Most dunning compliance advice is written for lawyers and read by nobody. Meanwhile the actual decisions — how many texts you may send, what the email must say, when consent was recorded and where that record lives — get made by whoever writes the retry job. If compliance lives in a PDF nobody opens, it does not live anywhere. It has to survive as checks in the codebase and fields in the schema.

Start with consent, because everything else hangs off it. For email, the rules are comparatively forgiving: a transactional notice about a failed payment to an existing customer sits on solid ground in most jurisdictions, provided it is actually about the payment and carries working identification and opt-out mechanics where the law requires them. SMS is stricter everywhere.…