Joint Trades Letter to the CFPB on Circular 2024-05

Dear Director Chopra,

The American Bankers Association1 (ABA), America’s Credit Unions, Bank Policy Institute, Consumer Bankers Association, Independent Community Bankers of America, and U.S. Chamber of Commerce write in response to the Consumer Financial Protection Bureau’s (Bureau or CFPB) Circular 2024-05, titled “Improper Overdraft Opt-In Practices,” published on September 17, 2024 (Circular).2 We are deeply concerned that, through the Circular, the Bureau has imposed new expectations on banks and credit unions with respect to their practices for recording and retaining their customers’ “opt-in” to the institution’s overdraft program for onetime point-of-sale (POS) debit card purchases and ATM transactions. These new expectations exceed the long-standing and well-established requirements of the Electronic Funds Transfer Act (EFTA) and Regulation E in violation of the Administrative Procedure Act (APA). We urge the Bureau to rescind the Circular.

In 2009 and 2010, the Federal Reserve adopted strong consumer protection rules governing overdraft services for one-time debit card POS purchases and ATM transactions.3 Through amendments to Regulation E, the Federal Reserve requires financial institutions prior to charging an overdraft fee on a POS or ATM transaction to (1) provide the customer with a notice describing the institution’s overdraft service, (2) provide the customer with the opportunity to opt in to overdraft for POS debit card or ATM transactions, (3) obtain the customer’s opt-in, and (4) send a confirmation of the opt-in to the customer.4 The amendments to Regulation E also give consumers the right to opt out of overdraft services at any time.5

The Federal Reserve’s objective was to ensure that bank customers received a consumer-tested disclosure and written confirmation of the customer’s opt-in decision prior to being charged an overdraft fee.6 The Federal Reserve did not impose specific requirements for the form of record that a customer must use to opt in to overdraft for these transactions – or for how the institution must memorialize that opt-in in its system. Indeed, the only mention of record retention in the 2009 Opt-in Rule is in the Board’s Paperwork Reduction Act analysis, which states, “Institutions are required to retain records for 24 months, but this regulation does not specify types of records that must be retained.”7

The Board intended for Regulation E’s record retention provision to apply. It states in relevant part: “(1) Any person subject to the Act and this part shall retain evidence of compliance with the requirements imposed by the Act and this part for a period of not less than two years from the date disclosures are required to be made or action is required to be taken.” 8

Moreover, the official comment to Regulation E’s record retention provision states that a “financial institution need not retain records that it has given disclosures and documentation to each consumer; it need only retain evidence demonstrating that its procedures reasonably ensure the consumers’ receipt of required disclosures and documentation” prior to opting in to overdraft for POS debit card or ATM transactions.9

When the Dodd-Frank Act transferred responsibility for EFTA to the CFPB, the CFPB adopted Regulation E without change. Unsurprisingly, the interagency examination procedures for Regulation E do not specify the form of record that an institution must use to obtain a customer’s opt-in or how the bank must memorialize the opt-in in its system. The procedures direct examiners only to ask institutions, “Does the financial institution maintain evidence of compliance with the requirements of the Electronic Fund Transfer Act and Regulation E for a period of two years?”1

If the Federal Reserve (and later the CFPB) intended to impose specific requirements for the recording and retention of customer opt-ins for each consumer, both agencies would have done so through rulemaking. Other consumer protection regulations impose specific record retention requirements. For example, Regulation B, which implements the Equal Credit Opportunity Act, requires institutions to “retain in original form or a copy” a consumer’s credit application, notification to the customer of the institution’s actions on the application, and the institution’s statement of specific reasons for an adverse action, among other required documents.11

Despite the purposefully limited regulatory requirements for recording and retaining evidence of customer opt-ins, the Circular asserts that a bank or credit union can be in violation of EFTA and Regulation E if the institution does not have “proof that it obtained affirmative consent” to enroll the customer in the institution’s overdraft program for POS debit card or ATM transactions. 12 The Bureau then listed “example[s]” of how it expects institutions to record the consumer’s optin:

Click here to view the full letter.

[1] A description of each trade association is listed in the Appendix.

[2] Consumer Financial Protection Circular 2024-05, Improper Overdraft Opt-In Practices (released Sept. 17, 2024) [hereinafter, Circular].

[3] Electronic Fund Transfers, 74 Fed. Reg. 59,033 (Nov. 17, 2009) [hereinafter, Opt-in Rule]; Electronic Fund Transfers, 75 Fed. Reg. 31,665 (June 4, 2010) [hereinafter, 2010 Supplemental Rule].

[4] Opt-in Rule, supra note 3, at 59,052 (codified at 15 C.F.R. § 205.17(b)(1)).

[5] The Supplemental Rule underscores the Board’s intent to provide consumers and the institutions that serve them with flexibility to opt-in to overdraft protection when they needed it. In 2009, mobile banking was not widely used. Most customers (who had not already opted in to overdraft) had to call their institution to opt in to overdraft when seeking an ATM withdrawal or at the cash register about to make a purchase. Consequently, the Federal Reserve deliberately did not impose specific requirements for the form of record that a customer must use to opt in to overdraft for these transactions – or for how the institution must memorialize that opt-in in its system. See 2010 Supplemental Rule, 75 Fed. Reg. at 31,667 (requiring institutions to send the confirmation – but not requiring confirmation to be received by the customer – before institution can charge an overdraft fee for a POS debit card or ATM transaction, in order to “provid[e] consumers access to overdraft services expeditiously when requested”).

[6] Opt-in Rule, 74 Fed. Reg. at 59,051.

[7] 12 C.F.R. § 1005.13(b)(1).

[8]Id. § 1005.13(b)(1) (cmt. 1).

[9] Examination Manual, Interagency Consumer Laws and Regulations, Electronic Fund Transfer Act 19, checklist 10 (2019), https://files.consumerfinance.gov/f/documents/cfpb_supervision-and-examination-manual_efta-exam-procedures-incl-remittances_2019-03.pdf.

[10] 12 C.F.R. § 1005.12(b).

[11] Circular, supra note 2, at 1.