Compliance Bulletin

Opt-In OD Fee Rule For One-Time Debit Card and ATM Transactions
November 16, 2009

The Federal Reserve Board (“Board”) issued a final rule under the Electronic Funds Transfer Act requiring banks [1] to provide consumers with an affirmative consent to assess fees for paying ATM and one-time (i.e., non-recurring) debit card transactions that overdraw an account (hereafter, sometimes referred to as “covered transactions”).

 The notice of the opt-in right must be provided, and the consumer’s affirmative consent must be obtained, before overdraft fees may be assessed. The requirement applies to both existing and new accounts, and a model form is provided. The rule applies to any “overdraft service” whether or not it is promoted. An overdraft service is defined [2] as a service under which a bank assesses a fee for paying a transaction when the consumer has insufficient funds in the account. It does not include any payment of overdrafts pursuant to a Regulation Z-covered line of credit (including transfers from a credit card account), home equity line of credit, or overdraft line of credit. The term also excludes a service that transfers funds from another account of the consumer or a line of credit or other transaction that is exempt from 12 CFR 226.3(d), that is, securities or commodities accounts in which credit is extended by a broker-dealer registered with the Securities and Exchange Commission or the Commodity Futures Trading Commission. [3]

In adopting an opt-in requirement rather than opt out, the Board is not only imposing the strictest alternative proposed but is also allowing few exceptions. It considered but did not adopt exceptions for charging a fee when: a bank reasonably believed the account had sufficient funds when it paid the transaction (e.g., when intervening transactions cause a previously authorized but uncleared payment to overdraw the account and the network rules require payment); a merchant or payee presents a transaction for payment by paper-based means rather than electronically using a card terminal, and the bank had not previously authorized the transaction; the transaction was not submitted because it is below the floor limits established by card network rules; and where a payment is made when a stand-in processor is used to authorize the transaction because the card network was temporarily off-line.

While the Board acknowledges operational limitations in processing transactions and that tracking a consumer’s actual balance may be impossible at times because some transactions are not processed in real-time, the agency also notes that a bank is in a better position to mitigate the effects of the information gap. On the other hand, the Board declined to prohibit banks from charging an overdraft fee (presumably for a customer who had opted in) with respect to a fee where the overdraft would not have occurred but for a debit hold placed on funds in an amount that exceeds the actual transaction amount. The Board believes that a more comprehensive approach that involves financial institutions, card networks, and merchants will be required to effectively address the problem with debit holds, and will continue to monitor developments assess whether to take further action.


Any fee charged on an account for an overdraft on a covered transaction is subject to the rule, including per item or per transactions fees; daily overdraft fees; sustained overdraft fees (where fees are assessed when the consumer has not repaid the overdraft after some period of time); and negative balance fees. The notice and opt-in requirements apply both to existing and new accounts. All accounts subject to Regulation E are covered, including payroll card accounts to the extent overdraft fees may be imposed for ATM or one-time debit card transactions. A covered transaction includes not only ATM withdrawals whether made at a proprietary or foreign ATM, but also inter-account transfers, bill payments, and postage stamp purchases—essentially any transaction that can be originated at an ATM. One-time debit card transactions include those made at a point-of- sale, on-line, and by telephone. Comment 17(b)-1-ii describes this safe harbor—a bank complies with the rule if it adapts its systems to identify debit card transactions as either one-time or recurring, in which case the bank may rely on the transaction’s coding by merchants, other institutions, and other third parties as a one-time or recurring debit card transaction.

The opt-in requirement does not apply to transactions made with debit cards offered by institutions other than the account-holding institution. These are transactions that originate as debit card transactions paid by the card issuer, but are received and processed by the account-holding institution as ACH transactions. [4]

A bank is not barred from paying overdrafts on covered transactions even if the consumer has not opted in, but it may not assess a fee. Thus, a bank is not prohibited from debiting the consumer’s account for the amount of the transaction and that results in a negative balance. [5] Comment 17(b)-3 is provided to address the concern that consumers may believe that an opt-in creates a contractual right for the bank to pay overdrafts on covered transactions. It states that the rule does not require a bank to authorize or pay any overdrafts on covered transactions simply because a consumer has opted in. Also, the model form (discussed below) includes language describing the discretionary nature of an opt-in.

Notice and Consent

Banks are required to provide consumers with a notice explaining overdraft services for ATM withdrawals and one-time debit card transactions, and the notice must be segregated from all other information, including other account disclosures. [6] A consumer must be given a reasonable opportunity and reasonable method to affirmatively consent. The notice may not contain any information that is not specified or otherwise permitted by § 205.17(d) (see below). The notice must be provided in writing or, if the consumer agrees, electronically. [7] Also, the method for providing consent (such as a signature line or check box) must be separate from other types of consents in order to ensure that opt-in information is not obscured within other account documents.

Comments 17(b)-3 and 4 provide examples of permissible forms of obtaining consent. Consent may be secured by mail, by telephone (a toll-free number is not required), on-line, or in person, including at account opening. A bank may require the consumer to make the election before opening the account, including choosing between an account that does not provide covered overdraft services and one that does. However, a bank is not required to offer different accounts in order to comply with the opt-in requirement.

A consumer may opt in at any time in the manner described in the notice, and a consent is generally effective until revoked by the consumer. [8] A revocation must be implemented as soon as reasonably practicable after receipt of the request, but no specific period of time is prescribed in recognition of the various means that notice may be provided. Revocation does not require a bank to waive or reverse any previously assessed overdraft fees. [9] The rule does not specifically address the imposition of fees for declining ATM or one-time debit card transactions. However, the Board notes that such fees could raise significant fairness issues under the Federal Trade Commission (FTC) Act since a bank bears little, if any, risk or cost to decline authorization of a transaction.

Examples of inappropriate methods of opting in are: including the “consent” in preprinted language in an account disclosure provided with a signature card that the consumer must sign to open the account and that acknowledges acceptance of the account terms, and providing a signature card that contains the consent in a pre-selected check box. Consents must be obtained separately from other consents or acknowledgements, and they must be used solely to indicate the consumer’s opt-in election. [10]

A bank must also provide a confirmation of the consumer’s consent in writing, or if the consumer agrees, electronically. A copy of a completed opt-in form may be given or sent to the consumer acknowledging that the consumer has elected to opt in. The written confirmation must include a statement informing the consumer of the right to revoke consent. [11]

A bank may not require a consumer to opt in to accept overdraft services for ATM withdrawals and one-time debit card transactions as a condition of paying overdrafts for checks, ACH transactions, or other types of transactions. A bank may not decline to pay these transactions because the consumer has not opted in to receive overdraft services for covered transactions. [12] This removes a compliance option (i.e., limiting all overdrafts) for banks that may have technological challenges in distinguishing covered transactions from, for example, recurring debit transactions. Part of the rationale for allowing an extended implementation date is to give the industry time to develop these capabilities.

The prohibition also implies that the consumer is entitled to have other overdraft transactions paid when he or she decides not to opt in, which is not the case since banks retain the option not to pay overdrafts for any customer for a variety of reasons. To address the possibility that banks might selectively refuse to pay overdrafts as a means of coercing consumers to opt in, the rule generally requires banks to apply the same criteria for deciding when to pay overdrafts for checks, ACH transactions, and other types of transactions without regard to a customer’s opt-in decision.

Same Account Terms

Consumers who do not elect to opt in must be provided with accounts having the same terms, conditions, and features as other customers without regard to their opt-in decision except for the features that limit the payment of overdraft fees on covered transactions. [13] Comment 17(b)(3)-1 provides a non-exclusive list of examples of terms, conditions, or features that cannot be varied (by implication, solely because of the opt-in decision). Thus, a bank may not assess an account fee on customers who do not opt in that is not assessed on those who do opt in. Nor may a bank vary other terms like minimum balance requirements and on-line bill payment services. For operational reasons, a bank is permitted to implement the consumer’s choice by means of a “back-room” process by opening a different account for consumers who do not opt in.

A bank may not exclusively provide consumers who do not opt in with a card that has PIN-debit functionality only, that is, without signature-debit functionality. While this may ease banks’ compliance burden, the Board notes that the fact that relatively fewer merchants allow PIN-debit transactions could be a coercive factor with respect to a consumer’s opt-in decision. [14]

The consistent terms requirement is not intended to interfere with a bank’s provision of limited accounts, such as those marketed to consumers who have previously had accounts terminated for cause. New comment 17(b)(3)-2 clarifies that such accounts may be offered as long as the consumer is not required to accept such an account because he or she did not opt in. [15]


If a bank’s policy is not to pay or allow ATM withdrawals or one-time debit card transactions if, at the time authorization is requested, the bank has a reasonable belief that the account has insufficient funds, then the notice and opt-in requirements do not apply. [16] This exception may apply at the account level rather than at the institution level where some but not all of a bank’s products qualify for the exception. Thus, if a bank offers three types of checking accounts and the no-pay policy and practice applies only to one of them, that type of account is not subject to the rule. [17]


For accounts opened prior to July 1, 2010, which is the mandatory compliance date, an overdraft fee may not be assessed on or after August 15, 2010 with respect to a covered transaction unless the notice and consent provisions are satisfied. For accounts opened on or after July 1, no such fee may be assessed unless the customer has opted in. Early adoption is permitted. [18] Since consent is required before an overdraft fee may be assessed, a consent may not be applied to a fee incurred before the opt-in decision is provided. [19]

Content and Format

The rule sets forth the required contents for the notice. It must be in a form substantially similar to Model Form A-9 found in Appendix A to the final rule, and may not contain any information that is not specified or otherwise permitted. Other information about banks’ overdraft services and other overdraft protection plans may be provided in a separate document. The elements of the notice include: (1) a description of the bank’s overdraft service; (2) what fees are imposed; (3) limits on fees charged and, if none, a statement that there is no limit; (4) disclosure of the opt-in right, including the means to exercise the right; and (5) the availability of any Regulation Z-covered line of credit or a service that transfers funds from another account to cover overdrafts, if applicable. The bank may, but is not required to, list additional alternatives for the payment of overdrafts. If the amount of a fee may vary by transaction, a bank may indicate that the consumer may be assessed a fee “up to” the maximum fee. [20]

Permissible modifications and additions to the consent include notice that the consumer has the right to opt into, or opt out of, the bank’s other overdraft services and a description of the means to exercise those choices. A bank may also disclose the associated returned item fee and that additional merchant fees may apply, and that the consumer may revoke the consent. [21]

Other Provisions

Banks must treat affirmative consent provided by any joint consumer of an account as consent for the account from all of the joint consumers, and a revocation of that consent by any of the joint consumers as revocation of consent for that account. [22]

The effective date of the final rule is 60 days after publication in the Federal Register, with a mandatory compliance date of July 1, 2010. The rule, including model form, are available from the Federal Reserve Board’s website at:

  1. The term “bank” is used in this Bulletin to refer to all financial institutions that are subject to the Electronic Funds Transfer Act and Regulation E.
  2. 12 CFR 205.17(a). Unless otherwise indicated, all citations are to the Board’s Regulation E, codified at 12 CFR Section 205, and related official staff commentary.
  3. See also comment 17(a)-1.
  4. See comment 17(b)1-i.
  5. See comment 17(b)-2.
  6. See 205.17(b)(1)(i).
  7. The Board notes that since the disclosures are not required to be in “written” form within the meaning of the Electronic Signatures in Global and National Commerce Act (“E-SIGN Act codified at 15 U.S.C. 7001 et seq.), electronic disclosures made under the rule are not subject to compliance with the consumer consent and other applicable provisions of the E-SIGN Act. But the notice is subject to Regulation E’s general requirement that disclosures be clear and readily understandable and in a form the consumer may keep.
  8. 205.17(g).
  9. This position is articulated in the Board’s analysis of the rule, and a supporting reference is made to a comment 17(f)-1, but the comment is not included in the final rule.
  10. Comment 17(b)-6.
  11. Comment 17(b)-7. See footnote number 22 in this Bulletin.
  12. 205.17(b)(2).
  13. 205.17(b)(3).
  14. 205.17(b)(3)1-ii.
  15. In its analysis of the rule, the Board states: “To the extent these more limited products permit the consumer to overdraft at ATMs or via a one-time debit card transaction, the consumer must be provided an opt-in under the final rule.” It is possible that the Board meant the consumer must elect to opt in in order to retain overdraft privileges in connection with such basic accounts.
  16. 205.17(b)(4).
  17. Comment 17(b)(4)-1.
  18. Comment 17(c)-1
  19. Comment 17(c)-2.
  20. See 205.17(d) and comments 17(d)-1 and 2.
  21. This provision appears to contradict comment 17(b)-7. 205.17(d)(6) allows an optional disclosure of the right to revoke consent while comment 17(b)-7 (referring to use of a copy of the consent notice as confirmation of the opt in) states that the copy must include a statement that the consent may be revoked at any time. It is probable that Section 205.17(d)(6) refers to a right to revoke with respect to other overdraft services.
  22. 205.17(e)

The information contained in this CBA Regulatory Compliance Bulletin is not intended to constitute, and should not be received as legal advice. Please consult with your counsel for more detailed information applicable to your institution. © This CBA Regulatory Compliance Bulletin is copyrighted by the California Bankers Association, and may not be reproduced or distributed without the prior written consent of CBA.