The Consumer Financial Protection Bureau (CFPB) has turned its attention to the payments industry of late and recently focused on recurring automatic debits in particular. In November of 2015, CFPB issued a compliance bulletin to remind companies about the rules surrounding automatic debits for products and services, such as subscriptions, memberships, a mortgage, credit card, or other monthly bills. In the course of examinations, CFPB notes, the Bureau has observed that some companies aren’t adequately following the rules. The financial industry views the release of the bulletin as a signal that CFPB plans to take supervisory or enforcement action if the requirements for recurring automatic debit authorization are not met.
CFPB recommends that steps should be taken immediately to make adjustments as necessary for compliance. With increased scrutiny expected for these types of transactions, merchants should make it a priority to review their operations and take appropriate steps to ensure they’re in compliance with the legislation that CFPB highlights.
Legislation
Automatic debits are governed by the Electronic Fund Transfer Act (EFTA) and Regulation E, which implements the Act. EFTA requires that all preauthorized debits are voluntary and that the debit is authorized by the consumer in writing or electronic format. The Regulation and the Electronic Signatures in Global and National Commerce Act (E-Sign Act) also comes into play for electronic authorization, as it defines electronic signatures and records.
Authorization for Recurring Automatic Debits
Merchants can obtain authorization for the recurring automatic debit in writing or in electronic format, with the consumer authorizing the transaction with a signature or similar authentication. A recorded oral authorization over the telephone is also acceptable, as long as the recording complies with state laws. The oral authorization recording must be retained with the company’s records.
Written Copy of the Authorization
The consumer must be provided with a written copy of the authorization that states the amount of the transfer, the timing, and information that it’s a recurring debit. A confirmation form can be used to fulfill the obligation by giving a customer two copies of a pre-authorization form and asking him/her to sign and return one and keep the second copy.
CFPB encourages companies to furnish the consumer with their written copy of authorization before the first debit transaction, “when practical.”
Stopping Recurring Automatic Debits
CFPB has also raised concerns that consumers are reporting difficulty stopping recurring automatic debits, as they have a right to do under the EFTA. Consumers have the right to revoke authorization of a recurring automatic debit if they give written or oral notice at least three days before the scheduled transfer. Consumers may be asked to provide the merchant or company with a letter within 14 days of the notice; if the consumer doesn’t follow up in writing, the responsibility of the merchant or company ends. CFPB has prepared sample letters for consumers to send to merchants or companies to revoke their authorization.
Merchants and companies can also offer more rights for the consumer to revoke the authorization than the EFTA allows, and some states require more rights to allow stop-payments of recurring automatic debits. With the CFPB taking notice of the issue, merchants should review their policy with regard to a consumer revoking authorization of recurring automatic debit and take necessary steps for compliance with federal and state laws.
