So we recently discovered that we have been charging NSF fees on ATM and debit card transactions for some customers without having the required written opt in document signed by the customer. Due to a glitch in our system, these customers were somehow opted in by default. How that happened is still being investigated. The problem has been resolved moving forward, but the issue is now what to do about the fees that have been collected without the required customer opt ins.
It has been suggested that we discuss this with our regulator to get feedback from them on what we should do. I obviously want to do the right thing while at the same time minimizing any adverse effects on the bank. It seems to me there is a potential regulatory penalty component and a potential civil liability component. As far as civil liability, is anyone aware of what the statute of limitations might be on potential customer claims? I have been told three years, but could not find any authority on this. In my internet research, I have also seen references to court cases where credit unions successfully invoked the statute of limitations on wrongful NSF fee claims, but I have not been able to find any specific cases.
Anyone have any suggestions or feedback on how I should approach this?