On December 7, 2023, Atlantic Union Bank (the “Bank”) entered into a consent order with the Consumer Financial Protections Bureau (CFPB) related to its in-person and telephone overdraft opt-in sales practices during 2017-2020. The settlement requires the Bank to refund affected consumers $5 million in overdraft fees and pay a $1.2 million civil money penalty to the CFPB.

The Electronic Funds Transfer Act (EFTA) and Regulation E (12 CFR § 1005.17(b)(1)), prohibit financial institutions from charging an overdraft fee for paying ATM or one-time debit card transactions (“regulated overdrafts”) unless an institution: (i) provides the consumer with its overdraft service disclosure (a/k/a What You Need to Know About Overdraft and Overdraft Fees); (ii) provides the consumer a reasonable opportunity to opt in; (iii) obtains the consumer’s affirmative consent, or opt-in; and (iv) provides the consumer with a written confirmation of the consent, which includes a statement informing the consumer of the right to revoke such consent.

As set forth in the consent order (which was issued in connection with an administrative proceeding), the CFPB concluded that the Bank violated the EFTA and Regulation E and engaged in deceptive practices in violation of the Consumer Financial Protection Act based on the CFPB’s findings that the Bank had engaged in the following sales practices:

1. In Branch Opt-in Process: For customers who enrolled in the overdraft service in branches, employees gave verbal descriptions of the bank’s overdraft service and collected verbal opt-in from customers prior to delivering the written overdraft service disclosure. The employees then documented the verbal election in the account opening system. The customers were asked at the end of the account opening process to sign the written overdraft service disclosure prepopulated with a checked box for opt-in. Regulation E requires the written overdraft service disclosure to be provided before a bank can obtain affirmative consent from a customer so the customer can make an informed decision to consent. The official commentary to Regulation E also states “Nor does an institution obtain a consumer’s affirmative consent by providing a signature card that contains a pre-selected check box indicating that the consumer is requesting the service.”
2. Phone Opt-in Process: For customers who enrolled in the overdraft service by phone, employees did not clearly explain which transactions were covered by the overdraft service, and made other misleading statements about the overdraft service. The misleading statements included stating: “(1) opting in would provide consumers with emergency funds when they needed them, with no other context about the costs of the service; (2) that consumers could avoid returned-item fees by opting in, even though such fees do not apply to ATM and one-time debit card transactions; and (3) that opting in would cover debit card transactions as well as checks, even though checks were already covered by [the standard overdraft service].” Some bank employees failed to inform callers that they could incur a $36 or $38 overdraft fee for each overdraft transaction. Many calls also evidenced customer confusion about the overdraft service terms and conditions.

The consent order prohibits the Bank from violating Regulation E and the CFPA by deceiving consumers about the overdraft service terms and conditions, transactions covered by opt-in, risk and costs associated with opt-in and not opting in, associated overdraft fees, and any other terms material to the opt-in decision. The restitution plan requires the Bank to:

1. Send overdraft opt-in status letters to consumers who remain opted in to the overdraft service for regulated overdrafts that include: (1) the consumer’s opt-in status, (2) the transactions and fees associated with opt-in coverage, (3) detailed instructions on how to revoke opt-in, and (4) that consumers have the option of enrolling in (i) overdraft service for ATM and one-time debit card services, (ii) overdraft service for checks, ACH and recurring debit card transactions, or (iii) declining all overdraft services.
2. Before charging overdraft fees to affected consumers (i.e., those who opted into the overdraft service for regulated overdrafts in branches or by phone in 2017-2020), obtain a new affirmative consent for regulated overdrafts after having provided written overdraft service disclosures that are compliant with Regulation E.
3. Change its enrollment process to not pre-check the opt-in before delivering written disclosures.
4. Revise policies, procedures, job aids, trainings, scripts, and other internal and external materials to clearly describe the overdraft service.
5. Require employees to use an accurate and informative phone script during all calls related to the overdraft service.
6. For all calls, send an electronic version of the written overdraft disclosure prior to obtaining consent and obtain a consumer’s written signature for the opt-in.
7. Maintain CEO and Board oversight of remediation.
8. Pay restitution to impacted customers in the amount of $5 million.
9. Distribute a copy of the consent order to its Board, senior leadership and business leaders who oversee the overdraft program now and to any new personnel for the next five years.

It is puzzling that the CFPB required the Bank to both send an opt-in status letter and obtain new opt-ins from the same customers prior to charging fees. Such a process is likely to cause customer confusion since customers will first receive notice that they are opted-in and then, several months later, will receive a new communication requesting their affirmative consent to opt-in to the overdraft service.

The consent order includes new requirements related to obtaining regulated overdraft opt-ins by phone as it requires the Bank to send the What You Need to Know About Overdrafts and Overdraft Fees disclosure and obtain the consumer’s signature for any phone opt-ins. Institutions should review their practices for obtaining regulated overdraft opt-ins by phone in light of the consent order. Given that the process for phone interactions required by the consent order would appear to be challenging to implement, institutions might want to consider a more practical approach. For example, consideration might be given to eliminating phone opt-ins in favor of online opt-ins where the information given to customers can be completely controlled and the disclosure and consent process can be clearly documented.

According to Atlantic Union Bankshares press release:

Well before today’s settlement, Atlantic Union proactively made improvements to its overdraft program, including to the Opt-In Overdraft Privilege service at issue in the settlement. In 2022, Atlantic Union also reduced or eliminated certain overdraft-related fees to help reduce the burden of such fees on customers. Among other changes, it eliminated fees on consumer accounts for items returned unpaid due to insufficient funds; reduced the number of overdraft fees that can be charged per day to a single account; and introduced a “no-overdraft” checking product.

As we have seen in many other CFPB overdraft and NSF consent orders, a change in practices will not help an institution avoid enforcement for prior acts or practices that the CFPB disfavors or deems unlawful. (Earlier this year, the Bank also settled a class action that alleged similar misleading and deceptive practices related to its overdraft service.)

As we blogged earlier last week, the CFPB will reportedly unveil a proposed overdraft regulation very soon. Some observers believe that the proposed rule will include an exemption for smaller depository institutions, so that the CFPB can avoid the SBREFA process, which would require the CFPB to consider the proposed regulation’s effect on small institutions. (The CFPB was criticized for skipping the SBREFA process before issuing its proposed rule on credit card late fees, which does not include an exemption for small institutions.)

[View source.]