In the CFPB’s most recent administrative adjudication issued September 18th, Chase Bank USA, N.A. and JP Morgan Chase Bank, N.A (Chase) entered into a Consent Order with the Bureau related to its billing and administration of Identity Theft Protection products (IPP) marketed to Chase card and other retail customers.
Although Chase did not admit liability in the Consent Order (the Order), the Bureau found that Chase and its third-party vendors had engaged in unfair acts and practices in violation of Dodd-Frank by billing and accepting monthly fees for credit monitoring services which were not provided. Specifically, consumers were billed before the credit reporting agencies (CRAs) had processed authorizations given to Chase or its vendors to access their credit information, a prerequisite to provide those services. The CFPB also found that the bank’s compliance monitoring service provider failed to identify, prevent, or correct those billings.
Chase took steps to correct the practices by ending the marketing of the IPP before March, 2012 and issuing some consumer refunds in October, 2012. But the Order prohibits Chase from further marketing or solicitation of IPP absent presentation and approval to the CFPB of a Compliance Plan detailing how consumers would be informed that such services would not be activated until authorization was given to access their credit information, and how the bank would ensure that customers would not be billed in the future for such products before the credit reporting agencies had processed the consumers authorizations to access their credit information.
The Order also required Chase to:
1. Develop a vendor management policy designed to insure products sold through vendors would comply with applicable federal consumer financial law, including adding requirements to comply with such laws in vendor contracts and implementation of procedures for ongoing call monitoring of vendors;
2. Complete refunds of approximately $309 million, plus interest, to more than two million consumers who enrolled in the credit monitoring product and were charged for services they did not receive. In addition to the amount paid for the product, Chase was required to refund interest and any over-the-limit fees resulting from the charge for the product.
3. Submit to an independent audit.
4. Pay a $20 million penalty to the CFPB’s Civil Penalty Fund.
The Office of the Comptroller of the Currency undertook a separate action and separately ordered restitution and civil money penalties of an additional $60 million.
The Order serves as a road map on what the CFPB expects with regard to third party marketing vendor management and compliance auditing, and again demonstrates the Bureau’s willingness to assess penalties against covered entities for practices found to be in violation of the law but carried out by third-party vendors.
In April, 2012, the CFPB issued a bulletin stating that it expected covered entities to monitor their service providers, and would hold them responsible for violations by service providers of Federal consumer financial laws.
©2026 Carlton Fields, P.A. Carlton Fields practices law in California through Carlton Fields, LLP. Carlton Fields publications should not be construed as legal advice on any specific facts or circumstances. The contents are intended for general information and educational purposes only, and should not be relied on as if it were advice about a particular fact situation. The distribution of this publication is not intended to create, and receipt of it does not constitute, an attorney-client relationship with Carlton Fields. This publication may not be quoted or referred to in any other publication or proceeding without the prior written consent of the firm, to be given or withheld at our discretion. To request reprint permission for any of our publications, please use our Contact Us form via the link below. The views set forth herein are the personal views of the author and do not necessarily reflect those of the firm. This site may contain hypertext links to information created and maintained by other entities. Carlton Fields does not control or guarantee the accuracy or completeness of this outside information, nor is the inclusion of a link to be intended as an endorsement of those outside sites.
