# The Dial-Ready List Standard: Cleared to Call, Hold, or Scrub

*You will be able to grade any phone list as cleared to dial, hold, or scrub again, so two people applying the same DNC, consent, window, and audit rules reach the same verdict.*

- Canonical URL: https://www.refolk.ai/guides/dial-ready-list-standard
- Pillar: Process, data, and compliance
- Format: Standard
- Published: 2026-09-27
- Last reviewed: 2026-09-27
- Reading time: 17 min

Deciding whether an outbound calling list is legally cleared to dial is a distinct job from clearing a list for email, and almost nobody has written it down as a rubric. This standard is for the revenue operations, recruiting operations, or compliance lead who signs off before reps or sourcers start calling. It gives you gradeable criteria, a procedure, and a checklist, so two people looking at the same list return the same verdict: cleared, hold, or scrub again.

Every published operations guide about clearing a list to contact people is scoped to email sending and domain suppression. The phone channel has entirely different failure modes and entirely different penalty math: federal and state Do Not Call registries, mobile-number consent, local calling windows, and AI-voice disclosure. This document covers those. It is written to be adopted as team policy and attached to a list before it reaches a dialer.

## What "dial-ready" means

Dial-ready means a list has passed four independent gates - DNC suppression, consent, calling-window, and audit-trail - with evidence on file, and carries a recorded verdict. A list is not dial-ready because it was bought clean or scrubbed last month; it is dial-ready because each gate produced a logged artifact you could hand to a regulator.

The verdict has three states, and the point of the standard is that they are gradeable, not felt.

| Verdict | Meaning | What triggers it |
|---|---|---|
| Cleared | All four gates pass with evidence | Fresh scrub, consent on file, window gated, records retained |
| Hold | A gate is fixable without re-sourcing | Missing state registration, stale scrub, unconfigured window |
| Scrub again | A gate fails at the row level | Area-code-only location, no line-type field, no consent proof |

The difference between hold and scrub-again is where the defect lives. A hold is a list-level or campaign-level gap you can close: file the Texas bond, re-run the scrub, configure the dialer. A scrub-again is a data-quality defect in the rows themselves, and no amount of paperwork fixes it - you have to go back and enrich or re-source.

> **Rule:** Evidence, not assertion
>
> Every gate must produce a retrievable artifact: a timestamped scrub file, a per-number consent record, a dialer window config, a registration certificate. A gate with no artifact is a failed gate.

## The federal floor every list must clear

Federal rules set a floor no list can go below, and they are the same whether you are selling software or sourcing candidates. Below is the spine of the standard: the hard thresholds that turn a subjective read into a pass/fail grade.

| Criterion | Value | Source |
|---|---|---|
| Max scrub age | 31 days | 16 CFR 310.8 |
| Revocation window | 10 business days | dated vendor summary |
| Calling window | 8 a.m. to 9 p.m. recipient-local | TSR and TCPA rules |
| Record retention | 5 years | 16 CFR 310.5(a)(10) |
| TSR max penalty | $53,088 per call | 2025 FTC adjustment |
| TCPA private damages | $500 to $1,500 per call | TCPA private right of action |

A few of these carry traps worth naming now.

The 31-day scrub cadence is a maximum, not a target. You must synchronize your lists with an updated National Registry at least every 31 days, and you may download data only once in any 24-hour period. But numbers are added to the registry daily, and the caller remains liable for a number registered after the last scrub. That is the single most important mechanism in this document.

> **Rule:** Re-scrub before every launch
>
> The 31-day window is a grace period for callers, not a delay in the consumer's protection. You must honor a registration within 31 days of when the person registered, so re-scrub immediately before each campaign regardless of when you last synced.

The revocation rules that took effect April 11, 2025 prohibit an exclusive means of revoking consent - a person may revoke in any reasonable manner - and require you to honor revocation within 10 business days of receipt. The FCC named standardized keywords you must honor: stop, quit, revoke, opt out, cancel, unsubscribe, and end. The broader "revoke-all" cross-subject provision has been deferred twice and now lands January 31, 2027. If your compliance calendar was written before mid-2025, check all three of these, because they were likely wrong on the day they were saved.

The National Registry is not a small or stale list. It held 258 million active registrations as of September 30, 2025, roughly 76% of the US population, and the FTC received 2.6 million Do Not Call complaints in fiscal year 2025 alone.

**258M - Active registrations on the National DNC Registry, September 30, 2025**

Roughly 76% of the US population, which is why an unscrubbed list is mostly protected numbers.

## Who owns this, and why the ratio is the risk

List clearance is owned by a small number of people and executed by a large number of people, and that gap is the structural risk. In Refolk's index of professional profiles, the population that dials dwarfs the population accountable for the list.

| Segment | Count | Derived ratio |
|---|---|---|
| RevOps leadership, US | 2,145 | baseline |
| RevOps leadership, UK | 235 | US is 9.1x UK |
| Recruiting/Talent Ops, US | 174 | RevOps US is 12.3x this |
| SDR/BDR, US | 44,874 | 20.9x all US RevOps leads |

**44,874 - US SDR/BDRs in Refolk's index, the population actually dialing**

Against 2,145 US RevOps leads, roughly 21 callers per person answerable for the list.

Two things fall out of this. First, roughly 21 dialers sit behind each RevOps lead, so a single mis-graded list propagates across many callers before anyone answerable sees a complaint. That is the argument for gating at the list, not trusting the rep. Second, US RevOps leadership outnumbers the UK 9.1x in Refolk's index, meaning most list-clearance policy is authored under US federal-plus-state rules. UK-facing teams that inherit an American rubric are applying it to the wrong regime; this standard is written for US dialing and should be re-anchored before it crosses a border.

If you need to find the people who actually own this decision - or the reps dialing into a specific state so you know whose calls to gate first - Refolk resolves that in plain English rather than a filter stack.

I ran this search: `Sales development reps in Florida and Texas at companies running predictive dialers.` - [see the full result list](https://www.refolk.ai/s/kg3ffgrpbp).

*Returns the reps most exposed to the two states with the tightest calling windows and the standalone registration requirements.*

## The state overlays that break a federal-clean list

A list that passes every federal gate can still be illegal to dial into specific states. Roughly eleven states run their own registries, and several impose registration, bonding, and tighter windows on top of the federal floor. The state-only rules are where "DNC-clean" lists get caught.

The state DNC registry set most often cited is Colorado, Connecticut, Indiana, Louisiana, Massachusetts, Missouri, Oklahoma, Pennsylvania, Tennessee, Texas, and Wyoming. Vendor lists disagree on the exact membership - some add Florida and Mississippi and drop Connecticut and Wyoming - so verify each state you dial against its own Secretary of State or attorney general resource rather than a vendor summary.

Registration and bonding are separate, standalone requirements. States including Arizona, California, Delaware, Florida, Kentucky, Maine, New York, Ohio, Oklahoma, Pennsylvania, Texas, and Utah require telemarketers to post a bond ranging from $10,000 to $100,000. Dialing into one of these without registration is a violation on its own, independent of whether the number was on any DNC list.

| Item | Federal | Florida | Oklahoma |
|---|---|---|---|
| Window end | 9 p.m. | 8 p.m. | 8 p.m. |
| Sunday calls | allowed | banned | verify |
| Per-day cap | none | 3 per number | verify |
| Bond required | no | yes | yes |

Florida is the sharpest overlay. The Florida Telephone Solicitation Act, as amended by SB 1120, cuts solicitations off at 8 p.m. local, bans Sunday calls, limits you to three calls per number per day, mandates disclosures within the first 30 seconds, lets both the state and private citizens sue, and carries fines up to $10,000 per violation. Oklahoma also cuts off at 8 p.m.; its Sunday and per-day rules are not established in this dossier, so treat those cells as unverified and confirm them against the Oklahoma statute before dialing.

Texas tightened in September 2025: SB 140 expanded the statute to cover text, graphic, and image transmissions and removed procedural prerequisites that had limited private suits, on top of the existing seller registration with the Secretary of State plus a surety bond.

#### The three layers a phone list must clear

1. **Row data** - Line type and location signal on every number
2. **Federal floor** - 31-day scrub, consent, 8 a.m.-9 p.m. window, retention
3. **State overlay** - State DNC, registration, bonding, tighter windows

*A list is only as clear as its weakest layer, and defects at the row layer cannot be fixed with paperwork.*

## The procedure: grading a list end to end

Grade a list by running eight gates in order, from data classification through record retention, producing an artifact at each. The order matters: you classify before you scrub because line-type and location determine which rules even apply, and you grade last because the verdict is a function of every gate above it.

#### From raw list to a recorded verdict

1. **Assemble and classify the list** - Tag each number as landline versus wireless and consumer versus business, and attach a location signal such as a verified ZIP or confirmed time zone. Done means every row has a line-type field and a location field; area code alone does not count.
2. **Run the federal DNC scrub** - Scrub against the National Registry with data no older than 31 days, then scrub again immediately before the campaign launches. Done means a timestamped output file is logged alongside the file it produced.
3. **Check state DNC, registration, and bonding** - For each state you dial, scrub the state registry and confirm registration and surety-bond status before the first dial. Done means registration certificates and bonds are on file for every registration state.
4. **Suppress against the internal DNC list** - Suppress every row against your own opt-out list, applied to every number on a contact and surviving deletion, re-import, and CRM sync. Done means the internal list is fed by every channel and honored across all of them.
5. **Verify consent on wireless numbers** - For wireless numbers dialed with an autodialer or an artificial or AI voice, confirm prior express written consent is on file. Done means a channel-specific consent record is retrievable per number.
6. **Gate the calling window per record** - Configure per-record calling windows to the recipient's local time and apply the strictest applicable state rule. Done means the dialer uses per-number time-zone calculation, not the call-center time zone, and places calls only inside the local window.
7. **Configure AI-voice disclosure** - If any calls use an artificial or AI-generated voice, confirm the disclosure of that voice and an opt-out mechanism are present. Done means the disclosure script and opt-out path are configured before the first call.
8. **Grade the list and retain records** - Assign the list a verdict of cleared, hold, or scrub-again, and retain the scrub and consent records for five years. Done means the grade is recorded with its evidence and the retention clock is running.

Retention is not a filing preference. Internal DNC records must be retained five years under the May 16, 2024 amendment to 16 CFR 310.5(a)(10), which doubled the prior two-year requirement. Set the clock when you grade the list.

The internal Do Not Call list deserves its own discipline. It should be one list fed by every channel that survives contact deletion, re-import, and CRM sync, and an opt-out must apply to every number on a contact rather than only the number that opted out. A stitched-together internal DNC process across tools is where opt-outs quietly leak back in. If you have not consolidated suppression across your stack, the companion standard on syncing one suppression list across every tool covers that mechanism in full.

## How this goes wrong: failure modes and false positives

Most bad calls come from a list that "passed" a check that was measuring the wrong thing. These are the false positives that make a list look dial-ready when it is not, each with the check that catches it.

### Area-code-only time zone

The most common false positive. A list passes the 8-to-9 window check because someone read the time zone off the area code, but a 212 number can ring in California. Area code is not location, and out-of-window suits built on that gap have surged onto federal dockets. Check: require a ZIP or carrier-lookup field, and reject any row whose only location signal is NPA-NXX. This is a scrub-again defect, not a hold.

### Stale scrub inside 31 days

A list says "scrubbed this month" and is treated as safe, but numbers registered after the scrub are now protected and still on your list. Check: re-scrub immediately pre-launch; the caller stays liable for anything registered since the last file.

### Opt-out honored only on the calling number

A person opts out and the suppression is applied to the number that received the call, while their other numbers on the same contact stay live. Check: confirm suppression applies to every number on the contact and survives re-import.

### The "it's B2B" assumption on cells

A business list gets dialed with an autodialer or AI voice on the assumption that business contacts are fair game. There is no B2B carve-out for cell phones: the TCPA treats any call to a wireless number as residential regardless of business use, and a personal cell is not covered by the landline B2B exemption. Because a large share of B2B direct dials are mobile numbers, an auto-dialer hitting those cells without consent is doing exactly what the TCPA restricts. Check: a line-type field on every row, and consent proof before any autodialed cell call.

> **Watch out:** The cell exemption teams rely on does not exist
>
> Calls to a business landline are exempt from the wireless auto-dialer rules; calls to a personal cell are not, even for business. If your direct-dial list is mostly mobile, the B2B exemption you are counting on is erased.

### State registration gap

A DNC-clean list gets dialed into Florida or Texas without registration, which is a standalone violation independent of DNC status. Check: a registration certificate and bond on file per state before the first dial.

### AI voice with only oral consent for marketing

An AI-voice campaign proceeds on prior express consent when the calls are marketing. Marketing AI calls need prior express written consent, the higher standard, not merely prior express consent. The FCC confirmed on February 8, 2024 that an AI-generated voice is an artificial or pre-recorded voice under the TCPA, so these calls cannot slip the rule. Check: written-consent records for any marketing call using an artificial or AI voice, plus identification, disclosure, and opt-out.

### A compliance calendar written before mid-2025

One-to-one consent is dead, the 10-business-day revocation clock is running, and the cross-subject revoke-all rule is deferred to January 31, 2027. Any calendar written before mid-2025 has all three wrong. Check: reconcile your calendar against these three dates.

### Fee and cap figure mismatch

Vendor pages cite $82 per additional area code and a $22,626 nationwide cap; the FTC's FY2025 release states $80 and $22,038. The eCFR notes $82 for each new area code in the first six months of the annual period beginning October 1, 2025 and $41 in the second six months. Check the FTC's own release for the current fiscal year before quoting a number, because these move annually.

#### Grading a list by defect location and fixability

Horizontal axis runs from Fixable without re-sourcing to Requires re-sourcing. Vertical axis runs from Row-level defect to List or campaign defect.

| Quadrant | What it means |
| --- | --- |
| Missing config, ready soon | Hold and configure the dialer or file the bond |
| Line type or location missing | Scrub again; enrich the rows |
| Stale scrub, missing certificate | Hold; re-scrub and file paperwork |
| No consent proof on cells | Scrub again; the rows are not dialable |

*Where the defect lives decides whether you hold the list or send it back for scrubbing.*

## Why gating beats speed

The penalty asymmetry is the whole argument for this standard: one bad call is expensive, and a window gate that blocks a handful of calls is cheap by comparison. A single off-hours or DNC call risks $500 to $1,500 in private TCPA damages, which have no aggregate cap, plus up to $53,088 in TSR civil penalty. Serial litigators build cases around the 31-day rule specifically because it is the most direct point of failure.

> A per-record window gate that blocks a few calls is cheaper than one class action.

The enforcement surface is still expanding 23 years after the registry launched. Since 2003 the FTC has filed 173 enforcement actions against 570 companies and 449 individuals, collecting nearly $400 million in penalties. With 258 million registrations and 2.6 million complaints in a single fiscal year, this is not a settled regime you can treat as background noise.

## The clearance checklist

Run this before any list reaches a dialer. Every item is a checkable statement with an artifact behind it, not a topic to think about.

#### Cleared-to-dial verification

- [ ] Every row has a line-type field (landline vs wireless) and a location field (ZIP or confirmed time zone), with no area-code-only rows.
- [ ] The federal DNC scrub used data no older than 31 days and was re-run immediately before launch, with a timestamped output file logged.
- [ ] Each state dialed has been scrubbed against its state registry, and registration certificates and bonds are on file for every registration state.
- [ ] The internal DNC list is fed by every channel, applies to every number on a contact, and survives deletion, re-import, and CRM sync.
- [ ] Every wireless number dialed by autodialer or AI voice has a retrievable prior express written consent record.
- [ ] The dialer computes the window per number in the recipient's local time and applies the strictest state rule (8 p.m. for Florida and Oklahoma, Sunday ban and 3-per-day cap for Florida).
- [ ] Any AI or artificial-voice campaign has a disclosure script and opt-out mechanism configured, and marketing calls have written consent.
- [ ] The list carries a recorded verdict (cleared, hold, or scrub-again), and scrub and consent records are set to retain for five years.

## Adopt it as policy and keep it current

Copy this rubric into your list-intake process and require the grade before a list is loaded. Below is the header to attach to every list so the verdict travels with the data and the next person can audit your call in minutes.

**List clearance header**

```
List name:
Graded by / date:
Verdict: cleared | hold | scrub-again
Federal scrub file + timestamp:
Re-scrub before launch (Y/N):
States dialed + registration/bond status:
Internal DNC suppression run (Y/N):
Consent basis for wireless (written / express / none):
Window rule applied (federal 9pm | FL/OK 8pm | other):
AI voice used (Y/N) + disclosure configured (Y/N):
Retention clock start date:
```

*Attach as the first rows of every list file or as CRM fields; fill every line before the list is loaded to a dialer.*

Three moving parts require a recheck on a schedule rather than a one-time read. The DNC access fees and penalty caps adjust annually, so confirm them against the FTC's own release for the current fiscal year before you quote them - do not trust a vendor page. The revoke-all cross-subject rule is deferred to January 31, 2027, so put that date on the calendar as a policy-update trigger. And state overlays change through legislation like Texas SB 140 and Florida SB 1120, so re-verify the state list and each state's window, registration, and bonding rules against primary sources whenever you add a new state to your calling footprint. Where this dossier marks an Oklahoma cell as unverified, treat it as unverified in your own policy until you have confirmed it against the statute.

## Frequently asked questions

### How often do I have to scrub a list against the Do Not Call Registry?

At least every 31 days if you are required to use the registry, and you may download data only once in any 24-hour period. But the 31-day maximum is a grace period for callers, not a delay in the consumer's protection, so you remain liable for numbers registered after your last scrub. The safe practice is to re-scrub immediately before each campaign launch and log the timestamp and output file.

### Is there a B2B exemption for calling business cell phones?

No. The TCPA treats any call to a wireless number as if it were residential regardless of business use, and the landline B2B exemption does not carry over to cells. Auto-dialed or AI-voice marketing calls to a personal cell need prior express written consent even when the target is a business contact. Because most modern direct dials are mobile, this is where cell-heavy B2B lists most often fail.

### What are the calling hours by time zone, and do weekends count?

The federal window is 8 a.m. to 9 p.m. at the recipient's local time, under both the TSR and the FCC's TCPA rule. Neither federal rule restricts Sundays, weekends, or holidays; those exist only at state level. Florida and Oklahoma cut off at 8 p.m. local, Florida bans Sunday solicitation, and Florida caps at three calls per number per day. Gate per record to the strictest applicable rule.

### What are the penalties for calling someone I should not have?

The 2025 FTC inflation adjustment raised the maximum TSR civil penalty to $53,088 per illegal call. Separately, the TCPA private right of action allows $500 per call in statutory damages, trebled to $1,500 for knowing or willful violations, with no aggregate cap. One off-hours or DNC call can therefore expose you to both a regulatory penalty and uncapped private damages, which is why per-record gating is cheaper than speed.

### How do I determine a recipient's time zone reliably?

Use the most reliable available signal: a verified billing ZIP, a confirmed time zone of record, or a documented opt-in time zone. Do not rely on NPA-NXX area-code and exchange routing, because number portability and address moves make it unreliable. A 212 number can ring in California, and out-of-window suits built on that gap have landed on federal dockets. Reject any row that carries only an area code as its location signal.

### Do AI-generated voice calls fall under the TCPA?

Yes. On February 8, 2024 the FCC adopted a Declaratory Ruling confirming that an AI-generated voice on a robocall is an artificial or pre-recorded voice under the TCPA, so AI calls cannot evade coverage. You must obtain consent before making them, provide identification and disclosure, and offer opt-out rights. Marketing AI calls require the higher prior express written consent standard, not merely prior express consent.

---

*From the Refolk guide library. I revise these guides rather than replacing them, so the current version is always at https://www.refolk.ai/guides/dial-ready-list-standard*