First response time is the time between a customer's message arriving and the first reply a person sends to it, usually reported as a median or an average over a week or a month, and often counted only in business hours. It is a standard service measure for written channels. In a bank's secure message center it is also misleading, because a message that holds a Regulation E notice of error starts a second clock the moment it arrives: 10 business days to decide whether an error occurred or to credit the account provisionally. That clock does not pause for the weekend queue, and a first response time that looks healthy can hide notices that reach the dispute team with two business days already gone. Botminds' Secure Message Triage reads each message as it arrives and dates every legal clock to the arrival day, so the first response measures service and nothing else. This guide prices the gap for a bank that does not.
Two clocks start when a secure message lands
4business hours
a sample first-response standard: a service target the bank sets for itself
10business days
to decide a Reg E notice of error, or credit provisionally, counted from receipt
92%
of 2025 checking or savings complaints to the CFPB came after the consumer had first tried the company
What is first response time, and how is it calculated?
First response time is the timestamp of the first human reply minus the timestamp of the customer's message. The definition is simple; three choices inside it decide what the number means. The first is what counts as a response: an automatic "we received your message" does not answer anything and should be excluded. The second is the clock: business hours make a Friday-evening message that is answered at 10 AM Monday look like a one-hour wait, calendar hours make it look like a 64-hour one. The third is the statistic: an average is pulled by a few very slow messages, so most teams report a median, and a 90th percentile shows how long the slowest tenth waited.
For a bank, add a fourth choice: measure per request, not per message. A reply that answers a customer's question about a fee in two hours, and ignores the card charge she disputed in the same message, has a two-hour first response time and an unanswered notice of error. The number is honest about the message and silent about the request that carried a deadline.
What is a good first response time for a bank's secure messages?
There is no regulatory figure for it; it is a service standard each bank sets, and the right one depends on staffing and on what the queue holds. The sample credit union on this page promises a first response within four business hours and escalates to the supervisor on duty at three. That is a reasonable service promise. It is not a compliance control, because a business-hours clock and a legal clock count different things.
The useful question is not "what is good" but "good for which request". A balance question can wait until tomorrow. A request to stop a debit due in three business days cannot. A notice of error does not need a reply within hours, but it does need to reach the person who owns its clock with the right date on it, and that is a routing standard, not a reply standard.
Why the Reg E clock does not wait for business hours
Because a notice is received when it arrives, and the regulation says so in terms. A business day is a day the bank's offices are open to the public for substantially all of their business (12 CFR 1005.2(d)), and the official interpretation settles the after-hours question: a business day runs to midnight, and a notice given after the office has closed still counts as given (comment 2(d)-1). The same comment spares the bank from keeping its phones staffed around the clock, and the Reg E error resolution calculator counts the days that follow on a real calendar.
"A financial institution shall investigate promptly and, except as otherwise provided in this paragraph (c), shall determine whether an error occurred within 10 business days of receiving a notice of error."
Regulation E, 12 CFR 1005.11(c)(1)
Put the two together and the inbox has its rule. The bank is not obliged to staff it at night; it is obliged to count from the night the message came in. A message sent at 9 PM on a Friday was received on Friday, and Friday is day 0 whether anyone read it then or on Monday afternoon.
Pricing a slow inbox: a calculator you fill with your own numbers
The cost of a slow inbox is mostly paid in business days taken from investigations, and you can count those before you put a dollar figure on anything. The table sets out the lines, the formula for each and what the sample credit union's weekend would have shown if its notices had been keyed by hand on the Tuesday.
The queue clock: business days a slow inbox takes from Reg E investigations
| Line | How to compute it | Sample credit union, one weekend | Your bank |
|---|---|---|---|
| A. Messages in the period | Count from the message center | 2,186 (Friday 6 PM to Monday morning) | — |
| B. Share carrying a notice of error | From a planted test or a reviewed sample of your own messages | 241 of 2,186, about 11% | — |
| C. Business days lost per notice | Business days between arrival and the day the dispute team gets it with the right date | 2, if keyed on Tuesday with Tuesday as the date | — |
| D. Investigation days lost | A × B × C | 482 business days across 241 notices | — |
| E. Notices reaching day 10 undecided | Count from the dispute system | From your own data | — |
| F. Provisional credit outstanding | E × average disputed amount | From your own data | — |
Line C is the one most banks have never measured, because the dispute system shows the date that was keyed. Measure it once by hand: take 50 disputes that began in secure messages, find each original message, and compare its arrival timestamp with the notice date in the dispute file. Any gap is business days the investigation never had, and if the dispute file's date is the later one, it is also a deadline computed wrongly.
The dollar lines follow from the days. A notice that reaches day 10 undecided needs provisional credit to take the 45-day route, so every business day lost to the queue moves some disputes from "decided" to "credited while we finish". Examiners read late dates as violations rather than delays; in 2014 the CFPB reported institutions that held off investigating phone disputes until the customer sent back a confirmation form (Supervisory Highlights, Fall 2014; how to train that habit out of a team is in Reg E training). And in the Bank of America order, the CFPB also found the bank had failed to timely investigate and resolve cardholders' claims (CFPB, 2022).
A weekend message, drawn to scale on the business-day calendar
Take a notice that arrives at 6:20 PM on Friday 16 October 2026. Received Friday, its 10 business days run from Monday 19 October (day 1) to Friday 30 October (day 10). If it is read on Monday afternoon and keyed into the dispute system on Tuesday with Tuesday's date, the system computes a due date of Tuesday 3 November: two business days later than the rule allows, and nobody can see the difference.
The same notice, dated on arrival and dated when keyed
- WeekendSat–Sun
- Investigation: 10 business daysMon 19 – Fri 30 Oct
- WeekendSat–Sun
- In the queueMon–Tue
- Investigation as the system sees itWed 21 Oct – Tue 3 Nov
The weekend is what makes this common rather than rare. Messages sent on Saturday or Sunday are received on a non-business day, so their first business day is Monday; keyed on Tuesday, they also land two business days late. A bank whose secure inbox is read Monday to Friday has, every Monday, a batch of notices whose clocks have started without it.
Does a slow reply affect the Reg E deadline? It spends it
A slow reply does not move the deadline; it uses it up. The ten business days in 1005.11(c)(1), quoted above, run from receipt, not from the first reply. Every business day the message waits in the service queue is a day the dispute specialist does not have.
Where the ten business days go
Read on arrival, handed off the same day
- Investigation · 100%
Read Monday, keyed Tuesday (weekend message)
- Service queue and keying · 20%
- Investigation · 80%
When is provisional credit due under Reg E?
Within 10 business days of receiving the notice, if the bank cannot finish its investigation in that time and wants up to 45 days (90 in some cases) to complete it. To use the longer period it must provisionally credit "the amount of the alleged error (including interest where applicable) within 10 business days of receiving the error notice", tell the customer within two business days after crediting, and give full use of the funds (1005.11(c)(2)). The one written-notice escape in that paragraph, for a bank that requires but does not receive written confirmation of an oral notice, does not arise for a secure message, which is already written.
So the queue's cost lands here first. A notice that reaches the specialist on day 2 has eight business days for a decision before provisional credit is due. The Reg E Dispute Management guide to the Reg E dispute timeline follows the deadlines after that point.
What does a delayed dispute cost a bank?
It costs investigation time, money credited before a decision, customer trust and examiner attention, in roughly that order of how often each shows up. The first two are in the calculator above. The third is visible in the CFPB's complaint data: in 2025, in 92% of checking or savings complaints, "consumers reported first attempting to resolve their issue with the company" (CFPB, Consumer Response Annual Report 2025). A dispute that sat unrecognised in a message center is one the customer already tried to raise.
The fourth is the hardest to price and the easiest to avoid. A late date is not a judgement call that an examiner might weigh; it is a deadline missed by arithmetic. The same message center that produces it holds the evidence that it was avoidable: the timestamp on the customer's message.
How do you prioritise messages with deadlines? By due date, not arrival
Order the queue by the earliest deadline any request in a message carries, and keep the legal clocks in a separate view counted in business days. Arrival order treats a stop payment due tomorrow like a rate question; topic order treats a three-request message as whatever its first request was. In Secure Message Triage the representative's queue is ordered by first-response due time, while every legal clock a message started sits on the clocks view with its owner and an escalation ladder: for a notice of error, a reminder on day 8, an escalation on day 9 and provisional credit proposed for approval on day 10.
Every legal clock from the message center, counted in business days
What SLA should a bank set for secure messages?
Set service levels by request, with the legal ones written as routing deadlines rather than reply times. The table is our suggestion for a bank writing its first; the two middle rows are where the law, not the service team, sets the outer limit.
Service levels for a secure inbox, request by request
| Request | Service level we suggest | What sets the outer limit |
|---|---|---|
| Any message | First human reply within the bank's published standard (sample: 4 business hours) | Bank policy |
| Notice of error (debit, ACH) | Dated on arrival; with the dispute team the same business day | Regulation E: decide or credit within 10 business days of receipt |
| Stop a preauthorized debit | Placed the day it arrives, before the next debit run | Regulation E: honored if received three business days before the debit |
| Billing error (credit card) | Dated on arrival; acknowledgment sent well inside 30 days | Regulation Z: acknowledge within 30 days, resolve within two billing cycles |
| Complaint | Logged the day it arrives | Bank complaint policy (sample: acknowledge in 2 business days, resolve in 15) |
| Closure or account change | Within the bank's standard (sample: 2 business days) | Bank policy and the account agreement |
Each clock's start, deadline and rule, set by the bank
Read with the eight-week go-live plan, the table is also a test plan: each row is a deadline the triage step can be measured against in shadow mode before any reply is sent. And the date on every notice depends on what counts as a notice of error in the first place.
Questions people ask
Is first response time the same as resolution time?
No. First response time stops at the first human reply; resolution time stops when the request is finished. For a Reg E dispute the two can be weeks apart, because a good first reply confirms the dispute and its timeline while the investigation runs for up to 10 business days, or 45 days with provisional credit.
Should automatic acknowledgments count as a first response?
Not for the service measure: an automatic receipt answers nothing. It is still useful to the customer as proof of the date the bank received the message, and it should never be mistaken for the date anyone read it.
Does a weekend count against first response time?
Under a business-hours measure, no; under a calendar measure, yes. Under Regulation E the question does not arise: a notice given on a Saturday is received on Saturday, and its 10 business days are counted on the bank's calendar from there.
Why report the 90th percentile as well as the median?
Because the median describes a typical message and the 90th percentile describes the slow tail, which is where weekend backlogs, second-language messages and multi-request messages sit. A notice of error is more likely to be in the tail than the median message, so the tail is the number to watch.
How does Secure Message Triage measure first response?
As a setting: the sample credit union counts four business hours from arrival during business hours and escalates at three. The legal clocks are counted separately, from the day the message arrived, so a fast first response cannot hide a late notice date.