads as fraud and, in many places, falls short of identification expectations that are commonly required — check your jurisdiction.
• Opt-out honoured immediately. STOP and equivalent requests end messaging at once, not at the end of the campaign. Your platform suppresses the number across all automated sequences, and the suppression is tested, not assumed.
• Opt-out confirmation and help route exist. The subscriber receives one confirmation that they are unsubscribed, and a HELP or support route is available. After opt-out, no further dunning texts go to that number — use email or in-account notices instead.
• Quiet hours respected. Automated texts are sent only inside reasonable local hours for the recipient's time zone. A common working window is roughly 8 a.m. to 9 p.m. local time, but the exact hours are commonly regulated — check your jurisdiction rather than copying any figure here as law.
• Numbers re-checked. Phone numbers change hands. Periodically verify numbers are still associated with the account, and stop texting any number that a different person answers.

Part 2: Email sender, content, and unsubscribe rules

Transactional billing email is commonly treated more leniently than marketing email, but dunning sits on the border: it is about an existing transaction, yet it asks for action. The safe posture is to meet the stricter standard on every item where the two differ.

• Accurate sender identity. The From name is your real business name and the From address is a monitored mailbox on your own domain. No deceptive headers, no sending as a person who does not exist, and never from a free webmail address.
• Honest subject lines. The subject describes a payment problem and the fix. Fake "Re:" prefixes, false urgency, and subjects implying a third party sent the mail are commonly prohibited deceptive practices — check your jurisdiction, and avoid them regardless.
• Physical or registered business address included. Many regimes commonly require a valid postal address in commercial email. Including your published business address also protects deliverability and trust, so there is no reason to omit it.
• Working unsubscribe or preference route. Every dunning email that is not purely transactional in your jurisdiction carries a functioning unsubscribe or communication-preference link, honoured promptly. Test the link monthly; a broken unsubscribe is a compliance failure and a spam-complaint engine.
• Suppression is permanent and shared. Unsubscribed addresses are suppressed across dunning, winback, and marketing — not just the sequence they unsubscribed from — except where a narrow transactional exception genuinely applies and you have confirmed it applies to you.
• One clear action link, to your own domain. The card-update link goes to a page you control, over HTTPS, that matches your branding. Lookalike links and URL shorteners trigger both phishing filters and customer suspicion.
• No threats you cannot or will not carry out. Do not claim legal action, credit reporting, or fees unless each is real, applicable, and verified for that subscriber's situation. Bluffing about consequences is commonly restricted in debt-related communications — check your jurisdiction — and it is bad practice even where it is permitted.

Part 3: Calling hours and identification basics

Phone outreach still matters for high-value and B2B accounts. Automated dunning rarely involves calls, but the moment a human dials, a second set of expectations applies.

• Caller identifies themselves and the business immediately. Name, company, and the reason for the call, in the first seconds — commonly required in many jurisdictions; check yours.
• Calls inside reasonable hours only. Call within the recipient's local daytime and early-evening hours. As with texts, exact permitted windows are commonly regulated and vary — check your jurisdiction and your industry's rules.
• Only the account holder's details discussed. Do not disclose a payment problem to family members, employers, or whoever else answers. Leave a neutral message asking for a callback, with no mention of debt or a failed payment.
• Do-not-call requests recorded and honoured. A request not to be called is logged against the account and respected by every team member, not just the person who heard it.
• Recording disclosed where required. If you record calls, say so where disclosure or consent is commonly required — check your jurisdiction, because one-party and two-party consent rules differ sharply.
• No harassment pattern. Repeated calls in a short window, calls intended to annoy, or misrepresenting the amount or status owed are prohibited in many regimes. A call log per account keeps frequency defensible.

Part 4: Records, data, and the audit trail

Compliance you cannot show is compliance you cannot prove. These four records are what an auditor, a platform reviewer, or your own future self will ask for.

• Consent records kept: who consented, when, through what wording and what form. Retained for as long as you message that person, and beyond where commonly required — check your jurisdiction for retention periods.
• Send logs kept: every automated message, its template version, its timestamp, and its recipient. Template version matters: if a complaint arrives about wording, you need to know exactly which words were sent.
• Opt-out and suppression logs kept: timestamped, exportable, and reconciled against your sending tools after every platform change or import.
• Payment data handled by your processor, not your inbox. Card numbers are never requested by email, text, or call script, never typed into chat, and never stored in your helpdesk. All updates happen on a secure, processor-hosted or properly compliant page. This one has no jurisdictional wobble: never collect raw card numbers in messages.

Why the rigour pays for itself commercially, not just legally: clean consent and clean sending habits are also what keep messages delivered, and each additional dunning email touch that actually arrives adds roughly 1–2 points of recovery, according to Churnkey analysis of Stripe data. Estimate the value of the recovery you are protecting with the recovery calculator, and benchmark your current performance on the failed payment recovery benchmarks page.

Pre-launch sign-off

1. Opt-in wording reviewed against every automated message type it must cover.
2. STOP, unsubscribe, and do-not-call flows each tested end to end by a staff member, this quarter.
3. Quiet hours set per recipient time zone in every sending tool, not just one.
4. Templates reviewed for threats, false urgency, and any claim about fees or reporting that has not been verified as real.
5. Consent, send, and suppression logs confirmed exportable.
6. A named owner for compliance questions, and a review date on the calendar — rules and provider terms change, so this checklist is re-run, not framed.

The bottom line

None of this is exotic: get consent and keep it, identify yourself in every message, honour every opt-out immediately, stay inside reasonable hours, never bluff about consequences, and keep the records that prove all of it. Treat every "commonly required" item here as a prompt to verify the rule in your own jurisdiction, with a lawyer for anything material. If you want the outreach itself handled with consent, suppression, and quiet hours built into the sequence rather than bolted on, review the flat $179/mo plan on the pricing page and see how a 14-day trial would run against your current setup.

Frequently asked questions

Is this checklist legal advice for my business?

No. It is general information about commonly expected practices for billing communications. Rules differ by country, state, and industry, and they change over time. For decisions that carry legal risk, get advice from a qualified lawyer in your jurisdiction.

Do I need separate consent to send dunning texts?

Commonly, automated texts require prior consent, and the consent has to cover the kind of message you are sending. Whether billing texts need a separate opt-in from marketing texts depends on your jurisdiction and your provider's terms, so verify both before you send.

Are dunning emails treated as transactional or marketing?

It depends on the jurisdiction and on the content of the email. Because dunning sits on the border, the safe approach is to meet the stricter marketing standard — clear sender identity, honest subject, working unsubscribe — on any email where the classification is uncertain.

What hours can I call or text about a failed payment?

Permitted hours are commonly regulated and vary by jurisdiction, so there is no single universal window to copy. As a working practice, operators restrict automated texts and calls to the recipient's local daytime and early evening, then verify the exact requirement where their customers live.

What records should I keep if a complaint arrives?

Keep consent records showing who opted in, when, and under what wording; send logs showing which template version went to whom and when; and timestamped opt-out and suppression logs. Together these let you show exactly what was agreed, what was sent, and that a stop request was honoured.