Dive Brief:

• The Consumer Financial Protection Bureau fined VyStar Credit Union $1.5 million Thursday in connection with an outage that affected its customers when the institution transitioned to a new online banking system in May 2022, the bureau said.
• The CFPB also ordered Jacksonville, Florida-based VyStar to refund all credit union members for previously uncompensated fees and costs caused by the outage, which made it difficult for members to perform basic banking functions. Some features were unavailable for over six months, the CFPB said.
• “VyStar and its senior management bungled the credit union’s rollout of a new banking system and left customers stranded without online access to their accounts,” CFPB Director Rohit Chopra said in a statement. “VyStar’s careless errors inflicted financial harm on their credit union members.”

Dive Insight:

The enforcement action follows an investigation by the National Credit Union Administration and the CFPB into the credit union’s violations of the Consumer Financial Protection Act, the NCUA said.

VyStar’s due diligence fell short as it sought to complete a successful conversion of the credit union’s mobile and online banking platforms, NCUA Chairman Todd M. Harper said in a statement Thursday.

“These management failures resulted in consumer harm over the course of not just weeks but months, as well as safety and soundness problems like strategic, reputational, legal, and compliance risks,” Harper said.

The CFPB’s order requires VyStar to improve its process before future updates and create contingency plans to minimize the impact on consumers’ ability to use its banking platform. The plans must incorporate adequate customer service resources to address consumer problems and ensure that upgrades and maintenance of consumer-facing banking tools are done regularly.

“This is a victory for consumers harmed by VyStar’s irresponsible actions,” NCUA board member Tanya F. Otsuka said in a statement. “Credit unions should be held to the highest standard of member protection, as their core mission is to serve those of modest means.”

The $1.5 million civil penalty will go toward the CFPB’s victims relief fund.

VyStar said in a prepared statement Thursday that it responded to the platform disruption by reimbursing and waiving all VyStar fees until services were restored, initiated a third-party fee reimbursement process, paused credit reporting during the outage, and maintained fund access through ATMs, contact centers and branches. “To be clear, VyStar proactively and voluntarily undertook this response, without regulatory prompt,” the credit union said in its statement.

VyStar said it has invested in technical infrastructure, enhanced information security, and upgraded its digital services.

“We hope the continuous improvements to our online and mobile banking platforms reassures members that we are dedicated to being a responsive organization and emerging from this experience better and stronger,” VyStar CEO Brian Wolfburg said in a statement Thursday. 

In May 2022, VyStar notified its customers that its digital banking services would be unavailable from May 13 through May 15 as the organization transitioned to a new banking system. But the outage lasted longer than anticipated because the credit union rushed an untested virtual banking platform online, disregarding internal warnings and an unrealistic deadline, the CFPB said.

When the system was restored, it lacked vital banking services, some of which took months to work, the bureau noted.

However, Wolfburg said in May 2022 that the credit union took down the system to make some “tweaks” and tried to put it back up.

“The system did not collapse or trip over — we took the system down actively and decided to do some tweaks,” Wolfburg told the Jacksonville Business Journal at the time. “We tried to take it back up once more and we saw the same issues, so we took it down completely and decided to invest the time that was necessary to make sure we get this right for our members.”

Wolfburg said VyStar had been planning to improve its online experience for about two years and added that “pent-up demand” exacerbated access issues.

With the system failure and subsequent limited access, VyStar’s members could not manage their accounts, were charged late fees when their online bill payments were not processed, and could not access their funds, the CFPB said.

The $14.75 billion-asset VyStar counts 80 branches in Florida and Georgia, and more than 980,000 members. It acquired 121 Financial Credit Union in March to expand in northeastern Florida. 

Thursday’s enforcement action “exemplifies the risks posed by the National Credit Union Administration’s inability to examine credit union third-party service providers,” Independent Community Bankers of America CEO Rebeca Romero Rainey said in a prepared statement.