Skip to main content

Regulation E

Prerequisites

Before diving into Reg E, understand:

TL;DR
  • Reg E implements EFTA (1978), governs debit/ATM/ACH/P2P (bank-funded)
  • Liability tiered: $0 before unauthorized, $50 within 2 days, $500 within 60 days, unlimited after
  • Provisional credit within 10 business days (20 for new accounts)
  • Investigation: 10 days standard, extendable to 45 (or 90 for certain transactions) with provisional credit
  • Merchants can't directly dispute. The issuer controls the process.

What Is Regulation E?​

Regulation E (12 CFR Part 1005) implements the Electronic Fund Transfer Act (EFTA) of 1978. It's enforced by the Consumer Financial Protection Bureau (CFPB) and establishes rights, liabilities, and responsibilities for electronic fund transfers.

What Reg E Covers​

  • Debit card transactions (signature and PIN)
  • ATM withdrawals and deposits
  • ACH transfers (direct deposit, bill pay, etc.)
  • Preauthorized recurring debits
  • P2P payments when bank-funded (Venmo, Zelle linked to bank account)
  • Payroll cards and government benefit cards

What Reg E Does NOT Cover​

  • Credit cards (governed by Reg Z)
  • Wire transfers
  • Check transactions
  • P2P payments funded by credit card (Reg Z applies)

Why Reg E Matters for Card Programs​

Reg E creates binding obligations for issuers that affect:

  • How disputes are handled
  • When provisional credit must be issued
  • How liability is allocated
  • What documentation is required

Understanding Reg E helps merchants anticipate why debit card disputes differ fundamentally from credit card disputes.

Consumer Liability Tiers​

Unlike Reg Z's flat $50 maximum, Reg E liability escalates based on how quickly the consumer reports:

Reporting TimelineMaximum Consumer Liability
Before any unauthorized transfer$0
Within 2 business days of learning of loss/theft$50
After 2 business days but within 60 days of statement$500
After 60 days from statementUnlimited (for transfers after 60-day period)

Scenario Examples​

Scenario 1: Card goes missing Monday. Consumer reports Tuesday. $400 unauthorized charge happened Monday.

  • Result: $50 maximum liability (reported within 2 business days)

Scenario 2: Statement shows suspicious activity on March 1. Consumer reports May 15. Fraudster was active throughout April.

  • Result: $500 for charges in first 60 days, unlimited for charges after May 1
Bank Practices

Most banks offer zero liability policies that exceed Reg E minimums. Visa and Mastercard zero liability rules typically apply to debit cards as well. However, Reg E is the regulatory floor. Consumers are always entitled to at least these protections.

Error Resolution Procedures​

Consumer's Obligation​

To invoke Reg E protections, the consumer must:

  • Notify the financial institution within 60 days of the statement showing the error
  • Notification can be oral or written (unlike Reg Z, which requires written notice)
  • Provide: name, account number, description of error, and amount (if known)

Bank's Investigation Timeline​

Standard timeline:

  • 10 business days to investigate and determine error
  • Extendable to 45 calendar days if provisional credit is issued

New accounts (first 30 days):

  • 20 business days to investigate
  • Extendable to 90 calendar days with provisional credit

POS and foreign transactions:

  • Extendable to 90 calendar days with provisional credit

Provisional Credit Requirements​

If the bank cannot complete its investigation within 10 business days (20 for new accounts), it must:

  1. Provisionally credit the disputed amount (including interest if applicable)
  2. Give the consumer full use of the funds during investigation
  3. Provide written notice of the provisional credit
  4. Complete investigation within 45 days (or 90 for POS/foreign/new accounts)

If No Error Found​

If the bank determines no error occurred:

  • May reverse the provisional credit
  • Must give at least 5 business days' notice before debiting the account
  • Must provide written explanation of findings
  • Must provide copies of documents relied upon if consumer requests

Preauthorized Transfers​

Consumer Rights for Recurring Debits​

Consumers have the right to stop preauthorized recurring payments:

  • Notify the bank at least 3 business days before the scheduled transfer
  • Notification can be oral or written
  • Bank may require written confirmation within 14 days of oral notice

Merchant Considerations​

  • ACH return codes related to stop payments: R08 (Payment Stopped), R07 (Authorization Revoked)
  • This is a consumer right under Reg E, not a dispute
  • Have alternative collection methods available if ACH is revoked

Error Types Covered by Reg E​

Covered errors:

  • Unauthorized EFT
  • Incorrect EFT (wrong amount, date, or recipient)
  • Computational error
  • Omission from statement
  • Receipt not received (ATM/terminal failure)
  • Request for documentation or clarification

NOT covered:

  • Quality of goods or services disputes (no merchandise protection)
  • Authorized transfers the consumer regrets

This is the fundamental difference from Reg Z. Reg E does not provide protection for merchandise disputes.

Reg E vs. Reg Z Comparison​

AspectReg E (Debit/ACH)Reg Z (Credit)
Maximum liability$50 → $500 → unlimited$50 (most offer $0)
Reporting deadline60 days from statement60 days from statement
Notice formatOral or writtenWritten only
Investigation10 days (extendable to 45-90)2 billing cycles (max 90 days)
Provisional creditRequired if extendedNot required
Merchandise disputesNot coveredCovered
Funds during disputeAlready debitedCannot collect

Issuer Obligations​

Required Disclosures (at account opening)​

  • Summary of consumer liability limits
  • Types of EFTs available
  • Charges for EFTs
  • Right to documentation
  • Stop-payment procedures
  • Error resolution procedures
  • Telephone number and address for inquiries

Periodic Statement Requirements​

  • Amount and date of each EFT
  • Type of transfer
  • Third party name if applicable
  • Location or terminal ID
  • Fees charged
  • Opening and closing balances

Investigation Documentation​

Banks must document:

  • Report date and method
  • Error description
  • Investigation steps taken
  • Decision rationale
  • Provisional credit actions
  • Final outcome

Merchant Implications​

ACH Returns​

Reg E-related ACH return codes:

CodeMeaningMerchant Impact
R10Customer Advises UnauthorizedConsumer claims didn't authorize
R07Authorization RevokedConsumer cancelled recurring
R08Payment StoppedConsumer stopped specific payment

High return rates can trigger NACHA enforcement. Monitor return rates by code.

Debit Card Chargebacks​

Network rules (Visa, Mastercard) govern chargeback mechanics, while Reg E informs the consumer's ability to dispute with their bank.

Key differences from credit:

  • Consumer funds are already gone (debited)
  • Provisional credit restores funds during investigation
  • Merchant has representment rights through network rules
  • Consumer Reg E rights are handled separately by the issuer

P2P Payments and Reg E​

When Covered​

P2P payments fall under Reg E when:

  • Funded from a bank account or debit card
  • The provider is a financial institution (Venmo, PayPal, Cash App, Zelle linked to bank)

When NOT Covered​

  • Funded by credit card (Reg Z applies)
  • Funded by stored balance (may have limited protection)
  • Recipient authorized by sender, even if scammed

The "Authorized Transaction" Problem​

If the consumer authorized the transfer, even under false pretenses, Reg E's unauthorized protection doesn't apply:

ScenarioReg E Protection?
Romance scam (consumer sends money)No - Authorized by consumer
Fraudster accesses app and sendsYes - Unauthorized
Pays for goods never deliveredNo - Authorized, and no merchandise protection
Network and App Provider Policies

Many P2P providers and networks offer voluntary protections beyond Reg E requirements. Zelle, for example, has expanded certain protections. But these are policy choices, not regulatory requirements.

Payroll Cards and Government Benefit Cards​

Payroll Card Requirements​

  • Employers cannot require employees to receive wages on payroll cards
  • At least one free ATM withdrawal per pay period
  • Full Reg E error resolution applies
  • Fee disclosures required before enrollment

Government Benefit Cards (Subpart B)​

Enhanced requirements including:

  • Additional fee restrictions
  • Minimum free cash access
  • Specific statement requirements

Compliance Timeline Summary​

EventDeadline
Consumer reports errorWithin 60 days of statement
Bank investigation (standard)10 business days
Bank investigation (new account)20 business days
Bank investigation (extended)45 calendar days
Bank investigation (POS/foreign/new)90 calendar days
Provisional credit (if extending)Within 10/20 business days
Notice before reversing provisional creditAt least 5 business days

Enforcement and Penalties​

CFPB Enforcement Authority​

The CFPB has primary enforcement authority for Reg E violations at larger institutions. State regulators and other federal banking agencies also have enforcement roles.

Common Violation Types​

  • Failing to provide provisional credit when required
  • Missing investigation deadlines
  • Inadequate error resolution procedures
  • Missing or incomplete disclosures
  • Improper liability allocation

Consequences​

  • Civil money penalties
  • Consumer restitution
  • Consent orders requiring remediation
  • Reputational harm

See Also​