On July 1, the Federal Reserve Board announced a joint enforcement action with the Illinois Department of Financial and Professional Regulation against a state bank that allegedly failed to properly oversee a nonbank third-party provider of financial aid refund disbursement services. The consent order states that from May 2012 to August 2013, the bank opened over 430,000 deposit accounts in connection with the vendor’s debit card product for disbursement of financial aid to students. The agencies claim that during that time, the vendor misled students about the product, including by (i) omitting material information about how students could get their financial aid refund without having to open an account; (ii) omitting material information about the fees, features, and limitations of the product; (iii) omitting material information about the locations of ATMs where students could access their account without cost and the hours of availability of those ATMs; and (iv) prominently displaying the school logo, which may have erroneously implied that the school endorsed the product. The regulators ordered the bank to pay a total of $4.1 million in civil money penalties. In addition, the Federal Reserve is seeking restitution from the vendor, and, pursuant to the order against the bank, may require the bank to pay any amounts the vendor cannot pay in restitution to eligible students up to the lesser of $30 million or the total amount of restitution based on fees the vendor collected from May 2012 through June 2014. The consent order also requires the bank to submit for Federal Reserve approval a compliance risk management program in advance of entering into an agreement with a third party to solicit, market, or service a consumer deposit product on behalf of the bank.