Outbound Compliance Checklist for VICIdial

Ensuring outbound call compliance is critical to avoid fines, maintain reputation, and respect consumer rights. Use this checklist to validate your VICIdial configuration, policies, and agent workflows against key regulations like TCPA, FCC, GDPR, and local state laws.

Prerequisites

• Admin access (User Level 9) to VICIdial and system configurations
• Knowledge of applicable regulations: TCPA (US), GDPR (EU), regional Do‑Not‑Call lists
• Up-to-date Do‑Not‑Call (DNC) and suppression lists
• Documented call scripts and agent training materials
• Logging and recording infrastructure enabled

1  Consent Management

1. Prior Express Consent: Verify every lead has documented opt‑in consent. Store timestamp, source, and call type permissions in lead fields.
2. Consent Expiry: Implement periodic re‑consent workflows for stale leads (e.g., annual reconfirmation).
3. Consent Audit Log: Log consent records via a custom field or external CRM integration for audit readiness.

2  Do‑Not‑Call (DNC) Handling

1. Upload DNC Lists: Import federal, state, and internal DNC lists under Admin → Lists → Upload DNC.
2. Enforce Flag: Ensure disposition codes set DNC=Y automatically suppress future dialing.
3. Realtime Checks: Integrate a DNC API check (pre‑dial) using non_agent_api.php to prevent dialing flagged numbers.
4. Monthly Refresh: Schedule monthly DNC list updates and clean out flagged leads via Clean Leads.

3  Time‑of‑Day & Geographic Rules

1. Local Call Times: Configure Local Call Time in campaign settings to dial only within permissible hours per region (e.g., 8 AM–9 PM).
2. Holiday Schedules: Use Admin → System Settings → Holiday Schedules to pause campaigns on national/regional holidays.
3. Timezone Mapping: Segment lead lists by time zone or use script logic to apply correct dialing windows.

4  Call Pacing & Abandon Rates

Monitor these metrics in real time and configure drop‑call alerts to auto‑pause campaigns.

5  Agent Script & Disclosure Requirements

1. Required Disclosures: Ensure call scripts open with proper identification: company name, reason for call, and opt‑out instructions.
2. Script Enforcement: Deploy mandatory scripts via the Agent Info Panel to prevent unscripted calls.
3. Opt‑Out Mechanism: Provide clear instructions (e.g., “Press 9 to opt‑out”) and process opt‑out dispositions immediately.

6  Recording & Data Retention

• Call Recording: Configure Campaign Recording settings and enable per‑call recording if required.
• Notification: Play a recorded message stating calls are being recorded, if mandated by state laws.
• Retention Policy: Define and enforce retention periods (e.g., 90 days) and auto‑purge older recordings.
• Secure Storage: Encrypt recordings at rest and restrict access via file permissions or storage ACLs.

7  Reporting & Audit Trail

• Enable Detailed Logging: Activate verbose Asterisk and VICIdial logs for call detail tracking.
• Export Audit Reports: Use Admin → Server Admin → Export Records to download user and configuration change logs.
• Disposition Analytics: Schedule regular runs of the Call Disposition Report to spot compliance issues (e.g., incorrect dispositions, high opt‑out rates).
• Third-Party Audits: Periodically engage external auditors to validate compliance configurations.

8  Training & Documentation

1. Agent Training: Conduct mandatory compliance training on TCPA, DNC, and company policies before live dialing.
2. Runbooks: Maintain runbooks for common compliance processes—DNC upload, consent management, and pause campaigns.
3. Policy Updates: Review and update compliance policies quarterly or as regulations evolve.

Best Practices

1. Automate compliance checks as part of your campaign launch playbook (Ansible or scripts).
2. Use version control for compliance-related configurations and scripts.
3. Implement real‑time dashboards showing compliance KPIs for supervisors.
4. Integrate SMS/email opt‑outs into the DNC suppression pipeline.
5. Regularly test compliance workflows by simulating calls and opt‑outs.

Next Steps

• Integrate third‑party compliance services (e.g., data screening, consent verification) via APIs.
• Leverage AI-driven quality assurance to flag non‑compliant agent behaviors.
• Expand compliance scope to inbound calls and blended campaigns.
• Stay informed on regulatory changes through legal counsel or compliance newsletters.

For further guidance, consult regulatory websites (FCC, FTC, GDPR portal) and the VICIdial Manager Manual.