What Is Regulation E and What Does It Cover?
Regulation E is the federal rule that implements the Electronic Fund Transfer Act (EFTA), codified at 12 CFR Part 1005. It governs electronic fund transfers (EFTs) — transactions that move money electronically into or out of a consumer’s bank account. Covered transactions include:
- Debit card purchases and returns
- ATM withdrawals
- Online bill payments
- Preauthorized recurring transfers (such as gym memberships or subscription services)
When one of these transactions appears on an account without the consumer’s authorization, Regulation E establishes the consumer’s rights, the bank’s obligations, and the specific deadlines that determine each party’s exposure.
How Liability Is Calculated: The Two Key Deadlines
Consumer liability under Regulation E is not fixed — it slides based on how fast the consumer acts. Two separate timelines govern two separate situations.
Lost or Stolen Access Device (Your Debit Card or PIN)
Under 12 CFR 1005.6, if the consumer notifies the financial institution within two business days after learning of the loss or theft of an access device, the consumer’s liability shall not exceed the lesser of $50 or the amount of unauthorized transfers that occur before notice.
If that two-business-day window is missed, 12 CFR 1005.6 provides that liability shall not exceed the lesser of $500 or the sum of the first-tier amount plus transfers occurring after the two-day window that the institution establishes would not have occurred had it been notified in time.
Unauthorized Transfer on a Periodic Statement
Even when no device is lost or stolen — for example, when a thief uses account credentials online — a separate deadline applies. Under 12 CFR 1005.6, a consumer must report an unauthorized electronic fund transfer that appears on a periodic statement within 60 days of the financial institution’s transmittal of the statement to avoid liability for subsequent transfers.
Missing the 60-day statement deadline does not automatically create unlimited liability; it removes the protection against later unauthorized transfers that the bank can show would not have occurred with timely notice.
Liability Caps at a Glance
| Situation | Deadline | Maximum Consumer Liability |
|---|---|---|
| Report lost/stolen access device | Within 2 business days of learning of loss/theft | $50 |
| Report lost/stolen access device | After 2 business days but within 60 days of statement | $500 |
| Report unauthorized statement transfer | Within 60 days of statement transmittal | Protected for later transfers |
| Fail to report within 60-day statement window | After 60 days of statement transmittal | Liability for later transfers may be unlimited |
Sources: eCFR 12 CFR 1005.6
What the Bank Is Required to Do After You Report
Once a consumer submits a notice of error, Regulation E imposes a strict sequence of deadlines on the financial institution.
The Investigation Timeline
The CFPB explains that once a consumer notifies the bank of an unauthorized transaction, it generally has ten business days to investigate, must correct an error within one business day after determining an error occurred, and then has three business days to report its findings.
If ten business days is not enough time, under 12 CFR 1005.11, the institution may take up to 45 days to investigate — but only if it provisionally credits the consumer’s account in the amount of the alleged error within 10 business days of receiving the notice of error. That provisional credit gives consumers access to the disputed funds while the investigation continues.
Extended Deadlines for New Accounts and Certain Transfers
12 CFR 1005.11 extends the 10-business-day investigation period to 20 business days when the error involves a transfer within 30 days after the first deposit to a new account, and extends the 45-day period to 90 days for certain transfers (such as point-of-sale transactions and transfers initiated outside the United States).
Bank Investigation Deadlines at a Glance
| Bank Obligation | Standard Deadline | Extended Deadline |
|---|---|---|
| Complete investigation | 10 business days | Up to 45 days (with provisional credit) |
| Provisionally credit account (if extension needed) | Within 10 business days of notice | — |
| Correct error once confirmed | 1 business day | — |
| Report findings to consumer | 3 business days after completing investigation | — |
| Investigation for new-account transfers | 20 business days | Up to 90 days (with provisional credit) |
Sources: eCFR 12 CFR 1005.11; CFPB Ask CFPB — unauthorized transaction
Step-by-Step: How to Dispute an Unauthorized Electronic Transfer
The following is a description of the process a consumer can follow under Regulation E. These are procedural steps, not legal directives.
-
Act immediately. As soon as an unauthorized charge or missing funds are noticed, the two-business-day clock for the $50 cap begins running from the moment the consumer learns of the loss or theft — not necessarily when the transfer posts.
-
Contact the financial institution directly. Most banks have a dedicated fraud or dispute line. Verbal notice is legally sufficient to trigger Regulation E protections, but written follow-up creates a documentary record.
-
Request written confirmation of the dispute. Note the date, time, and name of any representative. Ask the bank to confirm the dispute in writing.
-
Review account statements promptly. Because the 60-day statement deadline runs from the date the statement is transmitted — not the date the consumer opens it — regular statement review is the clearest way to preserve rights.
-
Track the bank’s response deadlines. Under 12 CFR 1005.11, the bank must complete its investigation within 10 business days (or 45 with a provisional credit) and report findings within 3 business days of completion.
-
Follow up in writing if the bank does not respond. If the bank denies the dispute or does not respond within the regulatory deadlines, consumers can file a complaint with the Consumer Financial Protection Bureau (CFPB) or, for national banks, the Office of the Comptroller of the Currency (OCC).
-
Document everything. Keep copies of all correspondence, screenshots of the unauthorized transactions, and any written responses from the bank.
Filing a Complaint If the Bank Does Not Comply
Regulation E is enforced by federal agencies including the CFPB. Consumers who believe a bank has violated Regulation E — for example, by failing to investigate within the required time, refusing a provisional credit, or not reporting its findings — can submit a complaint directly to the CFPB at consumerfinance.gov/complaint. The CFPB says companies provide an initial response to a complaint within 15 calendar days.
Consumers can also consult the BEST-AI-LAWYER resource to understand how to start a claim process against a bank for failure to honor federal consumer-protection obligations.
Frequently Asked Questions
Does Regulation E cover credit card unauthorized charges?
No. Regulation E covers electronic fund transfers tied to deposit accounts, such as debit card transactions and ACH transfers. Unauthorized credit card charges are governed by a separate federal law, the Fair Credit Billing Act (FCBA), which establishes a different dispute process and timeline.
What counts as “learning of” a loss or theft for the two-business-day deadline?
The two-business-day clock under 12 CFR 1005.6 starts running when the consumer becomes aware that the access device (such as a debit card) is lost or stolen — not when the first unauthorized charge posts. If a consumer notices the card missing on a Monday, the two-business-day reporting window generally runs from that Monday.
Can a bank deny a Regulation E dispute and keep my money?
A bank may lawfully deny a dispute if its investigation determines that no error occurred. Under 12 CFR 1005.11, the bank must report its findings within three business days of completing the investigation. If a provisional credit was issued and the bank concludes no error occurred, the bank may reverse the provisional credit — but must give the consumer written notice and five business days to withdraw funds equal to the provisional credit before reversing it.
What if the bank doesn’t finish the investigation in 10 business days?
Under 12 CFR 1005.11, if the institution cannot complete its investigation within 10 business days, it may take up to 45 days only if it provisionally credits the consumer’s account in the amount of the alleged error within 10 business days of receiving the notice of error. If the bank takes the extension but fails to issue the provisional credit, it is in violation of Regulation E.
Does the 60-day statement deadline apply even if I never opened the statement?
Yes. Under 12 CFR 1005.6, the 60-day period runs from the financial institution’s transmittal of the statement — when it was sent or made available — not from when the consumer opens or reads it. This is why timely statement review is important for preserving Regulation E protections.
What is a “new account” under the extended investigation deadlines?
12 CFR 1005.11 extends the standard 10-business-day investigation period to 20 business days and the 45-day period to 90 days for errors involving transfers within 30 days after the first deposit to a new account. The regulation treats new accounts as a separate category because account history is limited and fraud patterns may be harder to evaluate quickly.
Last verified: July 3, 2026. This content is informational only and does not constitute legal advice. BEST-AI-LAWYER is not a law firm.
Frequently asked questions
Does Regulation E cover credit card unauthorized charges?
No. Regulation E covers electronic fund transfers tied to deposit accounts, such as debit card transactions and ACH transfers. Unauthorized credit card charges are governed by the Fair Credit Billing Act (FCBA), a separate federal law with a different dispute process.
What counts as 'learning of' a loss or theft for the two-business-day deadline?
The two-business-day clock under 12 CFR 1005.6 starts when the consumer becomes aware the access device is lost or stolen — not when the first unauthorized charge posts to the account.
Can a bank deny a Regulation E dispute and keep my money?
A bank may lawfully deny a dispute if its investigation finds no error occurred. Under 12 CFR 1005.11, it must report findings within three business days of completing the investigation. If a provisional credit was issued and no error is found, the bank may reverse the credit but must give five business days' written notice first.
What if the bank doesn't finish the investigation in 10 business days?
Under 12 CFR 1005.11, the bank may extend the investigation to 45 days only if it provisionally credits the disputed amount to the consumer's account within 10 business days of receiving the notice of error. Failing to issue the provisional credit while taking the extension is a Regulation E violation.
Does the 60-day statement deadline apply even if I never opened the statement?
Yes. Under 12 CFR 1005.6, the 60-day period runs from the financial institution's transmittal of the statement — when it was sent or made available — not from when the consumer reads it.
What is a 'new account' under the extended investigation deadlines?
Under 12 CFR 1005.11, a new account triggers extended deadlines for errors involving transfers within 30 days after the first deposit. The standard 10-business-day investigation period extends to 20 business days, and the 45-day period extends to 90 days.