If a merchant cash advance funder has pulled money from your business account that you never authorized, the clock for disputing it is already running. The short answer, for 2026, to your question is yes: the Uniform Commercial Code says you’ve got limits on how long you have, and under 4-406 your maximum allowable time is 180 days for an unauthorized signature, but one year for an unauthorized endorsement. For electronic funds transfers it’s 4A-505 that applies and sets the time limit at one year from your statement. But your account agreement can shrink those numbers, so what really matters is the deposit agreement and the account statements.
UCC Article 4 deals with “bank deposits and collections” and its Section 4-406 applies to “items,” which are, says the Code, “an instrument or a promise or order to pay money handled by a bank for collection or payment.” That seems to be quite broad. In addition, a bank must include information on paid items in its account statements, and if it does, its customer must take reasonable steps to discover and report unauthorized payments. A customer who fails to do so may forfeit claims against the bank. Regardless of how careless the customer has been, all claims are precluded unless he or she has notified the bank within 180 days (the time in Florida after an amendment; it used to be one year) of an unauthorized signature on an item, and within one year of an unauthorized endorsement.
These days all kinds of payments are done electronically through funds transfers. To govern funds transfers, the UCC has Article 4A, not Article 4. Banks, generally speaking, have to refund funds transfers that were neither authorized by the customer nor verified by a commercially reasonable security procedure. But under section 4A-505, if the bank sends a statement showing the transfer and the customer does not object within one year, the customer loses the right to a refund. Unless the bank and the customer agreed otherwise.
A Much Shorter Window to Report Problems
The Uniform Commercial Code (UCC) lets you and the bank agree to change most rules, so business practice can grow where the law allows it. There’s a limit: you can’t waive good faith, diligence, reasonableness and care, and the standards you set can’t be “manifestly unreasonable.” Article 4 specifically says the bank can’t disclaim responsibility for lacking good faith or ordinary care, but the two sides can agree on the standards. In practice, the deposit agreement you signed to open the account - the fine print - can give you a much shorter window to report problems.
Courts have generally enforced those shorter windows. In W.J. Miranda Construction v. First Union (1999), a deposit agreement had cut a one-year notice period to 60 days, and the Florida court upheld the 60-day period. It just speeds up when the customer must notify the bank of an error; it doesn’t let the bank off the hook on its duty of good faith and ordinary care. It doesn’t bar the customer from suing. In Bank of America v. Putnal Seed & Grain (Fla. 2007), the court said the 60-day period was a condition precedent before the customer can ask the bank for reimbursement. In Cheese & Grill Restaurant v. Wachovia (Fla. 2007), the customer failed its contractual obligation to review the statements within 30 days. The bank won. Other states have upheld 20 days (Minnesota), 14 days (Wisconsin), 90 days (Texas), and 30 days (New York).
Electronic transfers are less settled, and the one-year rule in 4A-505 is where the fight is. Some cases, including Priority Staffing v. Regions Bank (federal court, Louisiana, 2013), have allowed that one-year rule to be shortened in account agreements, even for fraud. In Priority, for example, an employee who reconciled the company’s bank account and had the company’s online banking username and password committed fraud. The company wanted every unauthorized debit refunded, but the bank said no - anything older than 30 days before the company complained was off the table. (The company’s agreement had shortened the one-year period to 30 days.) The court enforced the 30-day period. Minnesota’s appeals court has held the same (Bonnema, 2002). New York went the other way in Regatos v. North Fork Bank (2003), later endorsed by New York’s high court in 2005. New York won’t let the one-year 4A period be shortened by agreement. There has not been a Florida court case on the question.
Here’s a take on a New York court’s concern. When a bank cuts the notice period from one year to 30 days, it can reduce how much it has to refund the owner if the owner fails to catch suspicious transactions on the statement. The other side, as I read it, is that the shorter window incentivizes the owner to look at their monthly statement as frequently as it’s sent in, and fixes disputes before they fester. Both sides of this debate have merit, and for the small-business owner, the point is the same.
Forfeit the Interest
There’s a special 90-day rule, Section 4A-204. If the bank has to refund an unauthorized transfer, it also owes interest. However, if you don’t exercise ordinary care to discover the unauthorized order and notify the bank within a reasonable time not exceeding 90 days from the date you were notified of the debit, you lose that interest. You still get the refund; you just forfeit the interest. This rule is designed to encourage you to monitor your account. Reporting quickly may also help the bank recover the money from the culprit.
How to Protect Yourself
If you’ve got one of those merchant cash advances, here’s how to protect yourself. Don’t think in terms of “a year” or “6 months” as the deadline. Grab your deposit agreement and look for the reporting window - it might be 60, 30, or even 14 days. Open every monthly statement as soon as you get it, even when you can’t stand to look at it because money’s tight, and dig through it. If you spot an odd debit, don’t just phone the funder and complain - put a written notice to the bank right away. Those shorter deadlines aren’t there just to mess with you; they’re meant to get you to check statements as often as they arrive. The longer a dispute hangs around, the bigger the problem.
Whatever your window turns out to be, meeting the deadline is a condition to making a claim; it doesn’t erase the bank’s duty. If you gave notice on time, the bank can still be sued and it still must refund improper transfers. If you missed it, you may be stuck, even if the fraud is clear. In an account that’s already lost daily to MCA debits, a refund you were owed makes a huge difference. Check your agreement, review the statement, and report the issue fast.
