The CFPB Payday Rule's Two-Failed-Payments Limit: What Lenders Must Build Into ACH and Debit Collections

Since March 30, 2025, payday, vehicle title and certain high-cost installment lenders have been bound by a federal limit on how they collect from borrowers' bank accounts. Once two consecutive attempts to pull a payment fail for insufficient funds, the lender has to stop. It cannot try the account again, through any payment channel, until the borrower gives a new and specific authorization. The same rule requires written notices before the first withdrawal, before any unusual one, and after the second failure.

This is the part of the Consumer Financial Protection Bureau's 2017 Payday Lending Rule that survived. The underwriting provisions were revoked in 2020, litigation held up the rest for years, and the payment provisions finally took effect in 2025. For a lender, they are less a legal question than a payments-engineering one: the rule lives or dies in how your loan management system, your ACH files and your debit card retries are configured. This guide sets out what the rule requires, how it interacts with the Nacha rules you already follow, and where it stands as of September 2026. It is a summary of the regulation, not legal advice for your particular loan products.

Where the rule stands in September 2026

The payment provisions are codified at 12 CFR 1041.7 through 1041.9, and the eCFR text current as of September 23, 2026 is unchanged. Two days before the March 2025 compliance date, the CFPB said it "will not prioritize enforcement or supervision actions" with regard to penalties or fines associated with the payment withdrawal and payment disclosure provisions, and that it was contemplating a proposed rule to narrow the rule's scope. The Bureau's 2026 regulatory agenda lists a proposed rulemaking to reconsider the remaining provisions. As of late September 2026 we could not find that proposal published in the Federal Register.

So the rule is in force, the federal regulator has said penalties are not a priority, and a rewrite is planned but not yet proposed. That is not the same as the rule going away. Under 12 U.S.C. 5552, state attorneys general can bring civil actions to enforce regulations issued under the Consumer Financial Protection Act, and state regulators were active on small-dollar lending through 2025. Record-keeping obligations also run for 36 months after a loan stops being outstanding, which means today's collection practices can be examined long after any change in federal priorities.

Which loans are covered

The rule applies to a lender that regularly extends consumer credit and makes covered loans. A covered loan is consumer credit, closed-end or open-end, that falls into one of three groups:

• Short-term loans, where the borrower must repay substantially the whole amount within 45 days. A typical payday loan due on the borrower's next payday falls here, as does a single-payment vehicle title loan due within 45 days.
• Longer-term balloon-payment loans, where repayment is due in a single payment more than 45 days out, or at least one payment is more than twice the size of any other.
• Longer-term loans with a cost of credit above 36 percent per year where the lender or its service provider holds a leveraged payment mechanism, meaning the right to initiate a transfer from the borrower's account. A single immediate payment the borrower asks for does not create one.

The rule excludes purchase-money loans secured by the item bought, real-estate secured credit, credit cards, student loans, non-recourse pawn loans, overdraft services and overdraft lines of credit, and qualifying employer wage advances and no-cost advances. Two conditional exemptions also exist: alternative loans modelled on the credit union Payday Alternative Loan, and accommodation loans made by lenders that, with affiliates, made 2,500 or fewer covered loans in the current and preceding calendar year and derived no more than 10 percent of receipts from covered loans. Whether a specific product qualifies for either is a question for your counsel, not your processor.

What counts as a payment transfer

The rule regulates any lender-initiated debit or withdrawal from a consumer's account to collect an amount due on a covered loan, whatever the channel. The regulation names ACH and other electronic fund transfers, signature checks whether processed through the check system or converted to ACH, remotely created checks, remotely created payment orders, and internal transfers when the lender also holds the account. The official commentary adds that an electronic transfer initiated with a debit card or a prepaid card is a payment transfer.

That breadth is the point. A lender cannot avoid the count by switching from ACH to the borrower's debit card after an ACH return, or by running a remotely created check instead.

How the two-failure count works

A payment transfer fails when it is returned unpaid, or declined, because the account lacks sufficient funds. On the ACH side that means NSF-type returns; on the card side it means a decline for insufficient funds. The counting rules are specific:

• Only insufficient-funds failures count. A return for another reason, such as an incorrect account number, is not a failed transfer under the rule.
• A success resets the count. If the first attempt fails and a re-presentment clears, the next failure is a first failure again.
• Channels are pooled. An ACH return followed by a returned remotely created check for the same payment is two consecutive failures.
• Loans are pooled. If a borrower has two covered loans with you, a failure on one loan and the next failure on the other trigger the prohibition for both.
• Split payments count separately. Two transfers initiated at the same time for halves of one payment, both returned for NSF, are two consecutive failures.
• The prohibition is per account. It applies to the account the two failures came from.
• The clock starts when you or your agent learn of it. The prohibition applies from the date the lender or its payment processor receives the second return.

Once triggered, the prohibition covers everything: later scheduled payments, late fees and returned-item fees, and any transfer made under an authorization or a post-dated check you already hold.

What you must do after the second failure

Within three business days of learning that the second consecutive attempt failed, the lender must send the borrower a consumer rights notice, substantially similar to the CFPB's model form, stating that the last two attempts were returned and that the lender can no longer withdraw from the account without new permission.

From there, the rule allows two ways to collect from that account again:

1. A new authorization. The borrower must authorize the specific date, amount and payment channel of each additional transfer, signed or otherwise agreed to in writing or electronically, in a form they can keep. You may ask no earlier than the day you provide the consumer rights notice. If the borrower agrees on a phone call they initiated in response to the notice, the call must be recorded and kept, and you must send a written memorialization no later than the first transfer. A transfer may be for less than the authorized amount but not more. The authorization becomes void if two consecutive transfers made under it fail.
2. A single immediate payment at the borrower's request. A one-time electronic transfer initiated within one business day of the borrower authorizing it, or a signature check the borrower provides that you process within one business day. This exception covers exactly one transfer: if it fails, you cannot re-present it without a new authorization.

Late fees and returned-item fees can be collected under a new authorization only if it says, clearly, that transfers may be made solely to collect those fees, the highest amount that may be charged and the channel to be used.

The notices before you collect

The rule also front-loads disclosure. Before the first scheduled withdrawal on a covered loan, the lender must send a payment notice with the date, amount, a truncated account identifier and a breakdown of principal, interest and fees. By mail, it must go out no later than six business days before the transfer; by email, text or in person, no later than three business days before. Electronic delivery requires the borrower's consent, and the lender must offer email as an option.

Any unusual withdrawal needs its own notice: one for a different amount than the regular payment, on a date other than a scheduled due date, or through a different channel than the transfer before it. That notice must be mailed between ten and six business days before the transfer, or sent electronically or in person between seven and three business days before. The first transfer under a new authorization is exempt, since the borrower has just agreed to its terms.

For collections teams, the unusual-withdrawal notice is the one that bites. Switching a borrower from ACH to their debit card, or pulling a partial payment on an off-cycle date, is exactly the kind of transfer that requires it.

How this fits with Nacha's retry limits

If you collect by ACH, you are already working under the Nacha Operating Rules, which let an originator reinitiate a debit returned for insufficient or uncollected funds (return codes R01 and R09) no more than two times following the original return, within 180 days of the original settlement date, with RETRY PYMT in the company entry description.

The CFPB rule is tighter for covered loans. Under Nacha, an NSF payment can be presented up to three times in total. Under the CFPB rule, if the original entry and the first reinitiation both come back NSF, that is two consecutive failures and the lender must stop, so the second Nacha retry is not available without a new authorization. Nacha's permission is a ceiling, and the payday rule sits below it.

The same logic applies to cards. Visa and Mastercard set their own limits on retrying declined transactions, but an insufficient-funds decline on a debit or prepaid card is a failed payment transfer under the payday rule, and it counts toward the same two. A retry schedule that is compliant for a subscription merchant can be a violation for a lender.

Nacha's return-rate monitoring is a separate pressure. Nacha sets a 0.5 percent level for unauthorized debit returns, 3 percent for administrative returns (R02, R03 and R04) and 15 percent for all debit returns. Exceeding one does not automatically violate the rules, but it allows Nacha to open an inquiry into how the originator is sending entries. Repeatedly re-presenting against empty accounts drives up the overall return rate, so the payday rule and Nacha's thresholds push in the same direction.

A collections checklist for covered lenders

• Count failures per borrower account, across every loan the borrower has with you and every channel you collect through: ACH, debit card, prepaid card and checks. A count kept separately by each system will miss the pooled failures the rule counts.
• Map return and decline codes to the rule. Insufficient-funds ACH returns and NSF card declines count; administrative returns do not.
• Hard-stop automated retries and dunning on the second consecutive failure, including fee-only transfers, and generate the consumer rights notice within three business days.
• Store every new authorization with its specific dates, amounts and channels, plus call recordings and memorializations for phone authorizations.
• Flag unusual withdrawals, such as a channel switch, an off-schedule date or a changed amount, and send the notice inside its window.
• Keep the records in tabular form for 36 months after the loan stops being outstanding, including each attempted transfer and its result.

How PayKings approaches it

Payday and high-cost installment lenders are already a high-risk category for acquiring banks, and a collections process that keeps re-presenting against empty accounts shows up in return rates and repeated NSF declines. PayKings places payday and installment lenders with banking partners that work with consumer lending, and sets up ACH and debit card collections with return-code reporting you can feed into your own compliance logic. We do not provide legal advice, and the counting belongs in your loan system rather than your gateway, but we can help you configure retry settings so the processing side does not work against it. If you are setting up collections or moving a lending portfolio to a new processor, talk to our team.