The following question has been posed to me by Operations:
When we receive an affidavit of unauthorized debit card transaction, we apply both Regulation E and Visa Zero Liability rule for the consumer's benefit. For example, the VZL allows the bank to reject a customer's claim if it is received after 60 days from the date when a statement showing the unauthorized transaction is presented to the customer. However, Regulation E requires the Bank to accept the claim no matter when it is submitted to the Bank. So if a customer submits a claim 180 days after the statement date, we still accept it and applies the VZL.
I'm very troubled if this is a right practice. Can we apply only one rule? If the transaction is processed on VISA's network, then I want to apply only the VZL. In other words, if a fraud transaction is processed though Visa's network (signature based) and the claim is submitted after 180 days, then we reject the claim.
What is the proper practice?

Unfortunately, it is a "both/and" proposition, not an "either/or."

What you can and cannot do under VISA rules does not negate your obligations under Regulation E. If you have a situation where a customer has not provided timely notice to the Bank, you still must follow the liability schedule of 1005.6. However, since the claim is late, you are not bound by the investigation or provisional credit requirements of 1005.11 so your investigation can take as long as you need it to, and you do not have to provide provisional credit. Even though you are accepting the cardholder's claim under Reg E, since it is outside the timeframes to qualify for Zero Liability protections, you are not obligated to provide them and can hold the customer liable for a portion of the unauthorized transactions based on 1005.6.

It is my understanding there are no timeframes under Visa's Zero Liability policy for consumer signature Visa debit card transactions. In the original post, you stated 'For example, the VZL allows the bank to reject a customer's claim if it is received after 60 days from the date when a statement showing the unauthorized transaction is presented to the customer.' Do you have this as a limitation defined in your account agreement that claims after 60 days are not subject to Visa's Zero Liability policy, since I believe Visa has no 60 day timeframes?

Although the personal Zero Liability does not define a timeframe, the business Zero Liability does.

http://usa.visa.com/small-business/card-benefits/security/zero-liability.jsp

Visa Business cardholders may be required to notify their financial institutions within 60 calendar days of the mailing date of the first statement showing any unauthorized transactions. Financial institutions may impose greater liability on the cardholder if the financial institution reasonably determines that the unauthorized transaction was caused by the gross negligence or fraudulent action of the cardholder—which may include your delay for an unreasonable time in reporting unauthorized transactions.

Brian, for the personal Visa Zero Liability, is it acceptable for a bank to put in their Deposit Account Agreement that there is a timeframe of 60 days from the statement date for personal Visa signature based transactions? Then you would go by the Reg. E liability rules?

VISA's personal website leaves it open ended.

http://usa.visa.com/personal/security/zero-liability.jsp

Covers U.S.-issued cards only. Does not apply to ATM transactions, certain commercial card transactions, PIN or other transactions not processed by Visa. You must notify your financial institution immediately of any unauthorized use. For specific restrictions, limitations and other details, please consult your issuer.

Since you are dealing with contract language you may want to confer with bank counsel.