Digital payments company Block agreed to pay $255 million to federal and state regulators over perceived deficiencies in its oversight of its peer-to-peer payments tool Cash App and to compensate users who became victims of fraud.

Specifically, the company agreed to pay the Consumer Financial Protection Bureau a $55 million penalty and to compensate victims with up to $120 million, according to a press release Thursday from the agency.

“Block employed weak security protocols for Cash App and put its users at risk,” the CFPB said in its release. “While Block is required by law to investigate and resolve disputes about unauthorized transactions, the company’s investigations were woefully incomplete.”

Block allegedly directed consumers that suffered financial losses to their banks for redress, but when the banks went back to the company for compensation, it would deny the requests, the CFPB said. The company also employed other tactics to block consumers’ efforts, like “tricking” them with its terms and undertaking “shoddy” investigations, the agency alleged. Block saved money in the process, the agency said.

“Cash App created the conditions for fraud to proliferate on its popular payment platform,” CFPB Director Rohit Chopra said in the release. “When things went wrong, Cash App flouted its responsibilities and even burdened local banks with problems that the company caused.”

The company also agreed to pay an $80 million fine imposed by states that alleged its money transfer service Cash App violated banking laws, according to the Conference of State Bank Supervisors.

The settlement between Block and 48 states, announced Wednesday, also requires the company to take corrective actions, including hiring a consultant to review “the comprehensiveness and effectiveness” of its programs to comply with the Bank Secrecy Act and related anti-money laundering laws, the CSBS said.

Those laws are meant to deter the movement of money for illicit activities and the financing of terrorism.

“Financial services firms are required to perform due diligence on customers, including verifying customer identities, reporting suspicious activity, and applying appropriate controls for high-risk accounts,” the CSBS said. “State regulators found Block was not in compliance with certain requirements, creating the potential that its services could be used to support money laundering, terrorism financing, or other illegal activities.”

The states, led by Texas, California and Florida, among others, alleged in a joint November 2023 report that Block’s Cash App practices violated those laws and/or had deficiencies under the laws. Those shortcomings were with respect to its own workforce practices and its oversight of outside vendors, according to the settlement. As part of the agreement, Block neither admitted or denied wrongdoing.

"While we strongly disagree with the CFPB’s mischaracterizations, we made the decision to settle this matter in the interest of putting it behind us and focusing on what’s best for our customers and our business," the company said in a Thursday press release.

Still, the company acknowledged that it has changed its “past” approach to compliance in an emailed statement Thursday from a spokesperson for Block. 

“As Cash App has grown, we’ve significantly increased our investment in compliance and risk management, while serving millions of customers with critical, affordable financial services,” the statement said. “We share our regulators’ commitment to addressing industry challenges and will continue to invest across our operations to help promote a safe and healthy fintech ecosystem.”

In its release, Block also noted measures it has taken to improve customer service and compliance, including using artificial intelligence to spot "bad activity" and account takeovers, as well as a customer warning mechanism.

Some 56 million people use the Cash App tool to send, store, spend and invest money, according to the release, which also noted that Block earned $7.5 billion in profits in 2023, including $4 billion from Cash App.

The Oakland, California-based company also said last month that it had tallied some 24 million instances of consumers spending via its Cash App debit card in September.

Block, led by Twitter co-founder Jack Dorsey, also operates the point-of-sale payments technology company Square and buy now, pay later operator Afterpay. 

"As mobile payment services have become more popular, state regulators must act to protect consumers in these new environments,” Michigan Department of Insurance and Financial Services Director Anita Fox said in a Wednesday release. “DIFS is committed to working with state regulators nationwide to ensure that all financial systems are safe, sound, and entitled to the public trust.”

Other federal regulators had also been contemplating action against the company last year, according to a lawyer representing whistle-blowers who filed complaints against Block with the Financial Crimes Enforcement Network,  as well as with the Securities and Exchange Commission and the Commodity Futures Trading Commission. The whistle-blowers alleged that Cash App’s user identity verification methods aren’t sufficient to prevent fraudulent activity, NBC News reported last year.

The CFPB pointed to similar Cash App problems that allegedly allowed for crime.

“Block also deprived Cash App users of meaningful and effective customer service and left the network vulnerable to criminals defrauding users,” the CFPB said in its release.

The Block spokesperson didn’t immediately respond to a request for comment on the reported federal probe.