The card networks publish thick rulebooks that govern how a dispute moves between issuer, acquirer, and merchant. Those rules are commercial. They can be amended by the network, waived in a settlement, or shaped by an issuer's own risk appetite. Sitting on top of all of it, for US-issued consumer cards and consumer deposit accounts, are two federal rules that the network cannot override and the issuer cannot opt out of: Regulation E and Regulation Z.
Understanding where these rules bind matters because they decide who carries the loss while a dispute is open, and they impose deadlines that are shorter and stricter than most network windows. When a network timer and a regulatory timer disagree, the regulatory timer wins for the cardholder relationship. The issuer eats the gap.
Two rules, two rails
The first thing to get straight is which rule applies to which transaction. They split on funding source, not on card form factor.
Regulation E implements the Electronic Fund Transfer Act and governs debit cards, prepaid accounts, ACH, and any electronic transfer that pulls from a consumer asset account. It is codified at 12 CFR Part 1005.
Regulation Z implements the Truth in Lending Act and governs credit cards and other open-end consumer credit. It is codified at 12 CFR Part 1026.
A debit card and a credit card can run over the same network rails and hit the same merchant, but the consumer's rights diverge sharply depending on whether the money was already theirs (Reg E) or borrowed (Reg Z). Both rules apply only to consumer accounts. Commercial and business card disputes fall outside them and live entirely under network rules, which is the seam the sibling Subscriptions course works inside on the merchant side.
The Reg E clock
Reg E error resolution lives in 12 CFR 1005.11. The consumer's notice of an error is timely if the institution receives it no later than 60 days after it sent the periodic statement on which the error first appeared.
Once the issuer has that notice, the clock the issuer cannot stretch begins:
- 10 business days to investigate and decide whether an error occurred, then 3 business days after finishing to report the result, and 1 business day to correct a confirmed error.
- If the issuer cannot finish inside 10 business days, it may take up to 45 days total, but only if it provisionally credits the consumer's account within that initial 10-day window and gives full use of the funds during the investigation.
- A 20 business day figure replaces the 10 for transfers on accounts open 30 days or less, and the extended ceiling rises to 90 days for new accounts, point-of-sale debit, and foreign-initiated transfers.
The provisional credit requirement is the part that overrides commercial preference. An issuer might prefer to hold the consumer's money until the merchant responds. Reg E does not allow it past the 10-day mark. The consumer gets the funds back provisionally, and the issuer absorbs the timing risk while it works the network dispute on its own slower clock.
The Reg Z clock
Reg Z billing error resolution lives in 12 CFR 1026.13. The consumer's billing error notice must reach the creditor within 60 days of the first periodic statement showing the error, the same outer window as Reg E.
After that, the creditor must:
- Mail or deliver written acknowledgment within 30 days of receiving the notice, unless it has already resolved the dispute in that period.
- Resolve the dispute within two complete billing cycles, and in no event later than 90 days.
During the investigation the consumer need not pay, and the creditor may not try to collect, the disputed amount or any related finance charges. That is the Reg Z equivalent of provisional credit: the borrowed money in dispute is parked, interest-free, until resolution.
Liability caps that sit underneath the timers
Both rules also cap how much of an unauthorized transaction the consumer can be made to bear, and the caps differ in a way worth memorizing.
Under Reg Z (12 CFR 1026.12), cardholder liability for unauthorized credit card use is capped at the lesser of $50 or the amount obtained before notification. In practice most issuers and the networks waive even that $50 through zero-liability policies.
Under Reg E (12 CFR 1005.6), the cap is tiered and can get much worse for a slow consumer. Report a lost or stolen access device within two business days and liability is capped at $50. Miss that window and it rises to $500. Fail to report an unauthorized transfer shown on a statement within 60 days and liability for transfers after that point can be unlimited. Debit fraud, in other words, punishes delay in a way credit fraud does not. That asymmetry is one reason consumer advocates favor credit for online spending.
A worked example
A cardholder sees a $400 charge they do not recognize on the March statement, sent March 5.
If it was a debit card, Reg E controls. The cardholder disputes on March 20, well inside 60 days. The bank cannot resolve it in 10 business days, so by that deadline it must place a $400 provisional credit and give full use of the funds. It then has until day 45 to finish. The $400 sits in the cardholder's account the whole time, and the bank carries the exposure while it files the network dispute against the merchant's acquirer.
If it was a credit card, Reg Z controls. The same March 20 notice triggers a written acknowledgment due by April 19. The card issuer cannot bill the $400 or any interest on it during the investigation, and must resolve within two billing cycles or 90 days. The cardholder was never out of pocket because the money was never theirs to begin with, so there is no provisional credit; instead the obligation to pay is suspended.
Same merchant, same network, same $400, two different bodies of law and two different cash-flow outcomes for the issuer.
The takeaway
Network rules tell you how a dispute moves. Reg E and Reg Z tell you who holds the money and by when, and they do not bend to a network timer or an issuer's preference. Build your dispute operation so the regulatory clock starts on the date the consumer notified you, runs in parallel with the slower network case, and never waits on the merchant's response. When the two clocks conflict, assume the regulatory one governs the consumer side and the issuer carries the float in between.