A complaint reaches a US bank through a branch call, a secure message, a social media post, a regulator referral or the CFPB's complaint portal. Each one has to be recorded, classified, investigated, answered and counted, often by a small team working from several systems. This guide covers what the CFPB and the bank regulators say about that work, where an AI employee can take on the repeatable steps, and which decisions stay with your compliance staff. It sits inside our wider guide to AI employees in banking and financial services.
How can banks automate complaint handling and still meet CFPB expectations?
How do complaints reach a bank?
Complaints arrive in two broad ways. The first is direct: letters, phone calls, branch visits, email, secure messages, chat and social media. The second is through a regulator. The CFPB says that when someone submits a complaint, it will "send your complaint directly to the company so it can review the issues in your complaint" (CFPB, How the complaint process works). If another agency is better suited, the CFPB forwards it there.
The OCC's Compliance Management Systems booklet makes the channel point explicitly. It says complaints "can come in many forms or through various channels: letters, phone calls, in person, other regulators, third-party service providers, emails, and even social media," and that bank policies should address how each type is documented and tracked (OCC Comptroller's Handbook, CC-CMS). In practice this is where the first gap appears. A portal complaint lands in one tool, a social post sits with the marketing team, and a phone complaint is a note in the contact center system. Nobody sees all three as one population.
What does the CFPB expect when a complaint is sent to your company?
Based on the CFPB's own consumer-facing pages today:
- The CFPB says "companies generally respond in 15 days." In some cases a company sends an interim update and then provides a final response within 60 days (CFPB).
- The consumer is notified when the company responds and then has 60 days to give feedback on the response (same page).
- The CFPB publishes complaints in the Consumer Complaint Database, without information that directly identifies the consumer, "after the company responds or after 15 days, whichever comes first." Published fields include date received, product, issue, company, state, ZIP code, tags and complaint ID (CFPB, Consumer Complaint Database data use).
- Companies can choose a public response from a pre-set list of options. That public response is optional (same page).
Those pages describe the process from the consumer's side, so check your own company portal instructions for the operational details that apply to your institution. What they make clear is that the clock is short, and that the first 15 days decide what the public record looks like.
What do supervisors expect from complaint management?
Complaint response is one of the parts of a compliance management system that examiners review. The CFPB's Supervision and Examination Manual, which includes the Compliance Management Review procedures, lists a "Consumer Complaint Response" component with its own examination objectives and procedures (CFPB Supervision and Examination Manual, November 2025 edition). In that module, examiners assess whether:
- processes and procedures for addressing complaints are appropriate;
- complaints, regardless of channel, are "appropriately recorded and categorized";
- complaints about the entity or its service providers are addressed and resolved promptly;
- complaints raising potential consumer harm are appropriately categorized and escalated;
- management monitors complaints to identify risks of consumer harm and takes corrective action.
The OCC booklet describes the same ingredients from the national bank side: a definition of a complaint and documentation requirements, clear responsibility and accountability, tracking of complaints and responses, analysis to find trends and "the root cause of significant trends," and reporting to the board and management. It also says the formality of the process should match the bank's size, complexity and risk profile. The FDIC's compliance management overview says institutions should handle complaints promptly, designate responsible staff, have a compliance officer aware of complaints received, and evaluate trends to identify systematic compliance problems (FDIC, Compliance Management Systems).
One note on policy context. The current Supervision and Examination Manual opens with a statement that, for 2026 examinations, the Bureau will focus supervision resources on what it describes as pressing threats to consumers, and will focus findings on pattern and practice violations with identifiable consumer harm. The complaint response procedures themselves are still in the manual. Your own state regulator and prudential regulator have their own expectations either way.
Why do root-cause analysis and UDAAP matter for complaints?
The manual's complaint procedures ask examiners to determine whether evaluations of complaints "include comprehensive root cause analysis to assess why a particular law violation or error occurred." Its example is an information system coding error that led to inaccuracies across a portfolio. Examiners also look at whether those evaluations reach the board and senior management, and whether root-cause findings change policies, procedures, training or monitoring.
The same manual describes the standards the CFPB applies for unfair, deceptive or abusive acts or practices. A practice is deceptive when it misleads or is likely to mislead a reasonable consumer in a material way, and unfair when it causes or is likely to cause substantial injury that consumers cannot reasonably avoid and that is not outweighed by benefits. A cluster of complaints about the same fee description or the same account-closure message is exactly the sort of signal a UDAAP review would start from. Counting complaints by product and issue is not enough. The count has to point at a cause that someone fixes.
What records should you keep?
The manual says intelligence from consumer contacts "should be organized, retained, and used as part of an institution's CMS." For complaints that are also Regulation E error claims, 12 CFR 1005.13(b) requires evidence of compliance to be kept for at least two years (CFPB, 12 CFR 1005.13). Set the retention period for the rest of your complaint files from the strictest rule that applies to the product, and keep the complaint, the evidence, the response and the root-cause tag together.
What does an AI employee do in a complaint queue?
The repeatable work follows the same sequence for most complaints:
- Intake from every channel.
It reads portal referrals, emails, secure messages, call notes and social posts, and opens one case per complaint in your case system. - Classification.
It tags product and issue, and flags language that suggests harm, discrimination or an unauthorized account, so those go to escalation first. - Linking to records.
It pulls the account, the transaction history, prior contacts and the fee or disclosure language involved. - Routing.
Error-resolution and billing-error issues go to the dispute workflow instead of the general complaint queue. For the Regulation E clocks, see our guide to Reg E dispute investigation automation and the glossary entry for Regulation E. Chargeback cases follow the chargeback automation guide. - Drafting.
It writes a response with the evidence cited, in the format your reviewers use. - Deadline tracking.
It tracks the 15-day response target and any 60-day final response, and raises a case before it ages. - Root-cause tagging.
It tags each closed case with a cause code, such as a disclosure, a system defect, a process gap or a vendor error, so trend reports draw from the cases themselves.
Who signs off on each complaint type?
Complaint type | What the AI employee does | Who signs off |
|---|---|---|
Fee or billing dispute (not an electronic fund transfer error) | Pulls fee history and disclosures, drafts explanation, proposes refund amount | Complaints analyst approves response; refund above policy limit goes to a manager |
Unauthorized electronic transfer or error claim | Opens the case, routes to the Reg E dispute workflow with evidence attached | Disputes lead, under the dispute workflow's own approvals |
Account closure or restriction | Retrieves the decision trail and notes, drafts a factual response | Compliance reviewer, with legal review when the reason involves a regulatory filing |
Service or process failure | Classifies, drafts apology and next steps, tags the cause | Complaints analyst |
Complaint alleging discrimination, unfair treatment or unauthorized product enrollment | Flags immediately, assembles the account history, does not draft a final answer | Compliance officer or fair lending owner |
Regulator inquiry or portal complaint with an attorney involved | Builds the file and timeline | Legal or compliance lead; regulator correspondence stays with people |
How does a Zamp AI employee run a complaint queue?
Everything starts with the agent operating procedure, or AOP. For a complaint queue, the AOP would hold your channel list, the 15-day and 60-day targets, the classification taxonomy, the sources of truth for account and transaction data, approval limits for refunds and the escalation paths. It would also record what the agent's identity may not do: it cannot send a final response without approval and it cannot contact regulators.
A case moves to Needs Attention when it falls outside the AOP's scope, such as missing account data, a refund over the limit or an unfamiliar complaint pattern. A reviewer then receives it with the context already assembled. Before any case closes, the validate step of the PEV loop checks the agent's own output, for example that the cited fee matches the ledger.
The agent's reasoning is written into the team's own case system, so a reviewer reads why a draft says what it says. That is how we run it in a biopharma procurement deployment, where reasoning is written inside SAP Ariba.
The same deployment shows what a high review rate means. In week one the agent sent 64% of requests to manual review and recommended a decision on 36%. As reviewed corrections accumulated, its decision rate rose to 85% and manual review fell to 15%. We treat a heavy review rate at launch as the safety mechanism working.
A reviewer's correction becomes an AOP change on a branch, tested against a golden set, reviewed and merged, with no engineering ticket. For data residency, Zamp offers BYOC on AWS, Azure or GCP and on-premises deployment, which regulated institutions often choose for that reason.
How should a complaints lead start?
Pick one channel and one product, such as card fee complaints from the portal. Run the AI employee beside your analysts for several weeks and compare its classification and draft against theirs. Review every disagreement and write each fix into the procedure. Widen to more channels only after the root-cause tags match what your team would assign. If you are also preparing for exam questions on automation, read what examiners ask about AI in BSA/AML programs, and for a smaller institution, the guide to AI employees for credit unions.
