Lead Vendor Due Diligence Checklist: What to Ask Before You Buy Calls or Leads in 2026

Why lead vendor due diligence is the buyer's problem

Buying calls or leads doesn't move TCPA risk to the vendor. Three primary sources explain why buyers vet vendors before the first call:

• Vicarious liability. In its 2013 DISH Network ruling (FCC 13-54), the FCC said a seller that doesn't place a call itself "may be held vicariously liable under federal common law principles of agency" for TCPA violations by third-party telemarketers, including through apparent authority and ratification.
• Knowing what your vendor does. The same ruling says a seller is responsible for a telemarketer's unauthorized conduct if it "knew (or reasonably should have known)" about the violations and "failed to take effective steps within its power" to stop them. Due diligence is how you show you looked.
• Assisting and facilitating. Under the FTC's Telemarketing Sales Rule (16 CFR 310.3(b)), it is a violation to give "substantial assistance or support" to a seller or telemarketer when you know, or consciously avoid knowing, that it is breaking the rule.
• Enforcement against lead generators. In Operation Stop Scam Calls (July 18, 2023), the FTC and more than 100 federal and state partners targeted lead generators it called "consent farms," and the FTC said "third-party lead generation for robocalls is illegal under the Telemarketing Sales Rule."

The lead vendor due diligence checklist at a glance

What consent and source questions should you ask a lead vendor?

Start with the record itself. The federal definition of prior express written consent in 47 CFR 64.1200(f)(9) requires a signed written agreement that clearly authorizes the seller to make autodialed or prerecorded telemarketing calls to a specific number, with clear and conspicuous disclosures. When the FCC adopted that standard in 2012, it said the seller bears the burden of showing that the disclosure was provided and consent was obtained. Ask:

• Do you attach a TrustedForm certificate or Jornaya LeadiD to every lead and every call, and can we retain and verify it ourselves?
• Can we see the live form, and every version of it used in the past year?
• Does the consent language name our company, or does it link to a partner list? If it's a list, how many companies are on it?
• Which sites, apps and ad accounts generate the traffic, and do you own them?
• Do you use sub-affiliates or buy traffic from other networks? If yes, how are they approved, and can we see their forms too?
• Is any traffic incentivized (rewards, sweepstakes, job offers)? The FTC's 2023 sweep described consent farms that lured consumers "with offers for jobs or rewards."
• Is each lead or call sold only to us, and is that in the contract?

How should a vendor scrub against Do Not Call and the Reassigned Numbers Database?

Scrubbing rules come from the FCC's TCPA rules and the FTC's Telemarketing Sales Rule. The FCC's safe harbor for a National Do Not Call Registry violation made in error, in 47 CFR 64.1200(c)(2)(i), requires written procedures, trained staff, an internal list of numbers the seller may not call, use of a registry version obtained from the administrator "no more than 31 days prior to the date any call is made," and paying for registry access directly, with no cost-sharing arrangement. Questions that test this:

• Do you have your own registry subscription, or do you rely on someone else's? Under 16 CFR 310.8, no one may share the cost of registry access, including through a telemarketer or service provider that divides it among clients.
• How often do you download the registry, and can you show scrub logs with dates?
• How are internal do-not-call requests recorded? FCC rules require honoring them within 10 business days and keeping them for 5 years (64.1200(d)(3) and (d)(6)).
• Do you pass do-not-call and opt-out requests to us, and do you suppress numbers we send back to you?
• Do you check aged leads or re-contacted numbers against the Reassigned Numbers Database? Its safe harbor (64.1200(m)) applies only if the caller had consent, queried the database, and got an incorrect "no" response.
• Do you call only between 8 a.m. and 9 p.m. in the consumer's local time (64.1200(c)(1)), and how do you handle state calling-hour rules?

What does National Do Not Call Registry access cost in 2026?

These are the FTC's public fees, not vendor prices. For fiscal year 2027, which began October 1, 2026, access costs $85 per area code per year, up from $82 in fiscal 2026. The first five area codes are free, and the most any single entity pays for every area code is $23,425 (up from $22,626). An area code added in the second half of a subscription year costs $43. A seller must have paid for an area code, directly or through another person, before it or its telemarketers call numbers there, and no one may split the cost among clients. A vendor that can't show a subscription of its own is a red flag.

What records should a lead vendor keep, and for how long?

The FTC amended the Telemarketing Sales Rule in 2024 (89 FR 26760, effective May 16, 2024) and extended most recordkeeping from two years to five. Under 16 CFR 310.5 as it reads today, sellers and telemarketers must keep, for 5 years:

• Each substantially different script, ad and prerecorded message, for 5 years after it stops being used.
• A record of each telemarketing call: who placed it, for which seller, the calling and called numbers, date, time, duration, caller ID, and the call's disposition, including where it was transferred.
• Complete records of consent: the person's name and number, a copy of the consent request "in the same manner and format in which it was presented," the purpose, a copy of the consent, and the date.
• A record of each service provider used to deliver outbound calls, with the contract, kept 5 years after it expires.

Who keeps the records: you or the vendor?

Under 16 CFR 310.5(e), a seller and a telemarketer can split recordkeeping by written agreement, and the agreement governs. If your contract is silent, assume you need your own copies. Ask the vendor to commit in writing to how fast it will produce a consent record, recording or form version when you have a complaint or demand letter. Five years of storage doesn't help if a record takes weeks to retrieve. Private TCPA claims generally have a four-year limitations period (28 U.S.C. 1658, applied in Giovanniello v. ALM Media, 2d Cir. 2013), so records need to last at least that long.

What should the contract with a lead vendor include?

The contract is where diligence becomes enforceable. Have counsel review it, and at least look for:

• Representations that every lead and call comes with prior express written consent naming you, plus a certificate or token on each record.
• A ban on sub-affiliates, or a written approval process with the right to see their forms.
• Audit rights over forms, consent records, scrub logs and call recordings, with a set response time.
• Indemnification for consent and do-not-call failures, backed by a certificate of insurance.
• Exclusivity terms if you're paying for exclusive leads or calls.
• Opt-out and revocation pass-back, with a timeline inside the 10-business-day federal window.
• Who keeps which records under 16 CFR 310.5(e).
• Notice of complaints, demand letters and regulator inquiries, and the right to pause or end the program.

What are the red flags in a lead vendor?

• Won't show the live form, or the form changes often without notice.
• Consent language that links to a long partner list or never names your company.
• Certificates that are missing, masked, reused across leads, or fail lead matching.
• No National Do Not Call subscription of its own, or no scrub logs.
• Traffic sources it won't name, or unlimited sub-affiliates.
• Incentivized offers (jobs, rewards, sweepstakes) behind leads sold as high intent.
• Leads sold as exclusive that other buyers are also calling.
• No written answer on how opt-outs reach you.

What to confirm with vendors before November 25, 2026

The FCC's amended consent-revocation rule (FCC 26-67, published October 26, 2026 at 91 FR 67214) takes effect November 25, 2026. It lets callers designate an exclusive revocation method if they disclose it, and it keeps the 10-business-day deadline to honor a revocation. Ask each vendor whether it will designate a method, how it will disclose it, and how revocations it receives will reach you, so a consumer who opts out with the vendor isn't called again by your team.

How MGM ScaleCraft answers these questions

We wrote our compliance overview for procurement, legal and compliance teams running this kind of review. As it states:

• A TrustedForm certificate or a Jornaya LeadiD token is attached to every lead we deliver, pulled fresh at submission and available in every delivery format.
• Consent scope is buyer-specific, not blanket, and do-not-call and revocation requests are honored across every owned property.
• Traffic comes from our own consumer brands, with buyer-specific delivery endpoints and no co-mingling with affiliate inventory.
• Mutual NDAs, a W-9, a certificate of insurance, and a DPA for partners handling regulated consumer data are available on request, and we will complete standard vendor security questionnaires. We don't hold SOC 2 attestation and don't claim certifications we haven't earned.

Run your vendor review

If you're vetting vendors before the November 25 revocation change, book a partner briefing and we'll go through this checklist against our own consent chain. For what calls cost by vertical, see Cost Per Call in 2026. For the difference between the two buying models, see Pay-Per-Call vs Pay-Per-Lead.

FAQs