CFPB - Consumer Financial Protection Bureau
10/31/2024 | Press release | Distributed by Public on 10/31/2024 08:17
Enforcement Action (VyStar Credit Union)
On October 31, 2024, the Bureau issued an order against VyStar Credit Union (VyStar), a Jacksonville, Florida based credit union with approximately 850,000 members with deposit accounts. VyStar membership is open to, among others, those living or working in the 49 contiguous counties of Central to North Florida, 29 Georgia counties, and past and present military members and their families. In May 2022, VyStar attempted to launch a new online and mobile banking platform with a new and untested provider. The new system crashed upon launch because VyStar brought it online prematurely and failed to establish or follow critical processes to ensure its success. The online and mobile banking platform was taken offline soon after the conversion; and initially when it returned, it lacked key banking services, some of which were not restored for months. The outage and subsequent limited functionality of the banking platform impacted VyStar members in significant ways, including the assessment of fees for failures to make timely payments, restricted access to their funds, and the inability to effectively manage their accounts. These significant problems were foreseeable and avoidable. VyStar failed to have adequate system development, implementation, and release controls in place; maintained policies and procedures that were deficient, out of date, and not followed by senior management; and was deficient in its service provider oversight. VyStar pushed the conversion process through too quickly, despite warning signs from its own development team, to meet an unrealistic deadline, which caused VyStar to take on unnecessary risk of harm to its members. The Bureau found that VyStar's planning and implementation of the conversion constituted an unfair practice in violation of the Consumer Financial Protection Act of 2010 that caused financial and non-financial harm to VyStar's members, including fees, costs, and inconvenience. The order requires VyStar to come into compliance with the law, establish a governance committee to ensure proper management of projects involving consumer facing banking systems, ensure that all consumers owed redress have been paid, and pay a $1.5 million civil money penalty.