What Is Regulation E?
Regulation E is the federal rule implementing the Electronic Fund Transfer Act, and it gives consumers dispute rights and liability limits on unauthorized electronic fund transfers. It covers debit card transactions, ACH transfers, and P2P payments drawn from a bank account, and it puts the investigation on the customer's bank, not on you.
The consumer's maximum loss depends on how fast they report the transfer. It only applies to transfers the account holder never authorized, so a payment someone sent themselves and later regretted falls outside it.
Key takeaways
- Regulation E covers unauthorized debit, ACH, and P2P transfers from a consumer bank account.
- Consumer liability caps at $50 when they report within two business days.
- Banks must decide within 10 business days, or provisionally credit and take 45.
- A transfer the customer sent themselves stays authorized, even when a scammer caused it.
- The Consumer Financial Protection Bureau enforces Regulation E through federal law.
Why Regulation E matters for merchants
When a customer calls a debit or ACH payment unauthorized, Regulation E makes their bank investigate it and usually return the money first. The rule gives the bank 10 business days to decide whether an error occurred.
A bank that needs longer can take 45 days, but only if it credits the amount back inside those first 10 days.
The bank decides on its own schedule, and you have no part in it. So it can hand the money back inside two weeks on a sale that was perfectly good.
How much the customer owes comes down to how fast they call their bank:
Say a customer spots a strange $340 debit charge. They call their bank on day 12 after the statement went out.
That's past the two-day window but inside 60, so their exposure tops out at $500 and can land lower.
All three tiers assume the money left a deposit account. A credit card charge disputed the same way goes to Regulation Z and the network's fraud reason codes.
What counts as an unauthorized transfer under Regulation E
A transfer is unauthorized only when someone other than the account holder starts it without authority and the account holder gets no benefit from it. A stolen card, a hacked login, and credentials taken through phishing all meet that bar.
Most consumers never make that distinction, but the rule turns on it.
When account holders type in the amount and hit send, they authorized that transfer. A scammer talking them through it still counts as authorized, so none of the liability caps apply.
Some banks reimburse these scam victims anyway, as a customer-service call. But each bank decides that for itself, so telling the bank you were scammed forces nobody to pay you back.
That's why recovery on the money-transfer apps varies so much:
Regulation E vs. a card network chargeback
Regulation E is a federal rule that binds the customer's bank, while a chargeback is the process the card networks run on their own reason codes.
One debit transaction can set off both at once. Regulation E says what the bank owes the customer. The network's dispute process is how the bank takes that money back from you.
Both apply when someone pays by debit card. Only Regulation E applies to ACH and most P2P transfers, because no card network handles those payments.
So how the customer paid decides what you can do about it. A debit chargeback shows up in your normal dispute queue, and you can send in evidence. Look up what your assigned code requires in our reason code lookup tool.
On a pure ACH or P2P claim, the customer and their bank settle it between themselves. Nobody asks you for anything.
Keep ACH and P2P to small orders, and set the limit at a number you could lose outright.
Summary: A chargeback gives you a place to submit evidence, while a pure Regulation E dispute does not.
FAQ
Can a consumer waive their Regulation E rights?
No, the Electronic Fund Transfer Act won't let a bank ask a consumer to sign those rights away. An account agreement or an app's terms of service can't override it.
Does Regulation E apply to business bank accounts?
Generally no. Regulation E protects accounts held mainly for personal, family, or household use, so your business checking account usually falls outside it.
Who enforces Regulation E?
The Consumer Financial Protection Bureau enforces Regulation E. It took the rule over from the Federal Reserve Board in 2010.
What happens if a bank denies a Regulation E claim?
The bank must write to the customer explaining why it found no error, and it can take back any provisional credit. The customer can still escalate to the CFPB, so the claim can come back after a denial.
