Reg E disputes: the 10-day clock and what to automate

A debit card claim lands in your queue on a Monday morning. Reg E disputes in the US give you 10 business days to decide whether an error occurred, and the evidence you need sits across a card processor, a core banking system, and one customer who has not replied to your email yet. Miss the clock without crediting the account and you are in breach, whether the claim holds up or not.

Error resolution is deadline-driven work, and the volume constantly fluctuates. Community banks and credit unions feel that hardest, because the clock does not scale with the size of the team, and AI for community banks covers the wider operation. This guide stays on the dispute itself: every deadline in the error resolution process, and when provisional credit is owed. It also names which steps of the investigation an AI agent can take on rather than your team.

What counts as a Reg E dispute

Regulation E implements the Electronic Fund Transfer Act and covers consumer accounts only. A claim falls inside it when the transaction was an electronic fund transfer from a consumer's asset account:

• Debit card transactions, including point-of-sale purchases, online orders, and telephone orders
  
  

• ATM withdrawals and transfers
  
  

• ACH debits, including recurring bill payments and account-to-consumer transfers
  
  

• P2P payments sent through a service connected to the account
  
  

• Pre-authorized transfers the consumer says they revoked
  
  

Credit card disputes sit outside Reg E. Those run under Regulation Z billing error procedures, which carry a different clock and different remedies. Business accounts are outside the regulation entirely, even when the transaction looks identical.

Inside Reg E, the regulation treats two situations as errors worth separating in your own workflow. An unauthorized transfer is one the consumer did not authorize and received no benefit from, which turns the investigation toward liability rules and the timing of the consumer's notice. An error claim covers the rest: a wrong amount, a duplicate posting, a transfer the consumer never received, or a bookkeeping mistake. Classifying the claim correctly on day one decides which evidence you need, so misclassification at intake costs you days you do not have.

The Reg E dispute timeline: every deadline that matters

Every deadline below starts from a different event, which is why so many institutions track them in separate places and then lose one. The CFPB's text of § 1005.11 is the authority for each.

Four details change how the table applies to your queue.

The 60 days run from the statement, not the transaction. A transfer posted in early March can still be disputed in mid-May if it appeared on a statement you sent at the end of March. Where the consumer asked you for documentation first, the 60 days run from the date you sent that information instead.

The 90-day window is wider than most teams assume. It applies to a transfer not initiated within a state, a point-of-sale debit card transaction, or a transfer within 30 days of the first deposit to the account. The CFPB's official interpretation reads point-of-sale broadly: every debit card transaction at a merchant terminal qualifies, including cash-only, mail, and telephone orders. ATM transactions do not, even at a merchant location. The 90 days replace the 45, not the credit condition: either extension still requires provisional credit within 10 business days.

You can ask for written confirmation, but you cannot wait for it. Where a consumer gives notice orally, you may require written confirmation within 10 business days, provided you tell them at the time and give them the address. The investigation starts anyway. The only thing the written confirmation changes is your provisional credit obligation.

A late notice is not automatically a dead claim. Notice arriving more than 60 days after the statement falls outside the § 1005.11 procedures, so the 10 business day clock never starts. The liability rules are separate: on an unauthorized transfer you still have to work through § 1005.6 before holding the consumer liable for anything, and where the delay came from extenuating circumstances such as extended travel or a hospital stay, those liability timings extend to a reasonable period.

Provisional credit: when you owe it, when you can wait

Provisional credit is the price of more investigation time. Finish inside 10 business days and you never owe it. Take the 45-day or 90-day extension and you must credit the disputed amount, plus any interest that would have accrued, within those same 10 business days, or 20 where the transfer happened within 30 days of the first deposit to the account.

Four rules decide how the credit behaves once it lands:

• Tell the consumer within 2 business days of crediting, giving the amount and the date
  
  

• Give full use of the funds. A hold on the disputed amount, or any other restriction on the credited money while the investigation runs, puts you outside the regulation
  
  

• You may withhold up to $50 on a suspected unauthorized transfer where you have a reasonable basis and meet the conditions in § 1005.6(a)
  
  

• You are not required to credit where you asked for written confirmation of an oral notice and did not receive it within 10 business days, or where the account falls under Regulation T
  
  

Reversing a provisional credit has its own sequence. If the investigation concludes no error occurred, you may debit the amount back once you have notified the consumer of the date and the amount. For 5 business days after that notice you must honour checks, drafts, and similar instruments payable to third parties, along with pre-authorized transfers, where you would have paid them had the credit stayed in place, and you cannot charge an overdraft fee on any of them.

CFPB Supervisory Highlights has cited institutions for failing to credit provisionally when an investigation ran past 10 business days, and for debiting a provisional credit back without the required notice. Examiners also fault the investigation itself: denying a claim because the consumer had dealt with the merchant before, or overlooking information the institution already held. The credit decision and the investigation run on separate clocks, and a team tracking one tends to lose the other.

Where Reg E disputes lose time

The regulation gives you 10 business days. Most of them go to work that has nothing to do with judgement:

• Chasing evidence from the customer. An intake conversation that misses one question costs a full round trip, and a customer who takes three days to reply has taken a third of your clock with them.
  
  

• Pulling records from systems that do not talk. Transaction detail in the core, authorization data at the processor, prior claims in a case management tool, and a screenshot the customer sent to a chat window.
  
  

• Classifying the claim twice. Reg E asks whether an error occurred, but a card chargeback also needs a scheme reason code, which governs the evidence the scheme will accept. Mastercard and Visa each publish their own list. What you owe the consumer does not change with the code, and ACH and P2P claims carry no reason code at all.
  
  

• Volume spikes. A breach at a national merchant produces a week of claims in a day, and the clock does not stretch to accommodate your staffing.
  
  

• Analyst variation. Two processors looking at the same claim reach different conclusions, which shows up later as inconsistent outcomes and weak cases submitted to the scheme.
  
  

None of that is decisioning. It is retrieval, transcription, and follow-up, and it is the part of the process that scales badly with headcount. It also feeds the findings examiners do cite, because an investigation built on thin evidence is the one most likely to be called unreasonable.

What to automate in Reg E disputes, and what to keep human

The split that works maps to the investigation itself rather than to job titles. An AI agent takes the retrieval and preparation, your team takes the decision and the exceptions.

Two lines on that table matter more than the rest.

The approval gate is not optional. A Reg E determination carries regulatory consequence, so the agent produces the recommendation and the reasoning, and a person signs it. Our Disputes Agent is built this way: it works the case end to end, then surfaces the recommendation with every piece of evidence it reviewed, and waits.

Clock tracking is the highest-value thing to automate first. It is a recurring examination finding, it needs no judgement, and it is the one piece of the workflow where software is straightforwardly better than a person holding 40 open cases in their head.

Yonder, a UK card issuer, runs its disputes this way, and the step that moved most was the one a clock-driven process can least afford to lose: human review dropped from 5 days to 24 hours. Yonder operates under FCA rules rather than Reg E, so the deadlines differ, but the work that was eating the clock is identical, namely evidence chasing and context lost between the frontline and the back office.

"The game changer for us is that Gradient Labs' frontline and back office agents talk to each other and keep the full context of a case... We've used plenty of AI tools, and nothing else has come close to that, especially for disputes... Cases that took us the best part of a week to decide now take a day."

Antony Atkins, Senior Escalations Manager, Yonder

How to check an AI agent is safe for Reg E work

Most AI vendors selling into customer service have never been examined on a consumer protection rule. Five questions separate the ones that can take Reg E work from the ones that cannot.

1. Does it know the Reg E clock, or just the ticket SLA? Ask how the agent tracks the 10 business day determination separately from the 45-day extension and the provisional credit trigger. A vendor treating all three as one due date will miss two of them.
   
   

2. Does every case produce an examination-ready record? You need an audit trail covering each piece of evidence reviewed, each decision taken, and each message sent to the customer, written as the work happens rather than reconstructed afterwards.
   
   

3. Do the guardrails run on back-office tasks, not just chat? Plenty of agents apply safety checks to customer-facing replies and nothing to the investigation behind them. Ours run 20+ dispute-specific guardrails on every turn and every back-office task, covering Reg E, Reg Z, CFPB guidance, and FFIEC alongside the UK and EU equivalents.
   
   

4. Can a person override any decision, with the reasoning in front of them? An approval gate that shows a verdict without the evidence is a rubber stamp.
   
   

5. What is the security and compliance posture? SOC 2 Type II, GDPR, and zero-day data retention with every model sub-processor is the floor for an agent touching consumer transaction data.
   
   

Gradient Labs was built for financial services from the ground up. Our founders built Monzo's data organisation and ran production machine learning under FCA regulation, our engineering team comes almost entirely from financial services, and every agent carries FS-specific guardrails rather than a generic safety layer bolted on afterwards. For a broader view of the category, our guide on AI dispute resolution tools covers how to assess vendors, and our walkthrough of automating the disputes workflow end to end covers the operational detail.

If your Reg E queue is running close to the clock, book a demo and we will walk you through the investigation workflow on your own case types.