In auditing unauthorized ACH transactions for Regulation E compliance and it appears that we do not perform any type of investigation. We just obtain a Written Statement of Unauthorized ACH Debit (WSUAD) and return the file with the appropriate ACH return code. I am trying to marry the Reg E requirements with ACH requirements.

If we do not conduct an investigation it would seem we must provide the customer credit for the unauthorized transaction within 10 days of their notification (oral or written). We do not have the 45-days to resolve since we are not investigating anything. Even if we have not yet received a signed WSUAD, we must give the customer credit by day 10 anyway. Then if we receive the WSUAD on day 15, we can return the item (this is assuming notification timing and ACH return deadlines are all good). Is this correct?

It seems returning the item would put another credit in the account, so what happens from there? I assume there is some back office work to be done to be sure the account isn't credited twice.

Thanks in advance.

When a customer signs a Written Statement of Unauthorized Debit (WSUD) the Reg E process is pretty simply. The back office returns the ACH and credits the account the same day and there is no additional investigation. The customer has their credit before the 10th business day so no provisional credit is necessary so all we have to do is notify the consumer of the conclusion of our investigation within three business days of concluding our "investigation." 1005.11(c). This notice may be as simple as the person taking the signed WSUD telling the customer, "We'll credit your account today." For auditing purposes, some institution's procedures state that the back office will provide a notice of the credit in writing, however Reg E does not require this.

If the customer makes an oral dispute and does not provide written confirmation by the 10th business day, provided your disclosures permit it, Reg E 1005.11(c)(2)(I)(A) states that provisional credit is not required. However, we must still investigate under Reg E. Since we cannot return the ACH without a WSUD, we may need to conduct an investigation by contacting the originating bank to request a copy of the authorization for the debit to determine if our customer did authorize the transaction or not. We may also review the customer's account history to see if they have been debited by this merchant before and if the ACH record appears to be a payment initiated on their behalf. If we cannot conclude whether or not the customer authorized the debit by the 45th day, we will have to pay the claim even if we cannot return the ACH.

Thanks for that explanation!

If they don't want to investigate anything, then is the 10th day our drop dead date for crediting the customer?

Also does your Regulation E - Investigation and Loss Mitigation training touch on investigation for ACH also or is it just with regard to EFTs with branded VISA and MasterCard? It seems we need some training in both areas...

Thanks.

Reg E 1005.11(c) states that we must correct the error within one business day of concluding our investigation. If we decide on Day 1 that we are not investigating because it is an ACH claim, then we must credit the customer on Day 2.

The 10 business days for provisional credit is there for those circumstances when we do not complete our investigation by the 10th business day.

Although my training focuses specifically on Reg E and VISA/Mastercard rules, here are recent and upcoming BOL Learning Connect topics that may be of assistance.

A to Z of Reg E recorded by Andy Zavonia on August 10, 2017 focusing specifically on Reg E (no ACH or VISA/MC rules)

VISA and Reg E Error Resolution September 12, 2017

Mastercard and Reg E Error Resolution September 14, 2017

Sticky ACH Situations October 26, 2017

How would you recommend handling a scenario wherein an accountholder calls in with the following account takeover/fraud scenario on a bill pay item. On day 1 we agreed it was unauthorized, were able to place a stop pay, and expect the funds to be returned from our bill pay vendor in 3-5 days. Have we "corrected the error" within one business day as Reg E is concerned? Or should we credit the customer's account and then monitor until the bill pay credit hits then debit the excess credit?

This is not one I've encountered before! Thanks for letting me resurrect this thread.

You completed the investigation when you agreed it was unauhorized. You should be crediting the customer within one business day of that determination. That's a final credit. If you can, have the vendor credit the bank, not the customer. But if the vendor can only credit your customer's account, watch for it and then recoup the extra funds from the customer. Explain that it's to reverse the extra credit from the bill payment vendor.