Why One Scrub Against the National Registry Isn't Enough

A single call to the wrong number can cost up to $53,088 per federal violation and $25,000 per call at the state level. Those penalties compound fast — the FTC has collected roughly $400 million in penalties since 2003 across 173 enforcement actions. Yet checking only the National DNC Registry catches an estimated 60–75% of risk, leaving a quarter to 40% of exposure in the gap where professional plaintiffs operate. Repeat filers drive 31–41% of TCPA lawsuits, with some individuals logging 150+ cases over a decade.

• National DNC Registry — 258 million active registrations covering ~76% of the U.S. population
• 11 state DNC registries — each with its own fees, update cycles, and carve-outs
• Internal opt-out lists — absolute, non-expiring, and overriding every federal exemption
• Reassigned Numbers Database (RND) — the only path to TCPA safe harbor for recycled numbers

A litigator screen adds a fifth layer, flagging the numbers most likely to sue even when they don't appear on any registry. The National Registry alone adds roughly 4.8 million new numbers each year, and a 100,000-number list scrubbed 30 days prior can still contain 800–1,200 newly protected contacts. Federal rules cap the re-scrub interval at 31 days for the National Registry and 15 days for wireless ported numbers, but high-volume operators treat those as outer boundaries, not targets. Internal opt-outs must be honored within 10 business days and propagated across every active list before the next outreach. Worqd builds compliance into the lead-handling path from first click to booked call, so the scrub happens upstream — once — whether the next touch is an AI voice agent or a human SDR. The compliance overhead isn't the cost of the lists; it's the cost of tracking eleven separate update cycles and keeping auditable, timestamped logs that hold up when regulators ask for proof.

The Multi-List Scrubbing Stack, Explained

Most teams think "scrubbing the DNC list" means one check against one federal list. In reality, a compliant scrub is a stack of five distinct layers — and skipping any one of them is where the lawsuits live.

Layer one is the National Registry. It holds roughly 258 million active registrations — about 76% of the US population — and federal law caps your scrub interval at 31 days. The registry does carve out an Established Business Relationship exemption: you can call customers who purchased within 18 months or inquired within 3 months. But as PossibleNOW notes, the burden of proving that relationship exists falls entirely on you.

Layer two is the state stack. Eleven states (CO, FL, IN, LA, MA, MO, OK, PA, TN, TX, WY) run their own registries with separate fees ranging from $25 to $500 per cycle, and quirks that bite — Missouri penalties reach $5,000 per violation, while Texas SB 140 adds a $200 registration fee and $10,000 bond. The real cost, as one industry analysis puts it, isn't the lists themselves but tracking eleven separate update cycles and carve-outs.

Layer three is your internal opt-out list — and it outranks everything. Per compliance guidance, an internal opt-out overrides every federal exemption, never expires, and must be honored within 10 business days. Regulators also expect you to accept opt-outs by any reasonable means, not just magic words like "stop" or "unsubscribe."

Layer four is the Reassigned Numbers Database. RND queries protect you when consent was given by a previous owner of the number — most valuable for consents older than 90 days, and only if the query happens before the call. Layer five is a litigator screen, because repeat plaintiffs drive 31–41% of TCPA lawsuits and often aren't on the registry at all.

Two newer wrinkles matter just as much:

• SMS is now treated like voice. Texas SB 140 and the Illinois Rabbit v. Rohrman ruling extend DNC rules to text messages.
• AI-placed calls need the identical scrub as human-dialed calls — suppression applies to the number called, not the caller, so one upstream scrub covers both.
• Wireless ported numbers require re-scrubbing every 15 days, tighter than the 31-day federal standard.

When Worqd builds outreach and AI SDR follow-up for clients, this stack is checked before any campaign goes live — the same scrub whether a human or an AI voice agent makes the call. If you're evaluating providers, ask which of the five layers their scrub actually covers. Many stop at layer one, and that's exactly the 25–40% gap where litigation farms operate.

Scrubbing Cadence: The 31-Day Floor Is Not a Target

Waiting 31 days between scrubs might keep you technically legal — but it won't keep you safe. The registry grows by roughly 4.8 million numbers per fiscal year, and every one of those new registrations is a call you can't make.

Federal law sets clear floors. The FTC's Telemarketing Sales Rule and FCC rule 47 CFR 64.1200(c) cap the gap between National Registry scrubs at 31 days maximum. Wireless ported numbers are tighter still, requiring re-scrubbing every 15 days. But experts are blunt about treating those limits as goals rather than boundaries: 31 days is the legal floor, not a target, as Belsmart puts it.

The math shows why. A 100,000-number weekly campaign scrubbed 30 days ago can already contain 800–1,200 newly protected numbers. That's not a rounding error — it's hundreds of calls per cycle that could each carry fines up to $53,088 federally. High-volume teams should scrub weekly or check numbers in real time at the point of dial, because the moment a static list is processed, it starts going stale.

Internal opt-outs carry an even stricter clock. U.S. regulators require you to honor a consumer's request to stop contact within 10 business days — and your process must accept any reasonable means, not just "magic words" like "stop," "cancel," or "unsubscribe." A reply saying "please don't call me about this anymore" counts. So does a vague "take me off this."

When someone opts out, the suppression is absolute. Internal opt-out requests have no exemptions and never expire — they override the Established Business Relationship exemptions the federal registry allows, every time. The request also needs to propagate across all active call lists and your CRM before any future outreach, not just the campaign it arrived through.

A practical cadence looks like this:

• National Registry: weekly scrubs, well inside the 31-day maximum
• Wireless ported numbers: re-scrub every 15 days
• Internal opt-outs: honored within 10 business days, applied everywhere at once
• High-volume outbound: real-time checks at the point of dial

This is why we treat scrubbing cadence as a compliance practice to check before any campaign launches, not an afterthought. When fast follow-up is the goal — and every inquiry qualified in under 60 seconds is the standard — the scrubbing underneath has to run on autopilot, on a schedule tighter than the law requires, with timestamped logs to prove it.

If you're building outbound that depends on volume, the cadence question is worth answering before the first call goes out. Book a growth call and we'll walk through where your follow-up path stands.

ctaText: Book a Growth Call socialProofText: One partner runs the whole path from first click to booked call — no vanity metrics.

Documentation: Your Audit Trail Is Your Legal Defense

Here's an uncomfortable truth: a perfectly scrubbed list can still cost you everything if you can't prove you scrubbed it. Under the FTC's Telemarketing Sales Rule, your safe harbor defense depends entirely on documentation — and regulators can treat missing records as evidence of guilt.

The TSR safe harbor defense requires timestamped logs showing what you checked, against which registry version, and when. It also requires written procedures and evidence of staff training. If those records don't exist, the FTC may infer that they would have shown noncompliance — meaning a missing log file can itself become a separate violation.

What should your audit trail capture? At minimum, every scrub cycle should produce:

• Date and time of the scrub, plus the registry versions checked
• Which lists were screened — federal, state, internal, and RND
• Match results and the action taken on each number
• Written procedures and staff training records

Retention timelines matter here. General telemarketing records fall under 16 CFR 310.5's 24-month rule, but a 2024 FTC amendment extended DNC and consent record retention to five years. Build your storage around the longer window — archiving logs weekly or monthly to durable, separate storage keeps the evidence chain intact.

If you buy leads from third parties, documentation becomes contractual. The RND safe harbor only applies when there's valid consent, a pre-call query covering the consent date, and an incorrect "No" result — skipped or post-call queries offer no protection. That's why requiring RND-query attestation from lead sources is now standard practice among insurance and home-services buyers in 2025–2026. Make it a written condition, not a verbal assurance.

The same discipline applies to automated outreach. When our AI systems place fast follow-up calls or texts on your behalf, the suppression requirements attach to the number called, not the caller — so one upstream scrub with a clean log covers both human dialers and AI voice agents pulling from the same list.

At Worqd, we treat the audit trail the same way we treat the campaigns themselves: as part of one plan, not an afterthought. Because when a compliance question arrives, the paperwork you kept — not the scrub you ran — is what answers it.

Setting Up an Automated Scrub Workflow (and Choosing a Vendor)

Manual scrubbing works once. Compliance, though, is a moving target — a 100,000-number list scrubbed 30 days ago can already contain 800–1,200 newly protected numbers, according to industry research. That's why the teams that stay out of trouble don't scrub harder; they scrub on a schedule.

The cleanest way to automate this is inside your CRM. One documented workflow uses a "Date of DNC Screening" field: every record gets stamped when it's checked, and a CRM list automatically pushes records back through re-screening once 27 days have passed. That buffer keeps you inside the 31-day federal maximum before the list goes stale — and since wireless ported numbers require re-scrubbing every 15 days, your workflow should segment those records on a tighter cadence.

When you evaluate vendors, per-number price is the wrong starting point. Pricing for a 2,000-number scrub ranges from $20 to $400+, but the spread reflects real differences in coverage. Compare what each tier actually includes:

• Federal-only vs. federal plus state registries (11 states maintain their own lists) and litigator screening
• Whether unused credits expire on cancellation — some vendors void "scrub coins" when contracts end
• Audit trail quality: timestamped logs, registry versions checked, and per-number actions, which regulators may scrutinize if records go missing
• Support for automated delivery — APIs, SFTP routines, or native CRM integrations rather than manual uploads

The litigator layer matters more than most teams expect. Serial filers are often not on the registry at all, so a list that passes a DNC scrub can still hold the numbers most likely to sue — repeat plaintiffs drove 31–41% of TCPA lawsuits in 2024. A cheap federal-only scrub that skips this screen isn't a bargain.

One more technical note: suppression requirements apply to the number called, not the caller. If AI voice agents and human dialers pull from the same list, one upstream scrub covers both — no duplicated processes needed.

Finally, remember that compliance is one part of a working outreach system, not the whole thing. A clean list protects you; it doesn't book calls. Results come when scrubbed data, fast follow-up, and permission-aware outreach run together — the approach Worqd builds into its growth engine, where every inquiry gets qualified in under 60 seconds and outreach goes only to people who agreed to hear from you. Scrub the list, then make the seconds after interest arrives count.