Pub. 11 2016-2017 Issue 6

www.nebankers.org 12 Extraordinary Service for Extraordinary Members. COUNSELOR’S CORNER Lessons Learned From the RushCard Enforcement Action Is There Still Room for Error in Technology Implementations? Bryan Handlos, Kutak Rock LLP “I think I’m less afraid of failure than some others.” “Those that get on in this world are the ones that take responsibility for their life. If things don’t go right . . . they do not blame others or play victim. They get on with things and learn the lesson.” “Praying for [those] who have been and those who still are affected by the tech change at Rushcard.” —Russell Simmons, aka Unc- leRUSH, cofounder of Def Jam Re- cords and the RushCard, among other things. “. . . @UncleRUSH right prayers dont pay bills. Im sitting in the dark with my 1 year old son becuz i have no access to my money.” —Tweet responding to Simmons’ tweet saying he would pray for those affected by the RushCard service out- age. 1 E ARLIER THIS YEAR, THE CONSUMER Financial Protection Bureau (CFPB) took enforcement action against UniRush, the company that administered the Rush- Card program, and MasterCard, the payment processor for the program. 2 The RushCard is a prepaid card. Many RushCard customers are otherwise unbanked. In 2015, UniRush’s con- version from TSYS to MasterCard did not go well. As a result, there was a temporary but serious service disruption for RushCard customers. Class action litigation ensued and was settled for $20 million. The CFPB also stepped in with a Consent Order for $10 million of restitution and a $3 million civil money penalty. Various other remedial actions also were re- quired. Among other things, the CFPB characterized UniRush andMasterCard pre-conversion testing as inadequate and actionable under the unfairness prong of the CFPB’s UDAAP authority. Many banks don’t have prepaid card programs like the RushCard program, so why should they be inter- ested? The CFPB essentially said that UniRush and MasterCard did a poor job of preparing for their conversion. The conversion was, in the words of the CFPB, “botched.” UniRush also did a poor job of handling the aftermath. All this resulted in a federal enforce- ment action and a multimillion dollar civil money penalty. Any bank with a less-than-perfect record of implement- ing its technology projects should be interested. What Happened? According to the CFPB, 3 UniRush and MasterCard failed to conduct adequate testing and preparation for the conversion of the RushCard pro- gram onto the MasterCard payment processing platform. The companies spent 13 months jointly preparing for the conversion and conducted multiple tests in preparation for the conversion. Apparently, however, testing did not accurately simulate the actual condi- tions for conversion. MasterCard also reportedly denied a UniRush request to test “a new data file” that was neces- sary to the conversion. A planned five- hour blackout period was extended by approximately three and a half hours and that blackout period was ended before all account activity files were loaded to the MasterCard platform. Customer transactions were declined during the blackout period. Testing was not conducted on the transmis- sion of account balance information in certain declined transaction scenarios. Balance information was communi- cated to customers inaccurately in these scenarios for two days. According to the CFPB, UniRush “failed to ensure” that all accounts would transfer to the MasterCard platform or that consumers with lost or stolen cards were issued new cards. UniRush also failed to prepare a contingency plan to enable it to scale up customer service in response to increased call volume, which spiked