CFPB Orders VyStar Credit Union to Pay $1.5 Million for Illegally Stranding Consumers from Accessing Their Money and Accounts

WASHINGTON, D.C. - Today, the Consumer Financial Protection Bureau (CFPB) took action against VyStar Credit Union for harming consumers through its botched rollout of a new online banking system. In May 2022, VyStar transitioned to a new, dysfunctional online banking platform that made it difficult for credit union members to perform basic banking functions for weeks, with some features unavailable for more than six months. Families incurred fees and costs as a result of these problems. The CFPB is ordering VyStar to ensure that all consumers are made whole. VyStar must also pay a $1.5 million civil penalty to the CFPB's victims relief fund. Today's action stems from the CFPB's close partnership with the National Credit Union Administration (NCUA).

"VyStar and its senior management bungled the credit union's rollout of a new banking system and left customers stranded without online access to their accounts," said CFPB Director Rohit Chopra. "VyStar's careless errors inflicted financial harm on their credit union members."

"Credit unions must prioritize their members, yet Vystar's due diligence fell far short of what was required for completing a successful conversion of the credit union's mobile and online banking platforms," said NCUA Chairman Todd M. Harper. "These management failures resulted in consumer harm over the course of not just weeks but months, as well as safety and soundness problems like strategic, reputational, legal, and compliance risks."

VyStar, formerly known as JAX Navy Federal Credit Union, is a Florida state-chartered credit union headquartered in Jacksonville with 70 branches in Florida and 10 branches in Georgia. VyStar is one of the largest credit unions in the country, with approximately $14.75 billion in total assets and over 980,000 members.

In May 2022, VyStar attempted to launch a new virtual banking platform. VyStar anticipated banking services would be inaccessible for several days during the transition to the new platform, but it turned out to be much longer. The new system crashed upon launch because VyStar brought it online prematurely and failed to establish or follow critical processes to ensure its success. The platform was taken offline soon after launch. Upon bringing the system back online, the new platform lacked key banking services, some of which were not restored for months.

The CFPB and the NCUA worked to contain the fallout from VyStar's misconduct. The CFPB found that the outage and subsequent limited functionality of the new banking platform harmed VyStar members in significant ways. Affected consumers were unable to manage their accounts, were charged late fees when their online bill payments did not go through, and were in many cases unable to access their funds.

The CFPB found that VyStar violated the Consumer Financial Protection Act, specifically through:

• Depriving consumers access to money and accounts: VyStar ignored red flags and continued with the rollout that caused consumers to lose access to their accounts and funds. The new, dysfunctional platform's frequent outages and limited functionality led to financial losses and other harm to consumers.
• Rushing a new platform online without appropriate testing: VyStar plowed forward to complete the platform conversion process ahead of an unrealistic deadline, despite warnings from its own development team. VyStar's management and governance failures resulted in the virtual banking platform outage and sustained period of limited functionality.

Enforcement Action

Under the Consumer Financial Protection Act, the CFPB has the authority to take action against credit unions over $10 billion in assets that violate consumer financial protection laws. The CFPB worked with the National Credit Union Administration in its investigation of VyStar's illegal activity.

The CFPB's order requires VyStar to:

• Refund fees to affected consumers: VyStar must ensure that the fees charged to its members as a result of the outage have been refunded, and reimburse any outstanding third-party fees or costs, including interest costs, imposed on members as a result of the outage.
• Clean up its broken process for updating its systems: For future updates to its banking systems, VyStar must create contingency plans to minimize the impact on consumers' ability to use its banking platform. The plans must include sufficient customer service resources to address consumer problems, and ensure upgrades and maintenance for consumer-facing banking systems are performed in a timely manner.
• Pay a $1.5 million fine: VyStar will pay a $1.5 million civil penalty to the CFPB's victims relief fund.

Read today's order.

Consumers can submit complaints about financial products and services by visiting the CFPB's website or by calling (855) 411-CFPB (2372).

Employees who believe their company has violated federal consumer financial protection laws are encouraged to send information about what they know to [email protected]. To learn more about reporting potential industry misconduct, visit the CFPB's website.