Banking and Finance Law Daily Wrap Up, ENFORCEMENT ACTIONS—CFPB, state regulator consent orders slap ‘Cash App’ service with monetary redress, civil penalties, (Jan 16, 2025)

By Justin Marcus Smith, J.D.

The CFPB and the state regulators separately entered into consent orders with Block, Inc., specifying up to $255 million in total redress and civil penalties for the company’s alleged violations of federal and state consumer-protection and BSA/AML laws.

The Consumer Financial Protection Bureau and a separate group of state regulators have announced that they settled their respective consumer-protection and Bank Secrecy Act and Anti-Money Laundering (BSA/AML) concerns with Oakland, California-based Block, Inc. (Block). Block operates “Cash App,” a peer-to-peer payment app. Block entered into the two consent orders in the interest of compliance and resolution, without admitting or denying any wrongdoing in either instance. On the whole, the regulators contended that Block operated its Cash App peer-to-peer payment app in a way that exposed consumers to fraud, while potentially facilitating other criminal activity, like money laundering and terrorism. In a press release, CFPB Director Rohit Chopra commented that when things went wrong, Block “flouted its responsibilities and even burdened local banks with problems that [Block] caused.” The state regulators specified that Block was cooperative throughout their investigation, and the CFPB and state regulators released their potential claims in exchange for the monetary and mitigative provisions of the consent orders (In the Matter of Block, Inc., File No. 2025-CFPB-0001 (CFPB Administrative Proceeding Jan. 16, 2025)).

CFPB settlement. The Consumer Financial Protection Bureau (CFPB) issued a press release dated Jan. 16, 2025, announcing that it entered into a consent order imposing consumer redress of up to $120 million plus a $55 million civil money penalty on Block. Block’s Head and Chairperson, Jack Dorsey signed the stipulation and consent to issuance of the 75-page CFPB consent order. According to the CFPB consent order, Block did not admit or deny wrongdoing, but a CFPB review had “identified” that Block:

• failed to provide effective customer service for Cash App in a manner that was unfair in violation of the Consumer Financial Protection Act (CFPA), 12 U.S.C. §§ 5531(c) and 5536(a)(1)(B);

• failed to take timely, appropriate, and effective measures to prevent, detect, limit, and address fraud on the Cash App platform in a manner that was unfair in violation of the CFPA, 12 U.S.C. §§ 5531(c) and 5536(a)(1)(B);

• employed dispute resolution and chargeback practices in a manner that was unfair in violation of the CFPA, 12 U.S.C. §§ 5531(c) and 5536(a)(1)(B);

• made representations to consumers relating to Cash App in a manner was deceptive in violation of the CFPA, 12 U.S.C. §§ 5531(a) and 5536(a)(1)(B);

• failed to comply with error resolution requirements of the Electronic Fund Transfer Act (EFTA) and Regulation E, as set forth in 12 C.F.R. § 1005.11, including § 1005.11(b)-(d), and § 1005.18(e);

• failed to retain evidence of compliance with the EFTA and Regulation E for a period of at least two years in violation of 12 C.F.R. § 1005.13; and

• failed to comply with limitation of liability requirements in a manner that violated Regulation E, 12 C.F.R. §§ 1005.6-1005.7; and, through its violations of the EFTA and Regulation E, violated the CFPA, 12 U.S.C. § 5336(a)(1)(A).

More descriptively, the CFPB alleged that Block “employed weak security protocols for Cash App and put its users at risk.” It also said Block did not comply with the legal requirement that it investigate and resolve unauthorized transaction disputes. It characterized Block’s investigations as “woefully incomplete.” The CFPB release said Block would first refer customers who alleged fraud to talk to their bank about reversing the transactions, and then deny the reversal requests.

The CFPB said Block also used other tactics intended to stymie users and thereby reduce Block’s own costs. For example, the CFPB said Block used its Terms of Service to trick users into thinking their linked bank would bear responsibility for dispute resolution, whereas the Electronic Fund Transfer Act (EFTA) generally requires peer-to-peer platforms like Cash App to investigate unauthorized transaction disputes. The CFPB emphasized here that “a company cannot simply use fine print to escape these legal requirements.”

The CFPB also said the phone number on the back of the Block Cash Card simply referred customers to contact customer support through the app. Doing so would then often lead to “delayed, inadequate, confusing, or inaccurate responses.” Worse, consumers who would then resort to web searches to identify another Cash App customer service route would often fall prey to online imposters who tricked them into giving up their passwords and other personal information. The CFPB contended Block knew about such fraudsters but “failed to take timely action to address the issue.”

Beyond the monetary provisions of the CFPB consent order, Block must, among other things:

• maintain live customer service for Cash App, with human voice communication available at least 12 hours a day, and human chat available at least 18 hours a day;

• clearly and prominently display live customer service information on the Cash App landing page;

• provide consumers with prompt explanations about restricted access to Cash App, unless otherwise instructed by law enforcement;

• conduct prompt investigations on receipt of consumer notices of error, correct errors, and provide provisional credits, among other details;

• implement fraud detection, safeguards, and related measures to limit fraudulent Cash App transactions;

• provide appropriate refunds;

• establish various responsible committees and compliance groups;

• propose and implement solutions to identified problems, including recommendations to its Board;

• design and implement a comprehensive compliance plan; and

• comply with many related and other details too extensive to impart here.

In exchange for the specified provisions, the CFPB released and discharged Block from all pertinent potential liability.

Multistate settlement. The Conference of State Bank Supervisors (CSBS) issued its own press release dated Jan. 15, 2025, announcing that 48 state financial regulators reached a multistate $80 million settlement with Block. As in the case of the CFPB consent order, Block entered the multistate consent order without admitting or denying any wrongdoing. The state consent order also stated that Block was cooperative throughout.

According to the multistate consent order, the state regulators, who collectively identified themselves as the State Money Transmission Regulators, said they began a “Multi-State Examination” of Block in May 2023 covering the period Jan. 1, 2021, to March 31, 2023. Regulators from California, Colorado, Kentucky, Massachusetts, New Hampshire, Ohio, Texas, and Washington conducted the examination. The consent order said the resulting Report of Examination (ROE), issued in November 2023, “identified findings related to the adequacy” of Block’s AML program. The state regulators, who, apart from those who conducted the examination, were otherwise led by those hailing from Arkansas, California, Massachusetts, Florida, Maine, Texas, and Washington State, contended they found Block was not in compliance with certain BSA/AML requirements. They said the AML deficiencies made Block’s Cash App vulnerable to potential misuse by money launderers, terrorists, and other criminals. The consent order said Block responded with a summary of new controls in place and planned enhancements. Again, the state regulators said Block was cooperative throughout, and the state regulators released their claims.

Among other details specified in the multistate consent order, Block agreed to pay the $80 million assessed penalty to the state agencies; to hire an independent consultant to review its BSA/AML program; to submit a report to the states within 9 months; and, to correct any deficiencies found within 12 months.

Companies: Block, Inc.; Conference of State Bank Supervisors

MainStory: TopStory ArkansasNews BankingOperations BankSecrecyAct CaliforniaNews CFPB ChecksElectronicTransfers ColoradoNews CrimesOffenses DoddFrankAct EnforcementActions FinancialIntermediaries FinTech FloridaNews GCNNews KentuckyNews MaineNews MassachusettsNews NewHampshireNews OhioNews StateBankingLaws TexasNews UDAAP WashingtonNews