Regulation E implements the Electronic Fund Transfer Act for covered U.S. consumer transfers, disclosures, errors, unauthorized transactions, and remittances.
Regulation E is the Consumer Financial Protection Bureau rule at 12 CFR Part 1005 that implements the Electronic Fund Transfer Act. It governs covered electronic fund transfers involving consumer accounts, including disclosures, error resolution, unauthorized-transfer liability, preauthorized transfers, prepaid accounts, and remittance transfers.
$50, $500, and possible post-60-day liability tiers are conditional, not an automatic allocation of every disputed transfer.Regulation E generally applies to an electronic fund transfer that authorizes a financial institution to debit or credit a consumer’s account. Common examples include:
The rule contains exclusions and specialized provisions. Check transactions, some wire or securities transfers, business accounts, prepaid accounts, government-benefit accounts, gift cards, and remittance transfers can follow different parts of the rule or different legal frameworks. Identifying the account and transaction type is the first step.
An error can include an unauthorized EFT, an incorrect EFT, an omitted EFT, certain bookkeeping errors, or a request for required information or clarification. Merely asking whether a transfer posted does not necessarily assert an error.
The standard section 1005.11 process can be summarized as follows:
| Step | General rule | Important qualification |
|---|---|---|
| Consumer notice | No later than 60 days after the institution sends the statement first showing the error | Notice should identify the account and explain the type, date, and amount as far as possible |
| Initial investigation | Institution generally determines whether an error occurred within 10 business days | It must begin promptly after oral notice and cannot wait for written confirmation to start |
| Extended investigation | Up to 45 days if required provisional credit and notices are provided | Longer periods can apply to certain new-account, point-of-sale debit, or foreign-initiated cases |
| Written confirmation | Institution may request confirmation within 10 business days after oral notice | Failure to provide requested confirmation can affect provisional credit, not the duty to begin investigating |
| Results | Institution reports results and corrects a confirmed error under the rule | Documentation can be requested in accordance with the rule |
This table is an orientation, not a deadline calculator. Prepaid, remittance, service-provider, and other provisions can modify the process.
Regulation E uses multiple liability tiers. Which tier applies depends on facts such as whether an accepted access device was lost or stolen, when the consumer learned of the loss, when the unauthorized transfer appeared on a statement, and when notice reached the institution.
For a lost or stolen access device, reporting within two business days after learning of the loss generally limits liability to the lesser of $50 or the unauthorized transfers before notice. A later report can permit liability up to $500 under specified conditions. If an unauthorized transfer appears on a periodic statement and is not reported within 60 days after the statement is sent, the consumer may face liability for later transfers occurring after that 60-day period and before notice if the institution proves the required connection.
For an unauthorized transfer made without an access device, the first two liability tiers generally do not apply. A timely report after the statement can therefore produce a different result from a lost-card case. Consumer negligence alone cannot increase liability beyond Regulation E’s permitted limits.
Assume a consumer discovers on Tuesday that a debit card was lost on Monday. An unauthorized USD 180 debit-card purchase occurred before the consumer notified the institution on Tuesday.
If the transfer meets Regulation E’s unauthorized-EFT definition and the other conditions for liability are satisfied, notice was within two business days after learning of the loss. The federal tier would generally limit liability to the lesser of USD 50 or the unauthorized transfers before notice, so the maximum under that tier would be USD 50 rather than USD 180.
The institution’s agreement, card-network policy, or state law may provide a lower liability amount. Different facts, including a delayed report or a transfer the consumer personally initiated, can change the analysis.
$50/$500 access-device tiers to every unauthorized account debit.This page provides general financial and regulatory education, not legal advice or a conclusion about a specific disputed transfer. Promptly use the institution’s reporting channel and consult current rules for an actual case.