Guides
Fintech consumer protection guide: terms, errors, complaints, privacy, and records
A fintech consumer protection guide to account terms, Regulation E and other dispute rules, CFPB complaints, privacy notices, and records to preserve.
What to take away
- Identify the legal provider, the account type, the payment rail and the governing agreement before you pick a dispute path.
- Save the version of the terms, fee schedule and privacy notice that was live on the date of the event.
- Describe dates, amounts and the correction you want instead of forcing the event into the wrong legal category.
- For eligible electronic fund transfers, Regulation E generally gives consumers 60 days after a statement showing an error to notify the institution; other disputes have different rules.
- Keep originals and a dated contact log until the issue and any follow-up are closed.
This fintech consumer protection guide starts with the parties: Digital finance products may stack a nonbank app on top of one or more banks, a card issuer, a payment network, a data provider and outside support vendors. Which protections apply depends on the product and the event, not on the app icon.
Start by mapping the parties, then preserve what the product showed at the time.
Build the product map
Answer each row from a document, not from memory.
- Legal name of the app provider and the bank or credit union holding the account, if any
- Product and account type, including who owns the account
- Payment method and rail, such as a card or electronic bank transfer
- Governing agreement, effective date, and any separate fee schedule
- Error-notice channel, relevant statement or event date, and applicable deadline
- Regulator or complaint body that matches the legal provider and product
Product map evidence
- Who offered the service?
- Who holds the funds?
- What kind of product?
- How did the money move?
- Which agreement applies?
- Who handled the event?
- Who supervises the entity?
One brand can cover several legal entities. Copy the exact name from the agreement or the statement rather than guessing from the logo.
Read terms as operating rules
The terms answer several things.
The terms answer several things:
- When a payment becomes final
- What fees apply
- Which limits can change
- How access can be suspended
- How errors are reported
Search the document for its defined terms and follow the cross-references.
Save a local copy with its effective date. A live webpage can change after the disputed event, and you will need the version that governed it.
Review the account ownership and eligibility section first, then funding and withdrawal, fees and exchange rates. Check these terms as well:
- Payment authorization and cancellation
- Holds and limits
- Error notices
- Suspension and closure
- Data sharing
- Arbitration and governing law
- Support contacts
Separate errors from dissatisfaction
An incorrect amount, a duplicate transfer, an unauthorized electronic fund transfer and a missing credit are not interchangeable. A defective purchase, a failed cancellation, a fee disagreement and a service outage are not interchangeable. Pick the label last.
Errors vs dissatisfaction
Error
- Amount
- Incorrect amount
- Transfer
- Duplicate transfer
- Authorization
- Unauthorized EFT
- Credit
- Missing credit
Dissatisfaction
- Amount
- Fee disagreement
- Transfer
- Failed cancellation
- Authorization
- Defective purchase
- Credit
- Service outage
Describe what happened first. Include what you instructed, what the provider displayed, what posted to the account, and the correction you want. The process that applies can turn on the account type, the payment rail, the timing and who initiated the transfer.
For a consumer account covered by the Electronic Fund Transfer Act (EFTA) and Regulation E, notify the financial institution within 60 days after it sends the statement that first shows the error. Generally, if the institution cannot complete its investigation within 10 business days, it must provisionally credit the disputed amount within that period, subject to the rule's conditions, and complete the investigation within 45 calendar days; exceptions apply to certain transfers and accounts.
Credit-card billing errors follow a different process under the Truth in Lending Act (TILA) and Regulation Z. Send written notice to the issuer's billing-inquiries address within 60 days after the statement showing the error; the issuer generally acknowledges the notice within 30 days and resolves it within two billing cycles, no later than 90 days. For an error in a credit report, the Fair Credit Reporting Act (FCRA) generally gives a consumer reporting agency 30 days to investigate a dispute, with statutory exceptions.
Escalate in layers
Begin with the entity that can inspect and correct the record. Use a verified support channel, ask for a case number, and follow any written-notice instructions the agreement requires.
Escalate in layers
- Contact entity that can correct record
- Use verified support channel
- Ask for case number
- Follow written-notice instructions
- Identify regulator with jurisdiction
- Send tailored narrative to each body
If the provider does not resolve it, identify the regulator or complaint body with jurisdiction. The CFPB's consumer complaint process describes submission, routing, the company response, publication of qualifying complaint information, and consumer review. It can produce a company response. It is not a court, and it does not guarantee the result you asked for.
To submit through the CFPB complaint portal, use the linked process, select the product and issue, identify the company, describe what happened and the resolution you want, and provide supporting details or documents. Keep the confirmation and check the portal for status and the company's response.
The right regulator depends on the provider's charter and product:
- The Office of the Comptroller of the Currency (OCC) supervises national banks and federal savings associations.
- A state banking regulator supervises state-chartered banks; the Federal Deposit Insurance Corporation (FDIC) supervises state nonmember banks, and the Federal Reserve supervises state member banks.
- The National Credit Union Administration (NCUA) supervises federal credit unions; state-chartered credit unions have a state regulator.
- The CFPB and the Federal Trade Commission (FTC) handle complaints involving companies and products within their respective jurisdictions. A state attorney general may also take consumer complaints under state law.
Send a different narrative to each body. State what prior contact produced, and address the questions that body actually asks.
Privacy is more than a policy link
For covered financial institutions, the Gramm-Leach-Bliley Act (GLBA) and its Privacy Rule govern privacy notices and certain sharing of nonpublic personal information. Read the notice for what data is collected, who receives it, and how to use any opt-out right that applies; exceptions mean an opt-out does not stop every kind of sharing. Privacy-law coverage depends on the provider and the data practice, so an app's policy link alone does not tell you which rules apply.
Privacy review checklist
- What data is collected?
- Where does it come from?
- Who receives it?
- Why is it used?
- How long is it kept?
- What controls does the user have?
- Separate financial privacy notice from app policy
Check what closing the account actually stops. Data already shared with connected recipients follows their retention practices, not yours.
Build a clean evidence file
Use original statements and exported records where the provider offers them. A screenshot shows what the interface displayed, but it can omit metadata and later status changes.
Keep the agreement and terms version, fee and privacy notices, statements, transaction receipts or IDs, confirmations, error or fraud reports, support messages and case numbers, complaint confirmations, and a dated timeline. Preserve proof of when you sent or received a required notice, along with screenshots and the original records behind them.
Regulation E requires covered financial institutions to retain evidence of compliance for at least two years (12 C.F.R. § 1005.13(b)); that is an institution's duty, not a universal consumer record-retention deadline. Keep your records through final resolution and any applicable review or appeal deadlines, since no single federal retention period covers every fintech dispute.
Evidence file contents
- One-page chronology
- Agreement and fee schedule
- Statements and confirmations
- Support messages and call notes
- Screenshots with dates and context
- Case, trace, or dispute numbers
- Requested correction and provider response
- Notices sent with delivery proof
Protect sensitive records
Keep full account numbers, identity documents, passwords, authentication codes and recovery secrets out of ordinary email unless a verified process requires protected submission. Redact anything you share outside the formal case.
Preserve the originals separately. A redacted working copy is a convenience, not a substitute for the source document.
Review the response
Compare the response against each issue you raised.
- Did it identify the transaction and the account correctly?
- Did it answer every material fact?
- Did it rely on records you can request?
- Did it explain the decision and the correction?
- Did it address fees or downstream effects?
- Does a review, appeal or further-notice deadline still run?
An automated status message is not a final investigation result.
Common questions
Do all finance apps carry the same consumer protections?
No. Protection follows eight things:
- the product
- the account
- the payment method
- the event
- the agreement
- the law
- the timing. Two apps with identical screens can sit under different rules.
Is a screenshot enough evidence?
It helps, but statements, confirmations, original messages and provider records can establish details a screenshot omits. Keep the screenshot and the underlying record.
Should I complain to a regulator first?
The provider usually holds the records and the correction tools. Some notice deadlines run while you seek support, so check the applicable process promptly rather than waiting. If the provider stalls, the regulator is the next layer, not the first.
Does filing a complaint guarantee I get the money back?
No. A complaint routes the issue to the company for a response. The outcome depends on the facts and on which process governs the transaction.
