UniRush LLC and Mastercard International Incorporated

Agency: Consumer Financial Protection Bureau
Date: Feb. 2017
Type: enforcement action
Source: consumerfinance.gov/enforcement/actions/unirush-llc-and-mastercard-int
Pages: 47
PDFs: 3 documents (links below)

Documents in this case

Stipulation · Feb. 2017 · 5 p.
Consent order · Feb. 2017 · 36 p.
Stipulation · Feb. 2017 · 5 p.

Case summary

The Consumer Financial Protection Bureau today took action against Mastercard and UniRush for breakdowns that left tens of thousands of economically vulnerable RushCard users unable to access their own money to pay for basic necessities. In October 2015, a rash of preventable failures by Mastercard and UniRush meant that many customers could not use their RushCard to get their paychecks and other direct deposits, take out cash, make purchases, pay bills, or get accurate balance information. UniRush then failed to provide customer service to many consumers who reached out for help during the service breakdown. The CFPB has ordered Mastercard and UniRush to pay an estimated $10 million in restitution to tens of thousands of harmed customers. The CFPB also fined Mastercard and UniRush $3 million.

Stipulation (Feb. 2017)

PDF of this document (5 pages)

Page 2

UNITED STATES OF AMERICA CONSUMER FINANCIAL PROTECTION BUREAU File No. 2017-CFPB-0010 In the matter of:

UniRush LLC and Mastercard International Incorporated STIPULATION AND CONSENT TO THE ISSUANCE OF A CONSENT ORDER The Consumer Financial Protection Bureau (Bureau) intends to initiate an administrative proceeding against Mastercard International Incorporated (Respondent), under 12 U.S.C. §§ 5563 and 5565, for its activities related to the conversion of the Rush Card prepaid card program onto the payment processing platform of the Mastercard Payment Transaction Services division of Mastercard International Incorporated (MPTS) in violation of the Consumer Financial Protection Act of 2010's (CFPA) prohibition on unfair, deceptive, or abusive acts or practices, 12 u.s.c. §§ 5531, 5536.

Respondent, in the interest of compliance and resolution of the matter, and without admitting or denying any wrongdoing, consents to the issuance of a Consent Order substantially in the form of the one to which this Stipulation and Consent to the Issuance of a Consent Order is attached (Consent Order), and which is incorporated by reference.

I 2017-CFPB-0010 Document 2 Filed 02/01/2017 Page 1 of 5

Page 3

2017-CFPB-0010 Document2 _ Filed 02/01/2017 Page 2of5

In consideration of the above premises, Respondent agrees to the following: Jurisdiction . The Bureau has jurisdiction over this matter under sections 1053 and 1055 of the

Consumer Financial Protection Act of 2010 (CFPA), 12 U.S.C. §§ 5563, 5565.

Consent

. Respondent agrees to the issuance of the Consent Order, without admitting or denying any of the findings of fact or conclusions of law, except that Respondent admits the facts necessary to establish the Bureau’s jurisdiction over Respondent and the subject matter of this action.

. Respondent agrees that the Consent Order will be deemed an “order issued with the consent of the person concerned” under 12 U.S.C. § 5563(b)(4), and agrees that the Consent Order will become a final order, effective upon issuance, and will be fully enforceable by the Bureau under 12 U.S.C. §§ 5563(d)(1) and 5565.

. Respondent voluntarily enters into this Stipulation and Consent to the Issuance of a Consent Order.

. The Consent Order resolves only Respondent’s potential liability for law violations that the Bureau asserted or might have asserted based on the practices described in Section V of the Consent Order, to the extent such practices occurred before the Effective Date and the Bureau knows about them as of the Effective Date. Respondent acknowledges that no promise or representation has been made by the Bureau or any employee, agent, or representative of the Bureau, about any liability outside of this action that may have arisen or may arise from

the facts underlying this action or immunity from any such lability.

Page 4

2017-CFPB-0010 Document2 Filed 02/01/2017 Page 3 of S

6. Respondent agrees that the facts described in Section V of the Consent Order will be taken as true and be given collateral estoppel effect, without further proof, in any proceeding before the Bureau to enforce the Consent Order, or in any subsequent civil litigation by the Bureau to enforce the Consent Order or its rights to any payment or monetary judgment under the Consent Order, such as a non-dischargeability complaint in any bankruptcy case.

7. The terms and provisions of this Stipulation and the Consent Order will be binding upon, and inure to the benefit of, the parties hereto and their successors in interest.

8. Respondent agrees that the Bureau may present the Consent Order to the Bureau.

Director for signature and entry without further notice.

Waivers 9. Respondent, by consenting to this Stipulation, waives:

a. Any right to service of the Consent Order, and agrees that issuance of the Consent Order will constitute notice to the Respondent of its terms and conditions;

b. Any objection to the jurisdiction of the Bureau, including, without limitation, under section 1053 of the CFPA, 12 U.S.C. § 5563;

c. The rights to all hearings under the statutory provisions under which the proceeding is to be or has been instituted; the filing of proposed findings . of fact and conclusions of law; proceedings before, and a recommended decision by, a hearing officer; all post-hearing procedures; and any other procedural right available under section 1053 of the CFPA, 12 U.S.C.

§ 5563, or 12 CFR Part 1081;

Page 5

2017-CFPB-0010 Document2 Filed 02/01/2017 Page4of5

. The right to seek any administrative or judicial review of the Consent Order;

. Any claim for fees, costs or expenses against the Bureau, or any ofits . agents or employees, and any other governmental entity, related in any way to this enforcement matter or the Consent Order, whether arising under common law or under the terms of any statute, including, but not limited to the Equal Access to Justice Act and the Small Business Regulatory Enforcement Fairness Act of 1996; for these purposes, Respondent agrees that Respondent is not the prevailing party in this action because the parties have reached a good faith settlement;

Any other right to challenge or contest the validity of the Consent Order;

. Such provisions of the Bureau’s rules or other requirements of law as may be construed to prevent any Bureau employee from:participating in the preparation of, or advising the Director as to, any order, opinion, finding of fact, or conclusion of law to be entered in connection with this Stipulation or the Consent Order; and

. Any right to claim bias or prejudgment by the Director based on the consideration of or discussions concerning settlement of all or any part of

the proceeding.

Page 6

2017-CFPB-0010 Document2 Filed 02/01/2017 Page5of5

Mastercard International Incorporated BY:

WE HD / rang 20; 20)

Timothy Murphy Y Date General Counsel and Chief Franchise Officer, Mastercard International Incorporated

Consent order (Feb. 2017)

PDF of this document (36 pages)

Page 7

UNITED STATES OF AMERICA CONSUMER FINANCIAL PROTECTION BUREAU ADMINISTRATIVE PROCEEDING File No. 2017-CFPB-0010 In the Matter of:

CONSENT ORDER UniRush LLC and Mastercard International Incorporated The Consumer Financial Protection Bureau (Bureau) has reviewed the practices of UniRush LLC (UniRush) and the Mastercard Payment Transaction Services division of Mastercard International Incorporated (MPTS) and has identified the following law violations: UniRush and MPTS engaged in unfair acts or practices by failing to conduct adequate testing and preparation for the conversion of the RushCard prepaid card program onto the MPTS payment processing platform in violation of sections 1031 and 1036 of the Consumer Financial Protection Act of 2010 (CFPA), 12 U.S.C. §§ 5531, 5536. Post-conversion, UniRush engaged in unfair acts or practices in its administration of RushCard accounts in violation of sections 1031 and 1036 of the CFPA, 12 U.S.C. §§ 5531, 5536. Under Sections 1053 and 1055 of the CFPA, 12 U.S.C. §§ 5563, 5565, the Bureau issues this Consent Order (Consent Order).

2017-CFPB-0010 Document 1 Filed 02/01/2017 Page 1 of 36

Page 8

I Overview 1.

In 2014, UniRush selected MPTS as its new payment processor for the RushCard. Services provided by MPTS include maintaining the system of record for the RushCard accounts and authorizing/settling card transactions on the Visa payment network on behalf of the card issuer. UniRush separately provides services on its systems that, when functioning, allow cardholders to, among other things, obtain direct ACH deposit of payroll and other funds to their cards, load funds onto their cards at various retail locations, maintain savings “goal” accounts, make bill payments and card to-card transfers, and obtain from UniRush information about their card balances and transactions through the cardholder website, mobile phone application, and customer service agents. 2.

Respondents jointly scheduled the payment processor conversion for October 10- 12, 2015, after which MPTS would begin providing payment processing services. At the time of the conversion, there were approximately 652,000 active RushCard users, approximately 272,000 of whom received direct deposits of their pay and/or government benefits on the RushCard.

MPTS and UniRush’s pre-conversion testing and preparation did not ensure that: (1) the conversion of RushCard accounts onto the MPTS payment processing platform would be completed within the specified timeframe for the conversion; (2) all RushCard accounts would be successfully transferred onto the MPTS platform, resulting in many RushCard holders not being able to access funds stored on their RushCard after the conversion; (3) fees would be assessed and transaction approvals would occur consistent with UniRush’s program rules and 2017-CFPB-0010 Document 1 Filed 02/01/2017 Page 2 of 36

Page 9

RushCard terms and conditions; (4) UniRush could handle increased demands on its customer service system after the conversion in the event of significant service disruptions, causing consumers to spend hours on hold or not be able to reach customer service, and (5) MPTS would convey accurate information about consumers’ balances to UniRush when it declined certain transactions. 4.

Post-conversion, UniRush’s administration of its prepaid card program resulted in some consumers: (1) not timely receiving their direct deposits; (2) receiving inaccurately inflated account balance information causing them to spend more funds than available on their cards; (3) not having access to funds they attempted to load onto their RushCards or that should have been available to them through subaccounts associated with RushCards, and (4) having negative account balances resulting from conversion failures that UniRush offset with subsequent deposits without the consumers’ prior knowledge.

II Jurisdiction 5.

The Bureau has jurisdiction over this matter under sections 1053 and 1055 of the CFPA, 12 U.S.C. §§ 5563 and 5565.

III Stipulation 6.

Each Respondent has executed a “Stipulation and Consent to the Issuance of a Consent Order,” dated January 30, 2017 (Stipulation), which are incorporated by reference and are accepted by the Bureau. By these Stipulations, Respondents have consented to the issuance of this Consent Order by the Bureau under 2017-CFPB-0010 Document 1 Filed 02/01/2017 Page 3 of 36

Page 10

sections 1053 and 1055 of the CFPA, 12 U.S.C. §§ 5563 and 5565, without admitting or denying any of the findings of fact or conclusions of law, except that Respondents admit the facts necessary to establish the Bureau’s jurisdiction over Respondents and the subject matter of this action. IV Definitions 7.

The following definitions apply to this Consent Order: a.

“Active RushCard Account” means a RushCard account in an active status with any recorded account activity (any data recorded for the account, including but not limited to transactions and attempted transactions) within the previous 90 days.

“Affected Consumers” means consumers with a RushCard account as of October 11, 2015, with any recorded account activity (any data recorded for the account, including but not limited to transactions and attempted transactions) within the six months prior to and including October 11, 2015. c.

“Allocation Agreement” means the separate agreement between Respondents, which sets forth each respective party’s allocable share of the amount of consumer redress specified in Paragraphs 66 and 73, civil money penalty specified in Paragraph 76, and administrative costs and expenses paid to third parties in administering the cost of consumer redress. d.

“Board” means Respondent MPTS’s and Respondent UniRush’s respective and duly-elected and acting Boards of Directors, or a respective committee thereof.

2017-CFPB-0010 Document 1 Filed 02/01/2017 Page 4 of 36

Page 11

“Class Action Settlement Agreement” means the agreement settling the actions titled Fuentes, et al. v. UniRush, LLC, et al., Case No. 1:15-cv-08372 (S.D.N.Y.); Huff v. UniRush, LLC et al., Case No. 2:15-cv- 02253 (E.D. Cal.); Peterkin v. UniRush, LLC, et al., Case No. 1: 15-cv-08573 (S.D.N.Y.); and Jones v. UniRush, LLC, et. al., Case No. 5:15-cv-05996 (E.D. Pa.). f.

“Effective Date” means the date on which the Consent Order is issued. g.

“Enforcement Director” means the Assistant Director of the Office of Enforcement for the Consumer Financial Protection Bureau, or his/her delegate.

“Related Consumer Action” means a private action by or on behalf of one or more consumers or an enforcement action by another governmental agency brought against Respondents based on substantially the same facts as described in Section V of this Consent Order. i.

“Respondents” means collectively UniRush LLC (UniRush) and Mastercard International Incorporated (“Mastercard”) and their successors and assigns. V Bureau Findings and Conclusions The Bureau finds the following:

UniRush is a Delaware limited liability company headquartered in the greater Cincinnati area. Since 2003, UniRush has marketed and administered the RushCard brand of general purpose reloadable prepaid cards. 9.

Mastercard is a global financial services corporation incorporated in Delaware and headquartered in Purchase, New York. Mastercard Payment Transaction Services 2017-CFPB-0010 Document 1 Filed 02/01/2017 Page 5 of 36

Page 12

(MPTS) is a division of Mastercard International Incorporated and is the current payment processor for the RushCard.

10.

UniRush is a “covered person” under 12 U.S.C. § 5481(6) as a seller and provider of “stored value or payment instruments.” 12 U.S.C. § 5481(15)(A)(v). In its role as program administrator, UniRush designs and controls the functions of RushCard and is principally responsible for setting the terms and conditions of the stored value provided to the consumer.

11.

Mastercard is a “covered person” under 12 U.S.C. § 5481(6) as a service provider to UniRush. 12 U.S.C. § 5481(26).

12.

Respondents spent 13 months jointly preparing to transfer RushCard accounts from UniRush’s prior payment processing platform to the MPTS payment processing platform during the October 10-12, 2015, payment processor conversion.

13.

Respondents committed acts or practices before, during, and after the payment processor conversion that adversely impacted consumers. Findings and Conclusions as to MPTS’s Unfair Acts or Practices Related to Pre-Conversion Testing for UniRush 14.

MPTS maintained several environments in which UniRush tested the payment processing services provided by MPTS in the months prior to the conversion. MPTS and UniRush conducted multiple mock tests in preparation for the actual conversion of the account data onto the MPTS processing platform. 15.

MPTS’s mock testing for the RushCard conversion did not accurately simulate the conditions under which the payment processor conversion would take place, 2017-CFPB-0010 Document 1 Filed 02/01/2017 Page 6 of 36

Page 13

resulting in an inaccurate estimate of the amount of time required for the conversion.

16.

MPTS also denied UniRush’s request to conduct a full additional mock conversion to validate and process a new data file that MPTS identified as necessary to successfully convert UniRush without postponing the conversion. Rather, MPTS merely confirmed the data was formatted properly without testing whether it could upload the file to its processing platform. 17.

MPTS’s inadequate mock testing for UniRush contributed to the actual RushCard conversion taking longer than anticipated, which injured consumers. Consumers were informed that the blackout period during the conversion—where RushCard holders could neither access their funds nor transact with their cards—would last from 3-8 a.m., but the blackout period lasted approximately 3.5 hours longer. Approximately 20,824 consumers experienced declined transactions during this extended blackout period.

18.

Respondents ended the extended blackout period before all the files containing RushCard account activity information (including recent transaction and balance information) were loaded on MPTS’s processing platform, but only after Mastercard agreed to cover any losses to UniRush caused by consumers who spent more funds than they had available on their RushCards, a possibility resulting from MPTS’s authorization of transactions without the most up to date account balance information.

19.

MPTS’s pre-conversion testing for the RushCard conversion contributed to certain configuration errors with UniRush’s prepaid card program that resulted in: (1) approximately 13,180 cardholders not being able to access their account 2017-CFPB-0010 Document 1 Filed 02/01/2017 Page 7 of 36

Page 14

information on UniRush’s consumer-facing applications from October 12-15, 2015; (2) approximately 1,110 cardholders having their accounts incorrectly suspended due to possible “fraud”; and (3) approximately $160,000 in monthly maintenance fees being improperly assessed on approximately 187,000 RushCards during the night of the conversion, which MPTS identified and reversed the next day.

20.

Prior to the conversion, MPTS provided technical manuals to UniRush that indicated that MPTS would communicate to UniRush accurate account balance information with every transaction approval or denial. The UniRush applications that consumers used to check their balances were designed to reflect the most recent account balance information in MPTS’s communications. 21.

Prior to the conversion, MPTS did not conduct testing on the account balance information MPTS sent to UniRush when transactions were declined for security reasons (such as an invalid PIN or expired card). 22.

For a two-day period of time after the conversion, when MPTS declined transactions for security reasons (such as an invalid PIN or expired card) it inaccurately communicated an account balance of zero to UniRush. 23.

As a result, thousands of consumers could have seen information on UniRush’s consumer-facing applications that incorrectly indicated a $0 balance on their card and refrained from purchasing necessities and paying their bills until the inaccuracy was resolved.

24.

RushCard users had no control over MPTS’s testing for the conversion of their accounts from RushCard’s prior payment processor to MPTS or whether MPTS 2017-CFPB-0010 Document 1 Filed 02/01/2017 Page 8 of 36

Page 15

provided accurate balance information to UniRush when it declined certain transactions.

25.

Section 1036(a)(1)(B) of the CFPA prohibits “unfair, deceptive, or abusive” acts or practices. 12 U.S.C. § 5536(a)(1)(B). An act or practice is unfair if it causes or is likely to cause consumers substantial injury that is not reasonably avoidable and if the substantial injury is not outweighed by countervailing benefits to consumers or to competition. 12 U.S.C. § 5531(c)(1).

26.

As described in Paragraphs 14-24, MPTS’s acts or practices caused or were likely to cause substantial injury to consumers that was not reasonably avoidable or outweighed by any countervailing benefits to consumers or to competition. 27.

Therefore, MPTS’s pre-conversion testing conduct for the RushCard conversion constituted unfair acts or practices in violation of Sections 1031 and 1036 of the CFPA, 12 U.S.C. §§ 5531, 5536.

Findings and Conclusions as to UniRush’s Unfair Acts or Practices Related to Pre-Conversion Testing and Preparation for the Conversion

28.

In preparation for the payment processor conversion, UniRush failed to ensure that all RushCard accounts would be accurately transferred onto MPTS’s payment processing platform.

29.

UniRush’s inadequate pre-conversion testing and preparation contributed to the improper deactivation of thousands of cards and the failure to transfer other cards onto MPTS’s processing platform. UniRush also did not ensure that consumers who had reported their cards lost or stolen prior to the conversion were issued new and functioning RushCards after the conversion. 2017-CFPB-0010 Document 1 Filed 02/01/2017 Page 9 of 36

Page 16

30.

As a result of UniRush’s failure to accurately transfer all RushCard accounts to MPTS’s processing platform, thousands of RushCard users were unable to transact or access funds stored on their cards for days or in some circumstances weeks after the conversion.

31.

UniRush failed to prepare a contingency plan that would enable it to scale its customer service response to meet the increased demand on its customer service system that resulted from the service disruptions it experienced following the conversion. When the payment processor conversion did not unfold as expected, demands of the UniRush customer service system reached levels for which UniRush did not prepare. For example, call volumes to its customer service system spiked up to six hundred percent higher than projected. 32.

During and after the conversion, UniRush could not meet increased consumer demand for trained customer service agents even after hiring additional agents. As a result, in the midst of service disruptions some consumers waited on hold for hours, often over the course of days, to speak to customer service agents, and could not obtain critical information about the status of their funds and accounts from UniRush’s customer service agents.

33.

RushCard users had no control over UniRush’s pre-conversion process for transferring accounts from its previous payment processor and creating a contingency plan to scale its response for increased customer service resulting from the service disruptions following the conversion. 34.

Section 1036(a)(1)(B) of the CFPA prohibits “unfair, deceptive, or abusive” acts or practices. 12 U.S.C. § 5536(a)(1)(B). An act or practice is unfair if it causes or is 2017-CFPB-0010 Document 1 Filed 02/01/2017 Page 10 of 36

Page 17

likely to cause consumers substantial injury that is not reasonably avoidable and if the substantial injury is not outweighed by countervailing benefits to consumers or to competition. 12 U.S.C. § 5531(c)(1).

35.

As described in Paragraphs 28-33, UniRush’s acts or practices in preparing for the payment processor conversion caused or were likely to cause substantial injury to consumers that was not reasonably avoidable or outweighed by any countervailing benefits to consumers or to competition.

36.

Therefore, UniRush’s preparation for the payment processor conversion constituted an unfair act or practice in violation of sections 1031(c)(1) and 1036(a)(1)(B) of the CFPA, 12 U.S.C. §§ 5531(c)(1), 5536(a)(1)(B). Findings and Conclusions as to UniRush’s Unfair Administration of Cardholder Accounts After the Conversion

37.

In the two days after the payment processor conversion, October 13 and 14, 2015, UniRush did not credit approximately 45,540 direct deposits to consumers’ account balances in accordance with its pre-conversion representation that RushCard consumers would receive direct deposit of their paychecks or government benefits “up to two days sooner” than their official pay date. 38.

UniRush also either did not successfully process or improperly returned to the funding source (in most instances, employers or government agencies) approximately 925 direct deposits in the weeks following the payment processor conversion.

39.

Between October 15 and 19, 2015, UniRush erroneously double-posted over 10,000 Automated Clearing House (“ACH”) deposits to consumers’ accounts. These double-posted deposits resulted in UniRush incorrectly inflating those 2017-CFPB-0010 Document 1 Filed 02/01/2017 Page 11 of 36

Page 18

cardholders’ account balances. When UniRush rescinded the duplicate deposits on October 19, 2015, approximately 3,899 consumers—who had used their cards when the balance information UniRush provided overstated the amount of funds available—incurred negative balances.

40.

UniRush failed to apply ACH debit transactions initiated by consumers around the time of the payment processor conversion to cardholder accounts for three weeks. When UniRush finally processed those transactions on November 2, 2015, an additional 4,644 cardholders—who had used their cards when the balance information UniRush provided them overstated the amount of funds available— incurred negative balances.

41.

Without providing advance notice to consumers, UniRush used funds consumers subsequently loaded onto their RushCards to offset these negative balances. UniRush did not inform consumers they had incurred negative balances as a result of the processing practices described in Paragraphs 39-40, or that it would or had offset those negative balances with consumers’ subsequent deposits. These offsets occurred over a period of many months following the October 2015 conversion.

42.

For approximately two weeks after the conversion, UniRush did not process cash loads that consumers made at retail locations. This service disruption prevented consumers who attempted approximately 2,110 cash loads from accessing funds they thought they had loaded onto their RushCards during this time period. 43.

For approximately two weeks after the conversion, UniRush disabled the function that allowed cardholders to transfer money from one card to another, impacting approximately 2,980 consumers. This prevented consumers from accessing funds 2017-CFPB-0010 Document 1 Filed 02/01/2017 Page 12 of 36

Page 19

in dedicated “goal” accounts that can be accessed only through card-to-card transfers.

44.

UniRush’s administration of RushCard accounts after the conversion caused some consumers to lack access to (1) employer direct deposits and government benefits; (2) accurate balance information because of UniRush’s ACH processing practices; (3) funds loaded onto their RushCards because UniRush used those funds to offset negative balances resulting from UniRush’s ACH processing practices; (4) funds they had attempted to load onto their RushCards; and (5) funds stored in dedicated “goal” accounts. Many consumers could not pay their bills or make critical purchases because of the disruptions in RushCard functionality. 45.

RushCard users had no control over UniRush’s post-conversion administration of their accounts.

46.

47.

As described in Paragraphs 37-45, UniRush’s acts and practices administering RushCard accounts after the payment processor conversion caused or were likely to cause substantial injury to consumers that was not reasonably avoidable or outweighed by any countervailing benefits to consumers or to competition. 48.

Therefore, UniRush’s administration of RushCard accounts after the payment processor conversion constituted an unfair act or practice in violation of sections 1031(c)(1) and 1036(a)(1)(B) of the CFPA, 12 U.S.C. §§ 5531(c)(1), 5536(a)(1)(B). 2017-CFPB-0010 Document 1 Filed 02/01/2017 Page 13 of 36

Page 20

VI Conduct Provisions IT IS ORDERED, under sections 1053 and 1055 of the CFPA, that: 49.

Respondents and their officers, agents, servants, employees, and attorneys who have actual notice of this Consent Order, whether acting directly or indirectly, may not violate sections 1031 and 1036 of the CFPA, 12 U.S.C. §§ 5531 and 5536, as follows and must take the following affirmative actions: a. Mastercard must establish, implement, enhance, and maintain testing policies, procedures, and standards reasonably designed to, at a minimum: i. Ensure that, during and after conversions, MPTS’s processing platform and services provided by MPTS are in-line with expectations and outcomes agreed upon with MPTS’s customers; ii. Ensure that for each processing conversion to MPTS’s processing platform, MPTS has documented and established a test methodology and performed post-implementation reviews of MPTS’s processing platform and services provided by MPTS to its customer;

iii. Prevent service or program disruptions likely to have an adverse impact on consumers during payment processor conversions or significant systems changes or upgrades to MPTS’s payment processing platform;

iv. Produce post-conversion outcomes that correspond to expected results and outcomes outlined in MPTS’s product specifications and 2017-CFPB-0010 Document 1 Filed 02/01/2017 Page 14 of 36

Page 21

verbal and written statements provided to its clients, assuming the accuracy of the client inputs;

v. Ensure that MPTS’s testing environments accurately simulate the results and processing times for the transmission and uploading of all data files that will occur during actual conversions. Such simulation must include data file uploads, database reorganization, and any daily processing expected to occur on those files during the scheduled conversion; and vi. Validate all conversion data files for all new clients to ensure those files contain information in a format that is compatible with MPTS’s processing platform and enables MPTS to administer its clients’ prepaid card programs in accordance with program specifications.

b. Mastercard must establish, implement, enhance, and maintain policies and procedures designed to ensure regular verification of real life settings with the configuration baseline allowing for compliance with the baseline and detection of deviations.

50.

UniRush must establish, implement, and maintain: a. An incident response program that includes at a minimum the following documented phases:

i. A preparation phase that ensures that UniRush has an incident response plan prior to an incident;

ii. A documented identification phase that verifies whether an incident has happened and details the incident;

2017-CFPB-0010 Document 1 Filed 02/01/2017 Page 15 of 36

Page 22

iii. A containment phase that ensures that after an incident has been identified and confirmed, information from the incident handler is effectively shared with all relevant stakeholders, including those external to UniRush;

iv. An eradication phase that ensures that after containment measures have been deployed, UniRush identifies the root cause of an incident and eradicates it; and v. A recovery phase that ensures affected systems or services are restored to the condition specified in the Service Delivery Objectives (SDO) or Business Continuity Plan (BCP). The procedures must require the documentation of the time constraint up to this recovery phase in the Recovery Time Objectives (RTO). b. A disaster recovery plan reasonably designed to ensure it can restore data in the event of a systems failure in a manner that minimizes program or service disruptions likely to have an adverse impact on consumers; c. A contingency plan reasonably designed to ensure that its customer service can respond within a reasonable time to increased consumer call or email volume in the event of a systems failure or program or service disruption that has the potential to have an adverse impact on consumers; and d. Policies and procedures reasonably designed to ensure the dissemination of timely and accurate information, including but not limited to information about account access or balances, to consumers in the event of a systems failure or program or service disruption that has the potential to have an adverse impact on consumers.

2017-CFPB-0010 Document 1 Filed 02/01/2017 Page 16 of 36

Page 23

51.

UniRush must enhance and update, as necessary, its oversight and compliance management systems to promptly identify and correct potential systems errors and violations of Federal consumer financial laws, including any errors or violations committed by Respondent’s Service Providers and/or vendors responsible for customer service. These measures must include: a. Regular monitoring and supervision by UniRush of the service providers, vendors, affiliates, or other agents it engages in connection with its customer service activities, including on-site visits (with or without notice), document collection, interviews of service provider personnel, monitoring of consumer complaints, and oversight of curative actions and/or remediation undertaken by the service providers, vendors, affiliates, or other agents; and b. Establishment or enhancement of policies and procedures to timely investigate, respond to, and correct errors in response to complaints by consumers or violations, as well as identify trends that may indicate errors are systemic or otherwise affect significant numbers of consumers. Systems Audit and Improvements 52.

No more than 60 days after signing an agreement to complete any payment processor conversion, UniRush must retain a qualified, independent third-party professional acceptable to the Enforcement Director with specialized expertise in processor conversions or systems design, architecture, and capacity planning, to conduct an audit of the conversion preparation, implementation, and contingency 2017-CFPB-0010 Document 1 Filed 02/01/2017 Page 17 of 36

Page 24

planning (Audit) using procedures and standards generally accepted in the payment processing industry.

53.

UniRush must provide results of its Audit to the Enforcement Director within 10 days after the report of the Audit is delivered to UniRush, but no later than 120 days prior to any conversion.

54.

Within 60 days of the delivery of the report of UniRush’s Audit identified in Paragraph 52, UniRush must submit to the Enforcement Director for review and non-objection a plan to correct deficiencies identified by the Audit and implement improvements to its systems architecture recommended by the third-party professional identified in Paragraph 52 (Audit Plan). 55.

The Enforcement Director will have the discretion to make a determination of non-objection to the Audit Plan or direct UniRush to revise its Audit Plan. If the Enforcement Director directs UniRush to revise its Audit Plan, UniRush must make the revisions and resubmit the Audit Plan to the Enforcement Director within 30 days of the date of notification of the need for revisions and prior to any conversion.

56.

After receiving notification that the Enforcement Director has made a determination of non-objection to the Audit Plan, UniRush must implement and adhere to the steps, recommendations, deadlines, and timeframes outlined in the Audit Plan.

VII Compliance Plan - Mastercard IT IS FURTHER ORDERED that:

2017-CFPB-0010 Document 1 Filed 02/01/2017 Page 18 of 36

Page 25

57.

Within 60 days of the Effective Date, Mastercard must submit to the Enforcement Director for review and determination of non-objection a comprehensive compliance plan designed to ensure that MPTS’s testing policies and procedures comply with all applicable Federal consumer financial laws and the terms of this Consent Order (MPTS Compliance Plan). The MPTS Compliance Plan must include, at a minimum:

a. Detailed steps for addressing each action required by this Consent Order; and b. Specific timeframes and deadlines for implementation of the steps described above.

58.

The Enforcement Director will have the discretion to make a determination of non-objection to the MPTS Compliance Plan or direct MPTS to revise it. If the Enforcement Director directs Mastercard to revise the MPTS Compliance Plan, Mastercard must make the revisions and resubmit the MPTS Compliance Plan to the Enforcement Director within 45 days.

59.

After receiving notification that the Enforcement Director has made a determination of non-objection to the MPTS Compliance Plan, Mastercard must implement and adhere to the steps, recommendations, deadlines, and timeframes outlined in the MPTS Compliance Plan.

VIII Compliance Plan - UniRush IT IS FURTHER ORDERED that:

60.

Within 60 days of the Effective Date, UniRush must submit to the Enforcement Director for review and determination of non-objection a comprehensive 2017-CFPB-0010 Document 1 Filed 02/01/2017 Page 19 of 36

Page 26

compliance plan designed to ensure that UniRush’s disaster recovery plan, customer service operations, policies and procedures to ensure timely and accurate communication with consumers, compliance management systems, and oversight of Service Providers comply with all applicable Federal consumer financial laws and the terms of this Consent Order (UniRush Compliance Plan). The UniRush Compliance Plan must include, at a minimum: a. Detailed steps for addressing each action required by this Consent Order; and b. Specific timeframes and deadlines for implementation of the steps described above.

61.

The Enforcement Director will have the discretion to make a determination of non-objection to the UniRush Compliance Plan or direct UniRush to revise it. If the Enforcement Director directs UniRush to revise the UniRush Compliance Plan, UniRush must make the revisions and resubmit the UniRush Compliance Plan to the Enforcement Director within 45 days. 62.

After receiving notification that the Enforcement Director has made a determination of non-objection to the UniRush Compliance Plan, UniRush must implement and adhere to the steps, recommendations, deadlines, and timeframes outlined in the UniRush Compliance Plan.

IX Role of the Board IT IS FURTHER ORDERED that:

63.

The Board, or relevant Committee thereof, of each Respondent must review all submissions (including plans, reports, programs, policies, and procedures) 2017-CFPB-0010 Document 1 Filed 02/01/2017 Page 20 of 36

Page 27

required by this Consent Order from its respective entity prior to submission to the Bureau.

64.

Although this Consent Order requires each Respondent to submit certain documents for the review or non-objection by the Enforcement Director, the Board of each Respondent will have the ultimate responsibility for proper and sound management of its respective entity and for ensuring that the entity complies with Federal consumer financial law and this Consent Order. 65.

In each instance that this Consent Order requires the Board of each Respondent to ensure adherence to, or perform, certain obligations of Respondent the Board must:

a. Authorize whatever actions are necessary for Respondent to fully comply with the Consent Order;

b. Require timely reporting by management to the Board on the status of compliance obligations; and c. Require timely and appropriate corrective action to remedy any material non-compliance with any failures to comply with Board directives related to this Section.

X Order to Pay Redress

IT IS FURTHER ORDERED that:

66.

Within 10 days of the Effective Date, Respondents must reserve or deposit into segregated deposit accounts $10 million, for the purpose of providing redress to Affected Consumers as required by this Section. Respondents are jointly and 2017-CFPB-0010 Document 1 Filed 02/01/2017 Page 21 of 36

Page 28

severally liable for this obligation. Respondents may set forth each party’s allocable share in the Allocation Agreement, but such agreement shall not be binding on the Bureau. Within 60 days of the Effective Date, UniRush, after consultation with Mastercard, must submit to the Enforcement Director for review and non-objection a comprehensive written plan for providing redress consistent with this Consent Order (“Redress Plan”). The Enforcement Director will have the discretion to make a determination of non-objection to the Redress Plan or direct UniRush to revise it. If the Enforcement Director directs UniRush to revise the Redress Plan, UniRush, after consultation with Mastercard, must make the revisions and resubmit the Redress Plan to the Enforcement Director within 15 days. After receiving notification that the Enforcement Director has made a determination of non-objection to the Redress Plan, UniRush must implement and adhere to the steps, recommendations, deadlines, and timeframes outlined in the Redress Plan.

67.

The Redress Plan must apply to all Affected Consumers and: a. Specify how UniRush will identify all Affected Consumers; b. Provide processes for providing redress covering all Affected Consumers; c. Include a description of the following:

i. Methods used to compile a list of Affected Consumers; ii. Methods used to calculate the amount of redress to be paid to each Affected Consumer;

iii. Procedures for issuance and tracking of redress to Affected Consumers; and iv. Procedures for monitoring compliance with the Redress Plan. 2017-CFPB-0010 Document 1 Filed 02/01/2017 Page 22 of 36

Page 29

68.

The Redress Plan must, at a minimum, require Respondents to provide: a. $25 to each Affected Consumer who experienced a denied transaction during the extended blackout period on October 12, 2015; b. $150 to each Affected Consumer whose card was placed in a possible fraud status that prevented the Affected Consumer from transacting or accessing account funds as a result of an improper configuration on the MPTS payment processing platform;

c. $100 to each Affected Consumer who received balance information in October 2015 incorrectly indicating that there were no funds in the Affected Consumer’s account;

d. $100 to each Affected Consumer whose ACH deposits were not processed in the week after the payment processor conversion according to UniRush’s representation that RushCard users would receive direct deposit of their paychecks or government benefits “up to two days sooner” than their official pay date;

e. $250 to each Affected Consumer whose ACH deposit was returned to the funding source, improperly loaded onto an expired or inactive card, or was unable to be successfully processed by UniRush in October 2015; f. $150 to each Affected Consumer that UniRush offset due to a negative account balance incurred because of rescission of a duplicate ACH deposit or delayed processing of an ACH debit transaction; g. $150 to each Affected Consumer who could not transact or access account funds because the account was not transferred onto the MPTS payment 2017-CFPB-0010 Document 1 Filed 02/01/2017 Page 23 of 36

Page 30

processing platform or improperly transferred to the MPTS payment processing platform in a status that would not allow the card to function; h. $150 to each Affected Consumer who could not transact or access account funds because a lost or stolen card was not promptly replaced or the replacement card did not function after the payment processor conversion; i. $150 to each Affected Consumer who initiated a cash load that was not promptly posted to the account following the October 12, 2015, payment processing conversion; and j. $50 to each Affected Consumer whose card-to-card transfer(s) were not processed immediately following the October 12, 2015, payment processing conversion.

69.

The Redress Plan must describe the process for providing restitution for Affected Consumers, and must include the following requirements: a. For Affected Consumers with Active RushCard Accounts as of the date the Redress Plan is implemented, credit must be applied to the account of each Affected Consumer and a Restitution Notification Letter must be mailed or sent via electronic communication to each Affected Consumer; b. For Affected Consumers who do not have Active RushCard Accounts as of the date the Redress Plan is implemented, a certified or bank check must be mailed to each Affected Consumer along with a Restitution Notification Letter;

c. The certified or bank check must be sent via United States Postal Service first-class mail, address correction service requested, to the Affected Consumer’s last known address as maintained by UniRush’s records; 2017-CFPB-0010 Document 1 Filed 02/01/2017 Page 24 of 36

Page 31

d. Reasonable attempts must be made to obtain a current address for any Affected Consumer whose Redress Notification Letter and/or restitution check is returned for any reason, using the National Change of Address System, and must promptly re-mail all returned Restitution Notification Letters and/or restitution checks to current addresses, if any; and e. Processes for handling any unclaimed funds must be established. 70.

With respect to redress paid to Affected Consumers, the Redress Plan must include:

a. The form of the letter (“Redress Notification Letter”) to be sent notifying Affected Consumers of the redress. The letter must include language explaining the manner in which the amount of redress was calculated and a statement that the provision of the refund payment is in accordance with the terms of this Consent Order; and b. The form of the envelope that will contain the Redress Notification Letter. 71.

The envelope containing a “Redress Notification Letter” must not include any materials other than the approved letters and redress checks, unless UniRush has obtained written confirmation from the Enforcement Director that the Bureau does not object to the inclusion of such additional materials. 72.

Within 90 days of completing implementation of the Redress Plan, UniRush must submit a Redress Plan report to the Enforcement Director, which must include a review and assessment from an independent auditor agreed upon by the Respondents on UniRush’s compliance with the terms of the Redress Plan, including:

2017-CFPB-0010 Document 1 Filed 02/01/2017 Page 25 of 36

Page 32

a. The methodology used to determine the population of Affected Consumers; b. The restitution amount for each Affected Consumer; c. The total number of Affected Consumers;

d. The procedures used to issue and track redress payments; e. The amount, status, and planned disposition of all unclaimed redress payments; and f. The work of independent consultants that have been used, if any, to assist and review its execution of the Redress Plan.

73.

Respondents must provide all relief to consumers required by this Consent Order, regardless of whether the total of such relief exceeds the amount reserved or deposited into a segregated account under this Section. If the amount of such relief exceeds the amounts required in the segregated accounts, Respondents are jointly and severally liable for such excess. Respondents may set forth each party’s allocable share in the Allocation Agreement, but such agreement shall not be binding on the Bureau.

74.

After completing the Redress Plan, if the amount of redress provided to Affected Consumers is less than $10 million, within 30 days of the completion of the Redress Plan, Respondents must pay to the Bureau, by wire transfer to the Bureau or to the Bureau’s agent, and according to the Bureau’s wiring instructions, the difference between the amount of redress provided to Affected Consumers and $10 million. Respondents’ obligation to make this payment to the Bureau is joint and several. The Bureau may use these remaining funds to pay additional redress to Affected Consumers. If the Bureau determines, in its sole discretion, that additional redress is wholly or partially impracticable or otherwise inappropriate, 2017-CFPB-0010 Document 1 Filed 02/01/2017 Page 26 of 36

Page 33

or if funds remain after the additional redress is completed, the Bureau will deposit any remaining funds in the U.S. Treasury as disgorgement. A Respondent will have no right to challenge any actions that the Bureau or its representatives may take under this Section.

75.

Respondents may not condition the payment of any redress to any Affected Consumer under this Consent Order on that Affected Consumer waiving any right. XI Order to Pay Civil Money Penalties IT IS FURTHER ORDERED that:

76.

Under section 1055(c) of the CFPA, 12 U.S.C. § 5565(c), by reason of the violations of law described in Section V of this Consent Order, and taking into account the factors in 12 U.S.C. § 5565(c)(3), Respondents must pay a civil money penalty of $3 million to the Bureau. Respondents are jointly and severally liable for this obligation. Respondents may set forth each party’s allocable share in the Allocation Agreement, but such agreement shall not be binding on the Bureau. 77.

Within 10 days of the Effective Date, Respondents must pay the civil money penalty by wire transfer to the Bureau or to the Bureau’s agent in compliance with the Bureau’s wiring instructions.

78.

The civil money penalties paid under this Consent Order will be deposited in the Civil Penalty Fund of the Bureau as required by section 1017(d) of the CFPA, 12 U.S.C. § 5497(d).

79.

Respondents must treat the civil money penalties paid under this Consent Order as a penalty paid to the government for all purposes. Regardless of how the Bureau ultimately uses those funds, Respondents may not: 2017-CFPB-0010 Document 1 Filed 02/01/2017 Page 27 of 36

Page 34

Claim, assert, or apply for a tax deduction, tax credit, or any other tax benefit for any civil money penalty paid under this Consent Order; or b.

Seek or accept, directly or indirectly, reimbursement or indemnification from any source, including but not limited to payment made under any insurance policy, with regard to any civil money penalty paid under this Consent Order.

80.

To preserve the deterrent effect of the civil money penalty in any Related Consumer Action, Respondents may not argue that they are entitled to, nor may they benefit by, any offset or reduction of any compensatory monetary remedies imposed in the Related Consumer Action because of the civil money penalties paid in this action (Penalty Offset). If the court in any Related Consumer Action grants such a Penalty Offset, Respondents must, within 30 days after entry of a final order granting the Penalty Offset, notify the Bureau, and pay the amount of the Penalty Offset to the U.S. Treasury. Such a payment will not be considered an additional civil money penalty and will not change the amount of the civil money penalty imposed in this action.

XII Additional Monetary Provisions IT IS FURTHER ORDERED that:

81.

In the event of any default on Respondents’ obligations to make payments under this Consent Order, interest, computed under 28 U.S.C. § 1961, as amended, will accrue on any outstanding amounts not paid from the date of default to the date of payment, and will immediately become due and payable. 2017-CFPB-0010 Document 1 Filed 02/01/2017 Page 28 of 36

Page 35

82.

Respondents must relinquish all dominion, control, and title to the funds paid to the fullest extent permitted by law and no part of the funds may be returned to Respondents.

83.

Under 31 U.S.C. § 7701, each Respondent, unless it already has done so, must furnish to the Bureau its respective taxpayer identifying number, which may be used for purposes of collecting and reporting on any delinquent amount arising out of this Consent Order.

84.

Within 30 days of the entry of a final judgment, consent order, or settlement in a Related Consumer Action, any Respondent to the Consent Order that was party to the Related Consumer Action must notify the Enforcement Director of the final judgment, consent order, or settlement in writing. That notification must indicate the amount of redress, if any, that Respondent paid or is required to pay to consumers and describe the consumers or classes of consumers to whom that redress has been or will be paid.

XIII Reporting Requirements

IT IS FURTHER ORDERED that:

85.

Respondents to the Consent Order must notify the Bureau of any development that may affect their respective compliance obligations arising under this Consent Order, including but not limited to, a dissolution, assignment, sale, merger, or other action that would result in the emergence of a successor company; the creation or dissolution of a subsidiary, parent, or affiliate that engages in any acts or practices subject to this Consent Order; the filing of any bankruptcy or 2017-CFPB-0010 Document 1 Filed 02/01/2017 Page 29 of 36

Page 36

insolvency proceeding by or against Respondent; or a change in the Respondent’s name or address. The Respondent must provide this notice, if practicable, at least 30 days before the development, but in any case no later than 14 days after the development.

86.

Within 120 days of the Effective Date, and again one year after the Effective Date, each Respondent must submit to the Enforcement Director an accurate written compliance progress report (Compliance Report) that has been approved by the each Respondent’s respective Board, which, at a minimum: a.

Describes in detail the manner and form in which Respondent has complied with this Consent Order; and b.

Attaches a copy of each Order Acknowledgment obtained under Section XIV, unless previously submitted to the Bureau.

XIV Order Distribution and Acknowledgment

IT IS FURTHER ORDERED that:

87.

Within 60 days of the Effective Date, each Respondent must deliver a copy of this Consent Order to each of its board members and executive officers, as well as to any managers, employees, service providers, or other agents and representatives who have responsibilities related to the subject matter of the Consent Order. 88.

For 5 years from the Effective Date, each Respondent must deliver a copy of this Consent Order to any business entity resulting from any change in structure referred to in Section XIII, any future board members and executive officers, as well as to any managers, employees, service providers, or other agents and 2017-CFPB-0010 Document 1 Filed 02/01/2017 Page 30 of 36

Page 37

representatives who will have responsibilities related to the subject matter of the Consent Order before they assume their responsibilities. 89.

Each Respondent must secure a signed and dated statement acknowledging receipt of a copy of this Consent Order, ensuring that any electronic signatures comply with the requirements of the E-Sign Act, 15 U.S.C. § 7001 et seq., within 30 days of delivery, from all persons receiving a copy of this Consent Order under this Section.

XV Recordkeeping IT IS FURTHER ORDERED that:

90.

Each Respondent must create, or if already created, must retain for at least 5 years from the Effective Date, the following business records: a.

All documents and records necessary to demonstrate full compliance with each provision of this Consent Order, including all submissions to the Bureau; and b.

All documents and records pertaining to the Redress Plan, described in Section X above.

91.

Each Respondent must retain the documents identified in Paragraph 90 for the duration of the Consent Order.

92.

Each Respondent must make the documents identified in Paragraph 90 available to the Bureau upon the Bureau’s request.

XVI Notices 2017-CFPB-0010 Document 1 Filed 02/01/2017 Page 31 of 36

Page 38

IT IS FURTHER ORDERED that:

93. Unless otherwise directed in writing by the Bureau, each Respondent must provide all submissions, requests, communications, or other documents relating to this Consent Order in writing, with the subject line, “In re UniRush LLC and MasterCard International Incorporated, File No. 2017-CFPB-0010,” and send them as described in subparagraphs (a) or (b). Each Respondent shall provide to the other Respondent a copy of any notice such Respondent provides to the Bureau and the Bureau shall provide a copy of a notice to a Respondent to the other Respondent.

a. By overnight courier (not the U.S. Postal Service), as follows: Assistant Director for Enforcement Consumer Financial Protection Bureau ATTENTION: Office of Enforcement 1625 Eye Street, N.W.

Washington D.C. 20006; or b. By first-class mail to the below address and contemporaneously by email to [email protected] and any other email address as directed in writing by the Bureau:

Assistant Director for Enforcement Consumer Financial Protection Bureau ATTENTION: Office of Enforcement 1625 Eye Street, N.W.

Washington D.C. 20006 XVII Cooperation with the Bureau IT IS FURTHER ORDERED that:

2017-CFPB-0010 Document 1 Filed 02/01/2017 Page 32 of 36

Page 39

94.

Each Respondent must cooperate fully with the Bureau in this matter and in any investigation related to or associated with the conduct described in Section V. Each Respondent must provide truthful and complete information, evidence, and testimony. Each Respondent must cause its officers, employees, representatives, or agents to appear for interviews, discovery, hearings, trials, and any other proceedings that the Bureau may reasonably request upon 5 days written notice, or other reasonable notice, at such places and times as the Bureau may designate, without the service of compulsory process.

XVIII Compliance Monitoring IT IS FURTHER ORDERED that, to monitor Respondents’ compliance with this Consent Order:

95.

Within 30 days of receipt of a written request from the Bureau, each Respondent must submit additional Compliance Reports or other requested information, which must be made under penalty of perjury; provide sworn testimony; or produce documents.

96.

For purposes of this Section, the Bureau may communicate directly with Respondents, unless Respondents retain counsel related to these communications.

97.

Respondents must permit Bureau representatives to interview any employee or other person affiliated with Respondents who has agreed to such an interview. The person interviewed may have counsel present.

98.

Nothing in this Consent Order will limit the Bureau’s lawful use of civil investigative demands under 12 C.F.R. § 1080.6 or other compulsory process. 2017-CFPB-0010 Document 1 Filed 02/01/2017 Page 33 of 36

Page 40

99.

For the duration of the Consent Order in whole or in part, Respondents agree to be subject to the Bureau’s supervisory authority under 12 U.S.C. § 5514. Consistent with 12 C.F.R. § 1091.111, Respondents may not petition for termination of supervision under 12 C.F.R. § 1091.113.

XIX Modifications to Non-Material Requirements

IT IS FURTHER ORDERED that:

100.

Any Respondent may seek a modification to non-material requirements of this Consent Order (e.g., reasonable extensions of time and changes to reporting requirements) by submitting a written request to the Enforcement Director. 101.

The Enforcement Director may, in his/her discretion, modify any non-material requirements of this Consent Order (e.g., reasonable extensions of time and changes to reporting requirements) if he/she determines good cause justifies the modification. Any such modification by the Enforcement Director must be in writing.

XX Administrative Provisions

102.

The provisions of this Consent Order do not bar, estop, or otherwise prevent the Bureau, or any other governmental agency, from taking any other action against Respondents, except as described in Paragraph 103. 103.

The Bureau releases and discharges Respondents from all potential liability for law violations that the Bureau has or might have asserted based on the practices described in Section V of this Consent Order, to the extent such practices occurred 2017-CFPB-0010 Document 1 Filed 02/01/2017 Page 34 of 36

Page 41

before the Effective Date and the Bureau knows about them as of the Effective Date. The Bureau may use the practices described in this Consent Order in future enforcement actions against Respondents and their affiliates, including, without limitation, to establish a pattern or practice of violations or the continuation of a pattern or practice of violations or to calculate the amount of any penalty. This release does not preclude or affect any right of the Bureau to determine and ensure compliance with the Consent Order, or to seek penalties for any violations of the Consent Order.

104.

This Consent Order is intended to be, and will be construed as, a final Consent Order issued under section 1053 of the CFPA, 12 U.S.C. § 5563, and expressly does not form, and may not be construed to form, a contract binding the Bureau or the United States.

105.

This Consent Order will terminate 5 years from the Effective Date or 5 years from the most recent date that the Bureau initiates an action alleging any violation of the Consent Order by any Respondent. If such action is dismissed or the relevant adjudicative body rules that any Respondent did not violate any provision of the Consent Order, and the dismissal or ruling is either not appealed or upheld on appeal, then the Consent Order will terminate as though the action had never been filed. The Consent Order will remain effective and enforceable until such time, except to the extent that any provisions of this Consent Order have been amended, suspended, waived, or terminated in writing by the Bureau or its designated agent. 106.

Calculation of time limitations will run from the Effective Date and be based on calendar days, unless otherwise noted.

2017-CFPB-0010 Document 1 Filed 02/01/2017 Page 35 of 36

Page 42

107.

108.

109.

110.

2017-CFPB-0010 Document’ Filed 02/01/2017 Page 36 of 36

Should any Respondent seek to transfer or assign all or part of its operations that are subject to this Consent Order, that Respondent must, as a condition of sale, obtain the written agreement of the transferee or assignee to comply with all applicable provisions of this Consent Order.

The provisions of this Consent Order will be enforceable by the Bureau. For any violation of this Consent Order, the Bureau may impose the maximum amount of civil money penalties allowed under section 1055(c) of the CFPA, 12 U.S.C. § 5565(c). In connection with any attempt by the Bureau to enforce this Consent Order in federal district court, the Bureau may serve Respondents wherever Respondents may be found and Respondents may not contest that court's personal jurisdiction over Respondents.

This Consent Order and the accompanying Stipulation contain the complete agreement between the parties. The parties have made no promises, representations, or warranties other than what is contained in this Consent Order and the accompanying Stipulation. This Consent Order and the accompanying Stipulation supersede any prior oral or written communications, discussions, or understandings.

Nothing in this Consent Order or the accompanying Stipulation may be construed as allowing the Respondents, their Boards, officers, or employees to violate any

law, rule, or regulation.

IT IS SO ORDERED, this 3/fay of Tamuary, 2017.

erbah) Covey

Richard Cordray Director Consumer = Protection Bureau

Stipulation (Feb. 2017)

PDF of this document (5 pages)

Page 43

UNITED STATES OF AMERICA CONSUMER FINANCIAL PROTECTION BUREAU File No. 2017-CFPB-0010 In the matter of:

UniRush LLC and Mastercard International Incorporated STIPULATION AND CONSENT TO THE ISSUANCE OF A CONSENT ORDER The Consumer Financial Protection Bureau (Bureau) intends to initiate an administrative proceeding against UniRush LLC (Respondent), under 12 U.S.C. §§ 5563 and 5565, for its activities related to the conversion of the RushCard prepaid card program onto the payment processing platform of the Mastercard Payment Transaction Services division of Mastercard International Incorporated (MPTS) and its administration of Rush Card accounts in violation of the Consumer Financial Protection Act of 2010's (CFP A) prohibition on unfair, deceptive, or abusive acts or practices, 12 u.s.c. §§ 5531, 5536.

2017-CFPB-0010 Document 3 Filed 02/01/2017 Page 1 of 5

Page 44

2017-CFPB-0010 Document3 Filed 02/01/2017 Page 2of5

In consideration of the above premises, Respondent agrees to the following:

Jurisdiction The Bureau has jurisdiction over this matter under sections 1053 and 1055 of the

Consumer Financial Protection Act of 2010 (CFPA), 12 U.S.C. §§ 5563, 5565.

Consent

. Respondent voluntarily enters into this Stipulation and Consent to the Issuance of a Consent Order.

the facts underlying this action or immunity from any such liability.

Page 45

2017-CFPB-0010 Document3_ Filed 02/01/2017 Page 3of5

7. The terms and provisions of this Stipulation and the Consent Order will be binding upon, and inure to the benefit of, the parties hereto and their successors in interest.

8. Respondent agrees that the Bureau may present the Consent Order to the Bureau

Director for signature and entry without further notice.

Waivers 9. Respondent, by consenting to this Stipulation, waives:

a. Any right to service of the Consent Order, and agrees that issuance of the Consent Order will constitute notice to the Respondent of its terms and conditions;

b. Any objection to the jurisdiction of the Bureau, including, without limitation, under section 1053 of the CFPA, 12 U.S.C. § 5563;

c. The rights to all hearings under the statutory provisions under which the proceeding is to be or has been instituted; the filing of proposed findings of fact and conclusions of law; proceedings before, and a reeommended decision by, a hearing officer; all post-hearing procedures; and any other procedural right available under section 1053 of the CFPA, 12 U.S.C. §

5563, or 12 CFR Part 1081;

Page 46

2017-CFPB-0010 Document3_ Filed 02/01/2017 Page4of5

. The right to seek any administrative or judicial review of the Consent Order;

. Any claim for fees, costs or expenses against the Bureau, or any of its agents or employees, and any other governmental entity, related in any way to this enforcement matter or the Consent Order, whether arising under common law or under the terms of any statute, including, but not limited to the Equal Access to Justice Act and the Small Business Regulatory Enforcement Fairness Act of 1996; for these purposes, Respondent agrees that Respondent is not the prevailing party in this action because the parties have reached a good faith settlement;

Any other right to challenge or contest the validity of the Consent Order;

. Such provisions of the Bureau’s rules or other requirements of law as may be construed to prevent any Bureau employee from participating in the preparation of, or advising the Director as to, any order, opinion, finding of fact, or conclusion of law to be entered in connection with this Stipulation or the Consent Order; and

. Any right to claim bias or prejudgment by the Director based on the consideration of or discussions concerning settlement of all or any part of

the proceeding.

Page 47

2017-CFPB-0010 Document 3

UniRush LLC BY:

‘20> i Ws

Ron Hynes C.

Chief Executive Offices, UniRush LLC

Filed 02/01/2017

Page 5 of 5