VyStar shipped a banking platform its QA refused to sign off — 850,000 members paid

On May 13, 2022, VyStar Credit Union, a Jacksonville institution with about 850,000 members, switched its online and mobile banking to a new platform during a planned outage. The new system never came up properly. Members queued in virtual waiting rooms — one complained to the CFPB about a wait exceeding four hours — and the mobile app was completely unavailable for a month. Full functionality was not restored until December 2022.

The CFPB's consent order details how launch pressure overrode the bank's own controls. Shortly before the release, management reclassified at least 135 defects that had been rated critical, so none of them blocked the conversion. When IT Audit asked, management claimed the decisions had been communicated to senior management — a false representation. The Quality Assurance head refused to sign off and was brushed aside as having a risk-averse mentality; developers who said the platform was not ready were ignored.

Members bore the consequences. In the week of May 15, call volume rose nearly 250% with a 33% drop rate that persisted for months between 31% and 44%. Branches had long lines, and members outside the service area had no branch at all. The fallback options were hollow: phone banking required prior setup, ATMs could not make third-party payments or accept deposits from network ATMs without fees. Members incurred non-sufficient-funds, overdraft, late, and wire fees from payments they could not see or make, and VyStar reimbursed or waived more than $2.5 million.

On October 31, 2024, the CFPB ordered VyStar to pay a $1.5 million civil penalty, complete a refund audit, and stand up a governance committee for consumer-facing system projects, finding the planning and implementation of the conversion violated the Consumer Financial Protection Act. The Bureau terminated the order on July 21, 2025, waiving alleged non-compliance, after the penalty was paid and the audit verified fee refunds. It was VyStar's second failed conversion: a 2016 platform switch also locked members out for about a week.

$1.5M CFPB civil penalty, more than $2.5M in member fees reimbursed or waived, and months of outages for 850,000 members

Launch-date pressure beat quality gates: management downgraded 135 critical defects so nothing blocked the conversion.

Internal warnings were overruled — the QA head refused sign-off and was dismissed as risk-averse, and developers who called the platform unready were ignored.

Oversight was fed a false claim: IT Audit was told senior management had approved the defect downgrades.

There was no usable fallback: phone banking needed prior enrollment and ATM limits left members paying fees for payments they could not see or make.

The lesson already existed — the credit union's 2016 conversion had also knocked out online banking for about a week.

A go-live date is a commitment to quality, not a substitute for it: when your own testers and developers say it is not ready, shipping on schedule only schedules the outage.

VyStar paid the $1.5 million penalty and ran a refund audit to verify members were made whole for outage-related fees and costs. The CFPB terminated the order on July 21, 2025 and waived any alleged non-compliance. The case is now a standard citation for treating a core banking migration as a product launch with go/no-go criteria rather than a deadline to defend.