Top Federal Reserve System Violations in 2024: Regulation E Error Resolution Requirements
Consumer Compliance Outlook (CCO) regularly publishes articles that leverage Federal Reserve supervisory data. These articles are designed to enhance the transparency of the Federal Reserve’s consumer compliance supervisory activities and provide practical steps that institutions may consider when addressing certain consumer compliance risks.
The 2024 supervisory data show that violations of the Electronic Fund Transfer Act (EFTA), as implemented by Regulation E, were among the top-cited consumer compliance violations in examinations and the source of numerous complaints against state member banks during that year.1 This article discusses Regulation E violations, examiner observations, and sound practices to mitigate associated compliance risks. Our format is to list the regulation’s requirements, discuss the violation of the requirement that examiners cited, and then review sound practices and risk mitigants.
EFTA — REGULATION E
The EFTA and Regulation E provide the legal framework for the rights, liabilities, and responsibilities of participants in electronic fund transfers (EFT) involving a consumer’s checking, savings, or certain other asset accounts held by a financial institution.2
REGULATORY REQUIREMENTS
Time Frames for Investigating Errors: 12 C.F.R. §1005.11(c)
If a consumer notifies a financial institution that an error occurred with an EFT, §1005.11(c) requires the institution to investigate the error within certain time frames, notify the consumer of its findings, and correct the error, if applicable.
Ten Business Days: A financial institution shall promptly investigate and determine whether an error occurred within 10 business days of receiving a notice of error.3 The bank is not required to provide provisional credit.
Forty-Five Days: If the institution is unable to complete its investigation within 10 business days from the receipt of a notice of error to investigate and determine if an error occurred, it may take up to 45 days provided it does the following:4
- provisionally credits the consumer’s account for the amount of the alleged error within 10 business days of receiving the error notice;5 and
- informs the consumer within two business days after provisional crediting and provides full use of the funds during the investigation.6
Note: An institution is not required to provisionally credit a consumer’s account to extend the time period for an investigation to 45 days if, among other things, the institution requires but does not receive written confirmation within 10 business days of an oral notice of error.7 However, an institution may not delay investigating an oral notice of error pending the receipt of written confirmation from the consumer.8
Permissible Extensions: The 10-business day time frame outlined above is extended to 20 business days if the notice of error involves an EFT to or from the account within 30 days after the first deposit to the account was made.9
Further, the 45-day time frame described above increases to 90 days if a notice of error involves an EFT that was not initiated within a state, was the result of a point-of-sale debit card transaction, or occurred within 30 days after the first deposit to the account was made.10
Regardless of the length or level of the investigation, the financial institution shall correct the error within one business day after determining that an error occurred and report the results to the consumer within three business days after completing its investigation.11 Notifications to the consumer required by §1005.11(c) may be made orally or in writing, unless the regulation specifies otherwise.12
Promptly Investigating. Examiners found that some financial institutions were not promptly initiating error resolution investigations after the consumer notified them orally of an error, in violation of §1005.11(c). These errors typically occurred because staff lacked expertise, were not provided adequate Regulation E training, or had unclear policies and procedures. One common misconception is that an institution’s duty to investigate an alleged error is triggered only when the consumer submits a written notice. But Comment 11(c)-2 of the Official Staff Commentary for Regulation E specifically clarifies that “a financial institution must begin its investigation promptly upon receipt of an oral notice. It may not delay until it has received a written confirmation (emphasis added).” Moreover, if consumers discover unauthorized transactions in their bank account, they are more likely to call the bank because of the urgency of mitigating the risk of additional unauthorized transactions. Reminding staff of this requirement during Regulation E training can help prevent violations.
Notifying Consumers of Investigation Results: Examiners observed that some financial institutions were not properly notifying consumers that errors had been corrected and that the consumer’s account had been credited. If a financial institution determines an error occurred as the consumer alleged, it must provide oral or written notice within three business days after completing the investigation.13 If an institution determines that no error or a different error occurred, it must provide written notice within three business days.14 These violations were caused by a lack of understanding of the Regulation E notice requirements. Further, in some cases, gaps in internal reviews and audit coverage caused these violations to go undetected.
Providing Provisional Credit: Examiners cited institutions for violating §1005.11(c)(2)(i), which requires an institution to provide provisional credit for the amount of the alleged error within 10 business days of receiving an error notice if the institution could not complete its investigation within 10 business days. An exception to the provisional credit requirement applies if the institution requests written confirmation of an error that was orally reported but does not receive it within 10 business days.15 That exception did not apply for the banks that were cited.
Examiners also cited institutions that provisionally credited accounts but failed to provide consumers with full access to and use of the funds during the investigation. These errors occurred because the institutions, and the third-party vendors responsible for providing provisional credit on the institution’s behalf, lacked effective procedures and controls to ensure compliance with Regulation E. To address this risk, the compliance department could meet with the vendor to review Regulation E’s requirements to ensure that when the system provides provisional credit, the consumer has access to the funds.
Providing Notice of Provisional Credit: Examination reports indicated that some financial institutions provided the notice of provisional credit outside of regulatory time frames and without the information Regulation E requires. These violations occurred because financial institutions failed to adequately oversee the third parties responsible for fulfilling critical error resolution functions. For example, in some cases, examiners found that provisional credit notices were sent outside of the regulatory time frames because the institution’s vendor delayed generating and delivering these notices. In other cases, violations occurred because the institution relied on template notices generated by third-party software that did not include required information and/or information necessary for the institution to monitor compliance. For example, while some institutions permissibly notified customers orally, they failed to appropriately document the date on which the notifications were made. As a result, they were unable to monitor and establish that notices were delivered in a timely manner.
Correcting Errors: Examiners cited institutions for failing to correct errors within one business day of completing the investigation and notifying the consumer that the investigation was complete. These violations typically occurred because banks failed to provide adequate resources and training for the error resolution process.
REGULATORY REQUIREMENTS
Procedures if a financial institution determines no error or different error occurred: 12 C.F.R. §1005.11(d)
If an institution concludes that no error occurred or the error was different from what the consumer described, it must follow the procedures in 12 C.F.R. §1005.11(c), as well as these requirements:
“(1) Written explanation. The institution’s report of the results of its investigation shall include a written explanation of the institution’s findings and shall note the consumer’s right to request the documents that the institution relied on in making its determination. Upon request, the institution shall promptly provide copies of the documents.
(2) Debiting provisional credit. Upon debiting a provisionally credited amount, the financial institution shall:
- Notify the consumer of the date and amount of the debiting;
- Notify the consumer that the institution will honor checks, drafts, or similar instruments payable to third parties and preauthorized transfers from the consumer’s account (without charge to the consumer as a result of an overdraft) for five business days after the notification. The institution shall honor items as specified in the notice, but need honor only items that it would have paid if the provisionally credited funds had not been debited.”
Examiner Observations
Providing Written Explanation of Findings: Examiners cited institutions for failing to provide sufficient written explanation of the results of an investigation, failing to provide a notice to the consumer of the right to request the documents that the institution relied on in making its determination, and failing to provide copies of the documents that it relied on in making its error determination when the consumer requested the documents.
In some cases, the institution failed to provide an adequate explanation, using generic language, such as “no error.” These violations were the result of insufficient templates generated by the institution’s dispute tracking system. Other violations occurred because the financial institution’s third party failed to provide copies of the documents relied on in making its error determination. Further, ineffective controls and procedures at the financial institution and the third party caused these violations to occur and go undetected.
Providing Notice When Provisional Credit Is Reversed: Examination reports revealed that some financial institutions failed to notify consumers when the institutions reversed provisional credit. These violations were caused by failing to provide adequate staff training, weaknesses in procedures, and gaps in internal controls. Additionally, some violations were caused by reliance on an inadequate notice generated by the institution’s third-party provider.
Root Causes
Examiners determined that violations of §1005.11(d) were largely attributable to weaknesses in third-party risk management practices, including oversight of the functions provided by the third parties, the use of third-party templates as well as weaknesses or gaps in Regulation E staff training, policy and procedure documents, and internal controls.
SOUND PRACTICES TO MITIGATE REGULATION E RISKS
Overseeing Third-Party Activities: When a financial institution engages third parties to fulfill error resolution obligations, the financial institution should provide appropriate oversight of the activities the third parties are conducting on the institution’s behalf. Additionally, when third-party software is used to generate required notices, institutions should ensure that templates for those notices are accurate and include the necessary information to monitor and evidence compliance.
Maintaining Detailed Procedures: Adopting sufficiently detailed error resolution procedures can help ensure staff comply with regulatory requirements. Procedures may include, but are not limited to, instructions for gathering sufficient and accurate information upon notice of an error by a consumer, what constitutes a thorough investigation, how consumer engagement should occur, and how to document the process throughout. To the extent that error resolution processes are outsourced to third parties, financial institutions should ensure that the third parties maintain procedures reasonably designed to comply with error resolution provisions.
Conducting Regular Training: Training helps to proactively prevent or minimize violations. The requirements of §1005.11 are technical and nuanced. Periodic training can help to reinforce compliance staff’s understanding of the requirements and clarify any ambiguities. Effective training should not only include information about the Regulation E requirements, but also provide clear guidance on the institution’s internal procedures and processes for resolving errors.
Conducting Secondary Reviews: A second review by experienced Regulation E staff of errors alleged by consumers can help mitigate the risk that a violation occurred during the initial investigation and resolution of the error. Suppose, for example, a consumer notifies the bank of unauthorized transactions after his debit card is lost, mentioning that his PIN was written on the card. A bank employee fielding the notification who erroneously believes the consumer’s actions eliminate the bank’s obligation to reimburse the consumer would violate Regulation E’s requirement that a consumer’s negligence does not affect his liability for unauthorized transactions.16 A secondary review could flag this violation.
Monitoring Regulation E Compliance: Management can regularly monitor the effectiveness of its controls, including Regulation E processes and procedures. To do this, management may consider conducting periodic reviews of notices of error, and completed investigations, to ensure that staff are adhering to established procedures and deadlines. Reviewing data points can also help identify violations; for example, the institution may benefit from periodic reviews of a sample of error investigations to ensure it complied with the regulation. Maintaining appropriately detailed monitoring mechanisms and tracking reports helps to ensure errors are resolved in a timely manner, accounts are properly credited or debited, and consumers are provided with necessary notifications, regardless of whether the error resolution activities are performed in-house or by a third party.
Enhancing Consumer Complaint Review: To help ensure compliance, institutions can regularly review complaint activity to identify and address Regulation E errors that may not have been identified through monitoring reviews or audits.
CONCLUSION
This article discussed common Regulation E violations Federal Reserve examiners cited in 2024 and sound risk practices institutions can consider to help mitigate compliance risk. Specific issues and questions related to Regulation E should be raised with your primary regulator.
Resources
- Scott Sonbuchner, “Error Resolution Under Regulation E: Examiner Insights and Common Violations,” CCO (Third Issue 2025)
- Kenneth Benton, “Error Resolution Procedures Under the Electronic Fund Transfer Act and Regulation E,” CCO (Third Issue 2025)
- Kate Loftus, “Top Federal Reserve System Violations in 2022: Regulation E Error Resolution Requirements and Regulation X Escrow Account Requirements,” CCO (Fourth Issue 2023)
- Scott Sonbuchner, “Error Resolution and Liability Limitations Under Regulations E and Z: Regulatory Requirements, Common Violations, and Sound Practices,” CCO (Second Issue 2021)
- Kathleen Benson, “Enhancing Your Compliance Training Program,” CCO (First Issue 2019)
- Kenneth Benton and Robert Sheerr, “Error Resolution Procedures and Consumer Liability Limits for Unauthorized Electronic Fund Transfers,” CCO (Fourth Quarter 2012)
- Cathryn Judd and Mark Jennings, “Vendor Risk Management — Compliance Considerations,” CCO (Fourth Quarter 2012)
ENDNOTES
1 “2024 Aggregate Supervisory Data for Institutions the Federal Reserve Supervises,” CCO (First Issue 2025). The 2022 and 2023 aggregate supervisory data revealed similar numbers. See “Introducing Our New Format,” CCO (First Issue 2023) and “Recent Supervisory Data for Institutions the Federal Reserve Supervises,” CCO (First Issue 2024).
2 12 C.F.R. §1005.2(b)(1).
3 12 C.F.R. §1005.11(c)(1).
4 12 C.F.R. §1005.11(c)(2).
5 12 C.F.R. §1005.11(c)(2)(i).
6 12 C.F.R. §1005.11(c)(2)(ii).
7 12 C.F.R. §1005.11(c)(2)(i)(A).
8 12 C.F.R. §1005.11(c), Comment 11(c)-2.
9 12 C.F.R. §1005.11(c)(3)(i).
10 12 C.F.R. §1005.11(c)(3)(ii).
11 12 C.F.R. §1005.11(c)(1), (c)(2)(iii), and (c)(2)(iv).
12 12 C.F.R. §1005.11(c), Comment 11(c)-1.
13 12 C.F.R. §1005.11(c)(1) for 10-day investigations, §1005.11(c)(2)(iv) for 45-day investigations.
14 12 C.F.R. §1005.11(d) and (d)(1).
15 12 C.F.R. §1005.11(c)(2)(i)(A).
16 12 C.F.R. §1005.6(b), Comment 6(b)-2: “Negligence by the consumer cannot be used as the basis for imposing greater liability than is permissible under Regulation E. Thus, consumer behavior that may constitute negligence under state law, such as writing the PIN on a debit card or on a piece of paper kept with the card, does not affect the consumer’s liability for unauthorized transfers.”