Short answer: if you text a lead or client, the Telephone Consumer Protection Act (TCPA) treats that text like a call — you need prior express written consent before an automated or marketing text, you can only send between 8 a.m. and 9 p.m. in the recipient’s time zone, and you have to honor an opt-out sent in any reasonable way. Violations run $500 per text, up to $1,500 if a court finds it willful, and a purchased lead list is the single most common way loan officers end up on the wrong side of it. This is one piece of the broader compliance rules for mortgage marketing — texting has the most specific, most-violated rules of any channel, which is why it gets its own breakdown.
Do I need consent before I text a lead?
Yes, for any text sent with an autodialer, a mass-texting platform, or pre-written/templated content — which covers almost every text a CRM sends. The standard is prior express written consent (PEWC): a signed agreement (an e-signature counts) in which the consumer names the company that may contact them, at the specific number given, using automated technology. A text you type and send yourself, one at a time, to a client you’re already working with is lower-risk than a templated drip blast, but if it’s an unsolicited marketing message, the same consent standard applies.
What actually counts as “prior express written consent”?
It has to (1) be in writing, (2) name your company specifically (or clearly identify “companies like us” if that’s what the consumer agreed to), (3) state that automated texts and calls may be used, and (4) not be a condition of getting a loan or service (see 47 CFR 64.1200 for the full text). A checkbox on a lead form that says “By submitting, I agree to receive calls and texts from [company name] at the number above” satisfies it — a vague “I agree to be contacted by partners” does not. This is exactly why purchased mortgage leads are risky: you’re trusting a vendor’s consent language named them, not you, and recycled or vague consent is the most common source of TCPA exposure in mortgage marketing.
What are the quiet hours for texting leads?
No texts before 8 a.m. or after 9 p.m. in the recipient’s local time zone — not yours. If you’re in California texting a lead in Florida at 7 p.m. your time, it’s 10 p.m. theirs, which is outside the window. Some states layer stricter telemarketing hours on top of the federal floor, so “federally compliant timing” isn’t automatically compliant in every state you market into.
How do opt-outs work, and what’s changing?
An opt-out has to be honored “by any reasonable means” — a reply of “STOP,” “unsubscribe,” or similar has always counted, and most CRMs auto-process those keywords. The FCC has spent 2026 revising this specific piece of the rule. A “one-to-one consent” requirement that would have forced a separate signed consent per company was struck down by the Eleventh Circuit in January 2025, and the FCC didn’t appeal — so that stricter bar never took effect. Separately, the FCC circulated draft rules on September 9, 2026 that would let a business designate one exclusive revocation channel (a specific reply keyword, an opt-out number, or a website) and treat revocation through other channels as non-binding once that channel is clearly disclosed — replacing a broader “revoke-all” rule that was set to take effect in January 2027. That proposal was teed up for the FCC’s September 30, 2026 open meeting (Troutman Pepper Locke’s coverage is a clean summary); treat it as pending until it’s formally adopted and published, and keep honoring STOP-style replies through every channel until your compliance contact confirms otherwise. This matters most when you’re texting old leads back into your pipeline — a lead who went quiet a year ago may have opted out somewhere along the way, and you won’t know unless your records carry forward.
Do I need to register my texting number for A2P/10DLC?
If you’re texting from a standard 10-digit business number through any platform (including most CRM texting features), carriers require A2P 10DLC registration — it’s how they distinguish legitimate business texting from spam and route messages instead of filtering them. This isn’t a TCPA requirement itself, but skipping it gets messages silently blocked or throttled, which is its own business problem layered on top of the compliance one. A mortgage-built CRM handles this registration, keyword opt-out processing, and quiet-hour enforcement automatically instead of leaving it to whichever app happens to be open on your phone.
Why is texting from my personal phone risky?
A 2026 National Mortgage News study found only about a third of loan officers exclusively use an approved central platform for lead texting — most are still texting from personal devices at least some of the time. That means no consistent opt-out handling, no contact-hour enforcement, no consent record tied to the message, and no audit trail if a complaint comes in. None of that is a TCPA violation by itself, but it’s exactly the setup that turns one bad number on a purchased list into a claim you can’t defend, because you can’t produce the record showing what consent existed. Texting discipline is one piece of a bigger system — see our full loan officer marketing breakdown for how it fits with email, social, and paid channels.
| Message type | Consent needed | Quiet hours apply | Opt-out required |
|---|---|---|---|
| Marketing/promotional text (new rate offer, “check out our new site”) | Prior express written consent | Yes, 8 a.m.–9 p.m. recipient’s time | Yes |
| Informational text to an existing client (closing update, doc reminder) | Prior express consent (written not always required) | Best practice, not always mandatory | Yes |
| Cold text to a purchased/aged lead list | Written consent naming you specifically — verify, don’t assume | Yes | Yes |
| One-to-one reply to an inbound text the lead sent first | Generally exempt (responding, not initiating) | Best practice | Yes |
Key takeaways
- Texting a lead requires prior express written consent naming your company, the specific number, and that automated messages may be used.
- Quiet hours are 8 a.m.–9 p.m. in the recipient’s time zone, not yours.
- Opt-outs must be honored through any reasonable channel — reply keywords like STOP, unsubscribe, cancel, or opt out.
- The FCC’s revocation rules are actively changing in 2026; a proposal circulated September 9, 2026 would narrow how businesses must process opt-outs, pending a vote.
- Purchased and aged leads carry the highest risk — the consent record belongs to the vendor, not you, unless you verify it.
- A2P 10DLC registration keeps texts from a business number delivering (and out of the spam filter) but isn’t itself a TCPA requirement.
- Violations run $500 per text, up to $1,500 if willful — texting from a personal phone with no audit trail is the setup that turns one bad number into an expensive one.
FAQ
Can I text a lead who just filled out my contact form?
Only if the form’s consent language names your company and states that automated texts may be used. A generic “I agree to be contacted” checkbox without that language doesn’t meet the prior-express-written-consent standard for marketing texts.
Is a “Reply STOP to unsubscribe” line enough to be compliant?
It covers the opt-out side, but it doesn’t create consent in the first place — you still need documented consent before the first automated marketing text goes out.
Does TCPA apply to one-off texts I send manually, not through a CRM?
The autodialer/automated-technology trigger is about the equipment and method, not just volume — a templated message sent to one person through texting software can still qualify. When in doubt, treat any non-conversational text the same as a bulk one.
What’s the practical difference between TCPA and the Do Not Call Registry?
They’re separate checks. TCPA consent covers whether you can text or robocall someone at all; the National Do Not Call Registry is a separate scrub you run before live cold calls. Being off the DNC list doesn’t substitute for TCPA consent, and vice versa.
Do purchased mortgage leads come with valid texting consent?
Sometimes, but don’t assume it. Ask the vendor exactly what consent language the consumer agreed to and whether it names you — or lenders “like you” — specifically. Vague or recycled consent is the most common source of TCPA exposure in bought-lead texting.
Will the CRM handle TCPA compliance for me?
A mortgage-built CRM can enforce quiet hours, process opt-out keywords automatically, and keep a timestamped record of consent and messages — which is most of what protects you if a complaint ever comes in. It doesn’t replace getting real consent in the first place.