VyStar CU pays $1.5M for botched systems upgrades

On October 31, 2024, the CFPB issued an order against VyStar Credit Union, a Jacksonville, Florida based credit union with approximately 850,000 members with deposit accounts. VyStar membership is open to, among others, those living or working in the 49 contiguous counties of Central to North Florida, 29 Georgia counties, and past and present military members and their families.

In May 2022, VyStar attempted to launch a new online and mobile banking platform with a new and untested provider. The new system crashed upon launch because VyStar brought it online prematurely and failed to establish or follow critical processes to ensure its success. The online and mobile banking platform was taken offline soon after the conversion; and initially when it returned, it lacked key banking services, some of which were not restored for months. The outage and subsequent limited functionality of the banking platform impacted VyStar members in significant ways, including the assessment of fees for failures to make timely payments, restricted access to their funds, and the inability to effectively manage their accounts. These significant problems were foreseeable and avoidable. VyStar failed to have adequate system development, implementation, and release controls in place; maintained policies and procedures that were deficient, out of date, and not followed by senior management; and was deficient in its service provider oversight. VyStar pushed the conversion process through too quickly, despite warning signs from its own development team, to meet an unrealistic deadline, which caused VyStar to take on unnecessary risk of harm to its members.

The Bureau found that VyStar’s planning and implementation of the conversion constituted an unfair practice in violation of the Consumer Financial Protection Act of 2010 that caused financial and non-financial harm to VyStar’s members, including fees, costs, and inconvenience.

The CFPB’s order requires VyStar to:

• Refund fees to affected consumers: VyStar must ensure that the fees charged to its members as a result of the outage have been refunded, and reimburse any outstanding third-party fees or costs, including interest costs, imposed on members as a result of the outage.
• Clean up its broken process for updating its systems: For future updates to its banking systems, VyStar must create contingency plans to minimize the impact on consumers’ ability to use its banking platform. The plans must include sufficient customer service resources to address consumer problems, and ensure upgrades and maintenance for consumer-facing banking systems are performed in a timely manner.
• Pay a $1.5 million fine: VyStar will pay a $1.5 million civil penalty to the CFPB’s victims relief fund.