# Consumer Protection
Source: https://paymentsandrisk.com/docs/compliance/consumer-protection

Last updated 21 October 2026.

TL;DR

-   Customer disputing a payment? Choose [Reg E](https://paymentsandrisk.com/docs/compliance/consumer-protection/reg-e/) for debit or ACH, [Reg Z](https://paymentsandrisk.com/docs/compliance/consumer-protection/reg-z/) for credit cards.
-   **Reg E** covers debit, ACH and EFT. Tiered liability, and a clock on error resolution
-   **Reg Z** covers credit cards. Billing disputes, $50 maximum liability, merchandise protection
-   **FCBA** sits inside Reg Z. It's where the formal billing-error procedure comes from
-   These are bank rules. You don't comply with them, you use them to predict a dispute

These rules bind banks, not you. Learn them anyway: they tell you how a dispute will go.

These Are Bank Rules, Not Your Rules

Reg E and Reg Z constrain banks and issuers, not merchants. You don't have to "comply" with them. But they set the timelines issuers follow, and they decide which of your evidence matters.

## Overview

Federal regulations protect consumers in payment transactions. Merchants don't administer them; that's the issuer's job. Knowing them still explains four things:

-   Why dispute rights exist and how they differ by payment method
-   Why issuers have specific response timelines
-   What documentation helps or hurts in disputes
-   Why credit disputes differ from debit disputes

## Key Regulations

### Regulation E (Electronic Fund Transfer Act)

**Covers:** Debit cards, ATM transactions, ACH transfers, P2P payments (when bank-funded), payroll cards

**Key provisions:**

-   **Liability tiers**: $0 → $50 → $500 → unlimited based on reporting speed
-   **Resolution timeline**: 10-45 days (90 days for certain transactions)
-   **Provisional credit**: Required if investigation extends beyond 10 days
-   **Scope**: Covers unauthorized transactions, NOT merchandise disputes

[Full Regulation E Guide →](https://paymentsandrisk.com/docs/compliance/consumer-protection/reg-e/)

### Regulation Z (Truth in Lending Act)

**Covers:** Credit cards, charge cards, HELOCs (BNPL coverage unsettled - 2024 CFPB rule was revoked in 2025)

**Key provisions:**

-   **Maximum liability**: $50 statutory (most issuers offer $0)
-   **Written notice**: Required within 60 days of statement
-   **Resolution timeline**: 30-day acknowledgment + 2 billing cycles (max 90 days)
-   **Scope**: Covers billing errors AND merchandise disputes
-   **Collection pause**: the issuer can't collect on the disputed amount while it investigates

[Full Regulation Z Guide →](https://paymentsandrisk.com/docs/compliance/consumer-protection/reg-z/)

### Fair Credit Billing Act (FCBA)

The FCBA amended TILA in 1974. Regulation Z implements it. What it covers:

-   Formal billing error procedures
-   A ban on adverse credit reporting mid-dispute
-   Acknowledgment and investigation requirements
-   The consumer's right to withhold the disputed amount

The FCBA is why credit cards have formal written dispute procedures. Network documentation rarely names it. It's under every credit dispute anyway.

## Why Merchants Should Understand

### Anticipate Dispute Outcomes

Reg Z covers merchandise disputes. Reg E doesn't. So quality and non-delivery are valid credit dispute reasons. Debit disputes stop at unauthorized transactions. "I didn't receive my order" works on credit, not debit.

### Prepare Better Evidence

Issuers have to "investigate". That tells you what to send with a representment. What they must consider shapes what you document.

### Set Customer Expectations

Give a frustrated customer a realistic timeline. Point them at the right channel. Fix it before it becomes a dispute.

### Evaluate Payment Method Risk

Credit is safer for the consumer: a fixed $50, against escalating debit liability. Some people reach for credit on big purchases for that reason. So your dispute pattern differs by payment method.

## Comparison Table

| Aspect | Reg E (Debit) | Reg Z (Credit) |
| --- | --- | --- |
| **Consumer liability max** | $50 → $500 → unlimited | $50 statutory; $0 in practice |
| **Reporting deadline** | 60 days from statement | 60 days from statement |
| **Notice format** | Oral or written | Written only |
| **Investigation period** | 10-45 days (or 90) | 2 billing cycles (max 90 days) |
| **Provisional credit** | Required if investigation extended | Not required |
| **Merchandise disputes** | Not covered | Covered (with conditions) |
| **Collection during dispute** | Consumer funds already gone | Cannot collect on disputed amount |

## Popular in This Section

-   **[Regulation E Guide](https://paymentsandrisk.com/docs/compliance/consumer-protection/reg-e/)** - Debit/ACH liability and disputes
-   **[Regulation Z Guide](https://paymentsandrisk.com/docs/compliance/consumer-protection/reg-z/)** - Credit card billing disputes

## Next Steps

**New to consumer protection regulations?**

1.  [Start with Reg E](https://paymentsandrisk.com/docs/compliance/consumer-protection/reg-e/) - Debit/ACH liability and disputes
2.  [Then review Reg Z](https://paymentsandrisk.com/docs/compliance/consumer-protection/reg-z/) - Credit card billing disputes

**Understanding dispute flows?**

1.  [Learn the chargeback lifecycle](https://paymentsandrisk.com/docs/chargebacks/lifecycle/) - Full dispute process
2.  [Understand issuer-side handling](https://paymentsandrisk.com/docs/chargebacks/issuer-side/) - How issuers process disputes

**Building your compliance program?**

1.  [Review network rules](https://paymentsandrisk.com/docs/compliance/network-rules/) - VAMP, ECM thresholds
2.  [Understand PCI DSS](https://paymentsandrisk.com/docs/compliance/pci-dss/) - Data security requirements

* * *

## Related Compliance Topics

-   [PCI DSS Compliance](https://paymentsandrisk.com/docs/compliance/pci-dss/) - Data security requirements
-   [AML Basics](https://paymentsandrisk.com/docs/compliance/aml-basics/) - Anti-money laundering
-   [Issuer-Side Chargebacks](https://paymentsandrisk.com/docs/chargebacks/issuer-side/) - How issuers handle disputes
-   [Issuer Perspective](https://paymentsandrisk.com/docs/fraud/issuer-perspective/) - How issuers think about fraud
-   [Network Rules](https://paymentsandrisk.com/docs/compliance/network-rules/) - Card network regulations
-   [Subscription Compliance](https://paymentsandrisk.com/docs/compliance/subscriptions/) - Recurring billing rules
-   [Chargeback Lifecycle](https://paymentsandrisk.com/docs/chargebacks/lifecycle/) - Full dispute flow
-   [Representment](https://paymentsandrisk.com/docs/chargebacks/representment/) - Fighting chargebacks
-   [Friendly Fraud](https://paymentsandrisk.com/docs/fraud/types/friendly-fraud/) - First-party abuse
-   [ACH Operations](https://paymentsandrisk.com/docs/operations/ach-operations/) - Bank transfer handling
-   [Cards](https://paymentsandrisk.com/docs/payments/payment-methods/cards/) - Card payment types