Quick answer: A debt settlement CRM is compliant by design when four things are true in the data model, not in a policy document. Fees are children of settlements, so a fee cannot post before the creditor settlement it belongs to. Client funds are mirrored from a dedicated account the client controls, never held by the firm. Consent, disclosures and call records live on the client record and are retained for five years. And every change to those records is auditable by field, user and time. On Salesforce, that last part is Shield: Platform Encryption, Field Audit Trail and Event Monitoring.
The rules a debt settlement CRM has to respect
The Telemarketing Sales Rule
The FTC's Telemarketing Sales Rule (16 CFR Part 310) has governed debt relief sold by phone since 2010. Three provisions shape system design. The advance-fee ban: a firm may not collect a fee until a debt is settled, the client has agreed to the settlement terms and at least one payment has gone to the creditor. The dedicated account rule: if the firm asks the client to set aside money, it must sit in an account the client owns and controls at an insured institution, administered by an independent third party, and the client may withdraw it at any time without penalty. And disclosures: cost, timing, the effect on credit and the possibility of creditor collection must be stated before the client signs.
The amendments the FTC published in the Federal Register on April 16, 2024 changed the recordkeeping side. Records must now be kept for five years instead of 24 months, and the required set expanded to call-detail records, prerecorded message records, consent and express-written-agreement records and do-not-call records. Business-to-business calls also came under the misrepresentation prohibitions.
Who enforces it in 2026
The CFPB has retreated from supervision and most enforcement. The FTC and state attorneys general have stepped in; Goodwin's 2025 year in review on debt collection and settlement describes the FTC's increased activity, and the multistate action against Strategic Financial Solutions with seven state attorneys general continued through 2025. The practical read for a settlement firm is that the enforcer is more likely to be a state than Washington, which makes state licensing and recordkeeping the design center.
State licensing and fee rules
About a dozen states have adopted a version of the Uniform Debt-Management Services Act, with registration, bonding, trust accounting and fee caps. California regulates through its Fair Debt Settlement Practices Act and DFPI licensing. Bills moved in 2025 and 2026 in Illinois (SB1685, licensing through IDFPR and success-based fees), North Carolina (SB 491 licensing versus HB 734 prohibition), Oregon (HB 3779 registration and disclosures) and Washington (HB 1599). The CRM consequence is that disclosure text, fee rules and sometimes program eligibility vary by the client's state, and that variation has to be data, not training.
TCPA and state mini-TCPAs
The FCC's one-to-one consent rule for lead generators was vacated by the Eleventh Circuit on January 24, 2025, a day before it would have taken effect, and the FCC removed it from the Code of Federal Regulations in September 2025. Lead generators are back to the prior standard of clear and conspicuous prior express written consent. State laws in Florida, Oklahoma, Washington, Maryland and elsewhere still set calling windows and consent rules, and TCPA class actions remain the largest litigation risk for an enrollment call center. The CRM has to capture consent with its source and timestamp, enforce calling windows by state, and honor internal and national do-not-call lists in the dialer.
Mapping each rule to the data model
Fees cannot post before the settlement
Model fees as records that belong to a settlement, and the settlement as a record that belongs to an enrolled debt. The fee record cannot exist without a parent settlement that has a creditor acceptance date and at least one posted settlement payment. Validation rules enforce it; the processor integration only releases a fee draft when those conditions are met. The transaction ledger then shows the fee next to the settlement payment it earned.
Client funds mirrored, not held
The dedicated account processor (Global Holdings, RAM, CFTPay, Forth Pay) is the system of record for the bank account. The CRM provisions the account through the processor's API, schedules drafts, and reconciles on a schedule so the CRM ledger matches the processor line by line, including returns and reversals. For the national debt resolution firm in our case study, the Global Holdings integration ran hourly batch reconciliation and was the largest single piece of the build.
Consent, disclosures and call records on the client
Consent is a record with channel, source, timestamp and the text the client saw. Disclosures are records with the version delivered and when. Call records come from the contact center integration (NICE CXone in the case above) with the call-detail fields the TSR now requires. All three attach to the client, so a regulator's request for one client's file is a report, not an archaeology project. Retention policies are set to five years at minimum.
Auditable by field, user and time
Salesforce Shield adds the controls regulators ask about. Platform Encryption encrypts sensitive fields such as SSN and date of birth at rest. Field Audit Trail keeps up to ten years of field history on the objects you choose, well past the five-year TSR window. Event Monitoring records who viewed and exported what. Together they let you answer "what did this record say on this date, and who changed it" without a developer.
State variation as data
Store state rules in a configuration object: licensed states, fee caps, required disclosures, calling windows. Enrollment reads the client's state and applies the right disclosure version and fee cap; the dialer applies the right calling window. When a state changes its rule, you change a row, not a process.
What this looks like in a build
In the debt resolution platform we build on Salesforce, the client record holds SSN and date of birth in dedicated fields that Shield can encrypt. The debt calculator applies program guardrails such as a maximum settlement percentage. The transaction ledger shows every draft, fee, settlement payment and reversal with running escrow and fee balances. The credit item ledger shows each enrolled debt's negotiation and settlement status. Settlement schedules show every creditor payment, scheduled and posted. The debt settlement page walks through the six screens.
Frequently asked questions
Does the TSR apply to leads that come from the web?
Almost every debt settlement sale involves a phone conversation, which brings it under the TSR regardless of where the lead started. Design to the TSR for every client.
How long do we have to keep call records?
Five years under the 2024 amendments, up from 24 months, and the records now include call-detail records, consent records and do-not-call records.
Can a CRM alone make us compliant?
No. It can make the compliant path the default path and make the record easy to produce. Licensing, bonding, disclosures and training are still the firm's job.
Do we need Salesforce Shield?
For encryption at rest, long field history and event monitoring, Shield is the standard answer on Salesforce. Firms that already hold SSNs and bank details in the CRM should treat it as part of the platform, not an add-on.
What about HubSpot?
HubSpot works well in front of the enrollment floor for lead capture and consent, with real-time routing into Salesforce. It does not replace the settlement data model or Shield-grade audit history for the servicing and settlement side.
Sources checked October 2026: FTC Telemarketing Sales Rule amendments, Federal Register, April 16, 2024; Goodwin, Consumer Financial Services 2025 Year in Review, Debt Collection and Debt Settlement; Morrison Foerster on Insurance Marketing Coalition v. FCC (January 2025) and Goodwin on the FCC's September 2025 final rule; CFPB v. RAM Payment (2022); Illinois SB1685, North Carolina SB 491 and HB 734, Oregon HB 3779, Washington HB 1599. This post is general information about system design, not legal advice; confirm requirements for your states with counsel.
Talk to a senior consultant about a compliance review of your current CRM, or see CRM compliance and audit controls.
