Payment initiation is the process in which a third-party service, with your permission, instructs your bank to send money directly from your account to a recipient, bypassing card networks entirely. In the United States, these transfers travel over the ACH network, the Real-Time Payments (RTP) network run by The Clearing House, or the Federal Reserve’s FedNow Service, with settlement ranging from seconds to the next business day. Consumer rights around how your account data is accessed and how errors get resolved come from two main places: the CFPB’s Personal Financial Data Rights rule under Section 1033 of the Dodd-Frank Act, and the Electronic Fund Transfer Act with its implementing Regulation E.
Who Is Involved in a Payment Initiation
The service that triggers the transfer is called a Payment Initiation Service Provider, or PISP. A PISP never holds your money. It sends a digital instruction to your bank asking for a specific amount to be released to a specific recipient. Your bank, which actually holds the funds and executes the transfer, acts as the account servicing provider.
Most PISPs in the U.S. do not plug directly into every bank. They work through data aggregators, which sit between fintech apps and financial institutions. An aggregator keeps API connections with banks, either through direct agreements with the largest institutions or through partnerships with the core banking software vendors that serve smaller banks. When you authorize a payment through an app, the aggregator pulls the account information it needs from your bank, reformats it into something the app can use, and helps the transfer along. That middle layer exists because U.S. banks have not yet landed on a single standard API for sharing financial data.1Federal Reserve Bank of Kansas City. Data Aggregators: The Connective Tissue for Open Banking
The CFPB has recognized the Financial Data Exchange (FDX) API as the leading candidate for a shared standard. The FDX specification is royalty-free and designed so you can share financial data without handing your bank login credentials to third parties.2Consumer Financial Protection Bureau. Application for Recognition as a Standard-Setting Body: Financial Data Exchange
How a Payment Goes Through, Step by Step
The flow starts at checkout when you select a direct bank transfer option. The merchant hands you off to your bank’s secure login. That redirection is deliberate. You enter your credentials on your bank’s own site or app, not the merchant’s. Before the redirect, the payment provider should clearly show the amount, currency, and recipient so you know what you are approving.3Open Banking Standards. Browser Based Redirection / PIS
Once you log in, your bank presents the pre-filled payment details that came through the API. You verify the amount and recipient, then confirm. That confirmation is the authorization your bank needs to release the funds. The bank sends a status message back to the payment provider indicating whether the instruction succeeded, and the provider returns you to the merchant’s site with a receipt.3Open Banking Standards. Browser Based Redirection / PIS
Authentication at the bank step usually relies on two factors drawn from three categories: something you know (a password or PIN), something you have (a phone), and something you are (a fingerprint or face scan). Newer systems use public-key cryptography under the FIDO2 standard, which keeps a private key on your device and never transmits it. Your device signs a challenge from the bank, and the bank verifies the signature with the matching public key already on file. Because nothing secret crosses the network, phishing and interception attacks are much harder.
Tokenization adds another layer. When you link your bank account to a payment app, your real account number is replaced with a random string, called a token, that has no value outside that specific system. If the merchant’s database is breached, attackers get tokens they cannot reuse anywhere else.
How Fast the Money Actually Moves
A confirmation that the payment was initiated is not the same as the funds landing in the recipient’s account. Three networks carry bank-to-bank transfers in the U.S., and they settle at very different speeds.
FedNow and RTP
FedNow, operated by the Federal Reserve, and RTP, operated by The Clearing House, both settle in seconds. Once a real-time payment settles, it is final and irrevocable. The Federal Reserve’s operating rules make this explicit: settlement is final at the moment the system records the debit and credit.4Federal Reserve Financial Services. Operating Circular No 8 – FedNow Service5FedNow Explorer. FedNow Service Will Raise Transaction Limit to $10 Million6The Clearing House. Real Time Payments Any insured depository institution can join RTP regardless of size, and FedNow participation has been growing steadily since its 2023 launch, though not every bank or credit union has joined yet.7The Clearing House. Real Time Payments – Institution
ACH
ACH remains the workhorse where cost matters more than speed. Standard ACH transactions settle the next business day. Same-day ACH runs through three daily processing windows, with the last submission deadline at 4:45 p.m. ET and final settlement by 6:00 p.m. ET.8Federal Reserve Financial Services. FedACH Processing Schedule Unlike real-time payments, ACH transactions can be reversed under certain conditions, which gives you a modest safety net.
What You Are Consenting To
Every payment initiation requires your explicit consent for that specific transaction. The CFPB’s Personal Financial Data Rights rule, finalized in October 2024 under Section 1033 of the Dodd-Frank Act, sets out exactly what that consent has to look like.9Consumer Financial Protection Bureau. Required Rulemaking on Personal Financial Data Rights
Before a third party can touch your account, it has to give you a clear authorization disclosure, separated from other material, that names the provider, lists the data it will access, states how long it will collect that data, and explains how you revoke access. You have to sign that disclosure, electronically or on paper. The provider can only collect data that is reasonably necessary to deliver the service you asked for.10eCFR. 12 CFR Part 1033 – Personal Financial Data Rights
Three uses of your data are explicitly banned: targeted advertising, cross-selling other products, and selling your data to anyone.10eCFR. 12 CFR Part 1033 – Personal Financial Data Rights Authorization lasts a maximum of one year. After that, the provider has to ask you again. If you revoke access, the provider must stop collecting your data and, in most cases, stop using and retaining what it already collected.11Consumer Financial Protection Bureau. Required Rulemaking on Personal Financial Data Rights – Final Rule
Banks that provide the data have to maintain a developer API that meets specific performance standards, including a minimum 99.5 percent response rate each calendar month, and they cannot force third parties to use your login credentials.12eCFR. 12 CFR 1033.311 – Requirements Applicable to Developer Interface The compliance timeline is phased by institution size, with the largest banks and nonbank data providers originally facing an April 2026 deadline and the smallest covered depository institutions given until April 2030. As of early 2026, those dates have been stayed for 90 days while legal challenges proceed.13Congress.gov. Open Banking and the CFPB’s Section 1033 Rule
If Something Goes Wrong
Unauthorized Transfers
The Electronic Fund Transfer Act caps your liability for unauthorized bank account transfers at $50 if you notify your bank within two business days of learning about the problem.14Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability Wait longer than two days but report within 60 days of receiving your statement, and your exposure rises to $500. After 60 days, you could be on the hook for the full amount of any unauthorized transfers that occur between the end of that 60-day window and when you finally report.15eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers If something like hospitalization kept you from reporting on time, the bank has to extend those deadlines to a reasonable period.
Error Resolution
Once you report an error, your bank has 10 business days to investigate and reach a conclusion. It can extend the investigation to 45 days, but only if it provisionally credits your account for the disputed amount within those initial 10 days, and you get full use of those provisional funds while the investigation runs.16Consumer Financial Protection Bureau. Procedures for Resolving Errors – Regulation E New accounts get slightly less favorable timelines: 20 business days for the initial look and up to 90 days for certain transaction types, including point-of-sale debit transactions and international transfers.17eCFR. 12 CFR 205.11 – Procedures for Resolving Errors
ACH Return Codes
If the payment traveled over ACH, there is a separate mechanism: return codes. If a company debited your account without authorization, your bank can return the transaction using code R10, which covers situations where you don’t know the company or never authorized the debit. If you authorized a recurring payment but the company charged the wrong amount or debited too early, code R11 applies. You have 60 days to initiate a return for unauthorized debits.18Nacha. Differentiating Unauthorized Return Reasons
How This Compares to Paying With a Credit Card
This is where a lot of people get caught off guard. Credit cards offer substantially stronger dispute protections than direct bank transfers. Under Regulation Z, your maximum liability for unauthorized credit card charges is $50, with no escalating tiers based on how quickly you report.19Consumer Financial Protection Bureau. Regulation Z 1026.12 – Special Credit Card Provisions More importantly, credit cards give you the right to dispute charges when a merchant fails to deliver what was promised, and you can withhold payment for the disputed amount while the issue is worked out. Bank transfers have no equivalent chargeback right. Once money leaves your account through a real-time payment, it is gone unless the recipient voluntarily returns it or your bank determines the transfer was unauthorized under Regulation E.
ACH is somewhat more forgiving because transactions can be reversed, but the window is narrow and you still have to report quickly. The practical takeaway: bank-initiated payments cost merchants less and settle faster, but you trade away the dispute leverage that credit cards provide. For recurring bills and trusted merchants, that trade is usually fine. For a one-time purchase from an unfamiliar seller, it is worth thinking about.
What Payment Initiation Does Not Cover
Regulation E and the consumer protections above apply to consumer accounts. Business-to-business wire transfers do not fall under this framework. They are governed by Article 4A of the Uniform Commercial Code, which puts the burden on the bank to prove it used a commercially reasonable security procedure to verify the payment order. If the bank accepted a fraudulent order in good faith using a procedure the customer agreed to, the payment is treated as authorized even if the customer did not actually send it.20Federal Reserve. Uniform Commercial Code Article 4A Funds Transfers A business customer still has to report an unauthorized order within a reasonable time, not exceeding 90 days after receiving notice the account was debited; miss that window and you forfeit interest on any refund.