The Electronic Fund Transfer Act and Regulation E have been around long enough that many compliance teams treat error resolution procedures as settled territory. The framework is familiar: consumer notifies institution of error, institution has 10 business days to investigate or must provide provisional credit and extend to 45 days (or 90 days for new accounts and international point-of-sale transactions), institution provides written notice of determination, dispute resolved. That timeline structure has not changed.
What does change is how precisely institutions implement it. CFPB examiners revisit Reg E error resolution in a substantial share of consumer protection examinations, and the same two categories of gaps surface repeatedly across institutions of different sizes and charter types. This post looks at where those gaps form in practice and what a process audit should focus on.
How CFPB Supervisory Highlights Work
Before getting into the specific gap categories, it is worth clarifying what CFPB supervisory highlights are and why they matter for compliance planning. The bureau publishes supervisory highlights periodically as summaries of examination findings across the institutions it supervises, without identifying the specific institutions examined. They function as informal guidance documents: they tell the market what examiners expect to find and what they consider deficient.
Compliance teams that track supervisory highlights closely use them as leading indicators of examination focus areas. A finding pattern that appears in supervisory highlights tends to show up in individual examinations in the months and years that follow. Reg E error resolution timing is a category that has appeared in CFPB supervisory outputs across multiple cycles, which is why it deserves ongoing attention even when there is no new final rule.
The Clock-Start Question
The most consistently recurring Reg E examination finding involves when institutions start the 10-business-day investigation clock. Regulation E defines the investigation period as beginning when the institution receives notice of the error and the consumer provides sufficient information to complete the investigation. The phrase "sufficient information" is where most process gaps appear.
When a consumer calls to dispute a transaction, many institutions start the 10-day clock from the date of the call. If the call results in a dispute intake form being completed with all relevant information, that is correct. If the call is an initial notification and the institution sends a written dispute form requiring additional information, the clock does not start until that form is returned with enough information to identify the transaction and the nature of the alleged error.
Examiners scrutinize whether institutions are starting the clock correctly in cases where the initial consumer contact did not provide enough information to investigate, and whether institutions are using a form-required process as a mechanism to extend the investigation window beyond what the rule allows. The practical exposure: if your error resolution intake process requires written dispute submission and your call center logs the dispute date but your investigation team tracks against the written form receipt date, those two dates need to be reconciled and the correct one used for regulatory timeline purposes.
For fintech-affiliated programs where a bank partner handles consumer accounts, this gets complicated further by the handoff between the fintech's consumer-facing interface and the bank's dispute processing team. If the consumer submits a dispute through the fintech app, the question of when sufficient information was received and by whom needs a clear procedural answer that both parties can demonstrate to an examiner.
Provisional Credit Calculation
The second recurring examination gap involves provisional credit. Under Regulation E, if an institution cannot complete its investigation within 10 business days, it must provide provisional credit for the amount of the disputed transaction within that window in order to extend the investigation period. Examination findings in this area tend to fall into a predictable pattern: institutions provide provisional credit for amounts that do not match the full disputed transaction amount.
This is an understandable operational error. In transaction dispute workflows, particularly for card-based transactions, the initial dispute amount sometimes differs from the final settled amount if the transaction was authorized in one amount and settled in another. Alternatively, if a dispute involves multiple line items and the consumer has disputed a partial amount, the institution may miscalculate the provisional credit scope.
The rule requires provisional credit for the amount of the alleged error as stated by the consumer. If the consumer disputes a $847 transaction, provisional credit must be provided for $847. If the institution believes the correct amount is $847.23 because of a rounding difference in settlement, the institution cannot provide a lesser amount and claim provisional credit compliance. The provisional credit obligation tracks the consumer's stated claim, not the institution's view of the settled amount.
New Account and Remittance Transfer Extensions
The extended 90-day window available for new accounts and international point-of-sale and remittance transfer disputes is a related area where examination findings cluster. Under section 1005.11, the 90-day extension requires provisional credit within 10 business days and a final determination within 90 days. Institutions that apply the extended window to transactions that do not qualify for it, or that delay providing provisional credit on the assumption that the 90-day window creates a longer credit-free investigation period, are at examination risk on both counts.
Common Process Questions for a Controls Audit
If your institution processes a meaningful volume of consumer EFT disputes, three questions are worth reviewing as part of a periodic controls audit.
First, how is the start date determined in your dispute management system, and who has authority to override it? If the system defaults to the intake call date, does it have logic to update the start date when a written form is required and returned? If start date is manually entered by dispute staff, what training and audit controls exist to ensure it is entered correctly?
Second, how is provisional credit amount calculated in cases where the authorized amount and settled amount differ? Is there a documented rule for this scenario, and is the rule aligned with the regulatory requirement to track the consumer's stated claim rather than the institution's view of the settled amount?
Third, how does your dispute management workflow flag disputes approaching the end of the investigation window? A compliance team that learns about a timeline breach during an examination rather than from an internal control alert has a monitoring gap worth closing before the next exam cycle.
What This Is Not About
To be direct about one point: Reg E error resolution examination findings do not represent a change to the underlying regulatory requirement. The 10-business-day window, the provisional credit obligation, and the 45/90-day extended investigation period are established requirements under section 1005.11. What they represent is a pattern of implementation gaps that examiners find routinely because the mechanics of dispute intake workflows make these errors easy to make and hard to detect without a deliberate audit.
That distinction matters for how you respond. This is not a new obligation requiring a new control. It is an existing obligation that warrants a process audit to verify the controls you already have are operating accurately. The difference between a regulatory change response and a process accuracy audit is meaningful for how you prioritize and scope the work.
How Regloom Handles Supervisory Highlights
The CFPB supervisory highlights are published periodically and are one of the more useful regulatory monitoring inputs for consumer protection compliance. In Regloom, we ingest them as a distinct source type, separate from final rules and proposed rules, and we tag the obligation-specific content against the relevant regulatory frameworks rather than treating the highlights as a general CFPB update.
The Reg E error resolution obligation set in our library covers EFT error resolution timelines, provisional credit procedures, and the new account and remittance transfer extension conditions as distinct control categories. When supervisory highlights contain findings that map to those categories, the relevant control owners in a Regloom workspace see a direct flag rather than having to read the full highlights document and determine relevance on their own. Supervisory highlights are the kind of regulatory output that tends to get noted in an inbox and then deprioritized during busier periods, which is precisely the monitoring gap that creates examination exposure.