First, it is important to clarify that you may be required to reimburse customers for unauthorized transactions that occur within 60 days after you transmit the periodic statement containing the errors, even when customers fail to provide notice within that timeframe.
Under Regulation E, when a customer fails to report an unauthorized transaction within 60 days after it appears on a periodic statement, the customer faces unlimited liability for unauthorized transfers that occur after that 60-day period (up to the date on which the customer notifies the bank about the unauthorized transactions). However, the bank still must reimburse the customer for the unauthorized transactions that occurred during that 60-day period. We note, though, that when an unauthorized transaction involves a lost or stolen access device, the customer is liable for up to $500 if she failed to notify the bank within two business days of learning of the loss or theft.
Regarding the timing of the 60-day reporting period, in our view, the “transmittal of the statement” is the date that your bank sends the statement to the customer — not the date the statement is generated and not the date that the customer receives the statement.
As mentioned above, Regulation E requires a customer to report an unauthorized transfer “within 60 days of the financial institution's transmittal of the statement” to avoid liability for subsequent unauthorized transactions. Although “transmittal” is not defined, other provisions regarding the 60-day reporting deadline use the word “send” instead of “transmit.” Consequently, we believe that the 60-day period begins once the statement containing the errors is sent.
For resources related to our guidance, please see:
- 12 CFR 1005.6(b)(3) (“A consumer must report an unauthorized electronic fund transfer that appears on a periodic statement within 60 days of the financial institution's transmittal of the statement to avoid liability for subsequent transfers. If the consumer fails to do so, the consumer's liability shall not exceed the amount of the unauthorized transfers that occur after the close of the 60 days and before notice to the institution, and that the institution establishes would not have occurred had the consumer notified the institution within the 60-day period.”)
- Official Interpretations, Regulation B, 12 CFR 1005, Paragraph 6(b)(3), Comment 2 (“For example, a consumer's account is electronically debited for $200 without the consumer's authorization and by means other than the consumer's access device. If the consumer notifies the institution within 60 days of the transmittal of the periodic statement that shows the unauthorized transfer, the consumer has no liability. However, if in addition to the $200, the consumer's account is debited for a $400 unauthorized transfer on the 61st day and the consumer fails to notify the institution of the first unauthorized transfer until the 62nd day, the consumer may be liable for the full $400.”)
- 12 CFR 1005.6(b)(2) (“If the consumer fails to notify the financial institution within two business days after learning of the loss or theft of the access device, the consumer's liability shall not exceed the lesser of $500 or the sum of: $50 or the amount of unauthorized transfers that occur within the two business days, whichever is less; and The amount of unauthorized transfers that occur after the close of two business days and before notice to the institution, provided the institution establishes that these transfers would not have occurred had the consumer notified the institution within that two-day period.”)
- Regulation E, 12 CFR 1005.11(b)(1) (“A financial institution shall comply with the requirements of this section with respect to any oral or written notice of error from the consumer that … is received by the institution no later than 60 days after the institution sends the periodic statement or provides the passbook documentation, required by § 1005.9, on which the alleged error is first reflected…”)
- Regulation E, Appendix A, Model Form A-3 — Model Forms for Error Resolution Notice (“We must hear from you no later than 60 days after we sent the FIRST statement on which the problem or error appeared.”)