A New SHIELD Against Debt Collection Procedures

When the federal government steps back from regulation, it’s common to see the states step up. Last week we saw New York City publish a final rule regulating debt collection. The New York City Department of Consumer and Workers Rights (DCWR) released the Stopping Harassment and Intimidation and Ensuring Lawful Debt (SHIELD) Collection Rule , which claims to provide the strongest consumer protection in the country . This rule went through the wringer, with multiple delays, a legal challenge, and extensive rewrites. Right now, it is scheduled to go into effect on September 1, 2026. 

Who Would Be Affected?  

This regulation would apply to anyone engaged in debt collection practices as they pertain to New York City consumers. It specifically includes “original creditors” and excludes routine account servicing. Debt collection practices start when one of the following occurs:  1) the creditor has ceased to send statements for accounts with periodic statements; 2) for accounts without periodic statements, the creditor has ceased sending bills or taken or threatened legal action; or 3) the creditor has accelerated the unpaid balance or demanded the full balance. 

So, if your credit union has shifted to debt collection practices and meet either category of the above-described criteria and have consumers residing in New York City, you may be subject to these new restrictions. 

Key Features of the Final Rule: ​ 

1. Communication Limits: Collectors can contact consumers up to three times per account within seven  days. ​ Certain communications (e.g., mailed letters, consumer-initiated contacts) are excluded from this limit. ​ (Note: The rule text points out that current local  regulations restrict communications per consumer to twice a week, so this regulation actually expands collector access.) This is a fairly significant departure from Regulation F, which is more permissive. Under Regulation F, there may be a rebuttable presumption of excessive calls if the debt collector exceeds seven calls in seven days, and does not set a frequency cap on emails or text messages. 
2. Electronic Communications: A debt collector no longer needs a consumer’s oral consent prior to sending an electronic message. Collectors can request consent for electronic communication via one message (excluded from the frequency cap). ​ Consumers can opt out of specific channels. ​(A note on TCPA – TCPA does require prior express consent but in general, debt collectors have obtained consent if the recipient provided his or her wireless number to the creditor and “such number was provided during the transaction that resulted in the debt owed.”) 
3. Workplace and Social Media : Contacting employer-provided emails/numbers is prohibited unless the consumer gives consent. ​ Social media contact requires consent and must not be public. ​ 
4. Validation Notice: Must be mailed within five days of the first communication. ​ If emailed, it must include specific information and meet legal requirements. ​ 
5. Disputes and Verification: Consumers can dispute debts at any time. ​ Collectors must stop collection after the first dispute/request until verification is provided within 60 days. ​ Default judgments cannot verify debts, so if a consumer challenges a debt, the creditor must obtain original account-level documentation for verification. 
6. Credit Reporting: Collectors must send advance notice before reporting negative information and wait 14 days. ​ Medical debt reporting is prohibited. ​ 
7. Time-Barred Debts: Collectors must send a disclosure if the statute of limitations has expired and wait 14 days before further contact. ​ 
8. Medical Debt: Prohibits credit reporting of medical debt and requires verification of related accounts within a three-month window for a single medical condition. ​ 
9. Language Access: Validation notices must be sent in the language used for collection within 5 days. ​ Spanish notices are required upon request. ​ 
10. Recordkeeping: Collectors must maintain detailed records of communications, disputes, and complaints for three (after the last collection activity for account-level records) to six (for operational policies, training materials, and certain operational records) years. ​ 
11. Public Websites: Websites referencing New York City consumers must display language-access availability and link to DCWP resources.  

How to Prepare  

If your credit union has consumers living in New York City, you may want to prepare for these rules as they are effective  September 1, 2026. Draft and implement policies, procedures and processes to set clear guidelines for when an account goes into debt collection. Update your policies, procedures and processes to ensure contact does not exceed three attempts within seven days, excluding mail contact. Establish a calendaring system to track contacts and disclosures. Update websites if necessary. Maintain detailed records of communications, disputes, and complaints. 

Although the number of credit unions this regulation affects may be mostly limited to those in the New York area, any member of any credit union could relocate to the New York City metropolitan area. Be prepared! 

Questions? Contact the Compliance Team at [email protected]