CFPB 1041 Payday Rule Payment Provisions With AI in Small-Dollar Collections: The 2-Consecutive-Failed-Attempts Rule, the Payment-Notice Regime, and Where the Reauthorization Requirement Actually Lands

The Rule That Survived the Rulemaking Fight

The CFPB's Payday, Vehicle Title, and Certain High-Cost Installment Loans rule, codified at 12 CFR Part 1041, was published in October 2017 with two substantive components: the ability-to-repay underwriting provisions at Subpart B and the payment provisions at Subpart C. The 2020 rulemaking rescinded the underwriting provisions but left the payment provisions intact. The Community Financial Services Association of America v. CFPB litigation challenging the Bureau's funding structure and, by extension, the rule itself was resolved in 2024 by the Supreme Court in the Bureau's favor, and the payment provisions became fully enforceable following the litigation-stay resolution.

The payment provisions apply to a specific set of covered loans defined at 1041.3: short-term loans of 45 days or less, longer-term balloon-payment loans, and longer-term loans with an all-in APR exceeding 36 percent that also include a leveraged payment mechanism (an authorization to withdraw payments from the consumer's account). The specific covered-loan universe includes payday loans in the classic sense, vehicle-title loans, and specific high-cost installment products that fintech and non-bank installment lenders originate at meaningful volume.

The payment provisions' operational point is that the specific covered-loan servicing operation has to run the specific payment-attempt discipline the rule requires, has to provide the specific payment notices the rule prescribes, and has to obtain the specific reauthorization when the specific two-consecutive-failed-attempts trigger fires. The compliance points are the specific mechanics of the payment operation, and the specific mechanics are the specific operational discipline the AI-driven small-dollar servicing operation has to enforce.

We build the AI agent that participates in the small-dollar-loan servicing workflow at fintech installment lenders, payday-loan servicers, and specific credit-union small-dollar programs. The architecture below is what we run so the payment attempts stay inside the rule's discipline, the payment notices are provided on the rule's timing, the reauthorization is obtained when the rule requires it, and the audit file supports the compliance position on every account.

The Two-Consecutive-Failed-Attempts Rule at 1041.8(b) and What It Actually Prohibits

The core payment-provisions rule at 1041.8(b) prohibits the lender from initiating a payment transfer from the consumer's account after the lender has made two consecutive failed payment-transfer attempts from that account. The "failed payment-transfer attempt" definition at 1041.8(b)(2) covers a transfer that fails for lack of sufficient funds, a transfer returned as unauthorized, a transfer returned for account-closed, a transfer returned for stop-payment, and specific other return types the rule enumerates.

The "two consecutive" language matters. The count resets when a payment attempt succeeds — a lender whose sequence of attempts is fail-fail-succeed-fail is a lender whose count as of the third attempt starts fresh at one, not at three. Per-account tracking of the consecutive-failure count is the compliance discipline the servicing system has to enforce.

The "from that account" language also matters. The prohibition attaches per account, and a lender that has hit the two-consecutive-failed-attempts limit on account A can still initiate attempts against account B if the consumer has a separate account and the consumer's authorization covers the separate account. Per-account tracking is a data-modeling point the servicing system has to accommodate.

The practical consequence of the two-consecutive-failed-attempts prohibition is that the lender's post-limit path is either the reauthorization the rule permits (with the consumer-consent process the rule requires) or the non-payment collection path (which includes late fees, credit reporting, collection communications, and eventual charge-off, but does not include additional payment-transfer attempts). The choice between the paths is the operational-and-business decision the lender's collections team makes on the accounts that hit the limit.

The agent's payment-attempt workflow reads the account's payment history, checks the consecutive-failure count against the two-limit, blocks any further attempt on an account that has hit the limit, and routes the post-limit account into the non-payment collection workflow or the reauthorization workflow the collections team's business rules select.

The Reauthorization Process at 1041.8(c) and the Specific Consumer-Consent Content

The reauthorization process at 1041.8(c) is the specific mechanism the rule provides for a lender to obtain the specific consumer's specific new authorization to attempt payment transfers after the two-consecutive-failed-attempts limit has been reached. The reauthorization has specific content requirements and specific procedural requirements that make it a specific formal consent process rather than a general "can I try again?" ask.

The reauthorization content at 1041.8(c)(3) requires the consumer's authorization to identify the specific amount of each transfer, the date of each transfer, the account from which the transfer is to be made, and the number of additional transfers the consumer is authorizing. The "specific amount" and "specific date" language rules out a general open-ended reauthorization; the consumer has to authorize specific transfers with specific amounts on specific dates.

The consumer-consent process at 1041.8(c)(2) requires the consumer to sign the authorization or, for electronic authorization, to use a process that meets the Electronic Signatures in Global and National Commerce Act requirements. The ESIGN-compliance point is its own compliance surface: the electronic-consent process has to include the disclosures ESIGN requires and the consumer's ability to consent to electronic delivery.

Practical implementation of the reauthorization process is a consumer conversation the AI can support with careful design. The conversation has to explain the two-attempt-limit that has been reached, explain the consumer's options (the reauthorization with specific transfers, or the non-payment path), obtain the consumer's consent to the transfers with the amounts and dates, and record the consent with the evidence the compliance file requires.

The agent's reauthorization workflow initiates the consumer conversation through the consented communication channel, presents the rule-compliant explanation of the limit and the options, collects the consumer's consent with the transfer parameters, and records the consent-and-evidence in the per-account compliance file. Human review of the consent is a compliance-critical step for the accounts where the consent process was not fully consensual (consumer confusion, consumer objection, consumer request for human assistance).

The Payment Notice Regime at 1041.9 and the Specific Timing Windows

The payment-notice regime at 1041.9 requires the lender to provide the consumer with specific notices before initiating payment-transfer attempts. The two notices the rule requires are the "first payment withdrawal notice" and the "unusual payment withdrawal notice." Each has content requirements, timing requirements, and delivery-channel requirements.

The first-payment-withdrawal notice at 1041.9(b)(2) has to be provided ahead of the first payment-transfer attempt on the loan, and the timing runs off the delivery channel: at least 6 business days before the attempt for a mailed notice, or at least 3 business days before the attempt for an electronic notice (with ESIGN consent in place) or an in-person notice. There is no upper-bound window; the rule sets a minimum lead time, not a maximum. The content includes the loan identification, the payment amount, the payment date, the account from which the payment will be transferred, the fees the consumer will be charged for the transfer, and other content the rule requires.

The unusual-payment-withdrawal notice at 1041.9(b)(3) has to be provided when the payment attempt differs from the regularly scheduled payment attempt in specific ways: a different amount than the regularly scheduled amount, a different date than the regularly scheduled date, a different account from the regularly scheduled account, or a re-initiation of a previously-failed attempt. The channel-specific timing floors are the same as the first-payment notice — 6 business days for mail, 3 business days for electronic or in-person — with no upper bound. The content includes the reason for the unusual attempt in addition to the standard content.

Timing windows are operational disciplines the servicing system has to enforce. A payment-attempt whose notice was not provided inside the window is an attempt that violates the rule regardless of whether the attempt itself would have been permissible. Per-attempt tracking of the notice-delivery evidence is the evidence the compliance file supports.

The agent's payment-notice workflow reads the scheduled payment-attempt from the loan-servicing system, determines whether the attempt is a first attempt or an unusual attempt, produces the notice with the rule-compliant content, delivers the notice through the channel the consumer's ESIGN and preference settings permit inside the timing window, and records the delivery evidence for the compliance file.

The Electronic Delivery and the ESIGN Consent Discipline

The specific electronic delivery of the specific payment notices is the specific operational efficiency most small-dollar-servicing operations reach for, and the specific ESIGN-consent discipline is the specific compliance point the specific electronic delivery requires. The ESIGN Act requires the specific consumer's specific affirmative consent to electronic delivery, the specific consumer's specific demonstrated ability to access the specific electronic content, and the specific ongoing right of the consumer to withdraw the specific consent.

Practical implementation of the ESIGN consent for the 1041.9 notices includes the initial consent obtained at loan origination (or at the notice-consent point if consent was not obtained at origination), the per-notice delivery-and-access evidence the delivery channel produces, and the per-notice retention of the delivery evidence in the compliance file.

A consumer that withdraws the ESIGN consent is a consumer whose notices have to be delivered in paper form from the withdrawal date forward. Paper-delivery timing has to accommodate the mail-delivery window, which typically requires the 6-to-10-business-day window for the first-payment notice to start earlier than the electronic-delivery window would require.

The agent's ESIGN-consent workflow reads the consumer's consent status, applies the consent to the notice-delivery decision, initiates the paper-delivery workflow for consumers whose electronic consent is withdrawn, and coordinates the channel-specific timing to hit the rule's window.

The Interaction With the ACH Rules and the NACHA-Rule Return-Code Discipline

The payment-transfer attempts the 1041 rule regulates are typically ACH debit entries against the consumer's deposit account. The interaction with the ACH rules is a coordination point the servicing operation has to run: the ACH return code an attempt receives is the data the 1041 workflow reads to determine whether the attempt "failed" in the specific sense the rule uses and whether the failure counts toward the two-consecutive-failed-attempts limit.

The failed-payment-transfer definition at 1041.8(a)(4) is narrower than the broader concept of "any return." A payment transfer is a "failed transfer" for purposes of the two-consecutive-attempts prohibition when the transfer results in a return for nonsufficient funds — the R01 (NSF) return in the ACH context, plus payments a lender-account-holding institution declines because the consumer's account lacks sufficient funds. Other return codes fail the transfer operationally but do not count against the 1041.8(b) consecutive-attempts counter: R02 (account closed), R03 (no account/unable to locate), R04 (invalid account structure), R08 (payment stopped), R10 (unauthorized), R16 (account frozen), R29 (corporate not authorized) and similar codes each carry a different consequence in the workflow, but they are not the trigger for the two-attempt prohibition. Treating them as trigger events would freeze payment attempts on accounts the regulatory trigger never actually reached.

That said, the consumer-authorization-revocation codes (R07 revoked, R10 unauthorized, R29 corporate not authorized) carry their own compliance consequence. A return that indicates the consumer has revoked authorization is a signal the consumer's consent to future transfers is withdrawn, and any transfer the lender initiates after receiving such a return is unauthorized under Reg E and Reg F regardless of the 1041.8(b) counter's state. The workflow treats those codes as a stop-attempts trigger under the consumer-authorization framework even though the code does not increment the 1041 counter.

Coordination with the NACHA WEB Debit rule matters: the NACHA account-validation is the pre-attempt discipline that reduces the first-attempt failure rate, and the 1041 payment-notice regime is the per-attempt discipline that runs alongside. The two sets of controls are the integrated compliance program the ACH-origination operation runs.

The agent's ACH-return-code workflow reads the per-attempt return, distinguishes NSF-type failures (which increment the 1041 counter) from other failure types (which do not), applies the consumer-authorization-revocation logic to accounts where the return indicates revocation, and coordinates per-account decisions with the NACHA-side return-rate compliance workflow.

The Specific Loan-Type Coverage Determinations and the Edge-Case Judgment

The specific covered-loan universe at 1041.3 has three specific categories and specific technical criteria for each. The specific short-term loan at 1041.3(b)(1) has a specific "45 days or less" term criterion and specific specific loan-type criteria. The specific longer-term balloon-payment loan at 1041.3(b)(2) has specific balloon-structure criteria. The specific longer-term high-cost loan at 1041.3(b)(3) has the specific 36-percent-APR criterion and the specific leveraged-payment-mechanism criterion.

The specific APR calculation for the 36-percent trigger uses the specific "military APR" methodology at Regulation Z appendix, which includes specific finance-charge components (interest, most fees, credit-insurance premiums) that the specific standard Reg Z APR calculation may treat differently. The specific per-loan APR calculation is a specific compliance determination the specific origination system has to make, and the specific loan whose specific calculation crosses the specific 36-percent threshold is a specific loan whose specific 1041 coverage attaches.

The specific leveraged-payment-mechanism definition at 1041.2(a)(11) covers the specific right of the lender to initiate a transfer of money from the consumer's account. The specific right can attach through the specific consumer's authorization to initiate ACH debits, through the specific consumer's provision of a post-dated check, through the specific consumer's authorization of a debit-card transaction, or through the specific consumer's authorization of a similar transfer mechanism. The specific determination of whether the specific loan includes a specific leveraged-payment mechanism is a specific per-loan coverage determination.

The agent's coverage-determination workflow reads the loan's terms and payment-mechanism authorization, applies the 1041.3 criteria, produces the coverage determination with the supporting reasoning, and routes the covered loans into the 1041-compliance workflow.

The Section 1041.5 Underwriting Provisions and the Rescission Aftermath

The 1041.5 underwriting provisions were the specific portion of the rule that the 2020 rescission removed. The specific rescission removed the specific ability-to-repay underwriting requirement, the specific principal-payoff option requirement, and specific related content. The specific practical consequence is that the specific covered lenders can originate specific covered loans without the specific 1041.5 underwriting discipline, though the specific 1041.8 and 1041.9 payment provisions continue to apply.

State-law and other federal underwriting requirements continue to apply to the covered loans. State-law usury caps, state small-dollar-lending rules, and other federal consumer-protection rules (UDAAP, Reg Z where applicable, ECOA, FCRA) all continue to apply. The 1041.5 rescission removed only the CFPB-imposed underwriting discipline, not the broader consumer-protection regime.

The specific supervisory pattern the CFPB has applied to the specific small-dollar-lending market since the specific rescission is a specific UDAAP-based pattern that has produced specific enforcement actions on specific origination and servicing practices. The specific covered lender that treats the specific rescission as a specific reduction in the specific compliance discipline is the specific covered lender whose specific supervisory conversation includes the specific UDAAP-based questions about the specific underwriting and servicing practices.

The agent's underwriting workflow — where the institution's business rules include the underwriting discipline — runs the ability-to-repay analysis, the state-law compliance checks, and the fair-lending analysis on the origination decisions. Those workflow decisions are the ones the institution has chosen to run beyond the 1041 minimum.

The State-Law Interaction and the Specific Preemption Boundaries

State-law interaction with the 1041 rule is a preemption analysis the lender's compliance program has to run. The rule at 1041.10 explicitly does not preempt state laws providing greater consumer protection, and state small-dollar-lending rules that exceed the 1041 discipline continue to apply.

State-level payment-restriction rules, loan-term restrictions, rate-cap rules, and licensing regimes all continue to apply. The compliance program has to run a state-by-state analysis for the covered loans the lender originates in each state.

The patchwork of state-level rules is a complexity the compliance program has to manage. A state's rule may be more restrictive than the 1041 rule, and per-state compliance analysis is an engineering discipline the servicing system has to enforce.

The agent's state-law workflow reads the loan's state jurisdiction, applies the state-specific rules to the origination and servicing decisions, and coordinates the 1041-compliance and state-compliance workflows.

The Failure Mode We Engineer Against

The pattern that produces the worst 1041 outcomes is the specific covered-lender operation whose specific consecutive-failed-attempts tracking is inconsistent across the specific accounts, whose specific reauthorization process is a specific informal "can I try again?" that does not meet the specific rule's specific consent-content requirements, whose specific payment-notices are missed inside the specific windows on a specific subset of the specific covered attempts, whose specific ACH-return-code classification against the specific 1041 failure-code list is incorrect, whose specific state-law compliance is a specific manual overlay that misses specific per-state variations, and whose specific supervisory-file evidence is incomplete on specific accounts. The specific CFPB enforcement pattern on that specific operation is a specific enforcement action with specific consumer restitution, specific civil penalties, and specific ongoing supervision.

The architecture we run against that is a workflow whose per-account consecutive-failed-attempts count is accurate and enforced, whose reauthorization process meets the specific rule-compliant content and consent requirements, whose specific payment notices are delivered inside the specific windows through the specific consumer's specific consented channels, whose specific ACH-return-code classification is systematic and correct, whose specific state-law compliance is integrated into the specific per-loan workflow, and whose specific per-loan compliance file supports the specific supervisory position on every account.

The consumer experience in this model is that the specific payment attempts do not exceed the specific rule's discipline, the specific reauthorization process is a specific informed-consent conversation rather than a specific pressure conversation, the specific payment notices arrive with the specific rule-required timing and specific specific content, and the specific overall servicing feels like a specific professional operation rather than a specific aggressive collection operation. The specific supervisory conversation with the CFPB and with the specific state regulators is a specific conversation about specific edge cases rather than about the specific foundational quality of the specific compliance program.

The Honest Read

The specific 1041 payment provisions are the specific surviving core of the specific CFPB's specific small-dollar-lending rule, and the specific mechanics are the specific operational disciplines every specific covered-lender servicing operation has to run. The specific two-consecutive-failed-attempts limit, the specific reauthorization process, the specific payment-notice regime, the specific ACH-return-code classification, and the specific state-law integration are the specific compliance points the specific supervisory conversation reads. The specific AI-agent contribution to the specific workflow is the specific systematic enforcement of the specific mechanics at the specific per-account level, and the specific per-account discipline is the specific operational quality the specific CFPB supervision reads as substantive.

The AI agent's contribution to the specific small-dollar-servicing operation is that the specific two-consecutive-failed-attempts tracking is systematic, the specific reauthorization is executed with the specific rule-compliant content, the specific payment notices are delivered inside the specific windows, the specific ACH-return-code classification is correct, and the specific state-law compliance is integrated into the specific per-loan workflow. The specific human judgment the specific workflow surfaces — the specific per-account decisions on the specific non-payment collection path versus the specific reauthorization path, the specific consumer-hardship response on the specific accounts where the specific consumer's situation calls for the specific loss-mitigation-style intervention, the specific state-by-state compliance decisions on the specific specific-jurisdiction edge cases — is the specific set of decisions the specific compliance and servicing teams make with the specific supporting information the agent produces.

We have written separately on the Regulation F debt-collection framework that specifically applies to the specific post-charge-off collection of the specific covered loans, on the UDAAP framework at 12 USC 5531 and 5536 that specifically applies to the specific consumer-facing conversation the specific reauthorization process runs, on the NACHA WEB Debit account-validation and credit-push-fraud framework that specifically coordinates with the specific 1041 payment-attempt discipline, and on the Reg E error-resolution regime that specifically addresses the specific consumer-dispute path on the specific electronic-fund-transfer failures. The specific small-dollar-lending program that combines the specific 1041 payment-provisions discipline with the specific broader consumer-protection compliance is the specific program the specific CFPB, the specific state regulators, and the specific consumer all read as substantive.