On December 7, 2023, the Consumer Financial Protection Bureau (CFPB) ordered Atlantic Union Bank, an approximately $20 billion bank headquartered in Richmond, Virginia, to pay $6.2 million for “illegal overdraft fee harvesting” and “illegally enrolling thousands of customers in checking account overdraft programs.” The bank was ordered to pay $5 million in refunds and $1.2 million to a victims’ relief fund.

Regulation E provides that a bank may not charge a fee for an ATM or one-time debit card transaction unless it completes four steps. First, the bank must provide the customer with a notice describing the bank’s overdraft services in writing. Then, the bank must provide the customer with a “reasonable opportunity” for that customer to “affirmatively consent” to the payment of the ATM or one-time debit card transaction fee. Third, the customer must provide that “affirmative consent” or opt-in to the bank. And finally, the bank must provide the customer with written confirmation of their consent, including a statement of the right to revoke the consent at any time.

The CFPB alleged that Atlantic Union Bank failed to obtain proper consent when an account was opened in person at a branch. Bank employees orally provided customers with options for opting in to the payment of one-time debit card and ATM transaction fees pursuant to Regulation E. Bank employees asked customers to opt in orallyand then input the option into the bank’s account-opening computer system before printing the written consent form. The consent form was printed at the end of the account-opening process and was pre-populated with the customer’s oral opt-in choice.

In instances in which a customer was given options for opting in to the payment of one-time debit card and ATM transaction fees over the phone, bank employees did not have a script and allegedly provided misinformation and misleading statements about the benefits, costs, and other aspects of opting in to the payment of one-time debit card and ATM transaction fees pursuant to Regulation E.

The CFPB has taken the logical approach that a bank must provide the customer with a written disclosure of its overdraft practices prior to having them opt in. Additionally, without providing the customer with a prior written disclosure, a bank should not pre-populate its Regulation E opt-in form. Now is the time to review the consent order and your bank’s Regulation E opt-in processes and procedures.