Corporate Misconduct Accountability Project
VyStar Credit Union · Consent Order
VyStar Credit Union Hit for Unfair Digital Banking Practices
The CFPB alleges VyStar Credit Union engaged in unfair acts and practices through its online and mobile banking services, harming consumers who depended on these platforms for essential financial transactions.
HIGH SEVERITY
TL;DR
The Consumer Financial Protection Bureau took enforcement action against VyStar Credit Union for unfair acts and practices in its provision of online and mobile banking services. The Bureau alleges these practices caused substantial injury to consumers that they could not reasonably avoid. VyStar agreed to a consent order without admitting or denying wrongdoing, settling the matter to avoid administrative proceedings.
This case shows how even community-focused credit unions can fail consumers when digital platforms prioritize institutional interests over member well-being.
2024
Year of CFPB enforcement action
The Allegations: A Breakdown
Core Allegations
What they did · 4 points
| 01 | VyStar Credit Union engaged in unfair acts and practices in the provision of online and mobile banking services. The Bureau intended to initiate administrative proceedings under federal consumer protection law. | high |
| 02 | The Bureau determined VyStar’s conduct violated the Consumer Financial Protection Act’s prohibition against unfair practices. Under the law, an act is unfair if it causes substantial injury to consumers that they cannot reasonably avoid and that is not outweighed by benefits. | high |
| 03 | VyStar’s online and mobile banking platforms allegedly exposed consumers to significant harm, either financially or through restricted access to critical banking features. Consumers could not simply choose to avoid the problem because these digital tools were critical to their daily financial management. | high |
| 04 | The credit union agreed to settle the matter through a consent order. VyStar did not admit or deny any wrongdoing as part of the settlement. | medium |
Regulatory Failures
How oversight fell short · 4 points
| 01 | The CFPB has jurisdiction over this matter under sections 1053 and 1055 of the Consumer Financial Protection Act. The Bureau exercises authority to enforce federal consumer financial law. | medium |
| 02 | The consent order resolves only VyStar’s potential liability for violations the Bureau asserted or might have asserted based on practices that occurred before the effective date. The settlement does not provide immunity for any other liability. | medium |
| 03 | VyStar acknowledged that no promise or representation has been made by the Bureau about any liability outside this action that may have arisen or may arise from the underlying facts. The credit union receives no blanket protection from future claims. | medium |
| 04 | The consent order becomes a final order effective upon its entry on the administrative docket. The Bureau can fully enforce it under federal law. | medium |
Profit Over People
Corporate priorities exposed · 4 points
| 01 | VyStar is a credit union that theoretically exists to serve its members rather than external shareholders. Despite this community-focused structure, the Bureau found cause to take administrative action for unfair practices. | high |
| 02 | The allegations suggest VyStar’s digital banking systems were designed or maintained in ways that negatively impacted the customers who relied on those platforms for stability and convenience. Institutional priorities may have overshadowed consumer protection. | high |
| 03 | Credit unions are not-for-profit institutions, yet the complaint indicates even these organizations can fall into patterns where revenue growth, technological expansion, and market competitiveness overshadow member well-being. | high |
| 04 | VyStar cultivated a reputation as a community-centered organization. These allegations cast a shadow on that public image by suggesting the credit union may have prioritized institutional convenience over consumer welfare. | medium |
Corporate Accountability Failures
The limits of enforcement · 5 points
| 01 | VyStar entered into the stipulation and consent order voluntarily. The credit union waived its right to all hearings, recommended decisions by a hearing officer, and all post-hearing procedures. | medium |
| 02 | The credit union waived any right to seek administrative or judicial review of the consent order. VyStar cannot challenge or contest the validity of the order. | medium |
| 03 | VyStar waived any claim for fees, costs, or expenses against the Bureau or any governmental entity related to this enforcement matter. The credit union agreed it is not the prevailing party because the parties reached a good faith settlement. | medium |
| 04 | The facts described in Section IV of the consent order will be taken as true and given collateral estoppel effect in any future proceeding to enforce the order. VyStar cannot relitigate these facts. | medium |
| 05 | VyStar waived any right to claim bias or prejudgment by the Director based on consideration of or discussions concerning settlement. The credit union accepted the Bureau’s settlement process. | low |
Community Impact
Who bears the cost · 4 points
| 01 | Online and mobile banking services are no longer optional conveniences but integral to daily life. For many people, especially lower-income consumers, those with limited mobility, or workers in precarious jobs, online banking is their primary means of managing finances. | high |
| 02 | When digital banking technology or institutional policies are set up unfairly, the economic fallout for consumers can be immediate. Consequences include missed rent payments, returned checks, overdraft fees, credit damage, and spiraling debt cycles. | high |
| 03 | VyStar is trusted by thousands of account holders to handle everyday financial transactions. The allegations suggest the credit union used or maintained digital platforms that negatively impacted the very customers who relied on those platforms. | high |
| 04 | A credit union that burdens members with unfair practices can inadvertently reduce consumer spending and savings in the region. This hinders small business growth and community development. | medium |
The Bottom Line
What this means · 5 points
| 01 | The CFPB’s action against VyStar Credit Union demonstrates that even community-focused financial institutions can engage in unfair practices that harm consumers. Membership-based structures do not automatically guarantee ethical behavior. | high |
| 02 | VyStar’s settlement without admitting or denying wrongdoing is a hallmark of many corporate settlements. Companies agree to pay fines or change policies while expressly refusing to admit liability, which can muddle public accountability. | high |
| 03 | The consent order becomes binding and fully enforceable. However, whether it creates a meaningful deterrent effect or leads to deep institutional reform at VyStar remains to be seen. | medium |
| 04 | This case illustrates the importance of robust regulatory oversight and consumer advocacy. Without the Bureau’s involvement, these alleged unfair practices might have continued indefinitely. | medium |
| 05 | The allegations underscore structural shortcomings in how financial products and services are governed. Digital transformation allows platforms to scale rapidly without always offering robust consumer protections. | medium |
Timeline of Events
October 15, 2024
VyStar Credit Union President/CEO Brian E. Wolfburg signed the Stipulation and Consent to the Issuance of a Consent Order
October 31, 2024
Stipulation and Consent Order filed with the Consumer Financial Protection Bureau (File No. 2024-CFPB-0013)
Direct Quotes from the Legal Record
QUOTE 1
Basis for CFPB action
allegations
“The Consumer Financial Protection Bureau (Bureau) intends to initiate an administrative proceeding against VyStar Credit Union (Respondent), under 12 U.S.C. §§ 5563 and 5565, for Respondent’s unfair acts and practices in the provision of online and mobile banking services in violation of the Consumer Financial Protection Act of 2010 (CFPA), 12 U.S.C. §§ 5531, 5536(a)(1)(B).”
💡 This establishes the legal foundation for the Bureau’s enforcement action against VyStar for unfair practices in digital banking.
QUOTE 2
Settlement without admission
accountability
“Respondent, in the interest of compliance and resolution of the matter, and without admitting or denying any wrongdoing, consents to the issuance of a Consent Order substantially in the form of the one to which this Stipulation and Consent to the Issuance of a Consent Order is attached (Consent Order), and which is incorporated by reference.”
💡 VyStar settled the case without admitting guilt, a common tactic that allows companies to avoid public acknowledgment of wrongdoing.
QUOTE 3
Jurisdictional admission
accountability
“Respondent agrees to the issuance of the Consent Order, without admitting or denying any of the findings of fact or conclusions of law, except that Respondent admits the facts necessary to establish the Bureau’s jurisdiction over Respondent and the subject matter of this action.”
💡 VyStar only admits facts needed to establish the Bureau has authority over the case, while denying nothing else specifically.
QUOTE 4
Limited scope of settlement
regulatory
“The Consent Order resolves only Respondent’s potential liability for law violations that the Bureau asserted or might have asserted based on the practices described in Section IV of the Consent Order, to the extent such practices occurred before the Effective Date and the Bureau knows about them as of the Effective Date.”
💡 The settlement only covers known violations up to a certain date, leaving VyStar potentially exposed for other or future misconduct.
QUOTE 5
No immunity granted
regulatory
“Respondent acknowledges that no promise or representation has been made by the Bureau or any employee, agent, or representative of the Bureau, about any liability outside of this action that may have arisen or may arise from the facts underlying this action or immunity from any such liability.”
💡 VyStar receives no blanket protection from other legal claims that might stem from the same underlying conduct.
QUOTE 6
Facts binding in future enforcement
accountability
“Respondent agrees that the facts described in Section IV of the Consent Order will be taken as true and be given collateral estoppel effect, without further proof, in any proceeding before the Bureau to enforce the Consent Order, or in any subsequent civil litigation by the Bureau to enforce the Consent Order or its rights to any payment or monetary judgment under the Consent Order, such as a non-dischargeability complaint in any bankruptcy case.”
💡 VyStar cannot dispute the facts in the consent order if the Bureau needs to enforce it later, making those facts legally binding.
QUOTE 7
Waiver of hearings and review
accountability
“The rights to all hearings under the statutory provisions under which the proceeding is to be or has been instituted; the filing of proposed findings of fact and conclusions of law; proceedings before, and a recommended decision by, a hearing officer; all post-hearing procedures; and any other procedural right available under section 1053 of the CFPA, 12 U.S.C. § 5563, or 12 CFR Part 1081;”
💡 VyStar gave up all rights to challenge this matter through formal hearings or administrative review processes.
QUOTE 8
No judicial review
accountability
“The right to seek any administrative or judicial review of the Consent Order;”
💡 VyStar cannot appeal or challenge the consent order in any court or administrative forum.
QUOTE 9
Waiver of fee claims
accountability
“Any claim for fees, costs or expenses against the Bureau, or any of its agents or employees, and any other governmental entity, related in any way to this enforcement matter or the Consent Order, whether arising under common law or under the terms of any statute, including, but not limited to the Equal Access to Justice Act and the Small Business Regulatory Enforcement Fairness Act of 1996; for these purposes, Respondent agrees that Respondent is not the prevailing party in this action because the parties have reached a good faith settlement;”
💡 VyStar cannot seek reimbursement for legal fees or costs, and acknowledges it is not the winning party in this matter.
QUOTE 10
Binding on successors
accountability
“The terms and provisions of this Stipulation and the Consent Order will be binding upon, and inure to the benefit of, the parties hereto and their successors in interest.”
💡 If VyStar merges or is acquired, the new entity must still comply with all terms of the consent order.
Frequently Asked Questions
What did VyStar Credit Union allegedly do wrong?
The CFPB alleges VyStar engaged in unfair acts and practices in its online and mobile banking services. Under federal law, this means the practices likely caused substantial injury to consumers that they could not reasonably avoid and that was not outweighed by any benefits.
Did VyStar admit to wrongdoing?
No. VyStar entered into a consent order without admitting or denying any wrongdoing. This is a common settlement practice that allows companies to resolve cases while avoiding formal admission of guilt.
What is a consent order?
A consent order is a legal agreement where a company agrees to certain terms to settle an enforcement action. VyStar agreed to the CFPB’s consent order, which becomes binding and enforceable without the need for a trial or hearing.
Who was harmed by VyStar’s practices?
The allegations suggest VyStar’s online and mobile banking customers were harmed. These consumers relied on digital platforms for essential financial transactions and could not easily avoid problems with the systems.
What happens to VyStar now?
The consent order becomes a final, binding order that the CFPB can enforce. VyStar must comply with all its terms, and the facts in the order are treated as true in any future enforcement proceeding.
Can VyStar challenge or appeal this order?
No. As part of the settlement, VyStar waived all rights to administrative hearings, judicial review, and any appeals. The credit union cannot contest the validity of the consent order.
Does this settlement protect VyStar from other lawsuits?
No. The consent order only resolves liability for violations the CFPB asserted based on practices that occurred before the effective date. VyStar explicitly acknowledged it has no immunity from other legal claims arising from these facts.
How does this affect VyStar’s members?
Members who experienced problems with VyStar’s online and mobile banking may have been harmed through lost access to funds, unexpected fees, or inability to complete essential transactions. The consent order addresses the CFPB’s enforcement action but does not specify individual member remedies in the public documents.
What should consumers do if they think they were harmed?
Consumers who believe they were harmed by VyStar’s digital banking practices should document their experiences, file complaints with the CFPB through consumerfinance.gov/complaint, and consider consulting with a consumer rights attorney about potential legal options.
Why does the CFPB care about online banking practices?
Online and mobile banking are essential services for millions of Americans. The CFPB’s mandate is to protect consumers in financial transactions, and unfair digital banking practices can cause significant financial harm, especially to vulnerable populations who rely on these platforms for daily money management.
Please visit the Consumer Financial Protection Bureau’s website to read more about this story: https://files.consumerfinance.gov/f/documents/cfpb-vystar-credit-union-consent-order_2024-10.pdf
💡 Explore Corporate Misconduct by Category
Corporations harm people every day — from wage theft to pollution. Learn more by exploring key areas of injustice.
- 💀 Product Safety Violations — When companies risk lives for profit.
- 🌿 Environmental Violations — Pollution, ecological collapse, and unchecked greed.
- 💼 Labor Exploitation — Wage theft, worker abuse, and unsafe conditions.
- 🛡️ Data Breaches & Privacy Abuses — Misuse and mishandling of personal information.
- 💵 Financial Fraud & Corruption — Lies, scams, and executive impunity.
