On Thursday, two federal agencies announced a penalty against VyStar Credit Union for what the agencies called a “flawed launch of a new online banking system” in May 2022, caused in part by a lack of management and governance over the vendor it chose for the project , according to the agencies.

The launch issues caused members of the Jacksonville, Fla.-based credit union to incur insufficient funds fees, late fees and the like as they were unable to access their accounts amid service outages and degradation, according to Office for Consumer Financial Protection. (CFPB) and the National Credit Union Administration (NCUA).

The credit union must pay $1.5 million to the CFPB’s victim relief fund, establish a process to identify members who incurred charges as a result of the service interruption, and reimburse those members, with interest, according to the consent order which he signed with the CFPB. .

The credit union must take other remedial actions under the order, including establishing contingency plans for consumer-facing banking systems, creating a committee to assess potential risks to members arising from ongoing or recurring technology issues, and drafting policies and procedures for its task testing. systems before and after launch.

The penalties are the result of “negligent errors” that “caused financial harm” to VyStar members, according to CFPB Director Rohit Chopra. “Management failures” that led to service outages and degradations caused “consumer harm not just for weeks, but for months,” according to NCUA President Todd M. Harper.

“Credit unions must put their members first, yet Vystar’s due diligence fell far short of what was required to complete a successful conversion of the credit union’s online and mobile banking platforms,” ​​Harper said.

In prepared comments sent to news outlets, a VyStar spokesman said the credit union “reimbursed or waived all VyStar fees” while restoring online services, began a process to refund any fees from incurred as a result of the outage and stopped credit reporting during the outage.

“To be clear, VyStar undertook this response proactively and voluntarily, without prompting regulation,” the spokesperson said. “During the outage, members maintained access to their funds and services through VyStar’s extensive network of ATMs and expanded programs at both its contact centers and many of its many physical branches.”

How the launch went

VyStar began rolling out a new virtual banking platform on May 13, 2022, according to the CFPB’s consent order against the credit union. The system “crashed at launch,” according to the agency, because it “brought it online prematurely” and lacked planning.

The launch continued despite feedback from the project’s development team that the platform was “not ready for launch, creating a significant reputational risk,” according to the consent order. The credit union had a tolerance for defects, bugs and lower standards of functionality that conflicted with its quality assurance team, and the head of that team refused to approve the release, according to the consent order.

The credit union discontinued its online and mobile banking platforms shortly after launching them. When the credit union restored online services on May 23, the interface was missing key banking services members previously had access to, including accessing bank statements, making internal transfers between accounts, paying off credit cards and loans, setting up recurring payments and access to full transaction history. .

Full functionality didn’t return until December 2022, according to the CFPB.

In addition, the credit union’s mobile banking app interface suffered larger outages and was completely unavailable for a month after the initial failure. As with the web interface, the mobile app gradually reintroduced features over “several months,” according to the consent order.

During outages, members may find it less easy to access account balances, transfer funds between accounts or make payments on credit card balances. Some members’ previously scheduled recurring payments have been delayed or canceled, according to the CFPB. This has resulted in members incurring fees, late payment interest and negative credit reports related to late payments.

VyStar agreed to comply with the CFPB’s sanctions “without admitting or denying any wrongdoing,” according to the consent order.

For-profit banks question nonprofit oversight

The CFPB’s consent order against VyStar “exemplifies the risks posed by the NCUA’s inability to scrutinize credit union third-party service providers,” according to Rebecca Romero Rainey, president and CEO of Independent Community Bankers of America, a community trade organization. banks.

Rainey added that policymakers “need to give the NCUA the same authority that banking regulators use to oversee cyber risk.” The lack of oversight is especially troubling, she said, given the increase in tax-exempt credit unions buying up for-profit community banks.

NCUA President Harper has previously aired similar complaints, pointing out that the administration lacks the same oversight capacity that bank regulators have.

“NCUA’s ability to analyze and assess risk across the entire credit union system remains limited because the agency does not have the same level of oversight of third-party service providers as federal banking authorities,” he said at a security briefing last week. credit facing cyber. the unions.