Study guide
2.2 Regulation E: Error Notices and Unauthorized Transfer Liability
CRCM Certified Regulatory Compliance Manager Exam
Track your progress as you read
Finished sections get a check mark.
1 1. CRCM Exam and Study Planning
1.1 CRCM examination, eligibility and study strategy
2 2. Electronic Transfers and Error Intake
2.1 Regulation E: Coverage and Consumer Disclosures 2.2 Regulation E: Error Notices and Unauthorized Transfer Liability 2.3 EFT Error Investigation and Provisional Credit
3 3. EFT Investigations, Remittances and Prepaid Accounts
3.1 Extended Error Rules and Remittance Transfers 3.2 Prepaid accounts and special Regulation E controls 3.3 Truth in Savings: Account Disclosures and APY
4 4. Overdraft Operations and Advertising
4.1 Overdraft Practices, Fees and Advertised Terms
5 5. ECOA Applications and Credit Decisions
5.1 ECOA Coverage, Protected Bases and Application Inquiries 5.2 Age, Spousal Signatures and Joint Credit Intent 5.3 ECOA Action Notices and Specific Reasons
6 6. Valuations and Fair Lending
6.1 Business Credit Notices and Appraisal Delivery 6.2 Fair Lending: Treatment, Effects and Comparative Evidence 6.3 Redlining, Steering and Qualified Self-Tests
7 7. Credit Cards, HELOCs and Open-End Credit
7.1 Credit Cards: Coverage, Disclosures and Ability to Pay 7.2 Credit Card Fees, Payment Allocation and Billing Errors 7.3 HELOCs and general open-end credit
8 8. Closed-End Credit and Mortgage Disclosures
8.1 Closed-End Credit: Disclosures, Finance Charges and APR 8.2 Rescission Timing and Ability-to-Repay Standards 8.3 TRID Integrated Disclosures: Loan Estimate, Closing Disclosure & Fee Tolerances
9 9. Education Loans and Mortgage Insurance
9.1 Private education loan disclosures and cancellation 9.2 Homeowners Protection Act and PMI termination
10 10. HMDA Coverage and Reporting
10.1 HMDA Institutional and Loan Coverage 10.2 HMDA Exclusions, Partial Exemptions and Data Points 10.3 HMDA: Loan Application Register (LAR) Compilation, Demographic Collection & Submission
11 11. Flood Insurance
11.1 Flood Determinations, Notices and Required Coverage 11.2 Flood Contents, Escrow, Private Policies and Force Placement
12 12. CRA Evaluation and Assessment Areas
12.1 CRA Institution Categories and Performance Tests 12.2 Community Development, Ratings and Performance Context 12.3 CRA Assessment Areas and Public File Contents
13 13. CRA Disclosures, Branching and Consumer Protection
13.1 CRA File Deadlines, Notices and Sunshine Agreements 13.2 Interstate banking and branch closing duties 13.3 Unfairness, Deception and Consumer Injury
14 14. UDAAP Controls and Social Media
14.1 Abusiveness and UDAAP Program Controls 14.2 Social media advertising, complaints and records
15 15. BSA Programs, Customers and Currency
15.1 BSA Program Pillars and Independent Testing 15.2 Beneficial Ownership, CIP and Ongoing Due Diligence 15.3 Currency Reports, Aggregation and Exemptions
16 16. Suspicious Activity and Sanctions
16.1 Suspicious Activity Reporting, Confidentiality and Records 16.2 Sanctions Scope, Ownership and Blocking Decisions 16.3 OFAC Reports, Records, Licensing and Screening Controls
17 17. Check Availability and Exception Holds
17.1 Regulation CC Scope, Deposit Days and Next-Day Items 17.2 Initial-Dollar Availability, Ordinary Checks and Policy Disclosures 17.3 Exception Hold Grounds and Reasonable Periods
18 18. Hold Notices and Settlement Services
18.1 Hold Notices, Timing and Consumer Communications 18.2 RESPA Coverage, Referral Payments and Fee Splits 18.3 Permissible Services, Ownership Returns and Marketing Agreements
19 19. Mortgage Servicing
19.1 Escrow, Servicing Errors and Force-Placed Insurance 19.2 Early Intervention, Continuity of Contact and Loss Mitigation
20 20. Consumer Reports and Credit Decisions
20.1 Consumer Reports: Permissible Purpose and Employment Use 20.2 FCRA Adverse Action Notices and Credit Score Disclosures 20.3 Risk-Based Pricing and Furnisher Accuracy Duties
21 21. Furnishing, Medical Information and Identity Theft
21.1 Negative Information Notices and Furnisher Disputes 21.2 Medical information in credit decisions: Regulation FF and V 21.3 Identity Theft Program Scope, Governance and Detection
22 22. Identity Theft and Debt Collection
22.1 Red Flag Responses, Program Updates and Address Validation 22.2 Debt Collector Scope, Calls and Communication Limits 22.3 Electronic Collection Messages and Validation Disputes
23 23. SCRA Protections and MLA Coverage
23.1 SCRA Eligibility and the Six-Percent Interest Cap 23.2 SCRA Foreclosure, Repossession, Leases and Waivers 23.3 MLA Borrowers, Identification and Credit Exemptions
24 24. Military Credit and Consumer Communications
24.1 MAPR, Military Disclosures and Prohibited Credit Terms 24.2 TCPA Calling Technology, Consent and Do-Not-Call Rules 24.3 Telephone Enforcement, TSR Coverage and Commercial Email
25 25. Electronic Consent and Consumer Leasing
25.1 E-SIGN Consent and Consumer Electronic Records 25.2 Consumer Leasing Coverage, Disclosures and Residual Value
26 26. Deposit Insurance and Privacy Notices
26.1 FDIC Insurance: Single, Joint and Trust Ownership 26.2 Retirement, Business and Custodial Insurance; FDIC Signs 26.3 Privacy Notices, Sharing and Opt-Out Opportunities
27 27. Privacy Sharing and Information Security
27.1 Privacy Sharing Exceptions, Account Numbers and Reuse 27.2 Information Security Programs and Incident Investigation 27.3 Customer Incident Notices and Regulatory Notification Clocks
28 28. Authentication and Specialized Data Privacy
28.1 Authentication, access and layered security 28.2 GDPR scope, lawful processing and incident response 28.3 HIPAA and HITECH in bank services
29 29. Insider Lending and Affiliate Definitions
29.1 Regulation O Insider Definitions and Nonpreferential Credit 29.2 Insider Approvals, Lending Limits and Executive Restrictions 29.3 Affiliate Definitions, Covered Transactions and Collateral
30 30. Affiliate Transactions, Appraisals and Originators
30.1 Low-Quality Assets, Market Terms and Affiliate Limits 30.2 Title XI Valuation Thresholds, Exemptions and Credentials 30.3 Valuation Independence, HPML Appraisals and SAFE Registration
31 31. Garnishment and Financial Records
31.1 Federal Benefit Garnishment: Review, Protection and Notice 31.2 Financial Privacy: Government Requests, Certificates and Exceptions 31.3 Regulation S and financial-record reimbursement
32 32. Bank Security and Insurance Sales
32.1 Bank Bribery and Physical Security Programs 32.2 Security Reporting and Retail Nondeposit Investments 32.3 Consumer protection in bank insurance sales
33 33. Securities Activities and Anti-Bribery Rules
33.1 Regulation R and bank brokerage exceptions 33.2 Regulation U purpose credit and margin collateral 33.3 FIRREA civil penalties and foreign bribery risks
34 34. Payment Systems, Child Privacy and Tax Reporting
34.1 Deposit Classification, Reserve Ratios and Debit Interchange 34.2 Internet Gambling Controls, Child Privacy and Email Rules 34.3 IRS information reporting and backup withholding
35 35. Accessible Banking
35.1 ADA Title III and access to banking services
36 36. CMS Governance and Operating Procedures
36.1 Board of Directors & Senior Management Oversight: Responsibilities, Culture & Resources 36.2 The Three Lines of Defense Model in Bank Compliance 36.3 Compliance Policies and Procedures: Development, Approval Cycles & Operationalization
37 37. Compliance Risk Assessment
37.1 Compliance Risk Assessment: Exposure and Control Evidence 37.2 Residual Risk, Specialized Reviews and Event-Driven Updates 37.3 Risk Scoring, Impact Dimensions and Risk Appetite
38 38. Risk Indicators and Compliance Training
38.1 Compliance Indicators, Emerging Risks and Model Limits 38.2 Legal Training Duties and Role-Based Curriculum 38.3 Board Education, Training Administration and Effectiveness
39 39. Monitoring, Testing and Vendor Diligence
39.1 Monitoring, Independent Assurance and Risk-Based Scoping 39.2 Sampling Objectives, Workpapers and Testing Reports 39.3 Third-Party Planning, Diligence and Contract Design
40 40. Vendor Controls and Complaint Management
40.1 Vendor Monitoring, Fintech Controls and Service-Company Notices 40.2 Complaint Intake, Investigation and Root Cause 40.3 Complaint Reporting, Agency Responses and Systemic Redress
41 41. Regulatory Change and Corrective Planning
41.1 Regulatory Surveillance, Impact Assessment and Gap Analysis 41.2 Change Implementation, Validation and Judicial Stays 41.3 Issue Prioritization, Root Cause and Corrective Plan Design
42 42. Restitution and Examination Management
42.1 Remediation Populations, Restitution and Closure Evidence 42.2 Examination Coordination and Consumer Compliance Ratings 42.3 Supervisory Findings, Responses and Enforceable Actions
43 43. Regulatory Reports and Resubmissions
43.1 Regulatory reporting, corrections and examiner updates
2.2 Regulation E: Error Notices and Unauthorized Transfer Liability
Key Takeaways Explain This Topic AI
An oral error notice can trigger an EFT investigation without a written affidavit.
Unauthorized-transfer liability depends on the access-device and statement-notice timelines.
Negligence alone does not enlarge the consumer’s liability beyond Regulation E limits.
Last updated: October 2026
Annual Error Resolution Notice Options
Depository institutions must deliver error resolution notices to consumers on an ongoing basis using one of two permissible compliance methods under 12 CFR § 1005.8(b):
Annual Long-Form Method: Mailing or delivering the full error resolution notice (substantially similar to Model Form A-3) at least once per calendar year; or
Periodic Short-Form Method: Including the abbreviated summary error notice (substantially similar to Model Form A-4) on or with each monthly or quarterly periodic statement.
Periodic Statements (12 CFR § 1005.9)
Periodic account statements provide consumers with documentation necessary to track account activity, reconcile ledger balances, and identify unauthorized transactions within regulatory reporting deadlines.
Delivery Frequency Rules
Monthly Statements: An institution must deliver a periodic statement for each monthly cycle in which one or more electronic fund transfers occur.
Quarterly Statements: If no electronic fund transfers occur during a statement cycle, the institution must provide a periodic statement at least once every three months (quarterly).
Mandatory Periodic Statement Disclosures
Under 12 CFR § 1005.9(b), periodic statements must disclose:
Transaction Posting Date: The calendar date on which each electronic fund transfer posted to the account.
Transfer Amount: The net dollar amount of each transfer, including any separately disclosed ATM surcharge fees.
Transfer Type and Account Affected: The classification of the transfer (e.g., ATM cash withdrawal, point-of-sale purchase, preauthorized ACH debit) and the specific consumer account debited or credited.
Terminal Identification: For transfers initiated at an electronic terminal (ATM or POS terminal), the physical location including street address, city, and state, or an established unique terminal code.
Account Identifier: The consumer's account number or truncated access device identifier.
Itemized EFT Fees: An itemization of all fees assessed for EFT transactions during the statement period.
Beginning and Ending Balances: The starting balance and closing balance for the statement cycle.
Error Resolution Contact: The dedicated postal address and telephone number designated for receiving consumer error inquiries.
Preauthorized Credit Verification: A telephone number that consumers can call to verify whether preauthorized electronic deposits (such as payroll or government benefits) have posted, if the bank does not provide positive notice.
Consumer Liability Tiers for Unauthorized Transfers (12 CFR § 1005.6)
Regulation E balances consumer protection against the requirement that account holders exercise reasonable diligence in safeguarding access devices. The regulation establishes a three-tiered liability structure for unauthorized transfers involving lost or stolen access devices, as well as distinct rules for compromises not involving access devices.
Statutory Conditions for Imposing Consumer Liability
A financial institution may hold a consumer legally liable for an unauthorized electronic transfer only if three conditions are satisfied under 12 CFR § 1005.6(a):
The access device was an accepted access device (the consumer requested and received it, or signed/used it, or received a renewal/substitute);
The institution provided complete initial disclosures (§ 1005.7), including liability rules and contact information; and
The institution provided a validated means of identification , such as a Personal Identification Number (PIN), biometric verification, signature verification, or chip authentication.
The Three-Tier Liability Structure for Lost or Stolen Access Devices
When an unauthorized transfer involves a lost or stolen access device (such as a debit card or ATM card), liability is governed by strict statutory windows:
Liability Tier Consumer Reporting Timeline Maximum Consumer Liability Limit
Tier 1: Timely Notice Consumer notifies institution within 2 business days after learning of the loss or theft of the access device. Lesser of $50 OR the actual total of unauthorized transfers occurring prior to notice.
Tier 2: Delayed Notice Consumer notifies institution after 2 business days of learning of loss/theft, but within 60 calendar days after transmittal of the periodic statement showing unauthorized EFTs. Lesser of $500 OR the sum of: (1) $50 or unauthorized transfers in first 2 business days, PLUS (2) unauthorized transfers occurring after 2 business days up to 60 calendar days that the bank proves would not have occurred with timely notice.
Tier 3: Extended Inaction Consumer fails to notify institution within 60 calendar days after transmittal of the periodic statement showing the unauthorized EFTs. Unlimited liability for unauthorized transfers occurring after the close of the 60-day period until notice is given, PLUS applicable earlier-tier liability. The institution must establish that later transfers would have been prevented by timely notice.
Unauthorized Transfers Not Involving an Access Device
When an unauthorized electronic fund transfer occurs without the loss or theft of a physical access device (such as when an an unauthorized ACH debit occurs without loss or theft of an access device; a stolen code or PIN can itself be an access device):
Within 60 Calendar Days: The consumer has $0 liability for any unauthorized transfers occurring within 60 calendar days following the transmittal of the periodic statement showing the unauthorized transfer.
After 60 Calendar Days: The consumer faces unlimited liability for unauthorized transfers occurring after the 60 calendar day window until notice is provided, provided the financial institution proves that the subsequent transfers would have been prevented had the consumer provided timely notice within the 60-day timeframe.
Extenuating Circumstances and State Law Preemption
Extenuating Circumstances: If the consumer's delay in notifying the financial institution was caused by circumstances beyond their control (e.g., extended international travel, hospitalization, incapacitation, or active military deployment), the institution must extend the notification deadlines to a reasonable period.
State Laws and Network Rules: More protective state liability rules are preserved by Regulation E; they do not replace the federal investigation duties. Similarly, payment card network rules (such as Visa or Mastercard Zero Liability policies) operate contractually to eliminate consumer liability for unauthorized card transactions, though Regulation E remains the mandatory federal regulatory benchmark during compliance examinations.