Finance teams plan to put more money into automating accounts receivable this year.
In Versapay’s 2026 survey of 400 finance leaders, 82% said they plan to increase their investment in automation, and 69% reported an increase in late customer payments over the previous 12 months. Ninety-one percent expect automation to cut days sales outstanding by four days or more, and 78% said unexpected receivables issues force strategic adjustments.
When those late payments turn into an account that stops paying, the creditor sends the file to a collection agency, along with invoices, contracts and customer contact information.
Where Federal Rules Apply
Collection agencies sit inside federal financial-privacy law. The Federal Trade Commission’s Safeguards Rule guidance lists collection agencies among the non-bank financial institutions the rule covers, alongside mortgage brokers, payday lenders and tax preparers.
Since May 2024, covered institutions have had to report certain security breaches to the FTC. The requirement applies when an unauthorized person obtains unencrypted information on at least 500 consumers, and the institution must notify the FTC as soon as possible and no later than 30 days after discovering the breach. Information counts as unencrypted for that purpose if an unauthorized person obtained the encryption key.
The rule also sets out what a covered institution’s security program must contain. It requires a designated qualified individual to run the program, a written assessment of foreseeable internal and external risks, regular review of access controls, encryption of customer information on internal systems and in transit, and multifactor authentication for every person who accesses that information.
The rule covers information about consumers. Commercial collection files center on businesses, but they can include personal details about individuals, such as a personal guarantee signed by an owner, the owner’s contact information or payment records tied to a person.
What a Breach at an Agency Reaches
In 2024, a Pennsylvania debt collection agency disclosed that an intrusion into its network had exposed data on more than 4.2 million people in the United States, including names, Social Security numbers, dates of birth, driver’s license numbers and account information. The company handled consumer credit, healthcare, commercial, auto loan, student loan and utility accounts.
The agency’s clients had placed those accounts, so the exposed records belonged to their customers. A creditor can lose control of its customers’ data through a breach at its collection agency even when its own systems stay secure.
How Files Move
Creditors that used to email spreadsheets with invoices and contracts attached can now place accounts through a portal or a connection to their billing system. The Safeguards Rule’s requirements for encryption in transit and multifactor authentication cover that channel along with the agency’s internal systems.
Southwest Recovery Services, a commercial collection agency headquartered in Addison, Texas, with 12 offices across seven states, applies these controls in its client portal. Every sign-in requires a one-time code, access is limited by role, and logins lock after repeated failed attempts, with a two-step password reset. Documents move through an authenticated channel encrypted in transit, with unique file names and a limit of 20 MB per file, and a U.S.-based security operations center monitors the portal around the clock. The firm’s controls are aligned with the Gramm-Leach-Bliley Act Safeguards Rule and the HIPAA Security Rule.
“Our clients trust us with their most sensitive information, and that trust starts with how that information moves,” said Steven Dietz, CEO and founder of Southwest Recovery Services.
Creditors place new accounts or update existing ones through structured templates in the portal, and every action on an account is time-stamped. Compliance and transparency are among the standards the firm lists for vetting a commercial collection agency.
The documents in a placed file also come into play if an account moves toward a lawsuit. For balances that stay unpaid, the firm has published the conditions a commercial debt has to clear before legal escalation, including documentation that supports the claim and a debtor able to pay a judgment.
The Last Handoff
Receivables automation shortens the time between an invoice and a payment, and it can shorten the time between a missed payment and a placement.
As more of that path runs through integrations, the transfer of a delinquent account becomes a transfer of customer data to an outside financial institution, subject to the same federal security requirements that govern the agency’s systems.
For finance teams adding to their automation budgets this year, that makes an agency’s security controls part of the placement decision, along with its recovery record and fees. A creditor comparing agencies now has reason to weigh how each one encrypts files, limits access and reports a breach.