U.S. Bank on Thursday agreed to pay a $37.5 million fine and to return fees charged to customers related to the bank’s alleged opening of accounts and access of credit reports without their permission.

The Consumer Financial Protection Bureau (CFPB) handed down the discipline, stating the bank’s alleged practices from 2015-21 violated the Fair Credit Reporting Act, the Consumer Financial Protection Act, the Truth in Lending Act, and the Truth in Savings Act.

The CFPB accused U.S. Bank of promoting sales goals, sales campaigns, and financial incentives that led bank employees to open accounts without permission. It added the bank had inadequate policies and procedures to prevent and detect these accounts.

Most of the alleged violations occurred in 2015 and 2016, the CFPB said. In 2016, the bank enhanced its processes for account openings, particularly for what constituted consumer consent, as well as for detecting and investigating sales misconduct. The number of accounts opened without authorization “trended downward” after the enhancements were implemented, the agency said in its order.

The bank agreed to the consent order without admitting or denying wrongdoing.

Other banks have been embroiled in similar fake account scandals, most notably Wells Fargo, which agreed to pay a $3 billion fine in 2020 regarding its misconduct. Wells Fargo also paid a $100 million fine to the CFPB in 2016.

Another bank alleged by the CFPB to have opened unauthorized accounts is Fifth Third Bank, in a case that has not yet been settled.

As part of its agreement with the CFPB, U.S. Bank must devote sufficient personnel and resources to prevent and detect improper sales acts or practices; appropriately handle complaints by customers and bank employees about sales pressure and improper sales tactics; track and address those complaints; provide employee training on what constitutes improper sales tactics; and maintain policies and procedures “to collect and retain evidence demonstrating that a consumer has authorized the issuance or opening of a consumer financial product or service.”

The bank must submit a comprehensive compliance plan to the CFPB within 30 days of the order, which must include detailed steps for addressing the order, a mechanism for ensuring the board is apprised of the status of compliance actions, and specific timelines for implementation.

The compliance plan must include “policies and procedures to identify, manage, mitigate, and report risks and misconduct associated with sales-related behaviors” and implement a sales practices oversight policy and program.

U.S. Bank response: The bank released a statement regarding the decision, noting since 2016 it has “made process and oversight improvements that have been effective in addressing these sales practices concerns.”

“The settlement related to legacy sales practices involving a small percentage of accounts dating back to 2010,” the statement said. “The action by the CFPB closes out a 5-plus year investigation. We are pleased to put this matter behind us.”