A financial institution that receives a consumer's notice of a disputed electronic transfer must open an investigation within 10 business days, under the error-resolution procedures set out at 12 CFR 1005.11, part of the Consumer Financial Protection Bureau's Regulation E. If the institution needs more time, it can extend the investigation to 45 calendar days from the date it received the notice, but only if it provisionally credits the consumer's account within that initial 10-business-day window.
Regulation E implements the Electronic Fund Transfer Act and governs how banks, credit unions, and other account-holding institutions must handle claims of unauthorized or erroneous electronic transfers — debit card transactions, ATM withdrawals, person-to-person payments, and preauthorized transfers among them. The rule's timelines are not guidance; they are binding deadlines that examiners cite when institutions fall short, according to the CFPB's own text of the regulation.
What Counts as an "Error" Under Regulation E?
An error is any of several defined categories in Section 1005.11, including an unauthorized electronic transfer, an incorrect transfer amount, an omission of a transfer from a periodic statement, a computational or bookkeeping error, or the consumer's request for documentation or clarification about a transfer. A consumer triggers the rule's protections by giving oral or written notice, and the CFPB's guidance is explicit that institutions "may not delay initiating or completing an investigation pending receipt of information from the consumer" — meaning a bank cannot condition the start of its clock on the consumer first filing a police report or contacting the merchant.
The consumer generally has 60 days after the institution sends the periodic statement on which the disputed transfer first appears to report it. Miss that window, and the protections in Section 1005.11 do not apply to that transfer, though the institution may still choose to investigate voluntarily.
How Fast Must a Financial Institution Investigate?
The standard clock is 10 business days from receipt of the error notice for the institution to determine whether an error occurred, then three more business days to report the results to the consumer. If a correction is warranted, the institution must make it within one business day of that determination. An institution that cannot finish within 10 business days may take up to 45 calendar days total, but that extension is conditional, not automatic.
| Scenario | Initial Investigation Window | Extended Window (With Provisional Credit) |
|---|---|---|
| Standard electronic transfer | 10 business days | 45 calendar days |
| Transfer within 30 days of first account deposit | 20 business days | 90 calendar days |
| Point-of-sale debit card transaction | 10 business days | 90 calendar days |
| Transfer initiated outside the United States | 10 business days | 90 calendar days |
When Is a Bank Required to Give Provisional Credit?
To use the extended timeline, the institution must provisionally credit the consumer's account for the disputed amount within 10 business days (or 20, for new-account transfers) of receiving the notice, and it must notify the consumer of that credit within two business days. During the investigation, the consumer gets full use of the provisionally credited funds. The one carve-out: an institution may withhold up to $50 of the provisional credit if it has a reasonable basis to conclude the transfer was unauthorized.
This provisional-credit mechanism is what separates Regulation E from the credit-card chargeback framework under Regulation Z, where a cardholder's liability during a dispute is capped differently and funds are not drawn from a demand deposit account in the same way. For a bank's operations and fraud teams, provisional credit is the compliance-critical step: miss the 10-business-day funding deadline and the institution loses the right to the 45-day extension, regardless of how complex the underlying investigation is.
Which Transfers Get the Longer 90-Day Clock?
Three categories move from the 45-day cap to a 90-day cap: transfers involving an account that is less than 30 days old, point-of-sale debit card transactions, and transfers "initiated outside a state," which the CFPB's Regulation E text treats as reaching foreign-initiated transactions, per eCFR's codified text of the section. New accounts also get a longer initial investigation window — 20 business days instead of 10 — before provisional credit is required, reflecting that institutions have less transaction history to evaluate on a recently opened account.
How Much Can a Consumer Owe for an Unauthorized Transfer?
Regulation E's companion liability-limit provision, Section 1005.6, sets three tiers tied to how quickly the consumer reports a lost or stolen access device. Report within two business days of learning of the loss, and liability is capped at $50 or the amount of unauthorized transfers before notice, whichever is less. Report later than two business days but before 60 days after the statement showing the unauthorized transfer, and liability can reach $500. Miss the 60-day statement window entirely, and liability for transfers after that point can be unlimited — though the CFPB's regulation text allows institutions to extend these deadlines when a consumer's delay was due to extenuating circumstances such as hospitalization or extended travel.
| Reporting Window | Consumer Liability Cap |
|---|---|
| Within 2 business days of learning of loss or theft | $50 or the amount of unauthorized transfers, whichever is less |
| After 2 business days, before 60 days from statement | Up to $500 |
| More than 60 days after statement showing the transfer | Potentially unlimited for transfers after the 60-day mark |
What Happens When the Bank Finds No Error?
If the institution determines no error occurred, or that an error occurred in a different manner or amount than the consumer alleged, it must mail or deliver a written explanation of its findings and notify the consumer of the right to request the documents the institution relied on. If the institution had extended provisional credit during the investigation and then determines no error occurred, it may reverse that credit — but only after following the notice requirements in Section 1005.11, and it must give the consumer at least five business days after mailing the notice before debiting the account, absent an agreement otherwise.
None of this authorizes an institution to require a consumer to sign a statement, contact the merchant directly, or file a police report as a precondition for opening or completing an investigation. Those constraints, laid out in the CFPB's frequently-asked-questions guidance on electronic fund transfers, are among the details institutions' compliance teams most often get flagged for in examinations, since the underlying investigation obligations run on fixed calendar and business-day clocks regardless of how a dispute is ultimately resolved.
What Falls Outside Regulation E's Error-Resolution Rule?
Section 1005.11 covers electronic fund transfers as defined in Regulation E — debit card purchases, ATM withdrawals, direct deposits, preauthorized bill payments, and person-to-person transfers made through an account-linked service. It does not cover paper checks, wire transfers governed separately under the Uniform Commercial Code, or credit card transactions, which fall under Regulation Z's billing-error procedures instead. A payment that starts as a debit card transaction but clears through the card network's chargeback rules can still trigger Regulation E's error-resolution clock at the account level, independent of whatever timeline the network itself runs for merchant-side disputes.
That overlap matters operationally. A bank's Regulation E investigation and a card network's chargeback process are two separate tracks with two separate clocks, and an institution's compliance obligation to the consumer under Section 1005.11 does not pause while a merchant dispute plays out on the network side. As the CFPB's guidance puts it, an institution may not delay initiating or completing its investigation pending information from other parties, which extends to waiting on a chargeback outcome before resolving the consumer-facing error claim.
Why the Clock Matters for Payments and Banking Operations Teams
For an issuer's operations and fraud teams, the practical stakes sit in two places: the 10-business-day trigger for provisional credit, and the documentation trail proving an investigation began on time. Both are point-in-time obligations tied to when notice was received, not when a case was assigned or when supporting documents arrived from a network or merchant. An institution that treats the 45-day period as the default timeline, rather than a conditional extension, risks missing the provisional-credit deadline that makes the extension available in the first place.
Because the consumer's 60-day reporting window runs from the date a periodic statement is sent, that statement date is the operative reference point for both the consumer's deadline to notify the institution and the institution's own downstream clocks. None of the timelines in Section 1005.11 vary by transaction size or channel — the same 10- and 45-day deadlines apply to a five-dollar debit card purchase and to a large preauthorized transfer alike.
For a related protection perspective, read What Regulation E Requires Banks To Do After an Unauthorized Transfer.