Regulation Z (Reg Z)

What is Regulation Z?

Regulation Z is the Consumer Financial Protection Bureau rule, 12 CFR part 1026, that implements the Truth in Lending Act (15 USC 1601 et seq.). It requires lenders to disclose the cost and terms of consumer credit in a standard way, and it sets substantive rules for credit cards, home loans and billing disputes. Rulewriting authority moved to the CFPB under the Dodd-Frank Act. The text of Regulation Z is published on the CFPB site and in the eCFR.

What does Regulation Z cover?

The rule applies to creditors that offer consumer credit. Its main pieces are:

• Disclosures for closed-end credit (a loan with a fixed term, such as an auto loan or mortgage) and open-end credit (a revolving line, such as a credit card), including the annual percentage rate (APR) and the finance charge.
• Credit card rules, including the provisions added by the CARD Act, and a cap on cardholder liability for unauthorized use. Under 12 CFR 1026.12(b), that liability cannot exceed the lesser of $50 or the amount obtained before the card issuer is notified.
• Billing error resolution for open-end credit under 12 CFR 1026.13.
• Mortgage rules: the ability-to-repay and qualified mortgage standards in 1026.43, the Loan Estimate and Closing Disclosure in 1026.19(e) and (f), periodic statements for residential mortgage loans in 1026.41, and payoff statements in 1026.36(c)(3).
• Record retention. Under 1026.25, a creditor keeps evidence of compliance for two years after the date a disclosure or action was required.

How does Reg Z billing error resolution work?

A cardholder who sees a billing error must notify the creditor in writing no later than 60 days after the creditor sent the first periodic statement showing the error. The creditor then has 30 days from receipt to acknowledge the notice in writing, unless it has already resolved the error. It must correct the error or send an explanation within two complete billing cycles, and never later than 90 days after receiving the notice.

Each of those clocks starts on a different event, which is why disputes teams track them in a case system rather than by hand. For a full walkthrough of the workflow, see Reg Z billing error and dispute automation.

What is the difference between Reg Z and Reg E?

Regulation Z covers credit: credit cards, mortgages, personal loans and lines of credit. Regulation E covers electronic fund transfers from consumer deposit accounts, such as debit card, ACH and ATM transactions. The two rules have different notice periods, different investigation timelines and different liability limits, so the first step in any dispute is to decide which product it involves. A debit card dispute follows Reg E. A credit card dispute follows Reg Z. The Reg E side of the process is covered in Reg E dispute investigation automation.

Card network chargeback rules sit on top of both. They are contract rules between banks and networks, not law, and they run on their own deadlines. See the chargeback automation guide for how the two layers fit together.

How does Reg Z relate to AI employees?

Most Reg Z work is deadline-driven casework with documents attached. An AI employee can log each billing error notice with its receipt date, calculate the 30-day and 90-day dates, assemble the transaction history and merchant records for the file, and draft the acknowledgment letter. On the mortgage side, it can compare a Loan Estimate or Closing Disclosure against the loan terms and flag mismatches, as described in loan document review with AI.

People make the decisions. A dispute analyst decides whether an error occurred, a compliance officer owns the interpretation of the rule, and approval gates keep the AI employee from sending a final determination on its own. Every step is logged, which gives the bank the evidence it needs to meet the retention requirement.

Frequently asked questions

Is Regulation Z the same as the Truth in Lending Act?

No. The Truth in Lending Act is the federal statute. Regulation Z is the CFPB rule in 12 CFR part 1026 that implements it. People often use the two names interchangeably, and TILA and Reg Z are listed together in most compliance programs.

How long does a creditor have to resolve a billing error under Reg Z?

The creditor must acknowledge the notice within 30 days of receiving it. It must resolve the error within two complete billing cycles, and no later than 90 days after receipt.

What is the maximum a cardholder can owe for unauthorized card use?

Under 12 CFR 1026.12(b), liability for unauthorized use of a credit card cannot exceed the lesser of $50 or the amount obtained by the unauthorized use before the issuer is notified. Conditions apply, including that the issuer gave adequate notice of the limit.

Does Reg Z apply to debit card disputes?

No. Debit card transactions that move money from a consumer deposit account fall under Regulation E. Reg Z applies when the transaction is on a credit account.

How long must lenders keep Reg Z compliance records?

Section 1026.25 requires a creditor to keep evidence of compliance for two years after the date disclosures are required to be made or action is required to be taken.