The Reg E opt-in model form A-9, annotated line by line

The Reg E opt-in model form is Model Form A-9, "Model Consent Form for Overdraft Services", in Appendix A to Regulation E. A bank or credit union must give a notice "substantially similar" to it before it may charge an overdraft fee on an ATM withdrawal or a one-time debit card purchase, and the rule is unusually strict about content: the notice must include the listed items and "may not contain any information not specified in or otherwise permitted" by 12 CFR 1005.17(d). That makes the form itself the first test of an opt-in program: a missing daily limit, an added sales line or a notice bundled with other disclosures is visible before any fee is examined. Botminds' Overdraft Compliance reads the notice, the consent and the confirmation behind every ATM and one-time debit card fee. This page annotates the form line by line, with the rule behind each line.

The form text below is the model as published in Appendix A, with its brackets and example amounts; the notes are ours, each tied to the paragraph of 12 CFR 1005.17 or its official interpretation that requires it.

What is model form A-9?

It is the federal model for the overdraft opt-in notice that 12 CFR 1005.17(b)(1)(i) requires before an institution may charge for paying an ATM or one-time debit card overdraft. The notice must be in writing, or electronic if the consumer agrees, and "segregated from all other information". The Federal Reserve Board wrote it in 2009, when it adopted the opt-in rule effective July 1, 2010, and the CFPB republished it in its own Regulation E in December 2011. It lives in Appendix A to 12 CFR part 1005, published there as an image of the form.

The form does one job. It explains that an institution has "standard overdraft practices", says which transactions it pays into overdraft without asking and which it will not pay unless the customer asks, states the fees and the limit, and gives the customer a way to say yes. Everything else an institution might want to say about overdrafts belongs somewhere else.

What must an overdraft opt-in notice include?

Five items, listed in 12 CFR 1005.17(d)(1) through (5), and nothing else except the optional additions in (d)(6). The list is short enough to check on one page, and an examiner will.

Is model form A-9 required, or can a bank write its own opt-in form?

The model is not mandatory word for word; substantial similarity is. 12 CFR 1005.17(d) says the notice "shall be substantially similar to Model Form A-9", so an institution may write its own, in its own layout, as long as it carries the required items, follows the model's structure closely enough to be substantially similar, and adds nothing the rule does not permit. The official interpretation expressly lets an institution tailor the form: it "need not provide the tear-off portion of Model Form A-9 if it is only permitting consumers to opt-in telephonically or electronically", and it may add or omit a line for declining (comment 17(d)-3).

What an institution may not do is make the notice longer in the ways a marketing team would. The Board's reason for fixing the content was its consumer testing, which found that the form's emphasis worked: "emphasizing certain language as shown in Model Form A-9 substantially enhanced consumer understanding", and additional content "may not be more prominent" than the required description (74 FR 59033). A bespoke form that buries the opt-in right under a paragraph about convenience fails that test before anyone reads the fees.

The Board tested a number of ways to address this misconception in the model form, and found that consumers best understood the concept of overdraft services as distinct from other forms of overdraft coverage when it was framed as an institution's “standard overdraft practices.”

Federal Reserve Board, final rule, 74 FR 59033 (November 17, 2009)

Can you add marketing to the A-9 form?

No. The notice "may not contain any information not specified in or otherwise permitted by" 12 CFR 1005.17(d). Paragraph (d)(6) lists what may be added, and the list is narrow: that the consumer may opt into or out of overdraft payment for other transactions such as checks, ACH and automatic bill payments, a way to exercise that choice, the returned-item fee, that merchants may charge their own fees, and the right to revoke consent. A slogan, a reason to opt in, a cross-sell or a testimonial is none of those.

Does the opt-in notice need the daily fee limit?

Yes, in one of two forms: "The maximum number of overdraft fees or charges that may be assessed per day, or, if applicable, that there is no limit" (12 CFR 1005.17(d)(3)). The 2009 rule explains the wording: the Board adopted it "to require disclosure of any daily limits on the number of overdraft fees or charges (or, that there are no limits)". The model shows the second form, "There is no limit on the total fees we can charge you for overdrawing your account."

The line is where the notice most often parts company with the core. An institution that has introduced a daily cap since it last revised its notice must update this line, and an institution whose notice states a cap must make sure the core applies it. In the fictional sample credit union the solution runs on, the fee schedule promised no more than four courtesy pay or returned-item fees a day; the core's cap was five until October 16, and 137 fifth fees on 131 members became a refund. That finding came from a disclosure test, and an opt-in notice that states a daily limit makes the same promise.

Overdraft Compliance compares each promise with what the core does

Why the A-9 form reads the way it does

Almost every choice on the form came out of the Board's consumer testing in 2008 and 2009, and knowing why helps decide what a tailored form must keep. Testing found "many consumers are unaware that they can incur overdrafts at the ATM or at POS, and that they believe instead that their transactions will be declined", which is why the form says plainly which transactions will be declined. Participants generally found the fees "even when located near the bottom of the notice", but the Board set the dollar amount in bold anyway, "to ensure that consumers view the fees". And the introductory paragraph mentions alternatives because placing them there "helped improve participants' comprehension" (74 FR 59033).

Where opt-in notices go wrong in enforcement

The public orders are less about the form than about the order in which it was used. In December 2023 the CFPB found that Atlantic Union Bank's employees, opening accounts in branches, asked new customers to say yes or no to overdraft coverage before handing them an adequate written notice, and that the bank misled customers who opted in by phone about which transactions were covered. The order required at least $5 million in redress and a $1.2 million penalty (CFPB enforcement page). A perfect A-9 handed over after the customer has said yes does not make the yes valid; the sequence is the subject of Reg E opt-in confirmation letter: proving the order of consent.

TD Bank's 2020 order shows the other failure: the notice was not the only thing the customer heard. The CFPB found TD charged overdraft fees to customers who had never affirmatively consented, and made misleading representations about its Debit Card Advance service in person, by phone and by mail, and ordered an estimated $97 million in restitution and a $25 million penalty (CFPB enforcement page). The CFPB's 2024 circular on improper opt-in practices, which drew on cases like these, was withdrawn on May 12, 2025 (90 FR 20084); the regulation the cases were brought under was not.

Testing the A-9 notice against the opt-in behind each fee

A form review proves the template. It does not prove that a given customer received it, before consenting, segregated from other papers, or that the core charges only those who consented. That is a test on each fee: for every ATM and one-time debit card courtesy pay fee, open the opt-in behind it and check that the notice came first, the consent second and the confirmation third. Overdraft Compliance does this with a dedicated agent that never treats the core's opt-in flag as consent.

Overdraft Compliance reads the consent behind each fee, in order

Across the sample year the solution read 188,412 opt-ins behind ATM and one-time debit card fees. The core's flag said every one of the 214 members in the finding had opted in. The documents said otherwise: 162 consents were taken by phone before the notice was sent, and 52 opt-ins were lost in a core conversion. A review of the A-9 template would have passed all of them. The wider testing approach, a year of postings rather than a template and a sample, is in overdraft protection compliance, tested on last year's postings.

Questions people ask

Does the A-9 form apply to credit unions?

Yes. Regulation E defines a financial institution as "a bank, savings association, credit union, or any other person that directly or indirectly holds an account belonging to a consumer", so 12 CFR 1005.17 and its model form apply to credit unions in the same way. A credit union's notice usually says courtesy pay where a bank's says overdraft, which is fine if the content is substantially similar.

Where are the Reg E model forms?

In Appendix A to 12 CFR part 1005 on the eCFR, which lists every model form and clause for Regulation E. A-9 appears there as an image of the form, with the brackets an institution fills in; the official interpretations that explain it are in Supplement I to part 1005, under section 1005.17.

Does the notice have to be on paper?

It must be in writing or, if the consumer agrees, electronic, and segregated from all other information either way. The consent itself can be taken by mail, phone, electronically or in person (comment 17(b)-4), but only after the notice has been provided.

Can the opt-in notice include the right to revoke?

Yes. Paragraph (d)(6) permits it, and comment 17(b)-7 notes that an institution can then satisfy the written confirmation requirement by sending the consumer a copy of the completed opt-in notice. Without that statement on the notice, the confirmation must be a separate document that includes it.

Do existing customers need a new A-9 if fees change?

The opt-in stays effective until revoked or until the institution ends the service (1005.17(g)), so a new consent is not required. The fee and limit lines on the notice given to new customers must be current, and a fee increase on an existing account is a change in terms under the account disclosure rules.