Do banks have to investigate disputed AI agent transfers?

Yes. Regulation E error-resolution rules require banks to investigate consumer disputes, generally within 10 business days or 45 days with provisional credit.

Does Regulation E apply to business accounts?

No. Regulation E covers consumer accounts. Business funds transfers fall mainly under UCC Article 4A.

Regulation E and AI Agents: Unauthorized Transfers and Liability

Q: Does Regulation E protect consumers when an AI agent makes a payment?

It depends. A transfer by someone the consumer gave their access device to is generally not unauthorized until the consumer tells the bank that person is no longer authorized, so sharing credentials with an agent can weaken protection. Fraud and scope disputes are less settled.

Short answerUnder Regulation E, a transfer made by someone the consumer gave their access device to is generally not "unauthorized" until the consumer tells the bank that person is no longer authorized. Handing an agent your credentials can therefore weaken your protection. But fraud, scope disputes and error-resolution duties still leave banks exposed. Clear, revocable mandates reduce the argument for everyone.

What Regulation E covers

Regulation E (12 CFR Part 1005) implements the Electronic Fund Transfer Act. It protects consumers making electronic transfers from their accounts: debit card payments, ACH debits and credits, P2P transfers and online bill pay. Business accounts are not covered; their funds transfers fall mainly under UCC Article 4A.

The key definition: "unauthorized" transfer

Regulation E defines an unauthorized transfer as one initiated by someone other than the consumer, without actual authority, from which the consumer receives no benefit. It then carves out an important exception: a transfer is not unauthorized if it was initiated by a person the consumer furnished the access device to, unless the consumer has told the bank that transfers by that person are no longer authorized.

An AI agent given a customer's card details or online-banking login looks a lot like that "person furnished the access device". On that reading, an agent's mistaken purchase may be the consumer's responsibility, at least until they revoke it.

Why it is not that simple

Scope. A consumer may argue they authorized the agent for one task, not the transfer that happened. Regulation E's exception is about who holds the device, not how far authority stretched, and courts and regulators have not settled how this applies to software agents.
Fraud. The CFPB has said that when a consumer is fraudulently induced to share access information, resulting transfers can still be unauthorized. A compromised or malicious agent may fall on that side.
No benefit. The definition requires that the consumer received no benefit. Agent errors that buy something the consumer did not want, but still delivered, are awkward to classify.
Error resolution still applies. If a consumer disputes a transfer, the bank must investigate within 10 business days, or within 45 days if it gives provisional credit, whatever the final answer.

The liability limits consumers rely on

When the consumer reports	Maximum consumer liability (lost or stolen access device)
Within 2 business days of learning of the loss	$50
After 2 business days, within 60 days of the statement	$500
More than 60 days after the statement	Unlimited for later transfers the bank shows would have been prevented

These limits cannot be waived by agreement. Whether a given agent transfer is unauthorized at all decides whether they apply.

Revocation is the hinge

Because the exception ends when the consumer tells the bank a person is no longer authorized, a clear way to revoke an agent matters legally as well as practically. A bank-side off switch, logged with a timestamp, turns "I told you to stop" from a phone-call dispute into a record.

What banks can do now

Identify agents separately from customers instead of accepting shared passwords.
Record what the consumer authorized, as a signed and versioned mandate with limits and expiry.
Require a strong consumer approval for anything outside it.
Give consumers an instant, logged way to revoke each agent.
Keep one evidence record per transfer to speed up error resolution.
Start with business accounts, where UCC 4A gives a clearer framework, and bring the same controls to consumer accounts as guidance develops.

Sources