Jim McCarthy is a former founding member of the CFPB and expert on the CFPB complaint process

According to a source inside the CFPB, the bureau's Office of Consumer Response is set to release its new portal supported by Salesforce. See an Analysis of the new portal here.

Since inception, the Bureau has used a General Dynamics Right Now system to power the back end of the complaint process. If the source is correct, Salesforce takes over officially the second week of March.


Expect the biggest changes to be consumer-facing with improvements to the complaint intake functions. Expect improved data quality through the introduction of smart "complaint intake" forms, which help consumers better capture product and issue. Companies will be assisted by receiving better, more applicable information, as well as new Company Portal functionality.

The Office of Consumer Response typically begins talking about possible portal changes 30 days ahead of the release, then provides full detail after the public announcement date. The Office of Consumer Response has leaked the release date of March 13th for the precise cut over to SalesForce. With technical and political factors, I believe it is possible to see changes to this date. However, based on the massive nature of the project, and the time it has taken to get off the ground, I struggle to believe there will be a delay.

As a company, what do I need to do?

Here is what I suggest:

  1. Take note of all the changes which increase exposure to risk. Map out a plan to mitigate the additional risk by first clearly understanding the changes. Expect the Bureau to do thorough training, however I am available for any questions you may have.
  2. Be prepared for response box changes. No longer do you have a separate "Response" and "Explanation of Closure" text boxes. Also, more data now fits into a text box (was previously 4000 characters). How will this impact your operation? Is there training needed? Note that the bureau runs text analytics on the responses placed into text boxes. An FYI as to why this change may have been made: If the Bureau has not been critical of your responses in the past, it’s possible that is because they could not see them with their text analytics tools (this assumes you uploaded rather than used the text box). Data extract is more dynamic.
  3. Consider who has access and how you will want this used by your company? This is a web-based system. It can be accessed by anyone with system credentials from any web access point. Controls -- such as onboarding and off-boarding -- are highly recommended. You will now be responsible for managing all user credentials

Complaints are a central component of the bureau's work and have been mentioned in nearly every enforcement action taken. Does your company know how to look at complaint data the way the bureau looks at complaint data? I am available for consulting if your company needs a review of your complaint process.

Next Article: Stellar Recovery Completes PCI DSS 3.2 Validation