Consumer Financial Protection Circular 2024-05

Question presented

Can a financial institution violate the law if there is no proof that it has obtained consumers’ affirmative consent before levying overdraft fees for ATM and one-time debit card transactions?

Response

Yes. A bank or credit union can be in violation of the Electronic Fund Transfer Act (EFTA) and Regulation E if there is no proof that it obtained affirmative consent to enrollment in covered overdraft services. The form of the records that demonstrate consumer consent to enrollment may vary according to the channel through which the consumer opts into covered overdraft services.

Regulation E’s overdraft provisions establish an opt-in regime, not an opt-out regime, where the default condition is that consumers are not enrolled in covered overdraft services. Financial institutions are prohibited from charging fees for such services until consumers affirmatively consent to enrollment. Violations of 12 CFR 1005.17(b)(1) can be proven in part by showing evidence that a consumer was charged an overdraft fee on a covered transaction where the available evidence does not adequately validate that the consumer opted in.¹

Regulatory background

Regulation E implements the EFTA and governs the assessment of certain overdraft fees. Specifically, before a financial institution may charge a consumer a fee in connection with an ATM or one-time debit transaction, Regulation E requires the financial institution to provide consumers with a “reasonable opportunity for the consumer to affirmatively consent, or opt in” to covered overdraft services, and to obtain the consumer’s “affirmative consent, or opt in” to such services.² Institutions are also required to provide consumers with a written or electronic notice describing the institution’s overdraft services prior to opt in, and to provide consumers with confirmation of the consumer’s consent to enrollment in writing or electronically with a notice informing the consumer of the right to revoke such consent.³ These rules do not apply to overdraft fees charged on written checks, recurring debit transactions, or ACH transactions.

Analysis

As noted above, Regulation E sets forth an opt-in, rather than opt-out, process before financial institutions are permitted to assess fees for covered overdraft services. The opt-in provisions provide that, absent affirmative enrollment by consumers, consumers’ default status is to not be enrolled in covered overdraft services. Regulation E’s opt-in provisions were established after the Federal Reserve Board found that consumers who were automatically enrolled in overdraft services may prefer to “avoid fees for a service they did not request."⁴ Therefore, consistent with this opt-in design, when determining compliance with Regulation E’s opt-in provisions, regulators and enforcers should inspect the financial institutions’ records to determine whether there is evidence of affirmative consent to enrollment in covered overdraft services.

In the CFPB’s supervisory work, examinations have found that some institutions have been unable to provide evidence that consumers had opted into overdraft coverage before they were charged fees for ATM and one-time debit transactions. While some institutions maintained policies and procedures relating to Regulation E’s overdraft opt-in requirements, supervisory examinations found that the institutions were unable to show that these policies and procedures were actually followed with respect to individual consumers. In response to examination findings, institutions began maintaining records to prove the consumer’s affirmative consent to enrollment in covered overdraft services.

In supervisory and enforcement work, the CFPB has also identified numerous other violations of law relating to Regulation E’s overdraft opt-in requirements over the years. These violations have included, for example: the failure of institutions to obtain consumers’ affirmative consent to enrollment in covered overdraft services,⁵ and obtaining consumers’ opt-in to covered overdraft services through deceptive and abusive acts or practices.⁶ The prevalence of violations related to overdraft opt in underscores the need for effective supervision and enforcement of Regulation E’s overdraft opt-in provisions.

Form of records evidencing opt-in

The form of the records that demonstrate consumer consent to enrollment may vary according to the channel through which the consumer opts into covered overdraft services. For example:

• For consumers who opt into covered overdraft services in person or by postal mail, a copy of a form signed or initialed by the consumer indicating the consumer’s affirmative consent to opting into covered overdraft services would constitute evidence of consumer consent to enrollment.
• For consumers who opt into covered overdraft services over the phone, a recording of the phone call in which the consumer elected to opt into covered overdraft services would constitute evidence of consumer consent to enrollment.
• For consumers who opt into covered overdraft services online or through a mobile app, a securely stored and unalterable “electronic signature” as defined in the E-Sign Act (15 U.S.C. 7006(5)) conclusively demonstrating the specific consumer’s action to affirmatively opt in and the date that the consumer opted in would constitute evidence of consumer consent to enrollment.