The Consumer Financial Protection Bureau (“CFPB”) issued a compliance bulletin (“Bulletin”) reminding entities of their obligation to obtain consumer authorization prior to automatically debiting a consumer’s account for recurring electronic fund transfers. The Bulletin states that the CFPB has observed that some entities may not fully comply with the authorization requirements imposed by the Electronic Fund Transfer Act (“EFTA”) and Regulation E, or that some entities may not be certain of these obligations or the intersection of these obligations and the Electronic Signatures in Global and National Commerce Act (“E-SIGN Act”). Nonetheless, the Bulletin emphasizes that, if the CFPB determines that an entity has engaged in acts or practices that violate the EFTA and Regulation E, or any other Federal consumer financial law, the agency will take appropriate supervisory or enforcement action to address the violations and seek all appropriate corrective measures, including remediation of harm to consumers and assessment of civil money penalties.


The Bulletin reminds companies of their obligations under the EFTA and its implementing Regulation E to obtain consumer authorization prior to initiation of recurring automatic debits from a consumer's account and to provide the consumer with a copy of the terms of the authorization.

With respect to the obligation to obtain authorization for automatic debits, the Bulletin states that the authorization must be readily identifiable to the consumer and the terms of the authorization must be clear and readily understandable to the consumer. The Bulletin further states that entities may obtain authorization for automatic debits “only by a writing signed or similarly authenticated by the consumer,” but the CFPB points out that paper, electronic or telephone authorizations are permitted, provided that electronic and telephone authorizations meet all of the applicable requirements of the E-SIGN Act. This includes the requirement that an electronic record be "inscribed on a tangible medium or […] stored in an electronic or other medium and [be] retrievable in perceivable form."With respect to telephone authorizations, the Bulletin notes that the requirements of Regulation E may be satisfied where a consumer provides the company with authorization by entering a code into a phone keypad or where the company records and retains oral authorization, so long as in either case, the consumer intends to sign the record as required by the E-SIGN Act. However, the CFPB warns that if telephone recordings are used, a company also should take care to comply with all state laws regarding the recording of telephone conversations.

The CFPB expresses concern that some companies may not be including key terms in the copy of the authorization provided to the consumer. Key terms would include the recurring nature of the automatic debits and the timing and amount of the payments. In its corresponding press release, the CFPB indicates concern that if consumers are not given clear information regarding the terms of automatic debits, they may not be able to manage the payments or ensure their account balance is large enough to avoid overdraft or insufficient funds fees. The CFPB encourages companies to, when practical, provide a copy of the authorization before the first automatic debit is initiated.

The CFPB specifically highlights mortgage servicing, student loan servicing, debt collection and short-term, small dollar lending companies as companies that solicit authorizations from consumers for payment by automatic debits. Although the Bulletin does not allege any specific practices by companies in these industries that violate the EFTA or Regulation E, the Bulletin appears to be a shot across the bow warning such companies of the risk of CFPB action if they do not comply with the existing automatic debit authorization requirements.


On the same day the Bulletin was issued, the CFPB posted a blog entry that includes links to sample action letters that consumers can use to contact companies to revoke authorization or to contact banks or credit unions to provide notice of revoked authorization, to provide notice of unauthorized debits or to request a stop payment order. The CFPB encourages consumers to submit complaints to the agency if revocations of authorization are not honored.

The CFPB also provides consumers with a series of “tips” about managing automatic debit authorizations, including verifying the company, understanding your consumer rights (e.g., a company cannot require a consumer to repay a loan by automatic debit as a condition for giving a loan), taking care to avoid overdraft and insufficient funds fees, and reviewing the terms of the authorization.