The Consumer Financial Protection Bureau (the “CFPB”) warned financial companies in a compliance Bulletin Monday that they must have proper authorization before automatically debiting funds from customers’ accounts. (CFPB Compliance Bulletin 2015-06, November 23, 2015.)

The Electronic Fund Transfer Act and its implementing rule, Regulation E, require that companies obtain consumer authorization for electronic fund transfers, or debits, from consumers’ accounts. The bulletin was partly meant to remind merchants and financial institutions that they must “clearly describe” the terms of an automatic withdrawal and get pre-authorization from the consumer before deducting payments. The agency’s warning follows an administrative proceeding that the CFPB filed on November 18, 2015 against an online payday lender, Integrity Advance, partly on grounds that Integrity allegedly continued to automatically deduct funds from consumers’ bank accounts after they cancelled authorizations for such withdrawals.

The CFPB said in its press release accompanying the bulletin that its supervisory process found that “one or more companies” did not provide the consumer with “critical information” about automatic debits in its disclosures, such as the amount and timing of the payments.

The bulletin provides further clarification on when companies should send disclosures and that they can get a consumer’s consent either in writing or by phone if the E-Sign Act requirements for electronic records and signatures are met.  Regulation E may be satisfied if a consumer authorizes preauthorized debits by entering a code into their telephone keypad or if the company records and retains the consumer’s oral authorization; provided in both cases that the consumer intends to sign the record as required by the E-Sign Act. Companies must keep “clear records” on what the consumer authorized, and they must provide the consumer – in paper form or electronically – a copy of the terms, including the amounts of the debits, the recurring nature of the debits, and the timing. When practical, the CFPB encourages companies to provide the copy of the authorization terms prior to initiating the first automatic withdrawal.