Regulation E, the Federal Reserve's implementing rule for the Electronic Fund Transfer Act, requires a bank or credit union to investigate a reported unauthorized transfer within 10 business days and caps a consumer's liability at $50 in most cases, provided the loss is reported within two business days of discovery. Miss that window, and the exposure climbs fast.
The rule sets the floor for how deposit-account disputes over debit cards, ATM withdrawals, and electronic transfers get resolved, and it binds any financial institution that offers electronic fund transfer services on a consumer account.
What counts as an "error" under Regulation E?
An error is a defined term, not a catch-all. Under the error-resolution rule at 12 CFR 1005.11, it covers an unauthorized electronic fund transfer, a transfer to or from the wrong account, an amount that doesn't match what the consumer authorized, an omitted transfer, a computational or bookkeeping mistake by the institution, an incorrect amount dispensed at an ATM, and a consumer's request for a transaction receipt or documentation the institution failed to provide.
A consumer has 60 days after the institution transmits the periodic statement showing the disputed transfer to give notice. The notice must identify the consumer's name and account number and explain why the consumer believes an error occurred, including the type, date, and amount of the transfer where known. An institution may require written follow-up within 10 business days of an oral notice, but it must still begin investigating on the date of the oral report.
How much can a bank hold a consumer liable for?
Liability under 12 CFR 1005.6 scales with how fast the loss is reported, not with whether the consumer was careless.
| Reporting window | Maximum consumer liability |
|---|---|
| Within 2 business days of learning of loss or theft | Lesser of $50 or the amount of unauthorized transfers before notice |
| 2 to 60 days after the institution transmits the statement | Lesser of $500, covering the first $50 plus additional unauthorized transfers the institution can show timely notice would have stopped |
| More than 60 days after the statement is transmitted | Unlimited for transfers occurring after the 60-day window closes |
Two conditions apply across all three tiers. The institution must have provided the liability disclosures required under 1005.7(b) when the account was opened, and a state law or the account agreement can set a lower liability limit than the federal cap, but never a higher one. The rule also allows an institution to extend a consumer's notification deadline where "extenuating circumstances" — such as extended travel or hospitalization — made timely notice impracticable.
How long does a bank have to investigate a dispute?
The baseline clock is 10 business days from the date of notice. The institution must determine whether an error occurred and report its conclusion to the consumer within three business days of finishing the investigation.
If the institution needs more time, it may take up to 45 calendar days total, but only if it provisionally credits the disputed amount to the consumer's account within the original 10 business days. That provisional credit must be available for the consumer's use while the investigation continues. Once the institution determines an error did occur, it must correct it within one business day of that determination, crediting or adjusting the account accordingly.
Two categories get longer clocks. For transfers involving an account that was opened within the preceding 30 days, the initial investigation window extends to 20 business days and the outer limit to 90 calendar days. The same 90-day outer limit applies to point-of-sale debit card transactions and transfers initiated outside the United States. If the institution ultimately finds no error occurred, it may reverse a provisional credit, but it must first send the consumer a written explanation and, on request, copies of the documents it relied on, a requirement the Consumer Financial Protection Bureau also sets out in its Electronic Fund Transfers FAQs for supervised institutions.
What transactions does Regulation E cover?
The rule applies to electronic fund transfers from a consumer asset account: debit card purchases at the point of sale and online, ATM withdrawals and deposits, preauthorized ACH transfers such as recurring bill payments, direct deposits, and electronic person-to-person payments processed through a bank's own transfer service. Regulation E does not govern credit card transactions, which fall instead under the Truth in Lending Act's separate error-resolution and liability framework, or wire transfers, which are covered by state adoptions of the Uniform Commercial Code rather than the EFTA.
What must a consumer actually do to trigger these protections?
Notice starts the clock, and notice has specific content requirements. A consumer must contact the institution and identify their name and account number, and state why they believe an error occurred, including the transaction's type, date, and amount to the extent known. An institution can ask for written confirmation of an oral report, and it can require that confirmation within 10 business days, but a failure to follow up in writing does not erase the institution's obligation to investigate the oral notice it already received.
What does the notice-to-resolution process actually look like?
The rule doesn't script a single required channel, but the sequence of obligations it imposes on the institution follows a consistent order once a consumer reports a suspected error.
- The consumer contacts the institution, by phone or in writing, within 60 days of the statement showing the disputed item, giving their name, account number, and the reason they believe an error occurred.
- If the report was oral, the institution may ask for written confirmation within 10 business days, but its investigation clock starts on the date of the oral report regardless.
- The institution investigates and, within 10 business days (20 for a new account), determines whether an error occurred.
- If it needs the extended period, it provisionally credits the disputed amount within that same 10 (or 20) business days and completes the investigation within 45 calendar days, or 90 for new accounts, point-of-sale debit transactions, and transfers initiated outside the United States.
- The institution reports its conclusion within three business days of finishing, corrects any confirmed error within one business day of that finding, and, if it finds no error, sends a written explanation and, on request, the documents it relied on before reversing any provisional credit.
Nothing in the rule requires a consumer to accept an institution's first conclusion as final; a denied claim can still be pursued through the institution's own appeals process or a complaint to the consumer's federal or state regulator, though pursuing that path is a decision for the account holder, not a step this rule mandates.
Frequently asked questions
For a related regulation perspective, read CFPB's Regulation E Gives Banks a 10-to-45-Day Error Clock.
