Do-Not-Call and Suppression Audit Checklist

Name the campaign under audit, the list it dials, the countries on that list and the date the list was built.

The suppression rules that apply depend on where the trader is, not where your desk is. A list mixing UK, German and US numbers needs three sets of checks.

Campaign: ________ List date: ________

Assign one owner for external do-not-call sources, one for internal opt-outs and one for campaign exclusions.

Three lists, three owners. When they're the same person write the name three times; the point is that each list has someone who answers for it.

External: ______ Internal: ______ Exclusions: ______

Write down which system is the single place a trader's do-not-call status lives: CRM, back office, calling platform or a separate suppression file.

If the answer is "all of them", the audit will find a trader who is suppressed in one and dialable in another. Decide the owning system now and treat the others as copies.

Confirm the legal basis your compliance officer has recorded for calling this list: consent, existing customer relationship, legitimate interest or something else.

The basis decides which suppression sources apply. A dormant trader who is still a client may be treated differently from a lead who never funded. Don't decide this yourself; record what compliance decided and when.

List every other team or vendor that can start a call to the same traders: sales floor, retention desk, an affiliate, a second dialer.

A trader who opts out with your AI agent and gets a call from the sales floor the next morning has been called after opting out. Every calling path needs the same suppression.

List every national or regional do-not-call register that covers a country on the list, with the operator and the account you use to access it.

Examples: the US National Do Not Call Registry under the TCPA and TSR, the Telephone Preference Service in the UK under PECR, Bloctel in France, the National DNCL in Canada, the Do Not Call Register in Australia. Your compliance officer confirms which apply to your entity and your legal basis.

Add the state-level and sector-level lists that sit beside the national one, where they exist.

Several US states keep their own do-not-call lists in addition to the federal registry, and some have separate rules for existing customers. Ask counsel which apply to the states on your list rather than assuming the national screen is enough.

Record whether each register is checked by your calling platform, by your CRM, by a third-party scrubbing service or by hand, and where the result is stored.

A screen that happens in a spreadsheet on someone's laptop leaves no trail. The result must land on the trader record or the list record where an auditor can find it.

Confirm the phone number format used for matching on every side: E.164 with country code, no spaces, no leading zeros.

A number stored as 07700 900123 in the CRM and +447700900123 in the register never matches. Normalize before screening, and log the count of numbers that failed to normalize.

Check how the register treats existing customers and confirm with compliance whether your dormant traders qualify, and for how long after their last activity.

Existing-customer treatment varies by country and is time-bound in some. "Dormant for three years" may fall outside it. Record the decision and the date; don't infer it from the register's FAQ.

Screen the list against the internal do-not-call list as well as the external ones, and record both results separately.

A number can be absent from every national register and still belong to a trader who told your agent to stop calling last month. The internal list is covered in its own section, but it runs in the same screening pass.

Fill the source register below for every country on the list.

Countries: ____ Registers screened: ____

Record the maximum age each register operator allows between a screen and a call, and confirm it with your compliance officer.

The interval differs by register and changes over time. Write down the number, the source and the date you checked, rather than the number someone remembers.

Register: ________ Max age: ____ days

Compare that maximum to the actual gap between your last screen and the campaign's planned end date, not its start date.

A six-week campaign screened once at import runs the last two weeks on a stale screen if the allowed interval is a month. Schedule a re-screen inside the campaign as well as before it.

Set the refresh schedule for each source: register subscription downloads, scrubbing service runs, internal list exports.

Put the runs on a calendar with an owner and a log entry per run. A refresh that depends on someone remembering is a refresh that gets skipped in a busy week.

Check the date on the register download or scrubbing report actually used for this list, and compare it to the date on the invoice or subscription record.

Brokerages have paid for a subscription and kept screening against a file from the previous quarter. The file date is the one that matters.

Define what happens to a list whose screen has expired mid-campaign: automatic pause, re-screen, or manual review.

Automatic pause is the safest default. The calling platform should refuse to dial a batch whose screen date is older than the allowed interval.

Set the re-screen rule for retries and callbacks scheduled days after the first attempt.

A callback booked for next Tuesday is a new call. If the trader registered on a do-not-call list on Monday, Tuesday's call needs a fresh check.

Record the refresh cadence for the internal opt-out list separately, and make it faster than any external one.

External registers change slowly. Your own opt-outs happen during calls, all day. The internal list should update within minutes, which is the subject of the next section.

List every channel a trader can use to opt out: during an AI call, during a human call, email, chat, the client portal, a written letter, a complaint.

Each channel needs a path to the same do-not-call field. An email that sits in support for a week while the dialer keeps going is the standard failure.

Confirm the AI agent recognizes an opt-out in every language the campaign runs in, including indirect phrasing.

"Don't call me again", "take me off your list", "I'm not interested, stop" and their equivalents in each language must all set the flag. Test each one; read the transcripts.

Measure the time from an opt-out on an AI call to the do-not-call flag appearing in the owning system and in every copy.

Topcalls writes the do-not-call outcome to the CRM through its connectors and webhooks. Time it on a test call from the moment the trader says it to the moment the CRM shows it.

Measured delay: ____ minutes

Confirm the do-not-call flag is write-once: no workflow, import, sync or human edit reverts it without a documented process.

Nightly CRM imports that overwrite the contact record are the most common way an opt-out disappears. Test it by importing a record for a suppressed trader and checking the flag survives.

Trace what an opt-out suppresses: this campaign only, all campaigns on the calling platform, all calls from any team, or all marketing including email and SMS.

A trader who says "stop calling" has objected to calls at minimum. Whether that extends to email is a compliance decision. Record what your process does today and have compliance confirm it matches the trader's request.

Handle a GDPR objection or erasure request as its own path, with a named owner and a step that suppresses the number before the record is deleted.

Deleting the record without keeping a suppressed hash or number means the trader can be re-imported and called again. Confirm the retention approach for suppression records with your compliance officer or counsel.

Check how an opt-out given to an affiliate, an introducing broker or a former vendor reaches you.

If it doesn't, write that down as a finding. It's a gap in the source list, not a reason to keep calling.

Confirm the opt-out confirmation the trader hears on the call, and that the agent ends the pitch immediately after it.

Continuing to sell after an opt-out is the moment a complaint gets written. Pull three transcripts with an opt-out and read what happened in the next thirty seconds.

Exclude traders with an open complaint, a dispute, a chargeback or a regulatory inquiry on their account.

A reactivation pitch to a trader mid-complaint reads as pressure. The flag lives in the back office or the CRM; the calling platform must read it at import and at dial time.

Exclude accounts that are closed, blocked, under KYC review, or flagged for anti-money-laundering reasons.

The account state comes from MT4/MT5 or the back office, not the CRM. Pull the exclusion list from the system that owns the state.

Exclude traders who deposited, traded or logged in after the list was built.

The dormant trader who funded yesterday doesn't need the dormant pitch. Refresh activity data at dial time or pull the exclusion daily.

Exclude traders in countries where your entity isn't permitted to market, and anyone whose country field is blank or doesn't match the number's country code.

A mismatch between the address country and the phone country code is a data-quality flag and a jurisdiction question. Hold the record until someone resolves it.

Exclude traders who received a call on this campaign within the attempt limit, and traders who declined on the previous reactivation campaign within the cool-off period compliance set.

Retry limits and cool-off periods are campaign rules the calling platform enforces. Write the numbers here so the audit can compare them to the configuration.

Max attempts: ____ Cool-off: ____ days

Exclude vulnerable-customer flags, deceased markers and any number tagged as a shared or business line where the trader can't be reached privately.

Vulnerability rules are part of FCA expectations for UK firms and appear in other regimes. Which flags exist and how they're set is a compliance question; that they're honored at dial time is an ops one.

Exclude numbers that failed E.164 normalization, matched an internal test range or appeared more than once on the list.

Duplicates mean double calls. Bad numbers mean wrong-party calls. Both count as calling someone you didn't mean to.

Fill the exclusion table with the system of record, the check timing and the owner for each rule.

Rules configured: ____ Rules still manual: ____

Confirm the calling platform re-checks the do-not-call flag and the exclusion flags immediately before each dial as well as at list import.

Ask for the mechanism, not a yes. A screenshot of the rule, or a test where you flag a contact after import and watch the call get skipped.

Test it: import a small list, flag one contact as do-not-call after import, run the campaign and confirm that contact was never dialed.

Keep the call log from the test as evidence. This single test answers most of what a regulator or an auditor asks about suppression.

Confirm the calling-hours rule is applied in the trader's local time zone, derived from the number or the address, not from the desk's clock.

Calling windows differ by country and sometimes by state. The window is a compliance input; applying it per trader is a configuration check.

Check that the campaign pauses automatically when a suppression source can't be reached or the screen date has expired.

Failing open, where the platform dials because the check couldn't run, is the wrong default. Failing closed is.

Confirm the caller ID shown to the trader is a number that reaches your team and honors an opt-out when called back.

A trader who calls the displayed number to say stop must reach a process that sets the flag, not a dead line.

Confirm a human transfer or callback booked by the agent inherits every suppression and exclusion check before it's placed.

The retention agent calling back on Tuesday is a new outbound call under the same rules.

Keep, per list, the screening report: source, file date, count screened, count suppressed, count that failed to normalize, and who ran it.

One report per screen, stored with the list, kept for the period compliance sets. A count that's missing is a screen you can't prove happened.

Keep, per call, the timestamp, the number, the campaign, the screen date the call relied on and the outcome, including any opt-out.

Topcalls logs every call with its outcome and transcript. Confirm the export includes the fields you'd need for a complaint and that the retention period matches your policy.

Keep the opt-out record with the channel, the date, the exact words where available and the time the flag was set in each system.

"The trader asked us to stop on 14 March at 10:42 on an AI call; the CRM flag was set at 10:43" is what closes a complaint quickly.

Keep the exclusion configuration under version control or at minimum a dated export, so you can show what the rules were on the day of any call.

Rules change. The rule in force at the time of the call is the one that matters, not today's.

Run a monthly sample: pick ten completed calls at random and reconstruct the suppression evidence for each within an hour.

If the reconstruction takes longer than an hour, the records aren't good enough. Log the sample and the time taken.

Sample date: ______ Calls reconstructed: ____ of 10

Log every complaint about an unwanted call with the root cause: stale screen, missing internal opt-out, exclusion not applied, wrong number, or another calling path.

Root causes point to which section of this checklist failed. The count per cause over a quarter tells you where to spend the next audit.

Record the audit findings, the fixes, the owner of each fix and the date compliance reviewed them.

Findings without a dated fix are findings you'll raise again next quarter. The compliance officer or counsel signs the record; the audit isn't done until they have.

Reviewed by: ________ Date: ________ Open findings: ____