CFPB Issues Guidance Emphasizing the Importance for Banks to Maintain Sufficient Proof of Customers’ Affirmative Consent to Overdraft Services

In recent discussions surrounding banking practices, the issue of overdraft fees, particularly for ATM and one-time debit card transactions, has gained significant attention.  On September 17, 2024, the Consumer Financial Protection Bureau (Bureau) issued Consumer Financial Protection Circular 2024-05 asserting that “[a] bank or credit union can be in violation of the Electronic Fund Transfer Act (EFTA) and Regulation E if there is no proof that it obtained affirmative consent to enrollment in covered overdraft services.”

In the circular, the Bureau highlights the various strict guidelines financial institutions must adhere to under Regulation E, including:

  • Opt-In Requirement: Before assessing any overdraft fees on ATM or one-time debit transactions, banks must provide consumers with a chance to opt in. If they fail to obtain this consent, any fees charged may constitute a violation of Regulation E.
  • Documentation and Consent: Banks must maintain adequate records demonstrating consumer consent. This documentation can vary based on how the consumer opts in—whether in person, over the phone, or online.
  • Written Notice: Banks must provide consumers with clear notice explaining the overdraft services available to them before they can opt in, along with confirmation of their consent, which includes information on their right to revoke it.

The Bureau also asserts that in its supervisory examinations, it has identified numerous instances where financial institutions could not provide proof of consumer consent before charging overdraft fees.  Moreover, even where banks had policies in place regarding compliance with Regulation E’s opt-in requirements the Bureau found in its examinations that those banks nevertheless were frequently unable to demonstrate that such policies were actually being followed.

Although Regulation E does not require a specific form of record evidencing consent, the Bureau provided examples of sufficient records specific to various channels:

  • In-Person or Mail Opt-Ins: A signed form indicating the consumer’s consent.
  • Phone Opt-Ins: A recorded call confirming the consumer’s choice.
  • Online or App Opt-Ins: A securely stored electronic signature reflecting the consumer’s decision and date of consent.