Regulation CC Check Hold Rules: What Fintechs Must Know in 2027

Regulation CC is one of those compliance frameworks that feels solved — until an examiner starts asking questions. The Expedited Funds Availability Act has been on the books since 1987, but the Federal Reserve and CFPB jointly updated the implementing rule in 2019, again adjusted inflation-linked thresholds in 2025, and the current 2027 figures carry real dollar consequences for institutions that haven't refreshed their policy documents since the Obama administration.

For fintechs specifically, the risk is subtle. You're often not the depository institution of record — you're the interface layer above a bank partner — and that creates a diffusion-of-responsibility problem that examiners have grown impatient with. The CFPB's 2026 Supervisory Highlights called out "inadequate funds-availability disclosures at the point of deposit" as a recurring finding across multiple fintech-bank partnership examinations. This post walks through every material aspect of Reg CC as it stands today: hold schedules, exception triggers, disclosure requirements, and the specific language errors that keep surfacing.

The Core Hold Schedule — and Where Fintechs Misread It

Under 12 CFR Part 229, banks and their fintech partners must make the first $275 of a check deposit available by the next business day. That threshold was $225 before the Fed's inflation adjustment in January 2025. If your funds-availability policy still says $225, you are out of compliance today.

Beyond that floor, the general availability schedule breaks down like this:

1. Next business day: The first $275; Treasury and U.S. government checks; Federal Reserve and Federal Home Loan Bank checks; cashier's, certified, and teller's checks; checks deposited in-person at a staffed teller.
2. Second business day: Checks drawn on the same institution where the deposit is made (on-us checks).
3. Up to the fifth business day: All other checks — the so-called "general hold" window.

One perennial source of confusion: "business day" under Reg CC means any day except Saturdays, Sundays, and federal holidays. The clock starts on the business day the deposit is received before the cutoff time — which the institution must publicly disclose, and which can be no earlier than 2:00 p.m. local time for a branch or ATM. Mobile-deposit cutoffs follow the same logic, and this is where many app-first fintechs stumble: if your mobile deposit cutoff is listed in UTC rather than local time, or buried in an FAQ rather than shown at the point of deposit confirmation, that's a disclosure violation.

Exception Holds: Six Triggers, Each With Its Own Timeline

The general hold schedule can be extended — but only for one of six statutory reasons, and each requires contemporaneous written notice to the customer. Applying an exception hold without delivering notice by the close of business on the day the deposit is made (or next business day if the deposit is received after cutoff) is itself a separate violation.

• New accounts: Any account open fewer than 30 days. Holds can extend up to 9 business days on non-next-day items.
• Large deposits: Deposits exceeding $6,725 on any single business day (2027 threshold; was $5,525 before the 2025 adjustment). The institution may hold the amount above $6,725; the first $275 and the next-day items still follow normal rules.
• Redeposited checks: A check previously returned unpaid. The hold can extend to the fifth business day or longer with notice.
• Repeatedly overdrawn accounts: An account that has been overdrawn for six or more business days in the preceding six months, or has been overdrawn by $5,525 or more on two or more occasions.
• Reasonable cause to doubt collectibility: This is the catch-all — and the most litigated. The institution must have specific facts suggesting the check will not be paid. A policy that applies this exception to all mobile deposits from new payees is not permissible.
• Emergency conditions: Computer failure, communications interruptions, war, or natural disaster.

Compliance note: Exception hold notices must state the reason for the hold, the day funds will be available, and — critically — that the customer may ask for a copy of the bank's availability policy. An email notification that says only "Your deposit is under review" does not satisfy Reg CC.

The Disclosure Most Fintechs Get Wrong

Section 229.18 requires institutions to provide a "specific availability policy disclosure" at account opening and, separately, a "general policy notice" at every physical location and ATM where deposits are accepted. For digital-first fintechs, those last two requirements translate to: a prominent, machine-readable notice at every point in the mobile or web deposit flow where a customer initiates a check deposit.

The specific failure the CFPB flagged in its 2026 Supervisory Highlights? Institutions were disclosing general hold timelines accurately but omitting the exception-hold triggers and the $275 next-day minimum from the same screen as the deposit confirmation. Regulators treated this as two distinct violations: one for incomplete disclosure, one for failure to disclose at the point of deposit.

The required elements of a compliant specific availability policy disclosure are not optional in their ordering or content:

1. When funds from each category of check will be available.
2. When the institution begins charging fees against the deposited funds.
3. A description of each exception that may be invoked.
4. A statement that longer delays may apply and the customer can call to determine availability.

This list must be in plain English. The Fed's model disclosure language (Appendix C to Part 229) is a safe harbor — use it verbatim or modify it only in ways that remain accurate and equally clear. Translating it into marketing copy that "sounds better" is precisely how you end up with a deficient disclosure.

Remote Deposit Capture: The Mobile-Specific Wrinkles

Reg CC was originally written for paper presented at teller windows. The 2019 amendments extended the framework explicitly to remote deposit capture (RDC), and a 2022 Federal Reserve interpretive letter clarified that mobile check deposit via smartphone camera is subject to the same hold and disclosure rules as any other deposit method.

For mobile-only fintechs, three points deserve special attention:

The "Received" Timestamp

A deposit is received when the institution's system accepts the image and any required data fields — not when the customer taps "Submit." If your backend queues images for batch processing that runs at 11 p.m. ET, a customer who submits at 9 p.m. may believe the funds clock started at 9 p.m. Your disclosure must explain the actual processing time, in local time, with specificity.

Duplicate Presentment Liability

RDC introduces the risk that a customer deposits the same physical check twice — once via mobile, once at a branch. Under the Check 21 framework (12 CFR Part 229, Subpart D), the institution that creates a substitute check warrants that no other party will be asked to pay the same item. Your fraud and exception-hold policies should explicitly address duplicate detection, and your customer agreement should state that the customer indemnifies the bank for losses arising from their own duplicate presentment.

The Endorsement Requirement

Since 2017, most major banks have required "For Mobile Deposit Only" on the back of the check. This is not a Reg CC requirement — it's a risk-management policy — but failure to disclose it in your RDC terms can create a separate UDAAP exposure if customers are routinely charged for duplicate-presentment losses they weren't warned about.

Reg CC Liability and the Fintech-Bank Partnership Structure

If you are a fintech operating on a bank-partner model — as most consumer neobanks do — the chartered bank is the "depository institution" under Reg CC. But the CFPB and OCC have been explicit since 2023 that bank partners cannot simply outsource compliance obligations to fintech program managers through contract language alone.

According to the OCC's 2023 guidance on bank-fintech arrangements, banks must maintain "ongoing monitoring of the fintech's compliance with applicable law" and cannot treat a program agreement as a substitute for that oversight. In practice, this means:

• The bank must review the fintech's funds-availability disclosure language before launch and at each material update.
• The fintech's customer support team must be able to accurately explain hold timelines and exception reasons — and must be trained to do so by a compliance resource, not just a product FAQ.
• Incident reporting should include any hold dispute that escalates beyond the first contact, so the bank's compliance team can track whether a pattern is emerging.

The financial penalties are not theoretical. In March 2025, the CFPB issued a consent order against a mid-sized bank and its neobank partner, citing — among other violations — check-hold disclosures that "omitted exception-hold triggers and failed to state the next-day minimum availability threshold accurately." The combined redress and penalty totaled $4.2 million.

Practical Steps to Audit Your Current Compliance Posture

If you haven't done a Reg CC gap analysis since the 2025 threshold adjustments, here's where to start:

1. Pull your current account agreement and funds-availability policy. Check every dollar figure against the 2027 thresholds: $275 next-day minimum, $6,725 large-deposit exception, $5,525 repeatedly-overdrawn threshold. Update all three if needed.
2. Walk through your mobile deposit flow as a new customer. Screenshot every screen. Ask: does the disclosure appear before the deposit is confirmed, or only in the terms of service? Does it include exception-hold triggers?
3. Review your exception-hold notice template. Does it state the reason, the availability date, and the customer's right to request the full policy? Is it sent by close of business on the deposit day?
4. Check your cutoff-time disclosure. Is it expressed in local time? Is it visible without scrolling on a standard mobile screen?
5. Audit your customer support scripts. Can a tier-1 agent explain the $275 next-day rule accurately? Do they know the six exception-hold triggers?
6. Confirm your bank partner's review cadence. Under OCC guidance, the bank should be signing off on material disclosure changes. Document that sign-off.

For deeper reading on the regulatory text, the Federal Reserve maintains the authoritative version of 12 CFR Part 229 with all current thresholds and the Appendix C model forms. The CFPB's exam procedures for Reg CC are also publicly available and worth reading as a self-assessment checklist — examiners use exactly that document during audits.

How Embedded Compliance Infrastructure Changes the Calculus

The administrative burden of maintaining accurate, jurisdiction-specific Reg CC disclosures — updating thresholds when the Fed adjusts for inflation, tracking exception-hold notice delivery, surfacing hold disputes to the right compliance tier — is exactly the kind of work that scales poorly when it lives in a spreadsheet and a shared Google Doc.

AtlasForge Financial's Safe to Spend 365 integrates real-time check-hold state tracking directly into the ledger layer, so the funds available for spending reflect the Reg CC hold schedule automatically — including exception holds applied at deposit ingestion. When a large-deposit exception is triggered, the platform generates a compliant notice payload that your bank partner can review and deliver through whatever channel the customer has consented to. Our platform overview has a detailed breakdown of how hold logic is modeled, and the AtlasForge Financial API exposes hold-state endpoints so your product team can surface accurate availability timelines in your own UI without rebuilding the compliance logic from scratch. If you're running a Reg CC gap analysis right now and want to compare your current disclosure language against the 2027 model forms, our team is also available — reach out through /contact to set up a technical review session.

Further reading

• Regulation E in 2027: Electronic Funds Transfer Rules
• FDIC Pass-Through Insurance for Fintechs Post-Synapse
• Regulation Z & TILA: What Fintech Lenders Must Disclose in 2027