Take them separately, because they fail in different ways.
Licensing. Most states license the act of soliciting, negotiating, or offering property on behalf of another person for compensation. If you're the principal buying for your own account, a VA setting appointments for you sits in a different place than a VA negotiating price for a third party, and where exactly that line falls depends on the statute in the state where the property and the homeowner are. That's an attorney question in that specific state, and the answer genuinely differs from one to the next.
Calling rules are separate from licensing and apply no matter where the caller physically sits. Do-not-call obligations, consent requirements for automated dialing, and whether you can record a call without telling the other party all vary, and several states require every party on the call to consent to recording. Confirm the current rules for the states you're calling into with counsel rather than with a script vendor.
Insurance. Errors and omissions covers professional services and normally responds to claims about advice or representation. General liability won't help you with a data problem. If a VA has your CRM login and client contact records, ask your carrier in writing whether contractors outside the country are covered persons and whether you have any cyber or data coverage at all. Many policies are silent or exclude it, and silence isn't coverage.
The thing that bites people here is credentials rather than scripts. Shared logins, wire instructions sent from an assistant's email, and no record of who accessed what. Individual accounts per person and no payment instructions ever leaving a VA's hands cost nothing to set up.
