"(The) CFPB assures Fiserv that the order is intended to acquire data for research purposes only, under the bureau's authority to monitor and maintain a fact-based understanding of the financial services marketplace," the statement read. "Because of this assurance, and because the data we produce about your settings will not include information elements that identify your specific institution, we do not believe this order poses the risk of compliance activity aimed at any individual credit union."

The data set requested by CFPB, according to Fiserv, included approximately 60 data elements about each hosted account processing client's system settings, but did not include institution name, location or other identifying information.

The requested data will capture a generic snapshot of deposit accounts and programs that includes overdrafts processing and identification, duration measurement, and fee assessment at the system level before any discretionary intervention. There was no personally identifiable consumer information involved in the order's data request, Fiserv said.

Read more: Compliance won't come cheaply …

Producing this unique data set to specifications contained in the order will require thousands of hours of effort across its organization, Fiserv revealed.

"While the CFPB may be seeking efficiency and data uniformity by issuing this order to large processors like Fiserv rather than thousands of individual financial institutions, this approach creates significant expense for us," the processor wrote.

Fiserv acknowledged the CFPB's statutory power to impose these costs on the industry it regulates rather from its budget. Fiserv, in its statement, said these expenses might affect hosted account processing client fees.

"We value the trust you place in Fiserv to safeguard your credit union's information, and assure you that our efforts to comply with this order will protect your credit union's identity and interests through the provision of anonymized data only," the letter said.

The 2010 Federal Reserve overdraft rule prohibited depository institutions from charging an overdraft fee for ATM withdrawals and one-time debit card transactions unless the consumer affirmatively opted in.

A 2013 CFPB report questioned whether consumers could expect and evade bank overdraft charges on checking accounts. A related 2014 report raised questions about the financial impact of opting in for overdraft protection on debit card and ATM transactions.

On April 28, 2015, the CFPB took its first enforcement action under the federal rules that protect consumers against illegal overdraft fees by fining Regions Bank $7.5 million for improperly charging overdraft fees to hundreds of thousands of customers.

CFPB Deputy Enforcement Director Cara Petersen said, "We are taking action against Alabama-based Regions Bank for failing to ask consumers if they wanted overdraft service before charging them fees for this service. Regions amplified this harm by letting it drag on for almost an additional year after the bank first discovered the violation. The bank also charged overdraft and non-sufficient funds fees on its deposit advance product despite claims that it would not do so. In the end, hundreds of thousands of consumers paid at least $49 million in illegal charges."