Skip to main content

Regulation E

This page covers debit cards, ACH, and bank-funded P2P, where the money already left the customer's bank account. Looking for credit card disputes?

Go by what the customer paid with, not the logo, since debit cards carry Visa and Mastercard branding too. Money out of a bank account is Reg E. A credit or charge card is Reg Z, even when it funded a P2P payment.

TL;DR
  • Reg E implements the EFTA of 1978 and covers debit, ATM, ACH, and bank-funded P2P
  • Liability is tiered: $0 before an unauthorized transfer, $50 if reported within 2 business days, $500 within 60 days of the statement, unlimited after that
  • Provisional credit within 10 business days, 20 for new accounts, if the bank hasn't finished investigating
  • Investigation: 10 business days standard, extendable to 45, or 90 for POS, foreign, and new-account transactions
  • You can't participate. Reg E is a fight between the cardholder and their bank, and you find out about it as a chargeback
  • There's no merchandise protection in Reg E at all. "It arrived broken" isn't a Reg E claim

A debit dispute doesn't feel like a credit card dispute to your customer. Their money is already gone. That changes how fast they escalate and how angry they'll be when they call you. It also changes what their bank is obliged to do. Reg E sets those obligations, and learning it lets you predict the bank's next move.

What Is Regulation E?​

Regulation E (12 CFR Part 1005) implements the Electronic Fund Transfer Act of 1978. The CFPB enforces it. It sets out who owes what when an electronic fund transfer goes wrong.

What Reg E Covers​

  • Debit card transactions (signature and PIN)
  • ATM withdrawals and deposits
  • ACH transfers (direct deposit, bill pay, etc.)
  • Preauthorized recurring debits
  • P2P payments when bank-funded (Venmo, Zelle linked to bank account)
  • Payroll cards and government benefit cards

What Reg E Does NOT Cover​

  • Credit cards (governed by Reg Z)
  • Wire transfers
  • Check transactions
  • P2P payments funded by credit card (Reg Z applies)

Why Reg E Matters for Card Programs​

Reg E binds the issuer, not you. It still shapes the debit disputes that reach you:

  • The bank is on a clock, so it pushes the dispute out to you fast
  • Provisional credit means the customer already has their money back, so they've got no reason to keep negotiating with you
  • The bank has to document its investigation, which is why you get a demand for records with a short deadline
  • None of it covers merchandise, so a "product never arrived" debit dispute arrives as a network chargeback instead

Consumer Liability Tiers​

Reg Z caps credit card liability at a flat $50. Reg E doesn't. It escalates, and how far depends entirely on how fast the customer speaks up:

Reporting TimelineMaximum Consumer Liability
Before any unauthorized transfer$0
Within 2 business days of learning of loss/theft$50
After 2 business days but within 60 days of statement$500
After 60 days from statementUnlimited (for transfers after 60-day period)

Scenario Examples​

Scenario 1: Card goes missing Monday. Consumer reports Tuesday. $400 unauthorized charge happened Monday.

  • Result: $50 maximum liability (reported within 2 business days)

Scenario 2: Statement shows suspicious activity on March 1. Consumer reports May 15. Fraudster was active throughout April.

  • Result: capped at $500 for transfers inside the 60-day window, unlimited for anything after it closes on April 30
What actually happens in practice

Most banks run zero liability policies well above the Reg E floor. Visa and Mastercard zero liability rules generally extend to debit. So your customer usually pays nothing regardless of these tiers. Reg E guarantees the minimum. What the bank offers is almost always better, and the customer never sees the difference.

Error Resolution Procedures​

Consumer's Obligation​

To invoke Reg E protections, the consumer must:

  • Notify the financial institution within 60 days of the statement showing the error
  • Notification can be oral or written (unlike Reg Z, which requires written notice)
  • Provide: name, account number, description of error, and amount (if known)

Bank's Investigation Timeline​

Standard timeline:

  • 10 business days to investigate and determine error
  • Extendable to 45 calendar days if provisional credit is issued

New accounts (first 30 days):

  • 20 business days to investigate
  • Extendable to 90 calendar days with provisional credit

POS and foreign transactions:

  • Extendable to 90 calendar days with provisional credit

Provisional Credit Requirements​

The bank gets 10 business days, or 20 for new accounts. Miss that and it has to:

  1. Provisionally credit the disputed amount (including interest if applicable)
  2. Give the consumer full use of the funds during investigation
  3. Provide written notice of the provisional credit
  4. Complete investigation within 45 days (or 90 for POS/foreign/new accounts)

If No Error Found​

If the bank determines no error occurred:

  • May reverse the provisional credit
  • Must give at least 5 business days' notice before debiting the account
  • Must provide written explanation of findings
  • Must provide copies of documents relied upon if consumer requests

Preauthorized Transfers​

Consumer Rights for Recurring Debits​

Consumers have the right to stop preauthorized recurring payments:

  • Notify the bank at least 3 business days before the scheduled transfer
  • Notification can be oral or written
  • Bank may require written confirmation within 14 days of oral notice

Merchant Considerations​

  • The relevant ACH return codes are R08 (Payment Stopped) and R07 (Authorization Revoked)
  • Neither one is a dispute. It's a consumer right, there's nothing to represent, and arguing about it wastes a phone call
  • If you bill by ACH, have a card on file as a backup before you need it

Error Types Covered by Reg E​

Covered errors:

  • Unauthorized EFT
  • Incorrect EFT (wrong amount, date, or recipient)
  • Computational error
  • Omission from statement
  • Receipt not received (ATM/terminal failure)
  • Request for documentation or clarification

NOT covered:

  • Quality of goods or services disputes (no merchandise protection)
  • Authorized transfers the consumer regrets

That's the big split from Reg Z. Reg E doesn't cover merchandise disputes at all. A debit customer with a broken product lands in the network chargeback system instead. The rules there are the network's, and you get to respond.

Reg E vs. Reg Z Comparison​

AspectReg E (Debit/ACH)Reg Z (Credit)
Maximum liability$50 → $500 → unlimited$50 (most offer $0)
Reporting deadline60 days from statement60 days from statement
Notice formatOral or writtenWritten only
Investigation10 days (extendable to 45-90)2 billing cycles (max 90 days)
Provisional creditRequired if extendedNot required
Merchandise disputesNot coveredCovered
Funds during disputeAlready debitedCannot collect

Issuer Obligations​

None of this is your obligation. Read it anyway. The bank's demand for records comes straight out of this list, and knowing that tells you what to have ready.

Required Disclosures (at account opening)​

  • Summary of consumer liability limits
  • Types of EFTs available
  • Charges for EFTs
  • Right to documentation
  • Stop-payment procedures
  • Error resolution procedures
  • Telephone number and address for inquiries

Periodic Statement Requirements​

  • Amount and date of each EFT
  • Type of transfer
  • Third party name if applicable
  • Location or terminal ID
  • Fees charged
  • Opening and closing balances

Investigation Documentation​

Banks must document:

  • Report date and method
  • Error description
  • Investigation steps taken
  • Decision rationale
  • Provisional credit actions
  • Final outcome

Merchant Implications​

ACH Returns​

Reg E-related ACH return codes:

CodeMeaningMerchant Impact
R10Customer Advises UnauthorizedConsumer claims didn't authorize
R07Authorization RevokedConsumer cancelled recurring
R08Payment StoppedConsumer stopped specific payment

Watch the unauthorized rate specifically. NACHA's threshold for unauthorized returns (R05, R07, R10, R29) is 0.5%. Cross it and your ODFI is on notice. Your origination can get suspended. Track it by code, weekly, not as one blended return rate. See ACH return codes for the full set.

Debit Card Chargebacks​

Two separate systems run at once and people conflate them. Network rules decide the chargeback mechanics and your representment rights. Reg E decides what the bank owes its own customer. They don't talk to each other.

What that means for you:

  • The customer's money is already gone, so they're motivated in a way a credit customer isn't
  • Provisional credit puts it back within 10 business days, whatever you do
  • You still get representment rights under network rules. Use them
  • You can't influence the Reg E side. There's no merchant seat at that table

P2P Payments and Reg E​

When Covered​

P2P payments fall under Reg E when:

  • Funded from a bank account or debit card
  • The provider is a financial institution (Venmo, PayPal, Cash App, Zelle linked to bank)

When NOT Covered​

  • Funded by credit card (Reg Z applies)
  • Funded by stored balance (may have limited protection)
  • Recipient authorized by sender, even if scammed

The "Authorized Transaction" Problem​

This is the hardest conversation in consumer payments. If the consumer pressed send, Reg E treats the transfer as authorized. It doesn't matter that somebody lied to make them press it. Scam victims aren't covered:

ScenarioReg E Protection?
Romance scam (consumer sends money)No - Authorized by consumer
Fraudster accesses app and sendsYes - Unauthorized
Pays for goods never deliveredNo - Authorized, and no merchandise protection
Voluntary protections aren't rights

Plenty of P2P providers and networks reimburse beyond what Reg E requires. Zelle has expanded certain scam protections, for one. Those are policy choices, and a policy can be withdrawn on notice. Don't plan around them.

Payroll Cards and Government Benefit Cards​

Payroll Card Requirements​

  • Employers cannot require employees to receive wages on payroll cards
  • At least one free ATM withdrawal per pay period
  • Full Reg E error resolution applies
  • Fee disclosures required before enrollment

Government Benefit Cards​

Government benefit accounts sit under 12 CFR 1005.15. Additional requirements stack on top of the standard rules:

  • Additional fee restrictions
  • Minimum free cash access
  • Specific statement requirements

Compliance Timeline Summary​

EventDeadline
Consumer reports errorWithin 60 days of statement
Bank investigation (standard)10 business days
Bank investigation (new account)20 business days
Bank investigation (extended)45 calendar days
Bank investigation (POS/foreign/new)90 calendar days
Provisional credit (if extending)Within 10/20 business days
Notice before reversing provisional creditAt least 5 business days

Where This Breaks​

You answer the bank's letter. A cardholder's bank sometimes contacts you directly about a debit dispute. Answer it if you like. It doesn't substitute for a network representment, and it doesn't stop the clock. File the representment through your processor either way.

You assume a reversed provisional credit means you won. It doesn't. The bank reversing its own customer's credit is a Reg E outcome, not a chargeback outcome. Your chargeback runs on network rules. The cardholder's Reg E claim runs on federal ones. You can lose yours while they lose theirs, and neither result binds the other.

You keep re-presenting an ACH after R07. R07 means the customer revoked authorization at their bank. There's nothing to argue. Re-debiting is what turns a return into a NACHA problem. Stop the mandate, then go collect another way.

You treat "I didn't get it" as a Reg E case. Reg E has no merchandise protection. A debit customer's non-delivery complaint gets routed into the card networks instead. You'll see it as a normal reason code with normal evidence requirements. The compelling-evidence rules that apply are the network's, not the CFPB's.

Your descriptor doesn't match your brand. Debit customers check balances more often than credit customers do. An unrecognized line item on a checking account gets reported as unauthorized much faster. So fix the descriptor first. See descriptors and communications.

Enforcement and Penalties​

CFPB Enforcement Authority​

The CFPB is the primary enforcer for Reg E at larger institutions. State regulators and the other federal banking agencies enforce it too. A bank too small for CFPB supervision still has somebody looking.

Common Violation Types​

  • Failing to provide provisional credit when required
  • Missing investigation deadlines
  • Inadequate error resolution procedures
  • Missing or incomplete disclosures
  • Improper liability allocation

Consequences​

  • Civil money penalties
  • Consumer restitution
  • Consent orders requiring remediation
  • Reputational harm

Next Steps​

Understanding debit/ACH disputes?

  1. Review ACH return codes - Understand R10, R07, R08 patterns
  2. Learn about ACH operations - Bank payment management

Comparing payment protections?

  1. Compare with Reg Z - Credit card liability differences
  2. Read the consumer protection overview - Full regulatory landscape

Preventing unauthorized transaction disputes?

  1. Understand third-party fraud - Stolen credential patterns
  2. Learn about account takeover - Hijacked account fraud
  3. Review issuer perspective - How issuers handle fraud

See Also​

Last updated on