Reg E violation penalties: damages, multipliers and the class cap

Reg E violation penalties come from two sources. The Electronic Fund Transfer Act lets a consumer sue for actual damages, statutory damages of $100 to $1,000 in an individual action, costs and attorney's fees, and three times actual damages when an institution failed to provisionally recredit within the ten-day period without a good-faith investigation; in a class action, statutory damages are capped at the lesser of $500,000 or 1% of the institution's net worth (15 U.S.C. 1693m, 1693f(e)). Regulators then add civil money penalties, redress and orders to fix the program: the CFPB fined U.S. Bank $15 million in 2023 and Block $55 million in 2025 over error-resolution failures, among others. For a head of payments or a CFO, the useful view is a ladder that starts at one late claim; Botminds' Reg E Dispute Management is built to keep claims off its lowest rungs, which is where every higher rung begins.

What are the penalties for violating Reg E?

The penalties for violating Reg E are civil liability to consumers under the Electronic Fund Transfer Act, administrative enforcement by the institution's regulator, and in rare knowing cases criminal liability. Section 1693m makes "any person who fails to comply with any provision of this subchapter" liable to the consumer, with one important exception written into the same sentence: "except for an error resolved in accordance with section 1693f." An error handled within the error-resolution rules is not itself a violation. An error handled late, without provisional credit, or without a proper explanation is.

Enforcement is split by charter. Under 15 U.S.C. 1693o, compliance is enforced by the appropriate federal banking agency for banks and savings associations, by the National Credit Union Administration for federal credit unions, and by the CFPB "with respect to any person subject to this subchapter," subject to its supervision limits. A slower year at one agency does not change the private right of action or the others' authority.

The damages ladder, rung by rung

Each rung multiplies the one below it. Actual damages are often small on a single claim: the withheld funds are eventually credited, so what remains is the overdraft fee, the returned payment, the late charge on a bill the consumer could not pay. Statutory damages of $100 to $1,000 then attach to the failure itself, and the court sets the amount on "the frequency and persistence of noncompliance, the nature of such noncompliance, and the extent to which the noncompliance was intentional." Costs and "a reasonable attorney’s fee as determined by the court" follow any successful action, which is why consumer lawyers can bring small Regulation E cases at all.

Two features shorten the window and soften the edges. An action must be brought "within one year from the date of the occurrence of the violation." And a person "may not be held liable" for a violation shown by a preponderance of evidence to be unintentional and to have "resulted from a bona fide error notwithstanding the maintenance of procedures reasonably adapted to avoid any such error." That defence is only as strong as the procedures behind it, which is one reason examiners and auditors look so closely at monitoring.

What are treble damages under EFTA?

Treble damages under EFTA are three times the consumer's actual damages, awarded when a court finds one of two failures in error resolution. The first is a missed provisional credit combined with a bad investigation: the institution "did not provisionally recredit a consumer’s account within the ten-day period" and either "did not make a good faith investigation of the alleged error" or "did not have a reasonable basis for believing that the consumer’s account was not in error." The second is a denial the evidence could not support: the institution "knowingly and willfully concluded that the consumer’s account was not in error when such conclusion could not reasonably have been drawn from the evidence available."

The first trigger is a timing failure dressed as an investigation failure, and it is the one an operations leader controls. An institution that credits provisionally by day 10 has taken itself off that branch of the treble-damages rule entirely, whatever the investigation later finds. The second trigger is about the quality of denials, and it is why a proposed "no error" deserves a second person and a look at every source behind it.

What is the class action cap under EFTA?

In a class action, EFTA allows no minimum recovery per member and caps statutory damages at "the lesser of $500,000 or 1 per centum of the net worth of the defendant," for "any class action or series of class actions arising out of the same failure to comply by the same person." The cap applies to statutory damages only. Actual damages for every class member, and costs and attorney's fees, sit outside it.

The cap's design matters for a board. A systemic failure, such as a template that leaves the right to request documents off every denial, or a policy that withholds provisional credit from a whole claim type, is one "failure to comply" affecting thousands of consumers. That is exactly the shape of the U.S. Bank and Block findings below, and it is the shape that turns a compliance defect into a reserve.

Civil money penalties: the three tiers and today's amounts

When the CFPB enforces Regulation E, the Consumer Financial Protection Act lets it seek a civil penalty for each day a violation continues, in three tiers that depend on the institution's state of mind. The statute's amounts have been adjusted for inflation each year; the current figures in 12 CFR 1083.1 apply to penalties assessed after January 15, 2025.

Per-day penalties explain the size of settled amounts. A defect that persists for a year is 365 days of exposure, and a reckless one can reach the second tier. In practice, consent orders state a single agreed figure, and the mitigating factors in 5565(c)(3), above all good faith and history, are where an institution's own testing and remediation records count.

What U.S. Bank and Block paid, and what they were told to fix

Both recent CFPB orders about Regulation E error resolution turned on the same mechanics: notices not investigated in time, and provisional credit not given. In December 2023 the CFPB found that U.S. Bank, administering unemployment-benefit prepaid cards, had received "approximately 135,000 timely notices of error" and in "more than 5,860 cases" missed the 10-business-day investigation while giving no provisional credit or giving it late (CFPB consent order 2023-CFPB-0019). In January 2025 the CFPB ordered Block, the operator of Cash App, to pay $55 million in penalties and at least $75 million, up to $120 million, in redress, and found that it "failed to provide provisional credits where required for at least 153,866 claims" of unauthorized card transfers (CFPB consent order 2025-CFPB-0001; enforcement page).

The remedies tell a buyer what the regulator values. Block's order prices the harm of a missing provisional credit directly: for each affected consumer, "a pro rata portion of the amount that would have accrued, at a 30% APR (up to $50) on the full amount of the alleged Unauthorized Transfer for the duration of the period of time that the consumer would have had use of a provisional credit." It also requires a provisional credit "within ten business days" when an investigation is not finished, written explanations with the right to request documents, and an end to re-presenting chargebacks without an internal evaluation. U.S. Bank's order forbids requiring further written confirmation of notices "submitted online or in writing."

Fourteen claims at one ATM with no provisional credit yet

Is the CFPB still enforcing Reg E?

The CFPB's enforcement has narrowed, but Regulation E is still enforced, and not only by the CFPB. In its 2025 enforcement lookback the Bureau reported that between January 31 and December 31, 2025 it dismissed or withdrew as plaintiff in 19 actions and terminated or modified 22 pending orders or issued no-action letters, and said it was focusing on "actual consumer fraud where there are identifiable victims with material and measurable consumer damages" (CFPB, 2025 enforcement lookback). The U.S. Bank order was among those terminated, by an order filed on September 22, 2025 that also "waives any alleged non-compliance therewith" (termination order).

Three things have not changed. The banking agencies and the NCUA examine and enforce Regulation E for the institutions they supervise, and the Federal Reserve's own complaint investigations cited 761 Regulation E violations over 2020–2024, with banks "ordered to provide restitution to the consumer for violations" where applicable. The private right of action under 1693m does not depend on any agency. And a failure to provisionally credit, with a named consumer and a measurable loss, is precisely the kind of case the CFPB still says it pursues.

Defences the statute gives: bona fide error and the cure before suit

EFTA gives an institution two defences worth designing for. The first is the bona fide error defence in 1693m(c), which requires both an unintentional violation and procedures reasonably designed to prevent it: written procedures, training, monitoring and their evidence. The second is quieter and more useful. Under 1693m(e), a person "has no liability" for a failure if, before a suit is filed, it "notifies the consumer concerned of the failure, complies with the requirements of this subchapter, and makes an appropriate adjustment to the consumer’s account and pays actual damages."

The cure provision rewards finding failures before consumers' lawyers do. Monthly testing that lists every late notice, every short credit and every letter missing a required line, followed by a prompt correction and a letter to the consumer, is not only a compliance practice; under 1693m(e) it is a way of closing liability on each of those claims. The tests that find them are in the Reg E audit checklist.

What remediation of Reg E errors involves

Remediation means finding every affected consumer, not only the ones who complained, and making each whole: the amount, interest, the institution's fees caused by the error, and the cost of the delay where an order prices it. The CFPB's Summer 2021 Supervisory Highlights describe institutions that "identified and remediated all consumers whose Regulation E error claims were wrongly denied based upon pre-existing relationships with the merchant" (Issue 24). The Block order's 30% APR formula shows how a regulator values time without provisional credit.

Where Reg E Dispute Management lowers the exposure

Every higher rung of the ladder starts with a claim that ran late, had no provisional credit, or ended in a denial the evidence could not carry. Reg E Dispute Management attacks those three directly. The design target is a provisional-credit decision by business day 3 of 10, not on the last day the rule allows; claims escalate to a manager at business day 7 and to the head of the department at day 9 in the sample configuration; and a proposed "no error" below the confidence threshold cannot be approved until the specialist has opened every source behind it.

A credit approved on day 3, with a reason and a second person to check it

The solution also produces the evidence that the 1693m(c) defence and the 5565(c)(3) mitigating factors depend on: every action by a person or an agent, with its reason and its sources, kept on an audit trail, and every closure tested for timing each month. It does not make an institution immune; a person still decides each claim and owns that decision. What it changes is the most common reason institutions climb the ladder at all. For the deadlines themselves, see the Reg E dispute timeline.

Questions people ask

Can a consumer sue a bank under Reg E?

Yes. Section 1693m gives consumers a private right of action for actual damages, statutory damages of $100 to $1,000 in an individual case, costs and attorney’s fees, with treble damages for certain error-resolution failures. The suit must be filed within one year of the violation, in federal or state court.

What did U.S. Bank pay for Reg E failures?

Under its December 2023 consent order with the CFPB, U.S. Bank paid a $15 million civil money penalty and set aside $5.7 million for redress to unemployment-benefit cardholders. The CFPB terminated the order in September 2025, noting the bank had paid the penalty and made the redress payments.

Are Reg E penalties per claim or per violation?

Private statutory damages are per action, with one cap for a class; CFPB civil penalties are per day a violation continues, in three tiers. One defective template can therefore be one class-action failure and, for the regulator, a violation for every day it stays in use.

Is there criminal liability under Reg E?

Only for knowing and wilful conduct. Section 1693n(a) provides for a fine of up to $5,000, imprisonment of up to one year, or both, for anyone who knowingly and wilfully gives false information, fails to provide required information or otherwise fails to comply with the Act.

Does paying the consumer avoid Reg E liability?

It can, if done before a suit: 1693m(e) removes liability where the institution notifies the consumer of the failure, complies, adjusts the account and pays actual damages before an action is filed. It does not bind a regulator, which may still cite the violation.