.svg)
The US Consumer Financial Protection Bureau (CFPB) has fined ACI Worldwide and its subsidiary ACI Payments for initiating around $2.3bn in mortgage payments while running a test.
In April 2021, when ACI carried out performance testing of its Speedpay bill payment platform, the company mistakenly used the actual data of nearly 500,000 homeowners instead of using de-identified or dummy data.
The data included names, bank account numbers, bank routing numbers and amounts to be debited or credited related to mortgages serviced by home lender Mr. Cooper, formerly known as Nationstar.
Altogether, the payment processor wrongly transferred mortgage payment transactions worth $2.3bn via the US Automated Clearing House (ACH) network.
According to the agency, Mr. Cooper was one of ACI’s largest mortgage-servicing customers until at least 2021.
Mr. Cooper services the mortgages of more than 4m borrowers and collects their monthly mortgage payments.
Many homeowners with mortgages serviced through Mr. Cooper chose to schedule their monthly mortgage payments by pre-authorising recurring mortgage payments on a scheduled date. The automatic payments were processed via the Speedpay platform.
But the payments during the test run were not authorised by the borrowers and they became aware of them only after they had been processed by their banks.
The CFPB said that the error exposed homeowners to overdraft and insufficient fund fees from their financial institutions.
“While borrower accounts have now been fixed, we are penalising ACI for its unlawful actions that created headaches for hundreds of thousands of borrowers,” said CFPB director Rohit Chopra.
The agency charged ACI with illegally initiating withdrawals from borrower bank accounts and improperly handling sensitive consumer data.
ACI was ordered to pay a $25m civil money penalty to settle the case.
Commenting on the action, ACI said it consented to the order, without admitting any wrongdoing, as it believes “the prompt conclusion of this matter is the best path forward and is in the interest of its employees, shareholders, and customers”.
The payment processor said at the time of the incident, Speedpay was a recently acquired addition to ACI’s portfolio and the transfers were made shortly after ACI took over the management of Speedpay’s legacy data environment from its former owner, Western Union.
The payment processor argued that the error happened because its policies and procedures were not followed and took swift action to reverse the ACH entries and prevent any consumer loss.
It stressed that ACI adopted additional controls to prevent such errors from occurring in the future.
In parallel with the regulatory action, ACI was also subject to a class action lawsuit where a settlement agreement was reached last month.
The company agreed to set aside $5m to pay all claims, attorneys’ fees and costs and a further $1m for borrowers who can prove they had suffered unreimbursed actual damages as a result of the incident.
ACI has more than 6,000 firms as customers, and the company processes more than 225bn consumer transactions annually. It reported revenue of $1.4bn and net income of $142m in 2022.
