How to Automate Reg E Dispute Investigations with AI Agents
Build an AI agent for Reg E debit card and ACH disputes. Track provisional credit deadlines, gather evidence from your core and processor, and draft the determination letter for review.
Disputes are a deadline business. Regulation E gives a bank or fintech 10 business days to investigate a debit card or ACH claim or put provisional credit on the account, and 45 days (sometimes 90) to finish. Every claim starts a clock, and most of the analyst's time goes into gathering records, not deciding.
That gathering is a defined job an agent can do well. The judgment, whether this was really unauthorized and what the customer gets back, stays with your team.
This is a guide to building a Reg E dispute investigation agent with Claude Code or Codex and running it in Runtime. The agent opens the claim, pulls the evidence, computes the deadlines, and drafts the determination. An analyst approves it.
The short answer. Give the agent the claim, read-only access to your core, card processor, and authentication logs, and your written dispute procedure. Have it build a transaction timeline, check the claim against your Reg E checklist, compute each deadline, and draft the determination and the customer letter. Keep provisional credit, reversals, chargeback filings, and letters behind human approval.
The Reg E clock
Most dispute backlogs come from missing one of these dates. The agent's first job is to compute all of them on intake and keep them visible.
| Event | Deadline (12 CFR 1005.11) |
|---|---|
| Customer reports the error | Within 60 days after the statement showing it was sent |
| Investigate, or give provisional credit | 10 business days (20 for accounts open under 30 days) |
| Finish the investigation if credit was given | 45 calendar days (90 for new accounts, point-of-sale, and foreign-initiated transfers) |
| Report results to the customer | 3 business days after finishing |
| Correct a confirmed error | 1 business day after the determination |
| Reverse provisional credit after a no-error finding | Notify first, and honor checks and payments for 5 business days |
Card networks run a second clock for the chargeback. Visa and Mastercard generally give issuers 120 days from the transaction or expected delivery date, with exceptions by reason code. A claim can be on time for Reg E and late for the chargeback, which is a write-off nobody planned for.
Credit card disputes follow Regulation Z instead: the creditor acknowledges within 30 days and resolves within two billing cycles, at most 90 days. The same agent can work both if the procedure says which rule applies.
What it does, and what it is not
What it does. Reads the claim from your case tool or intake form, pulls the disputed transactions and the 90 days around them, checks authentication (3DS, PIN, tokenized wallet, device and IP), looks for prior undisputed use of the same merchant and device, checks whether the merchant already refunded, and drafts a determination with every source cited.
What it is not. A decision engine that credits or denies money on its own. Every material improvement comes from a human questioning a premise. Plan for that.
How it runs in Runtime
Runtime is an operating system for coding agents like Claude Code and Codex. A dispute agent is built from a template (the agent's computer), skills (your dispute procedure, written as runbooks), and tools (what it can reach). Your core and processor stay the source of truth.
claim-intakeReads the claim, classifies it (unauthorized, not received, duplicate, wrong amount, ATM), and computes every Reg E and network deadline.
transaction-timelinePulls the disputed transactions and surrounding activity, with authorization, settlement, and refund status.
authentication-checkChecks 3DS, PIN, wallet token, device, and IP history, and prior undisputed use of the same merchant.
determination-draftMaps the evidence to your procedure, drafts the finding, the customer letter, and the chargeback reason code.
deadline-watchFlags every open claim near its provisional credit or final determination date in Slack.
- Zendesk
- Card processor
- Core / warehouse
- Case tool
- Slack
Create a banking ops agent that handles RFIs, hold-harmless requests, and returns of funds from our partner bank, verifies against our ledger, and drafts replies for my approval.
bank-ops-agent
Tools picked from your prompt
The stack
| Job | Example tools |
|---|---|
| Receive the claim | Zendesk Salesforce Your in-app dispute form |
| Card and transaction data | Marqeta  LithicGalileo, i2c, Fiserv, FIS, Jack Henry |
| Account and login history | Snowflake Your core or ledger, read-only views |
| Fraud signals |  SardineSift, Alloy, your own rules |
| Approvals and deadline alerts | Slack |
| Agent infrastructure |  Runtime |
Step 1: Write the dispute procedure
The procedure is the agent. Write down, in plain language, how your best analyst works a claim: which claim types you see, which evidence decides each one, when you give provisional credit up front, when you deny, and when you escalate. Include your sponsor bank's expectations if you have one.
Two habits make the procedure work for an agent:
- Say why, not just what. "Check for a 3DS challenge, because a passed challenge on a card-not-present claim usually means the customer authenticated the purchase" beats "check 3DS".
- Name the failure you're preventing. "Never treat a gross negligence argument as a reason to deny. Reg E does not allow it." An agent follows a named rule much better than an implied one.
Step 2: Give it read-only access
| Allow | Require approval | Exclude |
|---|---|---|
| Read the claimant's transactions, auth logs, and device history | Provisional credit and its reversal | Other customers' records |
| Read prior disputes and refunds for the same merchant | Final determination and customer letter | Full card numbers and CVV |
| Write a draft to the case | Filing the chargeback | Unrestricted writes to the core |
In Runtime, credentials are added through the dashboard, never pasted into a chat, and card numbers and SSNs are stripped from prompts and logs.
Step 3: Ask the agent to build it
Build a Reg E dispute investigation agent from the procedure in this repo. For each new claim, compute each Reg E deadline using its prescribed unit: 10 business days (20 when the new-account exception applies) for initial investigation or provisional credit, and 45 calendar days (90 when an extended period applies) from receipt of the notice for completing an extended investigation, plus the network chargeback deadline under that network's rules, pull the disputed transactions and 90 days of surrounding activity, check authentication and device history, check for merchant refunds, and draft a determination with every source linked. Use our letter templates. If evidence conflicts or a source is missing, mark the claim incomplete and say what is missing. Never credit, reverse, file a chargeback, or send a letter.
Ask it to write small, testable scripts for the parts that must be exact, such as the business-day calendar and the deadline math. Have an analyst check them against claims you already closed.
Step 4: Put it on the queue
Start with one claim type, usually card-not-present unauthorized claims, because they are the highest volume and the evidence is consistent. Run the agent in draft-only mode next to your analysts for two weeks and compare. Then let it take first pass on that type and add the next one.
Schedule one morning run that lists every open claim within two business days of a deadline. That single message prevents most Reg E findings in an audit.
What stays human, permanently
| Step | Why |
|---|---|
| The determination | It is a regulated decision about a customer's money. |
| Provisional credit and reversals | Money moves, and the timing is a legal obligation. |
| Letters to the customer | What you disclose, and how, is your policy and your liability. |
| Scam and first-party fraud calls | They need context and judgment beyond the evidence packet. |
| Changes to the procedure | Every improvement starts with an analyst questioning a premise. |
Lessons that cost the most
- Use the right unit for each deadline. The 10-day investigation and provisional credit clock runs in business days, so it needs your holiday calendar. The 45 and 90-day limits run in calendar days from when you received the notice. Mixing them up schedules work days or weeks late.
- Card networks and Reg E are separate clocks. Track both on every claim.
- Never use carelessness to deny. Writing a PIN on the card is not a reason to deny under Reg E; liability depends on when the customer reported, not how careful they were. Encode that explicitly.
- Keep the evidence, not just the answer. Examiners and sponsor banks ask how you decided. A draft with linked sources answers that.
- Start with one claim type. Mixed queues hide where the agent is weak.
Measuring it
Track time from claim to a reviewable draft, analyst minutes per claim, claims past a deadline, the share of drafts approved without factual changes, and chargeback recovery on claims the agent prepared. Split by claim type. Compare against two weeks of your own baseline before promising savings.
A realistic timeline
| Phase | Time |
|---|---|
| Agent environment ready | Minutes on Runtime; weeks if you build the infrastructure yourself |
| Procedure written and access scoped | One to two weeks |
| Draft-only run next to analysts | Two weeks |
| First pass on one claim type | Week four or five |
| Second claim type and chargeback filing drafts | The month after |
For merchant-side chargebacks, see the best AI agents for chargeback management. For the dispute vendors built for banks and fintechs, see the best AI dispute management software for banks.
Frequently asked questions
What are the Reg E dispute timelines?
Under Regulation E (12 CFR 1005.11), a consumer has 60 days after the statement is sent to report an error. The institution must investigate within 10 business days, or provisionally credit the account within 10 business days and finish within 45 calendar days. New accounts get 20 business days, and new accounts, point-of-sale, and foreign-initiated transfers get up to 90 days. Results go to the consumer within 3 business days of finishing, and a confirmed error is corrected within 1 business day.
Can an AI agent decide a Reg E claim?
It should not decide on its own. A well-scoped agent gathers the transaction, authentication, device, and account history, maps the claim to your procedure, computes every deadline, and drafts the determination and letter. A named analyst approves the decision, the provisional credit, and any reversal.
What is the difference between a Reg E dispute and a chargeback?
Reg E is the consumer protection obligation between a bank or fintech and its customer for electronic fund transfers such as debit card and ACH transactions. A chargeback is the card network process the issuer uses to recover the money from the merchant's acquirer. One claim often needs both: a Reg E investigation with its own deadlines, and a chargeback filed under the network's reason codes and time limits.
Does Reg E apply to fintechs and program managers?
Reg E applies to financial institutions that hold consumer accounts, and the CFPB defines that term broadly enough to include many fintechs that issue debit cards or prepaid accounts. In a sponsor bank model, the bank remains responsible and usually expects the program manager to run the dispute process to its standard. Confirm your obligations with counsel and your sponsor bank.
Where should a dispute investigation agent run?
In its own sandbox with read-only, scoped access to your core, card processor, and case tool, with card numbers stripped from prompts and logs and a record of every query. Runtime runs Claude Code and Codex agents that way, in your cloud, and holds credits, reversals, and letters for human approval.
The point
The Reg E clock does not care how many analysts you have. An agent that opens every claim with the evidence, the deadlines, and a draft gives your team the time to make the calls that matter.
Back to deciding.
