Joint Agency Investigation Led to CFPB Action Against VyStar Credit Union
A CFPB and NCUA investigation determines VyStar ignored red flags and continued with the rollout that caused members to lose access to their accounts and funds for weeks.
Following a joint investigation by the NCUA and the CFPB, the $14.7 billion VyStar Credit Union in Jacksonville, Fla., will pay a $1.5 million civil fine and refund fees to members for depriving them of access to their money and accounts for weeks during its botched roll out of a new online and mobile banking system in 2022, the independent federal agencies said Thursday.
The CFPB and NCUA investigation determined that VyStar violated the Consumer Financial Protection Act because the “credit union ignored red flags and continued with the rollout that caused members to lose access to their accounts and funds. The new, dysfunctional platform’s frequent outages and limited functionality led to financial losses and other harm to consumers.”
The CFPB noted that the new platform was taken offline soon after the launch, but when the credit union brought the system back online, the new platform lacked key banking services, some of which were not restored for months.
In addition, the investigation found that VyStar rushed the new platform online without appropriate testing.
“VyStar plowed forward to complete the platform conversion process ahead of an unrealistic deadline, despite warnings from its own development team. VyStar’s management and governance failures resulted in the virtual banking platform outage and sustained period of limited functionality,” the CFPB said in a prepared statement.
Without admitting or denying any of the findings of fact or conclusions of law, Vystar agreed to a 47-page Consent Order and a Stipulation and Consent to the issuance of the Consent Order.
“Credit unions must prioritize their members, yet Vystar’s due diligence fell far short of what was required for completing a successful conversion of the credit union’s mobile and online banking platforms,” NCUA Chairman Todd Harper said in a prepared statement. “These management failures resulted in consumer harm over the course of not just weeks but months, as well as safety and soundness problems like strategic, reputational, legal and compliance risks.”
NCUA Board Member Tanya Otsuka added, “This is a victory for consumers harmed by VyStar’s irresponsible actions. Credit unions should be held to the highest standard of member protection, as their core mission is to serve those of modest means. I am proud of the work done by the NCUA to hold VyStar accountable.”
Vice Chairman Kyle Hauptman did not make a statement.
The CFPB’s order requires VyStar to ensure that the fees charged to its members as a result of the outage have been refunded and reimburse any outstanding third-party fees or costs, including interest costs, imposed on members as a result of the outage.
What’s more, for future updates to its banking systems, VyStar must create contingency plans to minimize the impact on members’ ability to use its banking platform. The plans must include sufficient member service resources to address problems, and ensure upgrades and maintenance for member-facing banking systems are performed in a timely manner.
“VyStar and its senior management bungled the credit union’s rollout of a new banking system and left customers stranded without online access to their accounts,” CFPB Director Rohit Chopra said. “VyStar’s careless errors inflicted financial harm on their credit union members.”
VyStar’s $1.5 million civil penalty will be paid to the CFPB’s victim relief fund.
Late Thursday afternoon, America’s Credit Unions Chief Advocacy Officer Carrie Hunt issued a statement pushing back on the CFPB’s actions against VyStar.
“Credit unions strive to meet their members’ needs by offering the highest quality, affordable and competitive products and services. Although sometimes institutions may fall short, causing consumer uncertainty and headaches, credit unions always put their members’ best interest first. The CFPB’s enforcement action against VyStar Credit Union stretches its Unfair and Deceptive Acts and Practices authority in a unique way, harshly penalizing the credit union for internal operational actions that ultimately impacted members. We remain committed to pushing back against unchecked CFPB authority,” said Hunt.
America’s Credit Unions has a history of objections to the existence and authority of the CFPB.
In May, the U.S. Supreme Court ruled 7-2 to reject an attempt by payday lenders to dismantle the CFPB through a lawsuit that challenged its funding and governance. Before its merger into America’s Credit Unions, CUNA and NAFCU filed a brief in July 2023 supporting the suit brought by payday lenders.
Although thousands of VyStar members posted angry comments during the outage on social media, filed complaints with state and federal authorities, and threatened to cancel their membership, VyStar’s membership ranks have actually grown.
In 2022, for example, the credit union’s membership increased by 7.38%, which is much higher than its peer average of 2.98%, according to NCUA Financial Performance reports. In 2023, VyStar’s membership grew by 6.99%.
What’s more, VyStar’s membership ranks soared by nearly 22% at the end of the first quarter of this year and continued to expand by more than 12% at the end of the second quarter and 10% in the third quarter, according to NCUA Financial Performance reports.
It should be noted, however, that VyStar completed at least two mergers with other credit unions, one in 2023 with First Coast Federal Credit Union and its 1,674 members, and one this year with 121 Financial Credit Union, which served 50,000 members. The credit union also completed branch expansions in Florida and Georgia.
VyStar currently serves 997,469 members, according to NCUA data.
READ MORE: Vystar Credit Union Consent Order and Stipulation of Vystar Credit Union Consent Order