Regulation CC Funds Availability Rules for AI-Processed Deposit Transactions

Regulation CC is the operational law that decides when deposited funds must be released. Its July 1, 2025 threshold adjustments make the compliance surface meaningfully larger for every bank and credit union, including those running automated deposit workflows. Getting this right matters because AI agents are now making hold decisions in real time.

What Regulation CC actually requires, and what changed on July 1, 2025

Regulation CC, codified at 12 CFR Part 229, applies to transaction accounts, the checking accounts people use for everyday payments. The rule sets maximums, not minimums. A bank can always release funds faster, but it cannot make a customer wait longer than the schedule allows.

The July 1, 2025 thresholds result from a Board of Governors and CFPB final rule reflecting a 21.8 percent increase in CPI-W between July 2018 and July 2023. The minimum next-day availability amount rose to $275 from $225, and the cash withdrawal amount rose to $550 from $450. Three thresholds rose to $6,725 from $5,525: the new-account next-day check amount, the large-deposit exception threshold, and the repeatedly overdrawn threshold. Civil liability for individual actions now runs $125 to $1,350, up from $100 to $1,100. The class action maximum climbed to $672,950 from $552,500.

The standard availability schedule follows from these thresholds. ACH and wire transfers get next-day availability. State and local government checks deposited in person at a bank in the same state as the issuing government also clear next day.

A standard personal or business check is different. Deposits at a non-proprietary ATM can be held up to the fifth business day, and the $275 floor does not apply to non-proprietary ATM check deposits. In practice, most banks commit contractually to following those schedules in their mobile deposit agreements.

The six exception holds: where the regulation gives banks discretion, and where that discretion must be earned

The regulation does not give banks open-ended discretion to delay funds. It defines six specific exception categories, and a hold that doesn't fit one of them is a violation regardless of how sophisticated the reasoning behind it is. The new-account exception applies when an account has been open fewer than 30 calendar days. The first $6,725 of eligible check types follows the normal schedule, and amounts above that may be held up to nine business days. If the customer had an account at the same bank within the prior 30 days that was open at least 30 days, the new-account exception does not apply.

The large-deposit exception triggers when aggregate check deposits in a single day exceed $6,725. The first $6,725 still moves on the standard schedule. For large deposits, the availability chart shows the first $275 next business day, $6,450 by the second business day, and the remainder by the seventh business day.

The redeposited-item exception covers checks that have already been returned unpaid once. The repeatedly overdrawn exception applies when an account is overdrawn six or more banking days in the past six months, or overdrawn by more than $6,725 on two or more banking days in six months. That hold may extend to the seventh business day.

The reasonable-cause-to-doubt-collectibility hold is different in kind. The bank must have specific factual reasons: a return notice from the paying bank, a stop-payment order, a stale check more than six months old, a postdated check, or a reasonable belief the drawer is insolvent. Computer failure, severe weather, or similar events can extend a hold to the seventh business day.

Every exception hold carries a notice requirement. Under §229.13(g), the bank must provide written notice specifying the amount held, the reason for the hold, and the date funds will be available. A reasonable-cause hold needs a notice that gives the specific reason. Boilerplate language is a violation.

Where AI enters the deposit workflow and why the reasonable-cause exception becomes the compliance pressure point

Most of the mechanical exception triggers are already computed from account data. New-account age, aggregate deposit size, and overdraft count are straightforward lookups against core banking systems. The compliance work there is accurate threshold comparisons and correct notice generation, all of which AI agents can execute reliably. The reasonable-cause exception is structurally different.

That exception requires the bank to have and document specific factual grounds for doubting a particular check's collectibility. An AI model can flag a deposit in milliseconds based on behavioral anomalies, counterparty signals, or check characteristics. But that flag must be traceable to a specific, articulable reason that can appear in a compliant notice and survive examiner scrutiny.

There is also a demographic risk. The regulation explicitly bars demographic profile as a basis for a hold. An AI model trained on transaction data that correlates with protected characteristics creates Regulation CC exposure layered on top of fair lending risk.

Why does this gap exist? Regulation CC requires funds to be released on a defined schedule, but the check may not yet have been paid by the issuing bank. The compliance question is not whether to use AI, but whether it is built to produce the right outputs at every decision point.

Mobile deposit adds another layer. AI systems processing mobile deposits must be configured to apply the correct availability logic for each channel. Agentic AI platforms for banking are being deployed across omnichannel deposit workflows, handling transaction review, fraud monitoring, and hold decisions at a scale no human team can match.

What the notice requirement demands from an automated hold decision

The exception-hold notice is the compliance artifact that makes an AI-driven hold decision legible to the customer, the examiner, and the institution's own audit function. Under §229.13(g), every exception hold requires a written notice that specifies three things: the amount held, the specific reason for the hold, and the date on which the funds will be available. Timing matters more for automated systems than for manual ones. The notice must be given at the time of deposit or by mail no later than the first business day after deposit. For an AI agent processing deposits in real time, this is a same-day or next-morning output requirement.

The reasonable-cause notice is the hardest case. The specific reason requirement means the AI's basis for the hold must be expressible in plain language that the customer can receive and act on. An AI agent that generates exception holds without generating compliant notices, or that generates notices with generic language, creates a pattern of per-transaction violations. Each carries civil liability exposure under the updated 12 CFR 229.21 ranges.

The adverse-action analogy is instructive. Voice and text interfaces introduce a channel-specific question. The institution needs a documented path from the conversation to a durable written notice.

How the availability schedule interacts with fraud risk when AI processes deposits faster

Regulation CC's schedule was written for a batch-processing world. As deposit processing accelerates, the interval in which a hold can protect the institution narrows. That makes the precision of AI fraud scoring more consequential, and it makes errors more expensive than they were under slower rails.

Available funds are not cleared funds. Regulation CC requires faster releases, but fraud risk pushes toward longer holds. The only legal tool for extending holds is one of the six exceptions, and the only exception that responds to real-time fraud signals is reasonable-cause.

This is why the core challenge is balancing fraud-fighting obligations against consumer compliance requirements on availability timeframes. Where overnight batch processing gave compliance teams time to review holds before funds moved, real-time and near-real-time environments require hold decisions to be correct at the moment of deposit. That is exactly the operational environment agentic AI is designed for, provided the governance architecture is in place.

The governance architecture that makes AI-driven hold decisions defensible to examiners

An AI agent that touches Regulation CC hold decisions must be built within a governance architecture that makes every decision traceable, every notice verifiable, and every exception categorization defensible. This is not a best practice. It is a regulatory requirement that examiners will test.

The three-lines-of-defense model applies to agentic deposit decisions. In the first line, the AI agent itself must operate within permission-scoped access to account data, with configured thresholds that reflect current Reg CC amounts. In the second line, independent risk and compliance functions must be able to query every hold decision the agent made, including the factual basis the agent used to invoke a specific exception category. In the third line, internal audit must be able to reconstruct any hold decision, what data the agent saw, what exception category it applied, and what notice it generated, without relying on the agent's own account of its reasoning.

Immutable audit trails are not optional. Because the exception-hold notice must specify the reason and availability date, the system must log not just the outcome but the inputs and the categorization logic that produced it. That is the audit record that survives a CFPB examination or a private action.

Role-based access controls matter as much for what the agent can do as for what it can see. An AI agent that can place holds should not also be able to waive them unilaterally or modify the notice it generates. If you deploy AI on existing banking rails rather than replacing core infrastructure, you can map these controls onto the same permissioning architecture already in place for human operators. That reduces the implementation burden and the examination risk.

Threshold management is an ongoing governance task. The 2025 adjustments are not the last. The next cycle will occur in 2030.

What credit unions must address that larger banks can automate around

Credit unions answer to the same Regulation CC compliance clock as large banks, including the same July 1, 2025 thresholds and the same exception-hold notice requirements. The difference is that their compliance teams cannot monitor and document every AI-driven hold decision manually. The CPM Federal Credit Union Regulation CC policy update effective July 1, 2025 shows how much is involved. The agent must produce audit-ready outputs, handle member data in line with BSA obligations, and treat vulnerable members consistently with CFPB expectations. None of these are optional for federally insured credit unions.

For credit unions, AI agents that handle deposit intake, hold decisions, and notice generation in one workflow are a compliance capacity multiplier. They can enforce the correct thresholds, generate compliant notices, and log every decision without requiring a dedicated compliance officer to review each transaction. The audit trail requirement is also the fair-lending defense.

The examiner's view: what regulatory guidance says about AI models in deposit decisions

You will not find Regulation CC-specific guidance from regulators on AI hold decisions. But the existing model risk and AI governance frameworks establish the examination standard that deposit AI will be measured against, and they leave no ambiguity about what documentation the institution must be able to produce. The OCC, Federal Reserve, and FDIC jointly sought public input on how to help institutions mitigate check, ACH, wire, and instant payments fraud. They explicitly noted that Regulation CC's six exceptions allow extended holds when the institution has reasonable cause to doubt collectability. That posture signals openness to AI-assisted hold decisions, provided the evidentiary and disclosure trail holds up.

SR 26-2, issued jointly by the Federal Reserve, OCC, and FDIC, supersedes SR 11-7 and SR 21-8. The OCC's revised Model Risk Management guidance explicitly excludes generative AI and agentic AI models from its scope. That exclusion does not eliminate the governance obligation. It transfers the evaluation burden to the institution, which must define and document its own AI governance standard for models the guidance does not directly cover.

The examination implication is concrete. An AI system that places Regulation CC exception holds without a documented model inventory entry, without validation records, and without logs of its decisions is operating outside the governance perimeter regulators expect, even if its hold decisions happen to be individually correct. Compliance executives identify this as their most acute concern with AI in regulated workflows.

A practical mapping of Reg CC obligations to AI agent actions and controls

Every Regulation CC obligation in the deposit workflow can be mapped to a specific, controllable AI agent action. Institutions that do this mapping before deployment are the ones whose AI passes examination, not just audit. Start with threshold enforcement under 12 CFR 229.10, 229.12, and 229.13. The AI agent must apply the July 1, 2025 amounts as hardcoded parameters: $275, $550, $6,725. It should not infer thresholds from training data, and it needs a documented update process for the 2030 adjustment cycle.

For exception-category classification, the agent must classify each hold into one of the six permissible exception categories and log that classification with the factual basis. For reasonable-cause determinations, the fraud-scoring model must produce an output that maps to a specific, articulable factual reason, not a numeric score alone. Before deployment, you must document how score ranges translate to permissible specific reasons.

For notice generation under §229.13(g), the agent must generate a compliant written notice for every exception hold, specifying amount, reason, and availability date, at the time of deposit or within the first business day. For mobile deposit, the agent must follow the bank's posted mobile deposit availability policy as the controlling document. Where the policy differs from the standard schedule, the agent applies the policy, not the federal floor.

With fairness monitoring, you regularly analyze hold pattern logs for demographic correlations. The same audit trail that satisfies examination requirements is the dataset for fair-lending review. The audit trail is also the litigation record.

When thresholds change, the institution must update its funds availability disclosure and notify customers. The Fiserv agentOS launch, announced May 14, 2026, illustrates the direction the industry is moving. The governance issue is whether the institution can govern what agents access, decide, trigger, route, document, and escalate. That question will be answered exam by exam, starting now.