Overdraft and NSF Fee Practices: Disclosure, Opt-In, and Enforcement Risk

Overdraft and returned-item fees are legal. What draws enforcement is the gap between the fee a consumer could reasonably anticipate and the fee that actually posts. Almost every significant action in this area over the past several years has run on that theory rather than on a claim that the fee itself was too large.

Three separate rulebooks apply at once. Regulation E controls whether a fee may be charged at all on certain items. Regulation DD governs how fees are disclosed and how balances are described. And the unfair, deceptive, or abusive acts or practices standard sits above both, reaching conduct that complies with the specific rules but still produces surprise charges.

The opt-in rule and what it does not cover

An institution generally may not assess a fee for paying an ATM or one-time debit card transaction that overdraws a consumer account unless it has done four things: provided a notice describing the overdraft service in a form segregated from other account materials, given the consumer a reasonable opportunity to consent, obtained the consumer's affirmative consent, and confirmed that consent in writing or electronically with a statement of the right to revoke.

The boundary is the part people miss. The rule covers ATM withdrawals and one-time debit card purchases. It does not cover checks, ACH debits, recurring debit card transactions, or bill payments. A consumer who never opted in — and who believes, reasonably, that declining the service means declining overdraft fees — can still be charged when a recurring subscription debit hits a low balance. That mismatch between consumer expectation and rule scope is a recurring source of complaints and of examination findings.

The fee patterns that draw challenge

Supervisory and enforcement attention has concentrated on a short list of practices. Each shares a common feature: the consumer could not have avoided the fee with the information available to them at the time.

• Authorize positive, settle negative. A debit is authorized against a sufficient available balance and posts days later against an insufficient one. Charging an overdraft fee in that sequence has been treated as unfair because the consumer had no way to avoid it.
• Repeat fees on re-presented items. A merchant re-presents a returned debit and a second or third returned-item fee posts on what the consumer experiences as one transaction. Supervisory guidance has flagged this directly, and remediation has included refunds.
• Ledger versus available balance. Disclosing fees by reference to one balance while assessing them against another produces charges the consumer's own reading of the account cannot explain.
• High-to-low posting. Ordering transactions to maximise the number of items that overdraw the account remains a litigation and examination magnet even where disclosed.
• Fees on top of fees. An overdraft fee that itself drives the balance negative and triggers further fees, or sustained daily fees on a small negative balance, compounds the fairness problem.
• Stale opt-in records. Consent obtained years earlier through a since-redesigned flow, with no retained record of the notice as presented, cannot be defended on examination.

Verify before relying: the CFPB finalised a rule in late 2024 addressing overdraft fees at the largest institutions, and that rule was contested through both litigation and the congressional review process during 2025. As of mid-2026 the position is unsettled, and no product decision should rest on a summary of it. Check the current status directly at consumerfinance.gov. The Regulation E opt-in requirement, by contrast, has been in place since 2010 and is not what the dispute was about.

The disclosure layer

Regulation DD requires deposit account disclosures to state fees that may be imposed and the conditions for imposing them, and it constrains how balances are advertised. Institutions that promote the payment of overdrafts must also disclose, on periodic statements, the total fees imposed for paying overdrafts and the total for returned items, both for the statement period and for the calendar year to date. Those aggregate figures are frequently the first thing an examiner compares against a complaint file.

Balance disclosure deserves particular attention. Where an institution provides a balance through an ATM, an app, or a telephone line, describing an amount that includes funds available only through the overdraft service — without a clear explanation — has been treated as deceptive. The safer design shows a balance excluding overdraft availability and, if the overdraft-inclusive figure is shown at all, labels it explicitly.

1. Map the fee triggers

   List every fee code that can post on a negative or insufficient balance, and identify for each which item type triggered it and which balance was used.

2. Match triggers to authority

   For each code, identify the disclosure that describes it and, for ATM and one-time debit items, the opt-in record. A code with neither is an immediate remediation candidate.

3. Test the timing scenarios

   Run the authorize-positive-settle-negative case and the re-presentment case through the actual posting engine. Policy documents routinely say something the code does not do.

4. Reconcile statements to reality

   Confirm the aggregate overdraft and returned-item totals on periodic statements match the fee ledger, including reversals and courtesy refunds.

5. Read the complaints

   Consumer complaints describing a fee the consumer could not explain are the leading indicator. Categorise them by fee code, not by sentiment.

Adjacent regimes that change the answer

Where an overdraft service is structured as a line of credit rather than as a discretionary courtesy, it becomes credit, and closed-end or open-end truth-in-lending disclosure duties can attach — including finance-charge and rate disclosure. That distinction between a fee and a finance charge is the hinge on which the contested federal rulemaking turned, and the underlying disclosure architecture is set out in Truth in Lending for closed-end credit.

Network rules matter too. Automated clearing house rules constrain how many times a returned debit may be re-presented, which caps the fee-stacking scenario at the payment-rail level regardless of what the deposit agreement permits. The mechanics of authorization and returns on that rail — and the evidence a platform needs to defend an ACH authorization — are covered in ACH authorization, returns, and account-freezing risk.

State law sits alongside all of it and is not uniform. Some states impose their own limits or disclosure requirements on deposit account fees, and state attorneys general have brought their own actions on unfairness theories. A practice cleared under federal supervision is not for that reason lawful in every state, and a single state's restriction is not a national rule.

Finally, fee disputes and transfer disputes intersect. Where a consumer asserts that the underlying transfer was an error, the institution's investigation duties and any provisional credit obligation run on the Regulation E clock, and fees tied to a confirmed error generally have to be refunded as part of the correction. That sequence is set out in Regulation E error resolution.

Questions the desk gets

If a consumer opts out, can the bank still return items unpaid and charge a fee?

Generally yes. Declining the overdraft service means the institution should decline ATM and one-time debit transactions that would overdraw rather than pay them for a fee. It does not mean checks and ACH debits will be paid, and a returned-item fee on those is a different charge governed by the account disclosures. Consumers routinely misunderstand this, so the disclosure should say it plainly rather than technically.

How many fees can post on one transaction?

There is no single federal number, which is why the practice is analysed under fairness standards rather than a bright line. Where a merchant re-presents a returned debit, each presentment is a separate item under the deposit agreement, but supervisors have treated repeat fees on the same underlying transaction as unfair where the consumer could not control or anticipate the re-presentment. Network rules independently limit re-presentment attempts.

Does a signed account agreement resolve the fairness question?

No. Disclosure is necessary and not sufficient. The unfairness analysis asks whether the injury was substantial, not reasonably avoidable by the consumer, and not outweighed by countervailing benefits. A practice buried in a fee schedule that a consumer cannot practically use to predict a charge can still fail that test, and several enforcement matters have proceeded despite disclosed terms.

Do these rules apply to prepaid accounts and fintech balances?

Coverage follows the account type. Prepaid accounts are subject to their own set of requirements, including specific conditions where an overdraft or credit feature is offered, and consumer protections attach to the account-holding institution. A non-bank program manager is rarely the entity with the disclosure duty, but it is usually the entity that builds the flow, which makes contractual allocation of that responsibility essential.

Is the CFPB's overdraft rule in effect?

Its status is unsettled as of mid-2026, following both litigation and congressional review activity in 2025. Because the answer determines whether above-threshold fees at large institutions would be treated as credit subject to truth-in-lending requirements, it is not a detail to summarise from memory. Confirm the current position directly with the Bureau before setting pricing or building a disclosure flow around it.

Sequencing the work

Start where the evidence is cheapest to gather. Pull ninety days of fee data and sort by fee code and item type; the authorize-positive-settle-negative population and the re-presentment population will surface immediately, and their size tells you whether this is a policy question or a remediation project. Then pull the opt-in records for a sample of consumers charged on ATM and one-time debit items and check that a compliant segregated notice, an affirmative consent, and a written confirmation all exist.

Next, reconcile the posting engine against the written policy, because the two diverge more often than institutions expect. Then rewrite the consumer-facing explanation of what opting out does and does not do, since that single paragraph prevents a disproportionate share of complaints. Finally, confirm the current federal position at the CFPB and the Regulation E text, check supervisory guidance from your prudential regulator — the FDIC, OCC, or Federal Reserve — and check the deposit-fee statutes of the states where you take deposits. Related material sits on the Financial Regulation & Digital Assets desk.