The National DNC Registry Audit: Operational Safeguards for High-Volume Outbound Insurance Agencies

A National DNC Registry audit for high-volume outbound insurance agencies tests five controls: registry data no older than 31 days, a company-specific suppression list, written procedures, staff training, and retained records. The Telemarketing Sales Rule, the TCPA, and stricter state rules all apply to the same dialing program.

How often must an agency scrub against the National DNC Registry?

An outbound agency must scrub its calling lists against a National DNC Registry version obtained no more than 31 days before any call is placed. The FTC's Q&A for telemarketers and sellers ties the federal safe harbor to that 31 day window, so older registry data forfeits the defense.

Scrubbing is a recurring operational task, not a one time event at list purchase. Schedule it inside the dialer or CRM so no producer can launch a campaign against a stale list. A three layer check gives the strongest baseline before any campaign starts: the National DNC list, applicable state registries, and your own internal do-not-call list. Kadence, AI built to grow life insurance distribution, front to back office, makes the suppression check a gate in the outbound workflow, so an unscrubbed list never reaches the queue.

How many numbers are on the National DNC Registry now?

The National Do Not Call Registry held 258,515,050 active registrations as of September 30, 2025, according to the FTC's National Do Not Call Registry Data Book for Fiscal Year 2025. The registry added 4.8 million new numbers during fiscal year 2025, so the suppressed share of any purchased list keeps growing.

The same Data Book gives the exposure picture an auditor should keep in front of the dialing team:

Metric (FY 2025)	Value (count)	Source
Active registrations on Sept. 30, 2025	258,515,050	FTC Data Book
New numbers added to the Registry	4.8 million	FTC Data Book
Do Not Call complaints received	More than 2.6 million	FTC Data Book
Illegal robocall complaints per month	About 133,000	FTC Data Book
Illegal robocall complaints per month, FY 2024	About 92,000	FTC Data Book

The FTC treats complaint data as unverified consumer reports. Use them as exposure indicators, not as a violation rate. For an agency, the practical reading is simple: complaint volume is rising, so an unscrubbed list is a growing liability.

What are the penalties for violating Do Not Call rules?

The FTC has brought 173 lawsuits against 570 companies and 449 individuals since the Registry was established, obtaining nearly $400 million from alleged violators. That figure comes from the FTC's FY 2025 Data Book and shows enforcement reaches both companies and the individuals running them.

Penalty exposure stacks. Federal TSR enforcement, private TCPA claims, and state actions can arise from the same campaign, and a state may add licensing consequences for telemarketing operations. A predictive dialer working an unverified list can generate a large number of violations before anyone sees a pattern. Treat DNC compliance as risk management with a budget, not paperwork. Confirm current per violation amounts and state consequences with counsel, because they change and vary by jurisdiction.

What are the safe-harbor requirements for DNC compliance?

A defensible DNC safe-harbor program requires five elements: written procedures, employee training, monitoring and enforcement, a company-specific suppression list, and registry access within the 31 day window. A gap in any one element weakens the defense an agency can show in an enforcement proceeding.

Safe harbor is a documented posture, not immunity. Written procedures should name who runs the scrub, on what schedule, with which tools, and how opt-out requests are processed. Training logs need dates, attendee names, and content summaries. Monitoring means someone reviews dialer output and acts on failures, with discipline recorded. Kadence keeps these records beside the campaigns they govern, so audit documentation is not scattered across email threads and spreadsheets.

Does a do-not-call request to one agency apply company wide?

A consumer's request to stop calls must be captured on an entity-specific internal do-not-call list, and a request directed to one entity does not automatically extend to every affiliate. The FTC's Q&A for telemarketers describes the list as specific to the seller or telemarketer that received the request.

For an IMO or multi-agency organization, this makes the ownership question an audit item. Decide in writing which legal entity owns each internal list, how requests reach it from every channel (calls, texts, web forms), and whether the organization chooses to share suppression across affiliates. Sharing suppression is often the cleaner operating choice, even where the rule does not require it, because a prospect who says stop to one producer should not hear from the next. A single CRM record per contact makes that shared suppression enforceable.

How long must telemarketing records be kept?

The Telemarketing Sales Rule requires covered telemarketing records, including scripts, promotional materials, service-provider records, and other documentation, to be retained for five years in specified circumstances. Agencies should default to a five year retention window for the full compliance file rather than sort records case by case.

The practical test is whether the agency can produce every record within 24 hours of a regulatory inquiry. Scrubbing logs should show the date, the registry version used, list size before and after suppression, and the operator. Opt-out records need a request timestamp and a suppression timestamp. Keep dialer configuration exports that show calling-hour filters and abandonment controls were active. Confirm which records and periods apply to your calling program with counsel.

Which states have the highest DNC complaint rates?

In FY 2025, DNC complaint rates per 100,000 residents were highest in Arizona (1,028), Tennessee (1,017), Nevada (960), Illinois (943), and Florida (933), per the FTC Data Book. Agencies dialing into those states face the greatest complaint density and should apply the tightest suppression review there.

State	DNC complaints per 100,000 residents (FY 2025)
Arizona	1,028
Tennessee	1,017
Nevada	960
Illinois	943
Florida	933

Complaint rates are exposure indicators, not proof of violations. Even so, a campaign routed into a high complaint state deserves a fresh state registry pull and a second review of consent records before launch. See how agencies can tie routing and suppression together at the state level.

How do state rules change an outbound agency's scrubbing cadence?

State telemarketing restrictions may be stricter than federal baseline rules, covering calling hours, consent standards, registration, and licensing. An agency dialing across several states must maintain a suppression layer for each applicable state registry in addition to the federal list, which makes multi-state compliance its own operational track.

The safest practice is to pull current state data before each campaign batch rather than rely on a fixed calendar, since states refresh their lists on different cycles. For multi-state producer routing, tie the suppression layer to the state assignment logic so each record is scrubbed against the correct state list before the number is queued. Calling hours follow the recipient's local time, not the agency's, so the dialer should enforce time zones automatically instead of relying on agent awareness.

What dialer controls help prevent noncompliant outbound calls?

Four dialer controls prevent most noncompliant calls: a hard stop on lists without a current scrub date, recipient-local calling-hour filters, an abandonment-rate governor, and automatic suppression of internal opt-outs. Each control should block the call, not warn the operator.

Also check numbers against the FCC Reassigned Numbers Database before dialing consented leads, because a number tied to a consenting prospect may now belong to a new subscriber. Prior consent does not carry over. Consent to autodialed contact also does not replace DNC scrubbing: the two obligations run separately. For Voice AI doing outbound follow-up, build hour enforcement and reassignment checks into the campaign configuration rather than leaving them to manual review.

How do vendor lead risks affect DNC compliance?

Purchased leads carry the seller's DNC exposure with them, because the agency placing the call answers for it. A vendor's claim that a list is clean does not substitute for the agency's own scrub inside the 31 day window and its own internal list check.

Audit each lead source on three points: how consent was captured and stored, how old the list is, and whether the vendor will provide consent evidence on request. Reject lists that arrive without that documentation. Rank vendors by compliant, contactable records, not by price per lead. The methodology page explains how Kadence sources and weighs the research behind guidance like this.

What should the audit cycle look like, step by step?

Run the audit on a fixed cadence, at least before each major campaign batch and on a recurring internal schedule. Each cycle should verify that every required document type is present, current, and timestamped, so an inquiry produces a complete compliance package instead of a search for missing files.

The seven steps in this guide give the sequence: a 31 day scrub schedule, a three layer suppression protocol, dialer governors, opt-out logging, reassigned number checks, written procedures with training, and a centralized audit log. Teams that want that log tied to every campaign can book a demo and see how Kadence's CRM and Voice AI hold scrub dates, opt-out records, and dialer settings in one place.

Sources

• National Do Not Call Registry Data Book for Fiscal Year 2025
• Biennial Report to Congress on the National Do Not Call Registry, FY 2025
• Q&A for Telemarketers & Sellers About DNC Provisions in the TSR