TCPA Established Business Relationship — The 18-Month / 3-Month Exemption, Explained

The Established Business Relationship: What Calling Your Own Customers Actually Exempts

An established business relationship (EBR) under the TCPA lets you place telephone solicitations to a number on the National Do-Not-Call Registry — if the person made a purchase or transaction with your company within the 18 months immediately preceding the call, or an inquiry or application within the previous 3 months, per 47 C.F.R. § 64.1200(f)(5). That is the entire exemption: it unlocks the national DNC rules and nothing else — not consent, not extended hours — and it dies the moment the person says stop. Here is what the EBR covers, what it does not, and where teams misread it — as of July 2026.

This page is education, not legal advice. A dialer is a tool — compliance depends on how you use it. Enzo does not scrub lists against the national or state DNC registries — run every list through a third-party scrubbing service before uploading it. Enzo provides campaign-level internal DNC (per-campaign only). Consult a TCPA attorney for your specific situation.

What Counts as an Established Business Relationship

The definition at 47 C.F.R. § 64.1200(f)(5) turns on two clocks, both measured backward from the moment you dial:

The windows run from the most recent qualifying event — a repeat purchase restarts the 18-month clock. Nothing survives a company-specific do-not-call request: one “take me off your list” ends the relationship on the spot, even from a customer who bought yesterday.

An “Existing Relationship” Is Not the Legal Test

Teams often talk about a TCPA existing-relationship exception, but the statute’s term — established business relationship — is narrower than the everyday phrase. The test is the two windows, not whether someone feels like a customer: a buyer from two years ago is outside the 18 months, and a webform lead from five months back is outside the 3. A CRM record proves nothing by itself — without a dated transaction or inquiry inside its window, treat the number as a cold record and scrub it.

What the EBR Exempts: The National DNC Rules — and Only Those

Telephone solicitations to registry-listed numbers are otherwise prohibited under 47 C.F.R. § 64.1200(c)(2), and the private right of action has teeth: under 47 U.S.C. § 227(c)(5), anyone who receives more than one violating call in a 12-month period by or for the same company can sue for $500 per call, up to $1,500 trebled for willful or knowing violations. The same section gives an affirmative defense for reasonable, documented compliance practices — one more reason your EBR windows should live in records, not memory.

Two boundaries worth knowing. Cell phones can be registered on the national DNC list and are treated as residential in most cases — the FCC presumes it, though some courts require proof that the cell is used residentially. And the EBR only excuses the numbers it covers: everyone else on your list still needs a scrub against registry data obtained no more than 31 days before any call, per the safe harbor in 47 C.F.R. § 64.1200(c)(2)(i)(D). Subscriptions, SANs, and fees are in the DNC registry guide for callers.

What an EBR Does NOT Exempt

The expensive misreadings happen here: the EBR sits inside the do-not-call rules, while the TCPA’s consent, hours, and identification rules operate independently of it:

The most common mistake is treating “they’re our customer” as consent. Consent runs on a separate track: prior express written consent — a signed written agreement authorizing telemarketing to a designated number, 47 C.F.R. § 64.1200(f)(9) — is required for telemarketing that uses an autodialer or an artificial, prerecorded, or AI-generated voice to a cell phone, EBR or not (the FCC’s unanimous February 2024 ruling put AI-cloned voices under the artificial-voice restrictions). A live, manually dialed call to a customer inside the 18-month window is fine under federal law within quiet hours; the same customer dialed with a prerecorded pitch needs a signature on file — see the express written consent guide for what that signature requires.

How an EBR Ends

An EBR ends two ways: the clock runs out, or the person makes a company-specific do-not-call request. The second triggers the internal DNC machinery of 47 C.F.R. § 64.1200(d): a written policy, trained personnel, the request recorded when made, honored within a reasonable time not to exceed 10 business days (shortened from 30 by FCC order, effective April 11, 2025), and kept on your list for 5 years. The same order lets consumers revoke prior consent in any reasonable manner, on the same 10-business-day clock. Either way, the number belongs on your master suppression list.

State Laws: Don’t Assume the Federal EBR Carries Over

Federal law is the floor. A growing list of states have their own mini-TCPA or telemarketing statutes — Florida’s Telephone Solicitation Act, Oklahoma’s Telephone Solicitation Act, Texas SB 140, Washington’s Robocall Scam Protection Act, and Maryland’s Stop the Spam Calls Act among them — each with its own consent, hours, frequency, and exemption rules. A relationship that satisfies the FCC’s 18-month / 3-month definition may not satisfy a state statute — before an EBR campaign crosses state lines, have counsel confirm each state’s current rules. The broader federal picture — damages, consent after 2025, and the five process failures that generate lawsuits — is in TCPA for cold callers.

Where Enzo Fits — and Where It Doesn’t

Enzo’s role in an EBR program is narrow. The windows live in your CRM and transaction records, not in any dialer: segment customer lists by last-purchase and last-inquiry date before upload, so an “existing customers” campaign contains only numbers whose windows are open. Enzo does not scrub lists against the national or state DNC registries — run every list through a third-party scrubbing service first. What Enzo provides is campaign-level internal DNC: mark a contact DNC and they stay excluded from that campaign, even if they reappear in another list you upload to it — but marks are per-campaign only, so keep your master suppression file outside the dialer and re-apply it to every new campaign. The dialer itself is compliant tooling; whether your calling is lawful depends on your lists, records, and behavior.

Run the EBR as arithmetic: 18 months from a purchase, 3 months from an inquiry, dead on a single stop request, and never a substitute for written consent. Keep the dates in your records and the exemption does what it was designed to do — let you call your own customers without a registry violation.

See how campaign-level DNC and list segmentation work inside a real calling workflow — book a free discovery call.

Not legal advice. This guide is general information for outbound calling teams, not legal advice. Rules change and apply differently by state, industry, and call type — confirm your program with qualified telemarketing compliance counsel.

Definitions and rules from 47 C.F.R. § 64.1200, 47 U.S.C. § 227, and FCC orders, as of July 2026 — educational only, not legal advice.