Regulation E

Regulation E is the federal regulation that carries out the Electronic Fund Transfer Act, the statute enacted in November 1978 to govern electronic movements of money into and out of consumer accounts. It covers debit card purchases, ATM withdrawals, direct deposits, automatic bill payments, telephone and online transfers, and, in a separate subpart, international consumer remittances. Its own text describes what it is for: § 1005.1(b) says the part carries out the purposes of the Act, "which establishes the basic rights, liabilities, and responsibilities of consumers who use electronic fund transfer and remittance transfer services and of financial institutions or other persons that offer these services," and that "the primary objective of the act and this part is the protection of individual consumers engaging in electronic fund transfers and remittance transfers."

Two naming points are worth having straight, because both cause real confusion. First, the Act and the regulation are different instruments. The Electronic Fund Transfer Act is the statute, codified at 15 U.S.C. 1693 and following; Regulation E is the rule an agency wrote to implement it, and the rule is where the deadlines, disclosures and procedures actually live. A reader looking for what a bank must do is looking for the regulation. Second, there are two codified Regulation Es, and only the part number tells them apart. 12 CFR part 1005 is the Consumer Financial Protection Bureau's, and it is the current one: it was published at 76 FR 81023 in December 2011, it contains the remittance-transfer subpart and the prepaid-account rules, and its text has been amended as recently as December 2024. 12 CFR part 205 is the Board of Governors of the Federal Reserve System's earlier codification, it carries the identical title, it is still printed in the Code of Federal Regulations, and the text there has not been amended in over a decade. An older article or a court opinion citing "12 CFR 205.6" is citing the same rule at its former address.

Who and what the rule reaches. Regulation E defines "consumer" at § 1005.2(e) as a natural person, and "account" at § 1005.2(b)(1) as a demand deposit, savings or other consumer asset account "held directly or indirectly by a financial institution and established primarily for personal, family, or household purposes." Those two definitions do most of the work: a sole proprietor's business checking account is outside the rule even at the same bank, and so is a transfer between two companies. "Financial institution" at § 1005.2(i) is broader than "bank": it reaches any person that holds a consumer's account or that issues an access device and agrees to provide electronic fund transfer services, which is how a payment app can find itself inside the rule.

The two subparts. Subpart A is the general rule, §§ 1005.1 to 1005.20, and it is what people mean by Regulation E in ordinary conversation: disclosures, the issuance of cards and codes, consumer liability for unauthorized transfers, receipts and statements, preauthorized transfers, error resolution, ATM notices, overdraft services, prepaid accounts and gift cards. Subpart B, §§ 1005.30 to 1005.36, is a separate regime for remittance transfers, which is the rule that governs sending money abroad from a consumer account.

The error-resolution procedure, which is the part most worth knowing. Section 1005.11 is the machinery a consumer actually uses, and it is considerably more specific than "the bank will look into it."

It starts with what counts as an error. Under § 1005.11(a)(1) an error is an unauthorized electronic fund transfer; an incorrect transfer to or from the account; the omission of a transfer from a periodic statement; a computational or bookkeeping error by the institution; receiving the wrong amount of money from an electronic terminal; a transfer not identified as the documentation rules require; or a request for that documentation, or for information or clarification, including a request made simply to find out whether an error exists. Paragraph (a)(2) excludes three things that are not errors: a routine balance inquiry, a request for information for tax or recordkeeping purposes, and a request for duplicate copies of documents.

Then the clocks start, and there are two routes through them. Under § 1005.11(c)(1) the institution must investigate promptly and determine whether an error occurred within ten business days of receiving the notice, report the result to the consumer within three business days of finishing, and correct the error within one business day of deciding one occurred. If it cannot finish in ten business days, § 1005.11(c)(2) lets it take up to 45 days from receipt instead, but only on conditions. It must provisionally credit the disputed amount, with interest where applicable, within those same ten business days; it must tell the consumer of the amount and date of that credit within two business days of making it; and it must give the consumer full use of the money while the investigation runs. The price of more time is that the consumer holds the money in the meantime rather than the institution.

Three details inside that route are easy to miss and each of them matters. The institution may withhold a maximum of $50 from the provisional credit where it has a reasonable basis for believing an unauthorized transfer occurred and it has met the disclosure preconditions in § 1005.6(a). It need not provisionally credit at all if it required written confirmation of an oral notice and did not receive it within ten business days, or if the alleged error involves an account subject to Regulation T, the Federal Reserve Board's rule on securities credit by brokers and dealers. And § 1005.11(b)(2) is what allows that first condition: an institution may require written confirmation of an oral notice of error within ten business days, but only if it told the consumer of the requirement and gave the address when the oral notice was given.

The extensions, and the one that covers most card disputes. Section 1005.11(c)(3) lengthens both clocks in specific situations. Twenty business days replace ten where the disputed transfer happened within 30 days of the first deposit to a new account. Ninety days replace 45 for completing an investigation where the transfer was not initiated within a state, resulted from a point-of-sale debit card transaction, or occurred within 30 days of the first deposit. The middle limb is the one to notice, because an ordinary disputed debit card purchase falls inside it: the outer limit on that dispute is 90 days, not 45. The Official Interpretations draw the boundary of that limb precisely. Comment 11(c)(3)-1 says the extended deadlines "apply to all debit card transactions, including those for cash only, at merchants' POS terminals, and also including mail and telephone orders," and then says they "do not apply to transactions at an ATM, however, even though the ATM may be in a merchant location." So a disputed online purchase gets the longer outer limit and a disputed ATM withdrawal does not.

What happens if the institution decides there was no error. Section 1005.11(d) requires a written explanation of the findings and a statement of the consumer's right to request the documents the institution relied on, which it must then provide promptly. If it debits a provisional credit it has to notify the consumer of the date and amount, and it must honor checks, drafts and preauthorized transfers for five business days after that notification without charging an overdraft fee, to the extent it would have paid them had the credit not been taken back. Under § 1005.11(e), an institution that has fully complied has no further duty if the consumer later reasserts the same error, with one exception written into the paragraph: it does not close off an error the consumer asserts after receiving documentation or information they had requested under § 1005.11(a)(1)(vii).

What Regulation E does not do, which is where most of the disappointment comes from. It sets a ceiling on what a consumer can be charged for an unauthorized transfer, and Supplement I comment 6(b)-3 says plainly that "no agreement between the consumer and an institution may impose greater liability on the consumer for an unauthorized transfer than the limits provided in Regulation E." It says nothing about a transfer the consumer authorized, which is the shape of most modern schemes. Section 1005.3(c) then excludes several things outright, including any transfer originated by "check, draft, or similar paper instrument" and any transfer "through Fedwire or through a similar wire transfer system that is used primarily for transfers between financial institutions or between businesses." And a business account is outside the rule entirely. Those limits are the reason the same loss can be fully reversible on one rail and unrecoverable on another.

The sequence, from the consumer's side:

1. Notice. The consumer tells the institution an error occurred, orally or in writing, identifying the account and saying why they believe there is an error and, so far as possible, its type, date and amount.

2. The ten-business-day decision. The institution investigates and decides within ten business days, reports the result within three business days of finishing, and corrects any error within one business day of deciding.

3. Or the extension, paid for with a provisional credit. If it needs longer, it credits the disputed amount within those ten business days, tells the consumer within two business days of doing so, gives full use of the funds, and takes up to 45 days from the original notice to finish.

4. The longer outer limits where they apply, including 90 days in place of 45 for a point-of-sale debit card transaction.

5. The result, in writing if the answer is no, with the right to see the documents behind it, and five business days of protection for items presented against the account if a provisional credit is reversed.

A hypothetical example, with invented figures and dates; the rules are 12 CFR 1005.11(c) and (d). Nadia finds a $612 debit card purchase on her account that she did not make and telephones her bank on Monday, March 2, a business day. The bank's ten-business-day decision period runs from that notice. Before that period is out the bank tells her it has not finished, and it takes the extension route: it credits her account and, having a reasonable basis to believe an unauthorized transfer occurred and having given the § 1005.6(a) disclosures, it withholds the $50 the regulation allows. So the provisional credit is $612 minus $50, or $562, and she has full use of that money while the investigation continues. Because the disputed item was a point-of-sale debit card transaction, the outer limit for completing the investigation is 90 days from March 2 rather than 45.

If the bank concludes an error did occur, it corrects the account within one business day of that determination, which makes her whole for the full $612 and turns the provisional credit into a final one. If it concludes no error occurred, it owes her a written explanation, it must tell her the date and amount before it takes the $562 back, and for five business days after that notice it must honor checks and preauthorized transfers it would otherwise have paid, without charging her an overdraft fee for doing so.

Regulation E is a rule rather than a product, so the useful framing is what it reliably delivers and where it stops.

What it delivers

• A procedure with named deadlines rather than a discretionary review, which is the difference between a request and a right.
• Provisional credit as the price of a longer investigation, so a consumer is not funding the wait in the ordinary case.
• A written explanation and access to the underlying documents when the answer is unfavorable, which is what makes a bad decision challengeable.
• A floor that cannot be bargained away: an account agreement may promise more protection than the regulation, and may not impose more liability than it.

Where it stops

• It is built around unauthorized transfers. A payment the consumer made themselves after being deceived is generally outside its core protections, which is the single biggest gap between what the rule covers and what people lose money to.
• Paper checks are excluded by name, so a forged or altered check is governed by entirely different law.
• A transfer through Fedwire or a similar interbank or interbusiness wire system is excluded too.
• It protects consumers, so an account held for a business, however small, gets none of it.
• The deadlines bind the institution, not the network, so a dispute can be resolved under the regulation and still leave a merchant question open.