No one can predict the future of real estate, but you can prepare. Find out what to prepare for and pick up the tools you’ll need at Virtual Inman Connect on Nov. 1-2, 2023. And don’t miss Inman Connect New York on Jan. 23-25, 2024, where AI, capital and more will be center stage. Bet big on the future and join us at Connect.
Two-and-a-half years after accidentally initiating $2.3 billion in erroneous mortgage payments from 480,000 homeowners’ bank accounts, electronic payment processor ACI Worldwide Corp. says it’s ready to put the incident behind it after announcing a $20 million settlement with state regulators Tuesday.
As was the case when the company agreed to pay a $25 million penalty in June to the Consumer Financial Protection Bureau, ACI Worldwide said it settled “without admitting any wrongdoing, to avoid the expense and distraction of litigation.”
“At all times during and after the April 2021 error, consumers’ money and personal information remained safe,” the company said of the bungled test of the company’s Speedpay bill payment platform.
Having previously agreed to pay up to $6.5 million as part of a court-approved settlement of seven class action lawsuits, the episode will end up costing Miami-based ACI — or its insurers — more than $50 million.
According to settlements with state and federal regulators, ACI Worldwide subsidiary ACI Payments Inc. had intended to use dummy data to conduct tests of its newly acquired Speedpay electronic payments platform on April 23, 2021.
Instead, ACI accidentally transmitted actual consumer data, including names and bank account numbers, to the ACH network, an automated clearinghouse for electronic funds transfers. That mistakenly triggered $2.39 billion in payments from 478,568 homeowners to Mr. Cooper, one of the nation’s biggest mortgage loan servicers.
ACI maintained that “99.998 percent” of the erroneous debit entries were offset before any funds moved from consumer accounts. However, state regulators said some consumers were subjected to “unexpected and sometimes multiple mortgage payments,” in some cases exposing them to overdraft or insufficient funds fees.
Although state regulators said “the full indirect consumer impact is undetermined,” they identified approximately 2,710 consumers who reported to Mr. Cooper that they had experienced financial harm as a result of the error.
Antonio Salazar
“In today’s digital world, mistakes that happen at this scale can be devastating for consumers,” Maryland Commissioner of Financial Regulation Antonio Salazar said in a statement. “Unfortunately, in this case, consumers paid the price for this company’s lack of internal controls.”
Maryland helped lead a multi-state enforcement action that included participation by regulators from Arkansas, Connecticut and Texas, with support from the Conference of State Bank Supervisors.
State investigators determined that as ownership and operation of the Speedpay platform was being transitioned to ACI, it was “still hosted in the previous owner’s IT environment with certain services still provided by legacy vendors.”
These legacy vendors “were not adequately integrated into ACI’s risk and compliance framework, specifically with identifying the risk category each represented, so as to ensure that the defense protocols at ACI were properly tracking their activities as it related to supporting the Speedpay platform,” state regulators said in their settlement agreement and consent order.
The legacy vendors’ “circumvention of internal data security controls and a lack of segregation between internal production and testing environments” resulted in the erroneous automatic transfers of payments from consumers’ bank accounts to Mr. Cooper, state regulators alleged.
“Now that consumers have been made whole, state regulators are penalizing ACI Payments and sending a message to other companies that mishandling customer data will lead to stiff penalties,” Salazar said.
In addition to paying $10 million in fines to cover administrative costs and penalties, ACI agreed to implement risk management and compliance programs and file regular reports to state regulators for two years.
ACI said the settlement agreements with 44 state agencies and 50 state attorneys general, along with ACI’s previous settlement with the CFPB, “resolve these state and federal regulatory investigations arising out of this error.” ACI said it is “satisfied with the conclusion of this matter and is moving forward in the interest of its employees, shareholders and customers.”
In its most recent quarterly report to investors, ACI said it expects insurance will cover “substantially all of the settlement payments and costs, including lawyers’ fees, subject to the retained limits and other terms of the applicable policies.”
Get Inman’s Mortgage Brief Newsletter delivered right to your inbox. A weekly roundup of all the biggest news in the world of mortgages and closings delivered every Wednesday. Click here to subscribe.