A Reg E opt-in confirmation letter is the written confirmation 12 CFR 1005.17(b)(1)(iv) requires after a customer consents to overdraft coverage of ATM and one-time debit card transactions. It must confirm the consent in writing, or electronically if the customer agrees, and must include "a statement informing the consumer of the right to revoke such consent". Timing matters as much as content: the official interpretation treats an institution as compliant if its procedures ensure overdraft fees are charged only on transactions paid after the confirmation was mailed or delivered. So the letter is the last of three dated events, after the notice and after the consent, and an opt-in is valid only if all three happened in that order. Botminds' Overdraft Compliance checks those three timestamps behind every ATM and one-time debit card fee instead of trusting the core's opt-in flag; this page sets out what the letter must say, when it must go, and what evidence proves the sequence.
The Board believes that written confirmation will help ensure that a consumer intended to opt into the overdraft service by providing the consumer with a written record of his or her choice. This is particularly important when a consumer opts in by telephone.
Federal Reserve Board, final rule adopting the opt-in, 74 FR 59033 (November 17, 2009)
What must a Reg E opt-in confirmation include?
The regulation requires two things: confirmation of the consumer's consent, and "a statement informing the consumer of the right to revoke such consent" (12 CFR 1005.17(b)(1)(iv)). It must be in writing, or electronic if the consumer agrees. The official interpretation gives two ways to comply: mail or deliver "a copy of the consumer's completed opt-in notice", or "a letter or notice to the consumer acknowledging that the consumer has elected to opt into the institution's service" (comment 17(b)-7). The first works only if the notice itself carried the revocation statement, which 1005.17(d)(6) permits.
Everything beyond those two elements is evidence, not obligation, but it is evidence the institution will want later. A letter that names the account, the date and channel of the consent, and the service the customer chose, and that repeats the fee and daily limit from the notice, lets an examiner and the customer see what was agreed without a second document.
A Reg E opt-in confirmation letter: what the rule requires and what proves it later
- Confirmation that the customer consented
Required, 1005.17(b)(1)(iv). A copy of the completed opt-in notice satisfies it (comment 17(b)-7).
- A statement of the right to revoke the consent
Required in the confirmation itself, or on the notice if the completed notice is what you send back.
- In writing, or electronic only with the customer’s agreement
Required. An e-mail confirmation for a customer who never agreed to electronic delivery is not a confirmation.
- The date and channel of the consent
Good practice, not in the rule: branch, phone, online or mail, and the date and time. It is the one detail every later dispute turns on.
- The account and the service consented to
Good practice: ATM and one-time debit card overdrafts on a named account, distinct from any linked-account or line-of-credit plan.
- The fees and the daily limit as disclosed on the notice
Good practice: a letter that restates the notice’s numbers lets a mismatch with the core surface immediately.
When must the opt-in confirmation be sent?
Before any fee the opt-in is meant to allow. The regulation does not set a number of days, but two interpretations together fix the order. A fee may be charged only for overdrafts "paid on or after the date the financial institution receives the consumer's affirmative consent" (comment 17(c)-1). And an institution "complies with the confirmation requirement if it has adopted reasonable procedures designed to ensure that overdraft fees are assessed only in connection with transactions paid after the confirmation has been mailed or delivered to the consumer" (comment 17(b)-7).
In practice the safe procedure is to send the confirmation the day the consent is taken and to hold the core's fee eligibility until it has gone. An opt-in taken by phone on a Friday and confirmed by a letter batched for Tuesday leaves every ATM and debit card overdraft paid over the weekend exposed, because those fees were charged before the confirmation was mailed.
Three timestamps that prove an opt-in
Every valid opt-in leaves the same trail: the notice delivered, then the consent, then the confirmation, and only then a fee. Regulation E requires the notice and a reasonable opportunity to consent before the consent itself, 1005.17(b)(1)(i) to (iii), and the confirmation before any fee the procedures allow. The sample below, from a fictional credit union the solution runs on, shows what it looks like when the order is wrong.
The order Regulation E requires, and what Overdraft Compliance found on one account
- Notice, segregated from other information1 · Notice
- Consent, after a reasonable opportunity2 · Consent
- Confirmation with the right to revoke3 · Confirmation
- First fee allowed4 · Fee
- March 9, 10:14 AM · consent by phone, no notice yetMar 9 · Consent
- March 10, 6:51 PM · $60.00 ATM withdrawal, $29.00 feeMar 10 · Fee
- March 11 · notice and confirmation mailed togetherMar 11 · Notice
- Never · no new consent after the noticeNo new consent
Can a customer opt in to overdraft over the phone?
Yes, if the notice came first. The official interpretation lists "a readily-available telephone line that consumers may call to provide affirmative consent" as a reasonable method (comment 17(b)-4.ii), and the Board chose not to require a toll-free number because "institutions have an incentive to make it easy for consumers to opt in" (74 FR 59033). What the phone cannot do is replace the notice. A customer who has not received the segregated written notice cannot give a valid consent on the call, however clearly they say yes.
The phone is also where the description of the service drifts. A call-centre agent who sells the service as a way to stop declines, or never mentions the fee, is describing something other than the notice. That is the second half of the Atlantic Union order below, and the reason call monitoring and opt-in testing belong together; the call-side view is in UDAAP violation examples from bank calls and contact centers.
A phone opt-in that holds, and one that does not
Valid sequence: The written notice was delivered, or e-delivered with the customer’s agreement, and its date is kept
Invalid sequence: No notice yet: it will be mailed with the welcome pack
Valid sequence: The agent describes the service as the notice does and takes a yes that is separate from any other consent
Invalid sequence: The agent offers to stop declines and turns the service on
Valid sequence: Confirmation with the right to revoke goes out the same day
Invalid sequence: Notice and confirmation mailed together two days later
Valid sequence: Only on items paid after the confirmation was mailed
Invalid sequence: The next evening, before either document went out
Valid sequence: A consent that can be shown in order
Invalid sequence: No valid consent: every ATM and one-time debit fee is refundable until a new consent is taken
What if the notice came after consent? The Atlantic Union order
Then there is no consent. In December 2023 the CFPB found that Atlantic Union Bank violated Regulation E because, during in-branch account opening, its employees "requested that new customers orally provide their enrollment decision before providing them with an adequate written notice describing the overdraft service". It also found the bank misled customers who opted in by phone about which transactions the service covered, and that those phone opt-ins also violated Regulation E. The order required at least $5 million in redress and a $1.2 million penalty (CFPB enforcement page).
The sequence failure is the expensive one, because it does not stop at one fee. If consent was invalid, every ATM and one-time debit card overdraft fee charged on that account is a fee charged without consent, from the first to the last. TD Bank's 2020 order shows the scale that reaches: the CFPB found TD charged such fees "without obtaining their affirmative consent" and ordered an estimated $97 million in restitution and a $25 million penalty (CFPB enforcement page).
What a broken opt-in sequence has cost
$5M+
redress Atlantic Union Bank was ordered to pay in 2023, plus a $1.2 million penalty
$97M
estimated restitution TD Bank was ordered to pay in 2020, plus a $25 million penalty
162
phone opt-ins taken before the notice was sent, in one sample year at the fictional sample credit union
Consent that does not count, even with a confirmation
A confirmation letter cannot rescue a consent the rule does not recognise. The official interpretation is specific: consent "must be obtained separately from other consents or acknowledgements", including an e-sign consent; a signature line or check box may be used only "solely for purposes of evidencing the consumer's choice"; and an institution does not obtain consent "by including preprinted language about the overdraft service in an account disclosure provided with a signature card", or "by providing a signature card that contains a pre-selected check box" (comment 17(b)-6).
At account opening an institution may require the customer to choose, yes or no, as a step in opening the account, but "if the consumer does not check any box or provide a signature, the institution must assume that the consumer does not opt in" (comment 17(b)-5). A confirmation sent to a customer whose box was blank confirms a consent that never happened.
Does the confirmation need to mention revocation?
Yes, it is one of the two required elements. Revocation itself has rules worth putting in the letter's back office as well as its text. A consumer "may also revoke consent at any time in the manner made available to the consumer for providing consent", and the institution "must implement a consumer's revocation of consent as soon as reasonably practicable" (1005.17(f)). On a joint account, either holder's consent counts for the account, and so does either holder's revocation (1005.17(e)).
The Board declined to set a deadline for implementing a revocation because it "may depend on a number of variables, including the method used by the consumer to communicate the revocation request", so the evidence that matters is the time between the request and the core's change. Fees charged before the revocation took effect need not be reversed (comment 17(f)-1); fees charged after it was received and should have been implemented are the test.
How long should a bank keep opt-in evidence?
At least two years under Regulation E, which requires institutions to keep evidence that they complied for two years or more from the date the disclosure or action was due (12 CFR 1005.13(b)(1)). An opt-in, though, is effective until revoked (1005.17(g)), so the consent behind a fee charged in 2026 may have been taken in 2015. The evidence that proves today's fee is as old as the consent, so a retention schedule that destroys it two years after it was taken can leave a fee charged today with nothing behind it.
The evidence behind one opt-in, and where each piece usually lives
| Evidence | Proves | Usually held in |
|---|---|---|
| Notice version and delivery date | The notice came first and was segregated, 1005.17(b)(1)(i) | Disclosure library and mailing or e-delivery log |
| E-delivery agreement, if the notice or confirmation was electronic | Electronic delivery was allowed | Online banking enrolment |
| The consent: form, call or click, with a timestamp | Affirmative consent, obtained separately, 1005.17(b)(1)(iii) | Signed form image, call recording and transcript, or web log |
| Confirmation with the right to revoke, and its mailing date | 1005.17(b)(1)(iv) and the fee-timing safe harbor in comment 17(b)-7 | Correspondence system |
| Core opt-in flag and the date it was set | What the core did, not what the customer agreed | Core banking system |
| Revocation request and the date the core changed | Implemented as soon as reasonably practicable, 1005.17(f) | Contact centre, branch and core change history |
Testing every opt-in behind every fee
A sample of opt-in forms proves the template. It does not prove that the 214 customers in a finding consented before they were charged. Botminds' Overdraft Compliance opens the opt-in behind every ATM and one-time debit card fee and reads the four steps in the order 1005.17 requires: the notice, a reasonable opportunity, the consent and the written confirmation. Its rule is that the core's opt-in flag is never treated as consent. In the fictional sample year it read 188,412 opt-ins and found 214 members who paid 389 fees, $11,281.00, without a valid consent: 162 phone opt-ins taken before the notice was sent and 52 lost in a core conversion.
Overdraft Compliance reads the consent behind a fee, in order
The examiner's view is the same evidence, assembled. In the sample, the NCUA examiner pack carries a section on the consent tests with every opt-in read, member names masked and account numbers shown by their last four digits, and an internal auditor who reads everything and changes nothing. How a small credit union can run that program with one compliance officer is the subject of NCUA overdraft guidance when you are the whole compliance department.
The examiner pack carries every consent tested, not a sample
The supervisory expectation behind this goes beyond Regulation E. The FDIC's overdraft payment guidance, amended in February 2026 and still in force, tells institutions not to "steer frequent users of fee-based overdraft products to opt-in to these programs while obscuring the availability of alternatives" (FDIC FIL-81-2010). The notice's alternatives line and a clean sequence are the evidence that no steering happened; how the notice itself must read is in the Reg E opt-in model form A-9, annotated line by line.
Questions people ask
Can a branch take an oral overdraft opt-in?
Only after the customer has been given the written notice, and only as a consent obtained separately from other account-opening consents. Atlantic Union Bank's 2023 order turned on branch staff asking for an oral enrollment decision before an adequate written notice was provided, which the CFPB found violated Regulation E.
How do you prove a customer opted in?
With dated evidence of three events in order: the notice delivered, the consent given and the confirmation with the right to revoke sent, followed by fees only on items paid after the confirmation. The core's opt-in flag shows what the system did; it does not show any of the three events.
Can the confirmation be sent by e-mail?
Yes, if the consumer agrees to electronic delivery; otherwise it must be in writing. The agreement to electronic delivery is itself a separate consent, and comment 17(b)-6 says the overdraft opt-in must be obtained separately from it.
Does a joint account need two opt-ins?
No. Under 1005.17(e), the affirmative consent of any one joint holder is consent for the account, and a revocation by any one holder revokes it for the account. The confirmation should go to the holder who consented, and the evidence should say who that was.
What happens to fees if the opt-in is found invalid?
Every ATM and one-time debit card overdraft fee charged without a valid consent is charged in breach of 1005.17(b)(1), so the usual remedy is to refund them all on the account and take a new consent, notice first. In the sample, the agents propose exactly that, and until the member consents again, card and ATM items that would overdraw are declined rather than paid for a fee.