What is customer remediation in banking? From issue to close-out

Customer remediation in banking is the program a bank runs after it discovers that it harmed customers, most often by charging a fee it should not have charged: it identifies every affected customer, current and former, calculates what each is owed (usually with interest), pays them, and proves to its regulator and its internal auditors that the population was complete, the arithmetic right and the money delivered. The hard part is rarely the refund itself. It is finding people whose history sits in an old system, paying people who have closed their accounts, moved or died, and showing years later that nobody was missed. Botminds' Customer Remediation runs the whole program with agents that build the population twice, compute, draft letters and follow every dollar, while named people approve each step.

Regulators count remediation in money, and the sums are large. The FDIC alone reports that “a total of approximately $1.2 billion in restitution was ordered by the FDIC in 2025” under its formal orders, and that other banks it supervises paid voluntary restitution to 47,902 consumers (FDIC Consumer Compliance Supervisory Highlights, March 2026). The figures below set that against the CFPB's overdraft work and Australia's remediation record.

What is customer remediation in banking, in one sentence?

It is putting customers back where they would have been if the bank had not made the mistake, and being able to prove it. Australia's securities regulator, which has written the most detailed public guide to the work, defines a remediation as “a process, large or small, to investigate the scope of the misconduct or other failure and, if appropriate, return consumers who have suffered loss as a result of the misconduct or other failure to the position they would have otherwise been in, as closely as possible” (ASIC Regulatory Guide 277). US agencies do not use a single definition, but they ask the same three things of every program, in the words of the CFPB's responsible-conduct bulletin: “Did the entity conduct an analysis to determine the number of affected consumers and the extent to which they were harmed? Were consumers made whole through compensation and other appropriate relief, as applicable? Did affected consumers receive appropriate information related to the violations within a reasonable period of time?” (CFPB Bulletin 2020-01).

Those three questions are the whole job: a population, a payment and a communication, each with evidence behind it. Everything else a remediation team does, from the rate memo to the unclaimed property report, exists to answer one of them.

What is the difference between remediation and redress?

Redress is the money or relief a customer receives; remediation is the whole program that produces it, including fixing the cause. The words also track who is asking. CFPB orders speak of “redress” and require a redress plan. The FDIC and OCC speak of “restitution”: the FDIC's examination manual describes an “Order for Restitution: Section 8(b)(6): Issued to require an institution or IAP to disgorge any unjust enrichment to consumers and/or take other affirmative action to redress consumer harm” (FDIC Consumer Compliance Examination Manual II-9). Inside banks, “remediation” usually means the program and “refund” or “remediation payment” the money.

One more distinction saves confusion in a job search or a budget meeting. Many banks also run “KYC remediation”, which brings old customer due-diligence files up to the current standard. It shares the word and nothing else: no customer is owed money. What KYC remediation is is a separate discipline with its own guide.

What triggers a customer remediation?

A remediation starts the day the bank knows customers were harmed, whoever found it. The commonest triggers are a pattern in complaints, a compliance test or audit finding, a system change that did not do what the fee schedule said, an examiner's finding, or an enforcement order. The trigger matters less than the response: the same CFPB bulletin asks “What steps did the entity take upon learning of the violation? Did it immediately stop the violation?” before it asks anything about money.

Supervisory findings are the trigger that produced the most refunds of the last few years. When CFPB examiners found banks charging overdraft fees on debit card transactions authorized against a positive balance, they told the banks to stop the fees, look back over past postings and refund every customer charged (CFPB Supervisory Highlights, Issue 29; what those refunds cost is worked through inbank overdraft fee refunds). The typical bank-made trigger looks more like the sample program used throughout these guides: a $5.00 fee removed from the schedule on March 1, 2025 that the core system kept charging until June 12, 2026.

The six stages from issue to close-out

Every remediation, large or small, runs through the same six stages, and each ends with a decision someone signs. The order matters: a bank that pays before the population is settled pays twice, and a bank that closes before the last check has a final state reports a program as complete when it is not.

The middle of the chain is where programs break. A single query against today's core misses accounts that closed before a conversion; a spreadsheet with a hand-edited rate cannot be re-run when the auditor asks; a check printed is counted as a customer paid. Why two population builds must agree works through the population stage, the one most often found incomplete.

What is a lookback in remediation, and how far back does it go?

The lookback is the period of conduct the remediation covers: from the first day the harm occurred to the day it stopped. In principle it runs as far back as the harm does. In practice it is bounded by what the records still show and, under an order, by the window the regulator sets. CFPB examiners reported that banks' finalized plans for the overdraft fees above reached back to 2018 or 2019 and ran to the day each bank stopped charging them.

Shortening a lookback to save effort is the move regulators notice first. ASIC tells firms to start from the date the failure first caused loss, and warns that a review period stretching past seven years “may indicate a systemic underinvestment in systems to deliver products and identify misconduct or other failures as they arise” (RG 277). Where records have gone, the honest answer is an assumption that favours the customer, documented and approved, not a shorter period.

Does remediation include former customers?

Yes. Customers who closed their accounts were charged the same fee and are owed the same refund; the only difference is that the bank cannot credit them and has to find them. ASIC's guide is explicit that payments “should be made regardless of value and regardless of whether the consumer is a current or former customer”, and US orders name former customers in the definition of who is affected.

Former customers are also where populations break, because their history often lives in an archive rather than the live core. In the fictional sample program, a build from today's fee postings found 61,230 affected accounts; a second build that replayed every transaction in the core and the legacy archive found 62,414. The 1,184 difference were all accounts closed before the core conversion. How banks pay customers who already left covers addresses, estates, joint owners and charged-off balances.

Who regulates bank remediation, and what has changed since 2025?

The bank's own prudential and consumer regulators do: the CFPB for banks and credit unions over $10 billion in assets, the OCC for national banks, the FDIC for state non-member banks, the Federal Reserve for state member banks, the NCUA for credit unions, and state regulators alongside them. All of them rate remediation as part of the compliance management system. The interagency rating system says that “appropriate corrective action, including both correction of programmatic weaknesses and full redress for injured parties, limits consumer harm and prevents violations from recurring in the future” (FFIEC, 81 FR 79473).

Three things changed in 2025. On May 12, 2025 the CFPB withdrew 67 guidance documents (90 FR 20084); Bulletin 2020-01, the responsible-conduct bulletin quoted above, is not on the list, and no later notice withdraws it. The CFPB also terminated several consent orders early: the 2022 Regions Bank overdraft order, which required at least $141 million in redress, was terminated on July 21, 2025, with the Bureau recording that Regions had issued payments under its redress plan (CFPB enforcement action page). And the CFPB's current priorities, last updated May 28, 2026, put remediation first: “The focus should be on conciliation, correction, and remediation of harms subject to consumers’ complaints”, getting money “back directly to consumers” rather than filling the penalty fund (CFPB Supervision and Enforcement Priorities). Fewer penalties has not meant fewer refunds.

The CFPB has turned away from penalties; it has not turned away from refunds. The test is the same as it was: was every affected customer found, paid and told?

What is self-identified remediation, and what is it worth?

A self-identified remediation is one the bank finds, stops and pays before a regulator tells it to, and every US agency gives it credit. The CFPB's bulletin says such conduct could lead the Bureau “to close an enforcement investigation with no action or decide not to include Matters Requiring Attention in an exam report or supervisory letter”. The rating system allows a 1 or 2 rating “when violations involve limited impact on consumers, were self-identified, and resolved promptly”. The OCC's civil money penalty matrix treats a practice as self-identified “when the bank discovers the deficiency or conduct without prompting from a regulatory or law enforcement agency and alerts the OCC to the existence of the conduct or deficiency in a timely manner” (OCC PPM 5000-7).

The credit depends on the quality of the remediation, not its existence. A program that misses former customers, or cannot show how each amount was calculated, turns a self-identified issue into a second finding, and the second one is not self-identified.

How long does a remediation take?

Months when the bank finds the issue itself and its data is clean; years when it is not. ASIC's 2018 review of significant breaches found that “on average, it takes over 5 years from the occurrence of the incident before customers and consumers are remediated” (ASIC 18-284MR). Most of that time is detection and investigation, but a large share of the rest is mechanical: extracts, reconciliations, letters and payment files built by hand.

The weeks after payment are their own clock. Checks are cashed slowly, some come back, some are never cashed, and the program is not finished until each has a final state. Void dates, stop payments and unclaimed property covers that tail.

Customer Remediation in practice: one program as a waterfall

Botminds' Customer Remediation shows each program as one waterfall of plain counts, from accounts screened to money sent to the states, so the program manager, compliance, finance and internal audit read the same numbers. Take a fictional sample bank's program for the savings transfer fee above: 1,486,902 accounts screened, 62,414 affected, $8,914,220.40 in refunds computed with interest. Each count says how it was found and opens its source; a count that does not tie to the one before it says so, and nothing is paid until a person decides.

The waterfall in Customer Remediation: every stage a count, and a stage that does not reconcile says so

After the program manager approves the population, the agents recompute every refund and split the payment: 54,759 credits to open accounts, 7,614 checks to closed ones and 41 refunds held for Legal because the owner is in bankruptcy, with $0.00 unaccounted. Compliance approves the letters, Finance the payment file and internal audit the close-out; the agents never approve anything.

After the decision: every refund computed and split, with nothing unaccounted

Questions people ask

Do banks have to pay interest on remediation refunds?

No single US rule sets it; the order, the regulator or the bank's own policy does. Some CFPB orders require interest for the time value of money, and the UK ombudsman moved its default from 8% to the Bank of England base rate plus one point for complaints referred from January 1, 2026. Whatever the rate, it belongs in a written method approved before anyone is paid.

Can a bank remediate without telling its regulator?

It can pay without an order, and the FDIC counts such voluntary restitution: $4.7 million in 2025. But the CFPB's bulletin weighs whether the bank reported “without unreasonable delay”, and an examiner who later finds an unreported program will ask why. Most banks tell the regulator when the issue is material and keep the evidence either way.

Does a terminated consent order end the duty to repay customers?

The order's own obligations end; the law behind them does not. When the CFPB terminated the Regions order in July 2025 it ended the redress paragraphs by number, after recording that Regions had issued payments. A bank that finds unpaid customers after an order ends still owes them under the rules that made the fee wrong.

Who owns customer remediation inside a bank?

Usually consumer compliance owns the program, with the business line that caused the harm paying for it, finance releasing the money and internal audit validating the close-out. The remediation team, seat by seat sets out who approves what.

How small can a remediation payment be?

There is no general US floor. The Truth in Lending restitution policy skips adjustments under $1, and some banks set a minimum for checks, but regulators look hard at floors: the UK regulator listed a £250 threshold set without analysis as poor practice in March 2026. The sample program pays every affected account, however small the amount.