FIN-01 Financial Regulation & Digital Assets How Money Moves Federal
Regulation E Error Resolution for Digital Wallets and Payment Applications
Regulation E turns a consumer complaint into a regulated clock. This brief sets out when the clock starts, which investigation window applies, when provisional credit becomes mandatory, and what must be sent in writing.
Briefing in 60 seconds
- A consumer has 60 days from the periodic statement showing the problem to assert an error; late notice generally ends the institution's resolution duty.
- The default investigation window is 10 business days, extendable to 45 calendar days only if provisional credit is given and the consumer notified.
- New accounts, point-of-sale debit transactions, and foreign-initiated transfers use longer windows — 20 business days and 90 calendar days.
- A finding of no error requires a written explanation and notice that the consumer may request the documents the institution relied on.
Controlling variables
- Timing
- When the consumer's notice arrives relative to the periodic statement. The 60-day assertion window and the 10-business-day investigation window run from different events.
- Facts
- Whether the transfer was initiated by someone other than the consumer without authority, or by the consumer after being deceived. The two are treated differently.
- Status
- Whether the account is newly opened, and whether the transfer was point of sale or foreign-initiated, each of which extends the investigation windows.
- Documents
- Whether the institution required written confirmation of an oral notice and disclosed that requirement, which affects the provisional credit obligation.
- Jurisdiction
- Federal Regulation E sets a floor. State law may give consumers more protection, and more protective state provisions are not displaced.
General legal information about United States law. Not legal advice, not representation, and no attorney–client relationship is created by reading it. Rules differ by jurisdiction and change — verify against the official sources listed below.
When a consumer says an electronic transfer was wrong, Regulation E stops treating the exchange as customer service and starts treating it as a regulated proceeding. Deadlines attach immediately, and several of them run in business days while others run in calendar days.
The rule at 12 CFR 1005.11 governs. It defines what counts as an error, when the consumer must speak up, how long the institution has to investigate, when money must move into the account before the investigation ends, and what has to be put in writing when the institution concludes nothing went wrong.
What counts as an error
The definition is broader than fraud. It reaches an unauthorized electronic fund transfer, an incorrect transfer to or from the consumer's account, an omission of a transfer from a periodic statement, a computational or bookkeeping error by the institution, the consumer's receipt of an incorrect amount of money from an ATM or terminal, and a transfer the consumer cannot identify from the required documentation. A consumer's request for additional information or clarification in order to determine whether an error occurred is itself treated as an error notice.
What the definition does not cover matters just as much. A routine request for duplicate documentation for tax or recordkeeping purposes is not an error notice. Neither is dissatisfaction with a merchant, a delivery, or the quality of goods — a dispute about what was purchased is not a dispute about whether the transfer was correctly made.
The hardest line sits inside "unauthorized." A transfer initiated by a person other than the consumer, without actual authority, and from which the consumer receives no benefit, is unauthorized. A transfer the consumer personally initiated after being deceived by a third party generally falls outside that definition. The treatment of induced-payment scams has been actively contested, and agency interpretations in this area have shifted more than once.
Verify before relying: the boundary between credential theft and consumer-induced transfers is the single most litigated question in this rule. Check the CFPB's current Regulation E guidance and FAQs before writing it into a dispute policy.
When the clock starts
The consumer's assertion must reach the institution no later than 60 days after the institution sends the periodic statement, or provides passbook documentation, on which the problematic transfer first appears. Notice may be oral or written. The institution may require written confirmation of an oral notice within ten business days, but only if it told the consumer about that requirement and gave an address when the oral notice was received.
The institution's own investigation clock starts when it receives the notice, not when a case is assigned or a form is completed. Intake friction — routing a chat message to the wrong queue, or asking a consumer to resubmit through a different channel — does not pause the deadline. For payment applications, a message through in-app support that describes a specific problematic transfer is notice.
Which investigation window applies
Two variables set the timeline: whether the institution is willing to extend its investigation, and whether the transfer falls into one of three defined categories that get longer windows.
| Situation | Determine within | Extended window | Condition for the extension |
|---|---|---|---|
| Standard transfer on an established account | 10 business days | 45 calendar days | Provisional credit given and consumer notified |
| Transfer within 30 days of the first deposit to a new account | 20 business days | 90 calendar days | Provisional credit given and consumer notified |
| Point-of-sale debit card transaction | 20 business days | 90 calendar days | Provisional credit given and consumer notified |
| Transfer initiated outside the United States | 20 business days | 90 calendar days | Provisional credit given and consumer notified |
| Oral notice where written confirmation was properly required | Same as above | Same as above | Provisional credit not required if the written confirmation is not received within ten business days |
The extension is not automatic and it is not free. An institution that wants more than the short window must credit the disputed amount, notify the consumer of the credit, and give full use of the funds while it continues investigating. Choosing to extend without providing provisional credit is not an option the rule offers.
The operational sequence
- Log the notice
Record the exact date and channel the notice arrived, the transfers identified, and what the consumer said was wrong. Every later deadline is measured from this entry.
- Classify the account and transfer
New account, point-of-sale, or foreign-initiated? This single determination sets whether the short window is 10 or 20 business days and whether the long window is 45 or 90 calendar days.
- Decide within the short window
Complete the investigation, or commit to the extension. There is no third path that keeps the file open without crediting the account.
- Provisional credit, if extending
Credit the disputed amount within the short window and notify the consumer of the amount and the date of the credit, generally within two business days of crediting.
- Correct promptly on a finding of error
Where an error occurred, correct it — including crediting any interest and refunding related fees — within one business day of the determination.
- Report the result
Report the findings to the consumer within three business days of completing the investigation, in the manner the rule requires for the outcome reached.
- Written explanation on a no-error finding
Send a written explanation of the findings and tell the consumer they may request the documents the institution relied on. Then supply those documents promptly on request.
- Unwind provisional credit carefully
If credit was given and no error is found, notify the consumer of the date and amount of the debit and honor, for a defined period afterward, items that would have cleared had the funds remained.
Liability allocation is a separate question governed by 12 CFR 1005.6, and it turns on how quickly the consumer reported a lost or stolen access device rather than on the investigation timeline. Reporting within two business days of learning of the loss caps liability at a low statutory figure; delay past that point raises the cap, and transfers appearing on a statement that go unreported for more than 60 days can fall outside the protection entirely.
Digital wallets and payment applications
Regulation E follows the account, not the brand of the interface. A transfer initiated through a payment application that debits a consumer's bank account is an electronic fund transfer from that account. Stored-value balances held in many consumer payment applications are covered as prepaid accounts, which brought a large part of the peer-to-peer market squarely inside the error-resolution rules.
The practical consequence for platforms is that error resolution has to be an engineered process, not a support-team habit. Three failures recur: notices arriving through channels that are not wired into the dispute system, timers measured in calendar days when the rule requires business days, and outcome messages that state a conclusion without the written explanation and document-request language a no-error finding requires. Platform-side network duties around ACH authorization and returns sit alongside this rule and are covered in ACH authorization, returns, and account-freezing risk.
Dispute files also hold sensitive customer data. The security program that must protect them, and the notification duties that attach when it fails, are set out in GLBA privacy notices and the Safeguards Rule. Where a dispute is one symptom of a broader identity compromise, the consumer-side recovery sequence is in identity theft recovery.
Questions the desk gets
Does the 60-day window ever extend?
The rule allows a reasonable extension where a delay was caused by extenuating circumstances, such as extended travel or hospitalization. That is a narrow accommodation, not a general grace period, and it depends on the specific reason for the delay. Institutions should document the circumstance rather than applying a blanket policy in either direction. Separately, an institution may always investigate a late-reported item voluntarily; doing so is a business decision, not a regulatory obligation.
Can provisional credit be avoided by finishing quickly?
Yes — that is the design. Provisional credit is the price of taking longer than the short investigation window. An institution that completes its investigation within ten business days on a standard transfer, or twenty on a covered category, never reaches the provisional credit requirement. Institutions that consistently miss the short window are, in effect, choosing to fund disputes during investigation.
What if the consumer gave someone their credentials?
Where a consumer furnishes an access device or credentials to another person who is granted authority to make transfers, resulting transfers are generally not unauthorized until the consumer notifies the institution that the person is no longer authorized. Facts drive this, and the analysis differs sharply from a case where credentials were stolen through phishing. Document what the consumer actually reports, in the consumer's own words, at intake.
Does a no-error finding have to be in writing?
Yes. When an institution determines that no error occurred, or that an error occurred in a manner or amount different from what the consumer described, it must send a written explanation of its findings and note the consumer's right to request the documents relied on. A phone call closing the file is not compliance, and this is one of the most commonly cited operational gaps in the rule.
Where the risk actually sits
Not in hard cases. In timers. Most Regulation E exposure comes from ordinary disputes handled a few days late, closed with the wrong notice, or never routed into the dispute system at all. Build the process so that any inbound message identifying a specific transfer as wrong creates a dated record, the account and transfer type are classified on day one, and the short-window deadline sits in front of a named owner.
Then audit the notice templates against the rule text rather than against last year's templates. Read the current version of 12 CFR 1005.11 and the CFPB's own Regulation E page alongside the letters you actually send. Related payments and licensing material sits on the Financial Regulation & Digital Assets desk, including how product structure drives licensing exposure in state lending licenses and bank-partner models.
Sources
Atlas Research Desk
ATLAS briefs are researched and edited by the Research Desk, an editorial organization — not attorneys acting for you. Method and limits: editorial method · source standards · corrections.