For decades, subprime short-term lenders routinely leveraged automated bank debit authorizations to extract payments from consumer checking accounts, repeatedly presenting failed withdrawal attempts that generated cascading $35 non-sufficient funds (NSF) and overdraft penalties. To curb these predatory collection practices and safeguard consumer deposit accounts, the Consumer Financial Protection Bureau (CFPB) promulgated the federal Payday, Vehicle Title, and Certain High-Cost Installment Loans Rule, codified at 12 CFR Part 1041. A cornerstone of federal consumer financial regulation, Part 1041 imposes strict quantitative caps on payment withdrawals, establishes mandatory advance notice disclosures, and creates aggressive civil liability standards for non-compliant lenders.
Statutory Origin and Regulatory Authority
The CFPB enacted Part 1041 pursuant to its statutory authority under Title X of the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (12 U.S.C. § 5511 et seq.), specifically Section 1031, which empowers the Bureau to identify and prohibit Unfair, Deceptive, or Abusive Acts or Practices (UDAAP) in consumer financial markets. The rule applies comprehensively to "covered loans," defined as:
- Short-Term Loans: Any consumer credit contract with a maturity term of 45 days or less, including storefront payday advances, online cash advances, and vehicle title loans.
- High-Cost Longer-Term Loans with Balloon Payments: Longer-term consumer loans where the total cost of credit (including interest and fees) exceeds 36 percent APR and the lender secures a payment mechanism granting access to the borrower's depository account or vehicle title.
The Two-Consecutive-Failed-Debit Limitation (12 CFR § 1041.8)
The single most powerful consumer protection established under Part 1041 is the payment withdrawal penalty cap set forth in 12 CFR § 1041.8. Historically, when a borrower defaulted on a payday loan, lenders would initiate multiple electronic debits per day, splitting large payments into smaller amounts (e.g., three $100 attempts instead of one $300 debit), causing multiple $35 bank penalties that drained the borrower's entire paycheck before essential living expenses could be met.
Under federal law, 12 CFR § 1041.8 establishes the following strict standard:
The Two-Failed-Debit Rule Architecture
- The Two-Strike Prohibition: If a lender attempts two consecutive payment transfers (via ACH, debit card network, or check presentment) that return unpaid due to insufficient funds, the lender is legally prohibited from initiating any further payment attempts from that consumer account.
- Ban on Splitting Payments: A lender cannot circumvent the two-strike limit by dividing a payment into smaller fractional transactions. If multiple payment transfers are initiated simultaneously on the same date, they are legally treated as a single attempt.
- Mandatory New Consumer Authorization: To resume debiting the consumer's account after two failed attempts, the lender must obtain a new, un-coerced written authorization from the consumer complying with strict statutory disclosure formats under 12 CFR § 1041.9.
| Lender Payment Attempt Action | Legal Status Under 12 CFR Part 1041 | Regulatory Consequence |
|---|---|---|
| Initiating 3rd debit attempt after 2 returned NSFs | ILLEGAL (Violation of 12 CFR § 1041.8) | Federal UDAAP violation; subject to civil restitution & penalties |
| Splitting $400 payment into four $100 debits | RESTRICTED (Counts as 1 attempt; cannot multiply fees) | Depository institutions must not assess multiple NSF fees |
| Debiting account without prior written notice | ILLEGAL (Violation of 12 CFR § 1041.9) | Notice must be delivered at least 3 business days prior |
| Presenting electronic debit with valid authorization | LEGAL (Permissible under Regulation E) | Standard payment processing complying with Nacha guidelines |
Mandatory Consumer Disclosure Notices (12 CFR § 1041.9)
To ensure transparency, Part 1041 mandates that lenders deliver clear, conspicuous disclosures to consumers prior to initiating payment withdrawals:
- First-Failed-Attempt Notice: Within three business days of receiving notice that a payment transfer returned unpaid, the lender must transmit a written or electronic notice informing the consumer of the failed transfer, the date it occurred, and a warning that a second failed attempt will trigger the federal two-strike cutoff.
- Payment Notice Prior to Transfer: Lenders must deliver a payment notice to the consumer at least three business days before initiating an electronic transfer that differs in date, amount, or payment channel from the original schedule. The notice must specify the exact dollar amount, the transfer date, and the specific bank account routing details.
Supreme Court Confirmation: CFSA v. CFPB (2024)
For several years, subprime lending trade associations challenged the constitutional validity of the CFPB's Payday Lending Rule, arguing that the Bureau's independent funding mechanism under the Dodd-Frank Act violated the Appropriations Clause of the United States Constitution. In May 2024, the Supreme Court of the United States issued its landmark 7–2 ruling in Consumer Financial Protection Bureau v. Community Financial Services Association of America (CFSA), firmly upholding the constitutionality of the CFPB's statutory funding structure.
This definitive Supreme Court decision resolved all remaining constitutional challenges, cementing 12 CFR Part 1041 as an immutable federal standard actively enforced across all 50 states and U.S. territories.
Enforcement, Restitution, and Civil Liability Tiers
Under 12 U.S.C. § 5565, lenders that violate 12 CFR Part 1041 face severe administrative enforcement actions, federal court injunctions, and three tiers of civil money penalties:
- Tier 1 (Simple Violation): Penalties of up to $5,000+ per day for any statutory or regulatory violation.
- Tier 2 (Reckless Violation): Penalties of up to $25,000+ per day where the lender recklessly engaged in prohibited debiting practices.
- Tier 3 (Knowing Violation): Penalties of up to $1,000,000+ per day for entities that knowingly and intentionally executed unauthorized payment transfers.
- Mandatory Consumer Restitution: Lenders must refund 100 percent of all unauthorized debits and reimburse consumers for all secondary bank NSF and overdraft fees caused by illegal payment attempts.
How to Assert Your Rights Against Unauthorized Debits
If a short-term lender initiates unauthorized debit attempts or continues debiting your account after two consecutive failed transactions, execute this defensive protocol:
- Notify Your Depository Bank Immediately: Under the Electronic Fund Transfer Act (Regulation E, 12 CFR § 1005.11), notify your bank of unauthorized electronic transfers within 60 days of the statement date. Request an immediate Stop Payment Order or revoke the originator's ACH authorization.
- File a Formal CFPB Complaint: Submit an official regulatory complaint at
consumerfinance.gov/complaint. The CFPB routes complaints directly to lender compliance executives, requiring a formal written response within 15 days. - Report to State Attorney General: State attorneys general maintain concurrent enforcement authority under Dodd-Frank § 1042 to prosecute lenders violating federal consumer financial protection rules.