Error Resolution Under Regulation E: Examiner Insights and Common Violations
This special issue of Consumer Compliance Outlook reviews error resolution requirements and consumers’ liability for unauthorized electronic fund transfers (EFTs). This article discusses common violations Federal Reserve examiners have observed and the ways institutions can enhance their compliance management programs related to EFT errors.
NOT APPLYING LIMITS ON LIABILITY PROPERLY
When a consumer asserts an unauthorized transaction that occurred more than 60 days after the institution transmitted the periodic statement listing the disputed transaction, the institution is not required to follow the error resolution requirements of 12 C.F.R. §1005.11.1 Examiners have found that some institutions mistakenly believe this timing requirement for error notices also applies to the limits on a consumer’s liability for unauthorized transactions. However, the Official Staff Commentary for Regulation E clarifies that while a consumer has unlimited liability for transactions occurring after the 60-day period, the liability limits under §1005.6 still apply for transactions that occurred prior to the 61st day.2
As an example, consider this scenario. A consumer loses his card on January 1, 2025, and notices it is missing the same day. On January 2, 2025, $400 of unauthorized transactions are made, and on January 6, 2025, $600 of unauthorized transactions are made. The institution includes these transactions on the periodic statement it transmits to the consumer on February 5, 2025. On April 10, 2025, an unauthorized transaction for $800 is made. The consumer notifies the financial institution of the lost card on April 30, 2025 (more than 60 days after the periodic statement showing the unauthorized transactions on January 2 and 6 was transmitted). His total liability of $1,300 is calculated as follows:
- $50 for the $400 in unauthorized transfers that occurred on January 2, 2025,
- $450 of the $600 transfer that occurred on January 6, 2025, and
- $800 for the unauthorized transaction that occurred on April 10, 2025.3
The risk here is that staff fail to understand the liability rules that have been discussed for unauthorized transactions. An institution can mitigate this risk by ensuring that its EFT error resolution procedures and training include specific guidance for the added protections for consumers who allege unauthorized transactions. These added protections can be especially important when determining the effect of a late notice of error and when documenting consumers’ promptness in reporting the loss or theft of an access device (i.e., a card, code, or other means to initiate electronic fund transfers from a consumer’s account).4
NOT PROMPTLY INITIATING AN INVESTIGATION
An institution must investigate alleged errors promptly after receiving an error notice containing the information set forth in Regulation E,5 whether the notice was written or oral.6 While an institution may request a written confirmation after receiving an oral notice of error, it still must promptly begin investigating after receiving the oral notice.7 Additionally, although an institution may require that notice be provided only to the telephone number or address disclosed by the institution, if the consumer attempts to provide notice in a different manner, the institution must maintain reasonable procedures to refer the consumer to the specific telephone number or address required.8
An institution does not comply with the prompt investigation requirement if it requires, as a condition for starting the investigation, that consumers provide information not specified in the regulation. Common examples of requests that may not be used as a condition to begin the investigation, because the regulation does not require such information to be part of a consumer’s error notice, include:
- asking a consumer to visit a branch to complete an error notice,
- requesting the consumer first tries to resolve the dispute with the merchant,
- requiring the consumer to submit a notarized affidavit, or
- indicating the consumer must file a police report.9
To help manage this risk, compliance officers can review error resolution procedures for any steps that may delay an investigation and confirm they are consistent with the regulatory requirement for a prompt investigation. Additionally, compliance officers can review the procedures for receiving consumer disputes from different channels to ensure disputes are routed to the correct point of contact. This could include tellers, receptionists receiving incoming calls, and email inboxes for consumer feedback.
NOT PROVIDING PROVISIONAL CREDIT
Institutions choosing to extend an error investigation period beyond the time frame of 10 business days (or 20 days for new accounts) generally must provide provisional credit within 10 or 20 days, provided an exception does not apply.10
Examiners have seen instances in which the institution has taken more than 10 business days to investigate the error when an exception to providing provisional credit does not apply but fails to provide provisional credit or does not provide it in a timely manner. In some cases, the provisional credit covers the alleged error but fails to include interest when an interest-bearing account is involved. Provisional credit should include both the amount of the alleged error and interest, whenever applicable.11
An institution can mitigate this risk by reviewing error resolution procedures, including provisional credit requirements, to confirm they align with Regulation E and by conducting training. Compliance officers may also benefit from reviewing error resolution logs for any extended investigations in which the bank did not provide provisional credit. For extended investigations in which the bank did not provide provisional credit, the institution can confirm whether the circumstances fall within the regulation’s provisional credit exceptions, such as when the institution requires, but does not receive, written confirmation of an error.
NOT CONDUCTING A REASONABLE INVESTIGATION
A financial institution cannot deny a consumer’s claim of an error without conducting a reasonable investigation. However, a financial institution may forgo the investigation if it corrects the error as alleged by the consumer. A reasonable investigation includes reviewing relevant information within the institution’s records. A companion article in this issue on Regulation E’s resolution procedures discusses the reasonable investigation requirement in greater detail.
When the alleged error is an unauthorized EFT, the Electronic Fund Transfer Act (EFTA) places the burden of proof on the financial institution to establish that the transaction was authorized. Therefore, if the institution cannot establish that the disputed EFT transaction was authorized, the institution must credit the consumer’s account.12
To mitigate this risk, compliance departments can conduct transaction testing on previously denied error notices. For each previously denied allegation within the selected sample, the institution can confirm that employees reviewed all relevant information within the institution’s records and that the findings of the investigation met the institution’s burden of proof to establish that an error did not occur. If the transaction testing revealed the investigation was not adhering to regulatory requirements, the staff handling the investigations can receive additional training on this issue.
NOT COMPLYING WITH REQUIREMEMENTS FOR DENYING CLAIMS
A financial institution is required to follow specific regulatory requirements if it determines an error has not occurred or has occurred in a manner or amount different from what the consumer described. Within three business days after completing its investigation, the institution must report its results to the consumer. This explanation of findings must be in writing and disclose the consumer’s right to request the documents used to make the denial. Upon a consumer’s request, an institution must provide the documents.13 Regulators have seen institutions fail to meet these requirements.
The institution must follow one of two options to debit a previously provided provisional credit. Both options require the financial institution to honor checks and preauthorized transfers from the consumer’s account (without a charge to the consumer for overdrafts that would have been paid had the provisional credit not been debited) for five business days. Under the option in §1005.11(d)(1)(i), the institution debits the amount first and then provides the consumer notice, which includes a statement that certain items will be honored for five business days after the notification. Under the second option described in Comment 11(d)(1)(ii)-1, the institution provides the notice first, specifies the calendar date on which debiting will occur, and then debits the amount five business days later. This option may be simpler for the institution but also gives the consumer more freedom with the provisional credit during the five days prior to the debit.
Regulators have seen issues when an institution’s notice to consumers does not align with its actual practice for debiting provisional credit. This can happen because template language is not accurate, or employees are not knowledgeable about bank processes. For example, if the provisional credit is debited immediately upon notice, an institution must notify the consumer that third-party payments and preauthorized transfers will be honored for five days. But if an institution uses the alternative option from the Official Staff Commentary to Regulation E, the provisional credit cannot be debited until five business days after the notice is provided.
To mitigate these risks, compliance officers can review bank procedures, interview appropriate staff, and review template letters. Procedures and staff practices need to comply with Regulation E and be consistent with the template letters that employees send to consumers. In cases in which misalignment among written procedures, employee practices, and templates exists, consider retraining employees to ensure they follow the bank’s practices correctly.
NOT COMPLYING WITH REQUIREMENTS FOR CORRECTING ERRORS
If, after completing an investigation, an institution determines an error occurred, it must correct the error within one business day and report the results to the consumer within three business days, subject to the liability provisions of §§1005.6(a) and (b). This correction should include, as applicable, a credit for interest and a refund of fees charged by the institution. While reviewing practices for correcting alleged errors, regulators have found institutions failing to provide timely corrections of errors and notices to consumers. Examiners have also observed some institutions failing to include lost interest and fees caused by the error (e.g., an error resulted in an overdraft fee) in monetary adjustments provided to consumers.
An institution’s compliance officers can mitigate timing and consumer notification issues by properly documenting requirements and training employees. However, in some cases, determining the full amount of an error may be complicated. For instance, employees may need to examine the account and look at transactions that occurred around the same time as the error or to postdate the credit so the account can accrue the interest. Depending on how the bank’s systems and accounts are configured, reducing risk may involve more detailed discussions with employees who have a comprehensive understanding of the bank’s deposit account systems.
NOT COMPLYING WITH REQUIREMENTS AFTER INVESTIGATION IS FINAL
Once a financial institution has fully complied with the error resolution requirements in §1005.11, a consumer may not reassert the same error. But this finality can also present a challenge to institutions because once a financial institution provides notice that a provisional credit has been made final,14 the financial institution generally cannot reopen the investigation or reverse the credit. For example, if an institution provisionally credits a consumer’s account while investigating an error, determines an error occurred, and notifies a consumer that the provisional credit is final, but later learns the merchant refunded the consumer or that the transaction was authorized, the institution cannot reverse the credit.
An exception applies for foreign remittance transfers where the consumer alleges the same error to multiple parties. For example, suppose a consumer reports to a remittance transfer provider that it committed an error of $100 in executing a remittance transfer. The provider refunds the $100 after investigating and determining an error occurred. If the consumer subsequently alleges the same error with the institution holding the account, and that institution refunds the $100 after investigating but later learns of the prior refund from the remittance transfer provider for the same error, the institution holding the account may reverse the amount it previously credited to the consumer’s account.15
Steps to help mitigate this risk include educating the appropriate staff about the consumer protections under Regulation E for errors. Depending on a bank’s culture, training covering Regulation E can benefit employees handling deposit operations as much as it benefits compliance staff. Having employees in different areas of the organization attend training together can help ensure that all understand when the bank’s discretion ends and its legal obligations begin.
CONCLUSION
This article reviewed violations examiners have observed of Regulation E’s error resolution requirements and discussed sound practices to facilitate compliance. Specific issues and questions should be raised with your primary regulator.
ENDNOTES
1 See 12 C.F.R. §1005.11(b)(1). Alternative time limits may apply to government benefit cards and prepaid accounts. See §1005.15(e)(3)–(4) (benefit cards) and §1005.18(e) (prepaid cards).
2 See Comment 11(b)(1)-7.
3 See 12 C.F.R. §1005.6(b)(2): “If the consumer fails to notify the financial institution within two business days after learning of the loss or theft of the access device, the consumer’s liability shall not exceed the lesser of $500 or the sum of … $50 or the amount of unauthorized transfers that occur within the two business days, whichever is less.”
4 12 C.F.R. §1005.2(a)(1).
5 See 12 C.F.R. §1005.11(b)(1).
6 See 12 C.F.R. §1005.11(c)(1).
7 See Comment 11(c)-2.
8 See Comment 11(b)(1)-6.
9 See Comments 11(b)(1)-2 and 11(c)-2.
10 An exception applies under §1005.11(b)(2) if the institution requires written confirmation of an error within 10 days of an oral notice but does not receive it. In that case, the institution may extend the investigation period without providing provisional credit. Comment 11(b)(2)-1. The regulation requires that the consumer be notified of the written confirmation requirement when the oral notice of an error is made and the institution must provide the address to send the confirmation.
11 See Comment 11(c)-6.
12 See EFTA Section 909(b) (codified at 15 U.S.C. §1693.g(b). See also 83 FR 6364, 6382 (February 13, 2018): “Under EFTA section 909(b), the burden of proof is on the financial institution to show that an alleged error was in fact an authorized transaction; if the financial institution cannot establish proof of valid authorization, the financial institution must credit the consumer’s account.” (Emphasis added.)
13 12 C.F.R. §1005.11(d); Comment 11(d)-1.
14 See 12 C.F.R. §1005.11(c)(2)(iv).
15 See Comment 33(f)-3.