Summary: The CFPB’s payday rule, 12 CFR part 1041, now consists of its payment provisions only. After a lender’s second consecutive attempt to pull a payment from a borrower’s account fails for insufficient funds, the lender may not try again without the borrower’s new and specific authorization, and it must send a consumer rights notice within three business days. The compliance date was March 30, 2025. The CFPB has said it will not prioritize penalties and plans to propose a reconsideration, but as of October 2026 the rule is in force and unchanged.
What survived: the payment provisions only
The 2017 rule had two halves. The mandatory underwriting half was revoked in 2020. The payment half, subpart C, survived litigation and took effect on March 30, 2025.
Section 1041.7 states the rule in one sentence. It is “an unfair and abusive practice for a lender to make attempts to withdraw payment from consumers’ accounts in connection with a covered loan after the lender’s second consecutive attempts to withdraw payments from the accounts from which the prior attempts were made have failed due to a lack of sufficient funds, unless the lender obtains the consumers’ new and specific authorization to make further withdrawals from the accounts.”
Covered loans and what counts as an attempt
Section 1041.3(b) defines three kinds of covered loan:
- Short-term loans, where the consumer must repay “substantially the entire amount of the loan within 45 days of consummation.”
- Longer-term balloon-payment loans, repaid in a single payment more than 45 days out, or “through at least one payment that is more than twice as large as any other payment(s).”
- Longer-term loans where the cost of credit “exceeds 36 percent per annum” and the lender or its service provider “obtains a leveraged payment mechanism,” meaning “the right to initiate a transfer of money, through any means, from a consumer’s account to satisfy an obligation on a loan.”
The third category is where installment lenders land. A 24-month loan at 90 percent APR collected by ACH authorization is covered. Section 1041.3(d) excludes purchase-money, real-estate-secured, credit card, student and non-recourse pawn loans, among others.
A payment transfer is “any lender-initiated debit or withdrawal of funds from a consumer’s account for the purpose of collecting any amount due or purported to be due in connection with a covered loan,” in any channel.
An attempt fails “when it results in a return indicating that the consumer’s account lacks sufficient funds.” The counting rules in 1041.8(b)(2) decide the rest:
- A failure is the first failed transfer if no earlier transfer exists, if the immediately preceding transfer succeeded, or if it is the first failure after a new authorization.
- A failure is the second consecutive failed transfer “if the immediately preceding payment transfer was a first failed payment transfer.” A transfer “initiated at the same time or on the same day” counts as a previous transfer.
- A second failure counts “regardless of whether the first failed payment transfer was initiated through a different payment channel.”
- The count runs per account across “any covered loan that the consumer has with the lender,” not per loan.
A fictional example. A borrower owes a $200 installment. The lender’s ACH debit on March 3 is returned for insufficient funds. It is re-presented on March 5 and returned again. A debit card charge on March 6, or a debit against a second loan the same borrower has with the lender, is prohibited.
The new authorization
Section 1041.8(c) lets the lender continue only with an authorization that covers “the specific date, amount, and payment channel of each additional payment transfer.”
The lender may ask for it no earlier than the day it provides the consumer rights notice. The authorization “must be signed or otherwise agreed to by the consumer in writing or electronically and in a retainable format.” If granted by phone, “the lender must record the call and retain the recording.”
If an authorized transfer is returned for nonsufficient funds, the lender “may re-initiate the payment transfer, such as by re-presenting it once through the ACH system,” provided that return did not itself trigger the prohibition. And the authorization “becomes null and void” if two consecutive transfers under it fail.
Section 1041.8(d) allows one more path, a single immediate payment transfer at the consumer’s request, initiated within one business day of the authorization. Section 1041.8(e) prohibits “any action with the intent of evading the requirements of this section.”
The notices
Section 1041.9 requires two notices.
The payment notice goes out before the first withdrawal on a loan and before any unusual withdrawal. By mail it must be sent “no later than six business days prior to initiating the transfer.” Electronically or in person, “no later than three business days.” Unusual means a different amount, date or channel, or a re-initiated returned transfer.
The consumer rights notice is due “no later than three business days after it receives information that the second consecutive attempt has failed.” It must state that the lender “is no longer permitted to withdraw loan payments from the consumer’s account,” that the last two attempts were returned for non-sufficient funds, and that “Federal law prohibits the lender from initiating further payment transfers without the consumer’s permission.” It ends with a table of the failed attempts showing due date, date of attempt, amount and any lender fee.
Status of the CFPB’s reconsideration
The compliance date was March 30, 2025. The CFPB’s January 10, 2025 post said the court of appeals “rejected the payday lenders’ efforts to further delay the rule and confirmed that the rule will finally take effect March 30.”
On March 28, 2025 the CFPB announced it “will not prioritize enforcement or supervision actions with regard to any penalties or fines associated with the Payment Withdrawal provisions and the Payment Disclosure provisions once they become operative on March 30, 2025,” and said it was “further contemplating issuing a notice of proposed rulemaking to narrow the scope of the rule.”
The CFPB’s 2026 regulatory agenda, RIN 3170-AB38, says the Bureau “plans to issue a proposed rule to reconsider the remaining provisions of the 2017 rule, including the compliance date,” with a July 2026 target. As of October 14, 2026, no such proposal appears in the Federal Register and the text of part 1041 is as quoted above.
So the rule is in force. The March 2025 statement describes how the CFPB will spend its own resources. It did not amend the regulation, and a state regulator, bank partner or plaintiff reads the same payment records.
Testing payment histories for violations
The rule is testable on every loan because every element is a dated record:
- Classify each loan under 1041.3(b).
- Build one timeline per borrower account, not per loan, with every lender-initiated attempt across all channels, including same-day attempts, and its outcome.
- Flag any attempt that follows two consecutive insufficient-funds returns.
- For each flag, look for an authorization dated on or after the consumer rights notice that matches the attempt’s date, amount and channel. No match is an exception.
- Check that the consumer rights notice went out within three business days of the second return, and that a payment notice preceded the first withdrawal and every unusual one.
How the automated version works
MightyBot is an AI agent platform for lending and finance. Agents apply the counting rules above to every loan, written in plain English rather than code: two consecutive insufficient-funds returns on one account, any later attempt, and whether a matching authorization and timely notice exist. Each finding cites the transaction and document it rests on, and exceptions route to a person for approval before anyone contacts the borrower. See compliance monitoring and loan servicing.
