Requirements for Consumer Authorizations for Preauthorized Electronic Fund Transfers

The CFPB has posted an article and announced its issuance of Bulletin 2015-06 on automatic debits. The article explains to consumers the way an auto debit to a financial institution account works and the protections for the account owner, and provides links to action letter templates consumers can use to invoke those protections. The Bulletin alerts companies that they must obtain authorization before automatically debiting a consumer’s account. The Bulletin also reminds companies they are required by law to provide notifications to consumers that clearly describe the terms of preauthorized auto debits. In addition, the Bureau is publishing action letters for consumers seeking to revoke a company’s authorization to auto debit an account.


Preauthorized EFTs refer to an “electronic fund transfer authorized in advance to recur at substantially regular intervals.”

Regulation E requires that preauthorized EFTs from a consumer’s account be authorized “only by a writing signed or similarly authenticated by the consumer.” The commentary to Regulation E explains that the rule “permits signed, written authorizations to be provided electronically,” and specifies that the “writing and signature requirements…are satisfied by complying with the [E-Sign Act].” The E-Sign Act defines an electronic signature as “an electronic sound, symbol, or process, attached to or logically associated with a contract or other record and executed or adopted by a person with the intent to sign the record.” Thus, Regulation E does not prohibit companies from obtaining authorizations from consumers over the phone if the E-Sign Act requirements for electronic records and signatures are met.  The CFPB confirms that the E-Sign Act’s limited restriction on the use of oral recordings as electronic records – which are not allowed where the law requires that information be provided to a consumer in writing – does not apply to the preauthorization requirements of Regulation E.

Preauthorization can be obtained by:

  • A wet signature from a consumer,
  • An electronic signature on an electronically provided document (i.e. available on the website, or through an email), or
  • A telephone conversation, provided that the call is recorded and contains:
    • Notification to, and authorization from the consumer that the call is being recorded,
    • Identification of the consumer,
    • The terms of the preauthorized EFTs be clear and readily understandable to the consumer and should include the amount and timing of payments, and
    • Authorization from the member for the preauthorized EFT.


Regulation E requires that a copy of the consumer’s authorization must be provided to the consumer. The copy must be provided in paper form or electronically. The copy can be provided electronically, only if the consumer has consented to receive electronic disclosures through E-Sign. E-Sign does not permit oral communications or a recording of an oral communication as an electronic record.

The copy of the authorization provided must contain the terms of the preauthorized EFT, such as the amount and timing of all the payments to which the consumer agreed.


Retention of the authorization and evidence that the authorization was provided to the consumer must be retained for two years.

The CFPB also released sample letters for those seeking to revoke a company’s permission to automatically debit their accounts. Credit unions may see these letters from their members in the future.

  • A sample letter to send to a company or merchant to revoke the consumer’s permission to auto debit the account
  • A sample letter to send to a bank or credit union to provide notice that the consumer revoked a company’s authorization to automatically debit the account
  • A sample stop payment order to instruct a bank or credit union to stop allowing the company to take payments from the consumer’s account
  • A sample letter to a bank or credit union providing notice of an unauthorized debit from a consumer’s account

Leave a Reply

Your email address will not be published.