Digital payments company Block agreed to pay $255 million to federal and state regulators for deficiencies in its oversight of its peer-to-peer payments tool Cash App and to compensate users who became victims of fraud.
Specifically, the company agreed to pay the Consumer Financial Protection Bureau a $55 million penalty and to compensate victims with up to $120 million, according to a press release from the federal agency Thursday.
“Block employed weak security protocols for Cash App and put its users at risk,” the CFPB said in its release. “While Block is required by law to investigate and resolve disputes about unauthorized transactions, the company’s investigations were woefully incomplete.”
Block allegedly directed consumers that suffered financial losses to their banks for redress, but when the banks went back to the company for compensation, it would deny the requests, the CFPB said. The company also employed other tactics to block consumers’ efforts, like “tricking” them with its terms and undertaking “shoddy” investigations, the agency alleged. Block saved money in the process, the agency said.
“Cash App created the conditions for fraud to proliferate on its popular payment platform,” CFPB Director Rohit Chopra said in the release. “When things went wrong, Cash App flouted its responsibilities and even burdened local banks with problems that the company caused.”
The company also agreed to pay an $80 million fine imposed by states that alleged its money transfer service Cash App violated banking laws, according to the Conference of State Bank Supervisors.
The January 15 settlement between Block and 48 states also requires the company to take corrective actions, including hiring a consultant to review “the comprehensiveness and effectiveness” of its programs to comply with the Bank Secrecy Act and related anti-money laundering laws, the state association of regulators said in Wednesday press release.
Those laws are meant to deter the movement of money for illicit activities and the financing of terrorism.
“Financial services firms are required to perform due diligence on customers, including verifying customer identities, reporting suspicious activity, and applying appropriate controls for high-risk accounts,” the conference release said. “State regulators found Block was not in compliance with certain requirements, creating the potential that its services could be used to support money laundering, terrorism financing, or other illegal activities.”
The states, led by Texas, California and Florida, among others, alleged in a joint November 2023 report that Block’s Cash App practices violated those laws and/or had deficiencies under the laws. Those shortcomings were with respect to its own workforce practices and its oversight of outside vendors, according to the settlement. As part of the agreement, Block neither admitted or denied wrongdoing.
"While we strongly disagree with the CFPB’s mischaracterizations, we made the decision to settle this matter in the interest of putting it behind us and focusing on what’s best for our customers and our business," the company said in a Thursday press release.
Still, the company acknowledged that it has changed its “past” approach to compliance in an emailed statement Thursday from a spokesperson for Block. “As Cash App has grown, we’ve significantly increased our investment in compliance and risk management, while serving millions of customers with critical, affordable financial services,” the statement said.
“We share our regulators’ commitment to addressing industry challenges and will continue to invest across our operations to help promote a safe and healthy fintech ecosystem,” the statement said. The company’s release also noted measures Block has taken to improve customer service and compliance, including use of artificial intelligence to spot "bad activity" and account takeovers as well as a customer warning mechanism.
Some 56 million people use the Cash App tool to send, store, spend and invest money, according to the release, which also noted that Block earned $7.5 billion in profits in 2023, including $4 billion from Cash App.
Indeed, the Oakland, California-based company also said last month that it had tallied some 24 million instances of consumers spending via its Cash App debit card in September.
Block, led by Jack Dorsey, also operates the point-of-sale payments technology company Square and buy now, pay later operator Afterpay.
The state regulators form a nationwide network that polices money transmitters by licensing and supervising them and their transmission activity across some 700 transmitters. They do so under the Money Transmission Modernization Act standard (27 states have passed laws based on the standard).
"As mobile payment services have become more popular, state regulators must act to protect consumers in these new environments,” Michigan Department of Insurance and Financial Services Director Anita Fox said in a Wednesday release. “DIFS is committed to working with state regulators nationwide to ensure that all financial systems are safe, sound, and entitled to the public trust.”
Other federal regulators had also been contemplating action against the company last year, according to a lawyer representing whistleblowers who filed complaints against Block with the Financial Crimes Enforcement Network, an agency in the U.S. Treasury Department, as well as with the Securities and Exchange Commission and the Commodity Futures Trading Commission. The whistleblowers alleged that Cash App’s user identity verification methods aren’t sufficient to prevent fraudulent activity, according to an NBC News report last year.
The CFPB pointed to similar Cash App problems that allegedly allowed for crime. “Block also deprived Cash App users of meaningful and effective customer service and left the network vulnerable to criminals defrauding users,” the CFPB said in its release.
The Block spokesperson didn’t immediately respond to a request for comment on the reported federal probe.
