Reg E audit checklist: plant the errors examiners cite, count catches

A Reg E audit checklist is the set of tests an internal auditor or compliance tester runs over a bank's or credit union's Regulation E error-resolution work: whether notices were dated and investigated promptly, whether provisional credit was timely, complete and usable, whether results, denials and reversals carried the required content on time, and whether denials met the institution's burden of proof. The interagency examination procedures expect the audit to cover "all provisions of Regulation E as applicable", including work done by service providers, with "an audit trail that supports the findings." The weak point in most programs is not the list but its power: a quarterly sample rarely contains the defect that matters. This guide builds the checklist from the defects regulators have published, shows how to plant them to measure whether monitoring catches them, and explains how Botminds' Reg E Dispute Management tests the timing of every closed claim.

What should a Reg E audit include?

A Reg E audit should include the program (policies, procedures, training, third-party oversight), the transactions (closed and open error files tested against every deadline and content rule), and the evidence (that the institution can show what it did and when). The interagency procedures reproduced in the FDIC's consumer compliance examination manual set out what examiners look for in an institution's own audit: whether its scope reaches every key process, including the work outsourced to service providers, whether "testing includes risk-based samples covering product types and decision centers," whether significant deficiencies reach management or the board, and whether "the frequency of review is appropriate."

On the transaction side, the same procedures ask examiners to determine whether the institution "investigates alleged errors and notifies consumers of the results within allotted time frames and, when appropriate, provisionally re-credits the account," and whether it follows the required procedures after finding an error or no error. Section 1005.13(b) adds the evidence requirement: evidence of compliance must be kept for at least two years (12 CFR 1005.13); what that evidence has to contain for a denied claim is set out in Reg E documentation. An audit that cannot reconstruct a claim's dates from retained evidence has found a violation of its own.

What are the most common Reg E violations examiners cite?

The most common Reg E violations are late or conditioned investigations, missing or incomplete provisional credit, late or incomplete notices, generic denial explanations without the right to request documents, and reversals without the required notice. The Federal Reserve's review of 2024 supervisory data (Consumer Compliance Outlook, First Issue 2026) found each of them, and the CFPB's Supervisory Highlights add a long list of specific provisional-credit failures.

Two items from the CFPB's Summer 2021 edition show how specific the published list is. Examiners cited institutions for "Posting the provisional credit to the wrong account, by failing to ensure that the ownership of the credited account matched the account that should have received the credit," and for "Excluding interest from the provisional credit" (CFPB Supervisory Highlights, Issue 24). Neither shows up in a test that only checks whether a credit date sits inside ten business days. Both are exactly the kind of defect that a planted test claim can carry.

The planted-defect test: how to measure what your monitoring misses

A planted-defect test measures monitoring the way a fire drill measures an alarm: put known defects into the population, run the monitoring as it normally runs, and count which ones it reports. The number that matters is the catch rate per defect type, because a program that finds every late credit but no wrong-account credit has a blind spot that no overall pass rate will show.

The method is simple to run. Copy a set of closed claims into a test environment. Alter each copy to carry exactly one defect from the table above, keeping a key that only the tester holds. Mix them into an ordinary month's closures. Run every check the program uses: automated reports, the compliance sample, the second review. Then score each defect type as caught or missed. A defect that the program misses is not a finding about one claim; it is a finding about the test itself, and it goes into the audit report as a control gap.

Two design rules keep the test honest. Plant each defect type several times, because a single plant tells you little about a sampling program that might simply not have drawn it. And plant defects in the places the published findings came from: vendor-generated notices, posting systems and templates, not only the specialist's own work. The Federal Reserve attributed many 2024 violations to third-party templates and vendor delays, and the interagency procedures expect an audit's scope to reach them.

How do you test Reg E provisional credit timing?

Test provisional credit as five separate facts, not one date. For every claim whose investigation ran past business day 10 (20 for a new account): was the account credited by that day; for the full amount of the alleged error with interest where the account earns it, less at most $50 and only where 1005.6 allows; to the right account; with full use of the funds; and was the consumer told the amount and date within two business days of the credit? Each fact has its own failure in the published findings.

The exception needs its own test. An institution need not credit if it required written confirmation of an oral notice and did not receive it within 10 business days, but only if it told the consumer of the requirement and the address during the call. A tester should treat every "no credit, confirmation not received" claim as unproven until the call shows the disclosure. Claims that started in writing cannot use the exception at all.

How do you test denied Reg E claims?

Test every denial against the burden of proof, not only against the letter template. When the error alleged is an unauthorized transfer, the Electronic Fund Transfer Act puts the burden on the institution to show it was authorized, and the Federal Reserve's October 2025 examiner insights spell out the test: "For each previously denied allegation within the selected sample, the institution can confirm that employees reviewed all relevant information within the institution’s records and that the findings of the investigation met the institution’s burden of proof to establish that an error did not occur" (Consumer Compliance Outlook, Third Issue 2025).

In practice the tester asks three questions of each denial. What evidence in the institution's own records supports authorization: device, location, chip or PIN data, history? Did the reason given rest on something the rule does not allow, such as a prior relationship with the merchant, a missing affidavit or the consumer's negligence? And does the written explanation state the findings in words the consumer can follow, with the right to request the documents relied on? The CFPB's Spring 2022 edition records institutions that left that right out and then "failed to fulfill consumers’ subsequent requests" for the documents (CFPB Supervisory Highlights, Issue 26).

How many Reg E claims should be sampled, and can every claim be tested?

Timing can be tested on every claim, because it is arithmetic on dates the institution already holds; sampling is for the judgements that need a person. Neither Regulation E nor the interagency procedures fix a sample size; they ask only that samples follow risk and reach every product type and decision center. The arithmetic shows why a sample is weak for timing. If 3 of 2,512 monthly closures have a timing defect, a random sample of 60 contains at least one of them only about 7% of the time; a sample of 250 does so about 27% of the time.

The rest of the checklist follows from that split. Run the date tests on the full population. Run the content checks on every letter by machine and on a sample by a person. Review every denial if volume allows; if it does not, weight the sample toward products and decision centers where denials are most frequent. And plant defects at least once a year to prove the whole arrangement catches what it claims to.

Every September closure tested for timing, a sample read for letters

What the examiner will ask to see

Examiners start from documents and then test files, so the audit should prepare the same set. The interagency procedures list what examiners obtain: disclosure forms, procedural manuals and written policies, periodic statements, the error resolution files, the form letters sent when a consumer asks about or disputes a transfer, any contract that divides compliance duties with a third party, and the consumer complaint files. Complaint files deserve attention: the Federal Reserve's complaint data show that error resolution was 11.08% of all complaints it closed in 2024, and the Federal Reserve's review of 2024 violations lists complaint review among its sound practices, to catch Regulation E errors that monitoring and audits missed.

Who did what, when, why and on which evidence

The Reg E audit checklist: tests to run every cycle

Testing with Reg E Dispute Management

Reg E Dispute Management runs the date tests on every closed claim each month and checks every letter's required elements before a person sees it, so the compliance officer's time goes to the exceptions and to the judgements a machine should not make. In the solution's fictional sample month, all 2,512 September closures were tested for timing and 3 exceptions (0.12%) were listed, each reviewed by a person; 60 letters were sampled and pre-read, with 2 findings.

The sample month's findings are a fair picture of what full-population testing turns up: a notice sent on the third business day when two were allowed, a result reported on the fourth, a point-of-sale claim run on the 45-day clock instead of 90, a denial letter from a retired template without the right-to-documents line, and a credit that left out $5.00 of fees. None is dramatic. All are the kind of finding an examiner cites, and none would have been likely to appear in a sample of 60. The letter rules behind two of them are set out in Reg E letter samples, and the cost of the ones that slip through in Reg E violation penalties.

Questions people ask

What are the Regulation E examination procedures?

They are the interagency procedures examiners use, reproduced in the FDIC’s consumer compliance examination manual. They review management, policies, audit scope and training first, then transaction-test error resolution files, form letters, third-party agreements and complaint files against 1005.6 and 1005.11.

How often should a Reg E audit be done?

Regulation E sets no frequency; examiners judge whether "the frequency of review is appropriate" for the institution’s risk. A common pattern is an annual independent audit, with monthly compliance monitoring of timing and letters in between.

What is the difference between a Reg E audit and Reg E monitoring?

Monitoring is the compliance function’s routine testing of claims as they close; an audit is an independent check that the program, including its monitoring, works. A planted-defect test belongs to the audit, because it measures whether monitoring catches what it should.

Do examiners test claims handled by a vendor?

Yes. The interagency procedures expect the audit’s scope to include functions carried out by third-party service providers, and the Federal Reserve traced many 2024 violations to vendor templates and late vendor notices.

How long must Reg E dispute files be kept?

Section 1005.13(b) requires evidence of compliance for at least two years from the date the action was required, and longer when the institution knows it is under investigation or has been sued under the Act.