A Provisional-Credit Clock for AI-Assisted Card Disputes

An AI-assisted dispute workflow should start its compliance clock when the credit union receives the member's notice, not when an automated form becomes complete. The operating record should preserve the receipt time, channel, alleged error, transaction, amount, requested clarification, investigation steps, provisional-credit decision, member notices, automated outputs and named employee accountable for the result.

This is an implementation aid, not legal advice. Regulation E applies to covered electronic fund transfers, not every card dispute, and state law, network rules, account type and transaction facts may add obligations. The control objective is to prevent automation from delaying intake, changing the legal classification or hiding a missed deadline.

The CFPB's Electronic Fund Transfers FAQs explain that covered EFTs can include debit-card, ACH, prepaid and qualifying person-to-person transfers. A credit union should classify coverage before routing a case into a card-network chargeback path or an internal fraud workflow.

At notice receipt: open the case and preserve the member's words

The case clock begins with a qualifying oral or written notice. Capture the date and time, channel, member identity, account, transaction date and amount, and why the member believes an error occurred. If the notice lacks a field the automation expects, route the missing item for follow-up without resetting the original receipt timestamp.

An AI intake assistant can extract transactions, propose an error type, identify duplicate cases and draft questions. It should not require the member to contact a merchant before the credit union accepts the notice. The CFPB's FAQs state that a financial institution cannot delay starting or completing an investigation because a consumer has not first contacted a merchant.

Retain the original call recording, transcript, secure message or form alongside the structured fields. If the AI summary changes “I did not authorize this” into “merchandise dispute,” the original evidence must remain visible and the employee must correct the classification.

By business day 10: decide or provisionally credit

Regulation E section 1005.11 generally requires a prompt investigation and a determination within 10 business days after receiving notice. If the credit union cannot finish within that period, it may extend the investigation to 45 calendar days when it provisionally credits the alleged error within 10 business days and meets the other conditions.

The record should therefore show one of two branches: a completed determination with supporting evidence, or an extended investigation with the provisional-credit amount, posting timestamp, any permitted withholding, reason, employee approval and reconciliation to the core and card systems.

If the credit union requires written confirmation after oral notice, the employee should record when the member was told of the requirement and where to send it. The regulation identifies circumstances in which provisional credit is not required when written confirmation is not received within 10 business days, but the remaining error-resolution duties continue.

Within two business days: confirm the provisional credit

When provisional credit is used, the credit union must inform the member within two business days of the amount and date and give full use of the funds during the investigation. The notice event should contain the approved template, delivery channel, destination, send timestamp and delivery result.

Do not let an AI-generated notice become the system of record. The template should draw the amount and date from the posted transaction, not from a language-model summary. A human-owned exception queue should identify failed delivery, inconsistent amounts, returned mail and credits that posted in one system but not another.

By day 45—or 90 in defined cases—finish the investigation

The ordinary extended investigation period is 45 calendar days. Regulation E substitutes 90 days for certain point-of-sale debit-card transactions, transfers not initiated within a state and transfers involving a new account. It also substitutes 20 business days for the initial 10-day period when the transfer occurred within 30 days after the first deposit to the account.

Those extensions should be explicit case attributes, not silently inferred from a generic card label. Record the applicable basis, deadline calculation, source evidence requested, evidence received, card-network activity, third-party response, employee assessment, automated recommendation and disagreements between them.

The NCUA Federal Consumer Financial Protection Guide directs examiners to review error-resolution files, form letters, complaints and third-party agreements. That makes the case file—not a dashboard average—the durable unit of evidence.

After determination: correct in one day and report in three

If the credit union determines an error occurred, section 1005.11 calls for correction within one business day. Results must be reported to the member within three business days after the investigation is completed, including notice that provisional credit has become final when applicable.

If no error is found, retain the explanation, documents relied on, notice, provisional-credit reversal steps and member-access path for requesting the underlying documents. If provisional credit is debited, the workflow should also control the required notice and five-business-day treatment for specified items, rather than letting an automated reversal create an avoidable overdraft or fee.

Measure both timeliness and decision quality

A useful operating view reports time from notice to classification, initial investigation, provisional credit, member notice and final decision; cases nearing each deadline; reclassification and override rates; provisional-credit posting failures; notice-delivery failures; investigation reopenings; complaints; member remediation; and outcomes by channel, transaction type and member segment.

The NIST AI RMF Measure playbook recommends tracking known errors, incidents and negative impacts while documenting performance limits and accountability. Applied here, that means comparing AI-assisted cases with other cases for missed deadlines, wrong classifications, overturned decisions and disparate member burden.

Our complaint-analysis controls help connect a challenged dispute outcome to root cause and remediation. The Velera member-trust data brief adds the member expectation: people may use AI frequently while still resisting AI control over financial transactions.

The best evidence clock makes every deadline visible, every automation step reviewable and every member outcome traceable to a person with authority to correct it.