On November 23, 2015, the CFPB issued a Bulletin alerting companies that they must obtain proper authorization from consumers before automatically debiting their accounts. The Bulletin relates to the Electronic Fund Transfer Act requirements for “preauthorized electronic fund transfers,” which are EFTs scheduled in advance to recur at substantially regular intervals. The preauthorized EFTs in the CFPB’s spotlight are those that debit a consumer’s account.

Regulation E of the EFTA provides that preauthorized EFTs from a consumer’s account must be authorized by a “writing signed or similarly authenticated by the consumer.” The authorization must be readily identifiable as such and have clear terms, and the person obtaining that authorization must provide a copy to the consumer. It’s important to keep in mind that these are two separate requirements. The Bulletin clarifies how a company can obtain the consumer’s authorization, and describes the critical elements of that authorization, but leaves unanswered certain questions about delivering a copy of the authorization to the consumer when it is obtained by telephone.

Content of the Authorization

As noted above, the consumer’s authorization must be readily identifiable as such and must have clear terms. The Bulletin states that companies sometimes provide consumers with notices of terms for preauthorized EFTs that fail to disclose “critical information.” The CFPB explains that the authorization must be clear as to the recurring nature of the transfers and the amount and timing of the payments agreed to. Of course the authorization also needs to identify the consumer and the account to be charged. Regardless of how the consumer’s authorization is obtained, which is discussed below, all of this information needs to be in the authorization and in the copy provided to the consumer.

Regulation E also allows a consumer to stop payment of a preauthorized EFT by notifying his or her bank at least three business days before the scheduled date of the transfer. The regulation does not expressly require that this right be included in the consumer’s authorization, but we recommend including it. In the CFPB’s announcement of the Bulletin they state that consumers sometimes report having trouble stopping these automatic charges. To help consumers “who may be getting the runaround,” the CFPB also released sample letters that consumers can use to revoke their authorization or stop a single payment.

Obtaining the Authorization

Preauthorized EFTs from a consumer’s account must be authorized by a “writing signed or similarly authenticated by the consumer.” Enforcement actions and lawsuits in this area suggest that some businesses, perhaps because they did not exist before the Internet, do not understand that “writing” means on paper (when used in Regulation E and many other consumer protection laws). Until June 2000, the only way to obtain a consumer’s authorization for these recurring transfers was to have the consumer sign a piece of paper that included all of the necessary information.

Paper authorization still works today, but the enactment of the Electronic Signatures in Global and National Commerce Act (E-Sign) in June 2000 provides for more flexibility. E-Sign allows most contracts to be agreed to electronically, and Official Commentary to Regulation E confirms that the consumer’s consent to preauthorized EFTs can be provided electronically so long as this is done in compliance with E-Sign.

The most obvious way to obtain electronic consent is by computer. The terms of the authorization and the consumer’s intent to authorize the EFTs must be clear, but that is primarily a question of wording.

Prior to the CFPB’s Bulletin, however, it was unclear if authorization could be obtained by telephone. The Federal Reserve had said in 2006 that tape-recordings of telephonic authorizations would satisfy Regulation E if such recordings were written and signed authorizations under E-Sign. Their apparent unwillingness to interpret E-Sign meant that companies could not be sure what the Federal Reserve might decide in the future, and the transfer of EFTA interpretive and enforcement authority to the CFPB made the answer even less clear.

The Bulletin states that oral recordings obtained over the telephone may authorize preauthorized EFTs “provided that these recordings also comply with the E-Sign Act.” As to what compliance with E-Sign might mean, the CFPB further explains that Regulation E may be satisfied if a consumer authorizes the EFTs “by entering a code into their telephone keypad” or if the company records and retains the consumer’s oral authorization.

In both cases, it must be clear that the consumer intends to sign the record as required by the E-Sign Act. This is really no different than the rule for a paper authorization – it must be readily identifiable as an authorization and its terms must be clear. A conservative approach would be to repeat the terms of the authorization to the consumer after it is given and to require the consumer again to state “I agree,” all in recorded form. This recording then should be retained for at least two years.

It’s also important to comply with applicable State laws when making these recordings, as the CFPB notes. Depending on the State in question, this could mean obtaining the consumer’s specific consent to make the recording.

Providing a Copy of the Authorization

As discussed above, E-Sign allows most contracts to be agreed to electronically. E-Sign also provides that, when a law or regulation requires that disclosures be made available to a consumer “in writing,” those disclosures can be delivered electronically so long as the consumer affirmatively consents after receiving certain E-Sign disclosures.

Part of the difficulty with obtaining telephonic authorization for the transfers is that it does not change the EFTA requirement that the consumer be provided with a copy of the authorization. Regulation E Commentary states that this copy must be provided “either electronically or in paper form.” It’s unclear from Regulation E or its Commentary if a company must comply with E-Sign when providing the copy electronically, and the Bulletin doesn’t do much to resolve this uncertainty.

If a company obtains the consumer’s EFT authorization by computer, and assuming that the company also took that opportunity to obtain the consumer’s consent to electronic disclosures in compliance with E-Sign, the company could provide an electronic copy of the authorization to the consumer at the same time.

But if the company obtains the EFT authorization by telephone, how is the company supposed to provide the consumer with a copy of that authorization? The company could mail a paper copy of the authorization to the consumer, provided that it includes all of the critical terms and is clear as to the consumer’s intent. However, the CFPB “encourages” companies to provide that copy to the consumer before the first authorized EFT is initiated, “when practical.” The point seems to be that the consumer should receive the copy before the first EFT, i.e., that merely putting it in the mail is not sufficient, which might mean delaying the first EFT in many cases.

Given that Regulation E allows a company to deliver the copy “electronically,” it also should work to deliver that copy to the consumer by computer. The question unanswered by the Bulletin is if compliance with E-Sign is needed when delivering an electronic copy.

It’s possible that E-Sign compliance is not necessary when delivering an electronic copy of the authorization, but it’s hard to get completely comfortable with that conclusion. Given that the authorization itself must be provided “in writing” but can be provided electronically if done in compliance with E-Sign, and given that the company must provide the consumer a “copy” of that authorization, that suggests that any electronic delivery of the copy also must comply with E-Sign.

If E-Sign compliance is needed, that would mean that the consumer would have to sign-on to a computer, the company would need to deliver the E-Sign disclosures to the consumer, and the consumer then would need to affirmatively consent to receiving an electronic copy of the EFT authorization before the company could deliver it electronically. That could undermine at least some of the advantages of receiving the authorization telephonically. It might be easier just to mail a copy of the authorization to the consumer.

In the absence of further clarification from the CFPB, it would be safer when obtaining the consumer’s authorization by telephone to mail a copy of the text of that authorization to the consumer. This might be overly conservative, but the risks of EFTA lawsuits and enforcement could be too high for any other conclusion.