Reg E gives banks 10 business days to investigate an error, or 45 days with provisional credit. See the exact timelines and what an AI employee run.
A customer says a debit card charge or ACH debit on their account is wrong. From the day your bank receives that notice, a federal clock starts, and it does not pause for staffing gaps, month-end, or a backlog in the disputes queue. This post walks through the Regulation E error resolution timelines in 12 CFR 1005.11, checked against the eCFR in October 2026, and shows which parts of the casework an AI employee can run and which decisions stay with your people.
Regulation E defines "error" in 1005.11(a). It covers an unauthorized electronic fund transfer, an incorrect transfer to or from the account, a transfer left off a periodic statement, a bank computational or bookkeeping mistake, an incorrect amount from an ATM, a transfer not properly identified on a receipt or statement, and a consumer request for documentation or clarification about a transfer. Routine balance inquiries, requests for tax records and requests for duplicate copies are excluded.
The notice must reach the bank no later than 60 days after the bank sends the periodic statement on which the error first appears. It can be oral or written. It has to let the bank identify the consumer and the account, and it has to say why the consumer believes there is an error, with the type, date and amount where possible. The bank may ask for written confirmation within 10 business days of an oral notice, as long as it told the consumer about that requirement and where to send it when the oral notice came in.
Two details trip up intake teams. The 60-day window runs from the statement date, not the transaction date. And a request for documentation or clarification counts as a notice of error, with its own 60-day window that starts when the bank sends the information requested.
The table below summarizes 1005.11(c). Business days are the days the bank disclosed to the consumer under 1005.7(b)(3), so confirm your own calendar before you configure any timer.
Situation | Time to determine whether an error occurred | Provisional credit |
|---|---|---|
Standard case | 10 business days | Not required if you finish in time |
Bank needs more time | Up to 45 days from receipt of the notice | Required within 10 business days, with notice to the consumer within 2 business days of crediting |
Transfer within 30 days of the first deposit to the account | 20 business days in place of 10, then up to 90 days in place of 45 | Required within the extended initial period |
Point-of-sale debit card transaction | 10 business days, then up to 90 days | Required within 10 business days |
Transfer not initiated within a state | 10 business days, then up to 90 days | Required within 10 business days |
After the investigation ends, the clock keeps running in smaller steps. The bank reports results to the consumer within 3 business days of completing the investigation. If it finds an error, it corrects it within 1 business day of that determination.
A few conditions in 1005.11(c)(2)(i) matter in practice. A bank that has a reasonable basis to believe an unauthorized transfer occurred, and has met its 1005.6(a) obligations, may withhold up to $50 from the provisional credit. A bank need not provisionally credit if it required written confirmation of an oral notice and did not get it within 10 business days, or if the account is subject to Regulation T. The consumer has full use of provisionally credited funds during the investigation.
If the bank finds an error, it corrects it and tells the consumer, and if a provisional credit was made, the notice says it is now final. If the bank finds no error, or a different error than the consumer described, 1005.11(d) adds requirements. The report must include a written explanation of the findings and tell the consumer they can request the documents the bank relied on. The bank must then provide copies promptly on request.
If the bank debits back a provisional credit, it must notify the consumer of the date and amount. It must also say it will honor checks, drafts and preauthorized transfers payable to third parties for five business days after that notice, subject to the limits in the rule.
On documentation, 1005.13(b) requires evidence of compliance to be kept for at least two years from the date action was required. If the bank knows it is under investigation or enforcement, it keeps relevant records until the matter is closed. Your examiners will look for a file that shows the date the notice arrived, each step taken, the evidence reviewed, the decision, who made it, and the date each notice went out.
Most missed Reg E deadlines are not caused by hard decisions. They come from handoffs. A notice arrives through a branch, a call center, a mobile app message and a mailed letter, and the receipt date is recorded differently in each. Evidence sits in the core, the card processor, the fraud platform and the online banking logs. Someone has to count business days correctly around holidays, and someone has to remember that a new account or a point-of-sale transaction changes the answer.
The 10-business-day mark is the pressure point because it triggers the provisional credit decision. A case that has not been triaged by day 6 or 7 forces a credit simply to protect the timeline, which is a legitimate choice but should be a deliberate one.
An AI employee is an AI agent that runs a whole job end to end under a defined procedure, with approval gates and a full audit trail. In an error resolution queue it can take on the repetitive work that sits between intake and the decision.
The same pattern appears in card disputes, where an agent investigates and assembles evidence before a person reviews it. Our chargeback automation guide and the buyer's guide to AI chargeback agents cover the network side of that work.
The final determination of whether an error occurred stays with a trained analyst. So do these decisions:
This split follows the human-in-the-loop approach: the agent prepares and proposes, a person approves and signs. Every approval is recorded with the reviewer and the time. For the wider picture of how banks structure those approval gates across compliance work, see our guide to AI employees in banking and financial services compliance, and for investigation-style work see AI agents for financial crime investigations.
A Reg E queue belongs to one AI employee with one Agent Operating Procedure, written by your disputes lead, not an engineer. For this job the AOP would hold the clocks above (10 business days, the 45 and 90-day extensions, the two-business-day credit notice, the three-day results notice), your disclosed business-day calendar as the source of truth for counting, and a ceiling on the provisional credit the agent may prepare.
The agent's identity matters as much as its instructions. It reads the core, card processor and fraud platform and writes only to the case record. It cannot post a credit, send a no-error letter or debit one back. Those wait for a named analyst.
Trigger for Needs Attention | What the analyst receives |
|---|---|
Receipt dates disagree across branch, app and mail | Each channel's timestamp, side by side |
Account age or transaction type is unclear, so the 10 or 20-day clock is uncertain | The evidence that would settle it |
Authorization and login data conflict | Both records, already pulled |
Day 6 passes with no determination | The file and the credit decision it forces |
Each puts the case in Needs Attention. Before a case is marked ready for approval, the validate step of the PEV loop recomputes the deadline from the receipt date, checks the notice template against the finding type, and confirms the file shows receipt date, steps, evidence, decision-maker and notice dates.
The agent writes its reasoning into your dispute case-management system, as it did inside SAP Ariba in a biopharma procurement deployment.
When an analyst overrides a draft, that correction becomes an AOP change on a branch. It runs against a golden set of past claims, including deadline edge cases, gets reviewed, and merges. No ticket is filed.
Expect heavy review at launch. In that biopharma deployment, 64% of requests went to manual review in week one. As reviewed corrections built up, the decision rate rose from 36% to 85% and manual review fell to 15%. The early rate is the safety mechanism.
Dispute data sits beside account detail, so a bank would usually pick BYOC or on-premises. Our deployment guide covers both.
Pick one error type, such as unauthorized debit card transactions, and run the agent in a shadow mode where analysts work the case as usual and compare their file to the agent's. Measure whether the agent applied the correct deadline to every case and whether the evidence file matched what the analyst gathered. Once the deadline logic and the notices are consistently right, move the agent to preparing cases for approval, and add error types one at a time.
Have your compliance and legal teams review the notice templates and the business-day calendar before go-live. This post is a summary of the regulation as of October 2026, not legal advice, and your institution's disclosures, state law and any card-network rules may add requirements. The definition of Regulation E is also in our glossary.
