Before an AI agent calls your customers

Somewhere in a bank this week, a vendor demo just ended.

The voice sounded human. It handled an interruption, answered a balance question and wrapped up the call politely. Everyone in the room was impressed.

Then someone from compliance asked a question, and the room got a little quieter.

Here is our view. How an AI agent sounds is the easy part. What matters to a bank is whether it can prove what happened on every call. That comes down to three questions we see come up again and again, each one tied to a rule that already exists.

1. Who owns the consent?

Since February 2024, the FCC has treated AI-generated voices as "artificial" voices under the Telephone Consumer Protection Act. In plain terms, an AI agent calling a customer needs the same consent as any other artificial or prerecorded voice call.

Getting consent is only half of it. Customers also take it back, and they rarely do it with a tidy keyword. They say things like "please stop calling me at work." For debt collectors, Regulation F treats a request like that as notice that the time or place is inconvenient. A human agent would hear that and write it down. An AI agent has to understand it in plain language, act on it in the moment and send it back to the system of record, so the next call, on any channel, from any team, respects it.

This is getting more specific, not less. Starting November 25, new FCC rules let an opt-out apply to just one category of informational messages. An agent that hears an opt-out now also has to know which kind of message it was responding to.

What to ask: Who holds the consent record, and how does an opt-out heard on a call get back to it?

2. How is a payment authorized?

Taking a payment is where a conversation turns into money moving, and it is where a friendly "sure, go ahead" is not enough on its own.

For recurring payments from a customer's account, Regulation E says the payment can only be authorized by a writing signed or similarly authenticated by the customer, and the customer gets a copy. A phone call has to end up as that record.

So ask the vendor to walk you through one payment from start to finish:

• Disclosure: what the customer hears, and whether it is read word for word

• Authorization: how it is captured, and where it is stored

• Copy to the customer: how and when it is sent

• Payment: how it is processed, and what happens if it fails

What to ask: How does a phone call become that record, and can you show us one?

3. Where does the data go?

A call about a loan carries nonpublic personal information: names, balances, account details, sometimes hardship circumstances. Under the Gramm-Leach-Bliley safeguards rules, financial institutions are expected to oversee every service provider that touches that information. That means choosing providers that can protect it, requiring it by contract and checking on them over time.

An AI voice vendor is a service provider like any other, except it often holds more: recordings, transcripts and everything the customer said. Timing matters too. Banks have to tell their primary regulator within 36 hours of a serious computer-security incident, and bank service providers have to alert the bank as soon as possible when an incident disrupts their service. Those clocks only work if the vendor's contract says who gets told, and how fast.

Ask for these in writing:

• Encryption: in transit and at rest

• Retention: how long recordings and transcripts are kept, and why

• Breach notice: who is told, and how fast

• Independent audit: the latest report

What to ask: Where do recordings live, how long are they kept, and how does a breach get reported?

The question under all three

Look at the three together and they are really one question: can you show what happened on every call?

Consent, payments and data each get answered the same way. Not with a demo, but with a record. What the customer agreed to, what they said, what the agent did next, and where all of it lives now.

If you help banks and BPOs choose vendors, these make a good first page for any RFP. They are not hard questions for a vendor that was built for this industry. They are very hard questions for one that was not.

Why we care about this at Domu

We are one of the vendors who gets asked these questions, and we think they are exactly the right ones.

How an AI agent sounds is the easy part. What matters is whether you can prove what happened on every call.

Compliance first is one of Domu's core tenets. A vendor should be able to answer all three questions in writing, before any customer hears the agent's voice. On Domu, every call leaves a record of what was said, what the customer asked for and what happened next, so the answer is there whenever someone needs it.

This is our perspective for teams in banking and consumer finance, not legal advice.

Sources: FCC 24-17, Declaratory Ruling, Feb. 8, 2024; 47 U.S.C. 227; 12 CFR 1006.6(b); FCC 26-67 (2026); 12 CFR 1005.10(b); 16 CFR 314.4(f); 12 CFR Part 30, App. B; 12 CFR Part 53.