Domain Atlas / Lending & credit collections AI
Hello Digit's automated-savings algorithm
Explore this deployment in the PAN Lab ↗
In the PAN Lab, the readouts of this case's model organization carry a shaded evidence band whose width follows the least-established class among the modeling inputs the readings rest on.
The least-established input behind this case's model organization's readings is an assumption, not a measurement. Evidence base: 1 assumed · 10 published baseline.
Hello Digit's automated-savings tool is an algorithm with a money-movement actuator rather than a decision about a person: a member grants access to a checking account through a third-party financial-technology platform the consent order does not name, and a proprietary algorithm analyses that account's transaction data to determine when and how much to save, then initiates automated clearing house transfers out of the account into pooled accounts held in the company's name at partner banks. There is no human in the transfer loop, no per-transfer consumer confirmation, no applicant, no eligibility decision, no score and no adverse-action notice. The Consumer Financial Protection Bureau's consent order of 10 August 2022 records that since its inception the company knew its algorithm was not perfect and had limitations that hampered its ability to predict precisely how much to withdraw, and that it was aware of the underlying reasons its algorithm triggers overdrafts, naming transactions that may be stale or inaccurate due to time lags in the banking system or inaccurate data provided by third-party partners, and the impossibility of predicting all customer, bank and automated clearing house behaviour. Settlement takes one to three days, widened to as much as five business days in some cases by the current terms. Two published overdraft rates exist and both are the operator's own, at different denominators: the order records the company's own estimate that approximately 1 to 2 percent of USERS experience overdrafts as a result of using the service, and the acquirer publicly countered that a Digit Save transaction caused an overdraft fee in less than 0.008 percent of CASES. Neither is an audited measurement, and neither may be given as the error rate without its unit.[3]
What happened
Most cases in this atlas are about a decision made about a person: a score, an eligibility call, a flag, a notice. This one is not. There is no applicant here, no eligibility test, no adverse-action notice and no appeal. A member grants access to their checking account, and from then on a proprietary algorithm reads that account's transactions, decides when and how much the member can spare, and initiates an automated clearing house transfer out of the account into a pooled balance held in the company's name. Nobody reviews an individual transfer. Nobody confirms one. On the acquirer's own reporting the actuator has fired about 1.1 billion times over ten-plus years, which is roughly a hundred million money movements a year.
What the company sold alongside it was a promise. The order reproduces the words. The website headlined that the service saves the perfect amount every day, so you do not have to think about it. Elsewhere the company billed itself as one that never transfers more than you can afford. An application-store welcome screen read "Save Money. Pay off Debt. No Overdrafts." until late 2021. And there was an express no-overdraft guarantee: the company believed so strongly in its ability to safely identify money you did not need that if it overdrew your account, it would pay the fee.
The Bureau's finding is not that the algorithm was bad. It is that the company knew what the algorithm could not do and marketed the opposite. The order records that since its inception the company knew its algorithm was not perfect and had limitations that hampered its ability to predict precisely how much to withdraw, and that it was aware of the underlying reasons its algorithm triggers overdrafts. Two of those reasons are named: transactions that may be stale or inaccurate because of time lags in the banking system or inaccurate data provided by third-party partners, and the plain impossibility of predicting all customer, bank and settlement behaviour. Settlement takes one to three days. So the decision is computed against a picture of the account that is days old, and the transfer posts into an interval the picture could not cover.
Two numbers describe how often that went wrong, and they are not in conflict. The order records the company's own estimate that approximately 1 to 2 percent of users experience overdrafts as a result of using the service. After the order the acquirer told trade press that a Digit Save transaction caused an overdraft fee in less than 0.008 percent of cases. The first is denominated in users, the second in transactions. Both can hold at once on any plausible transfer volume, and quoting either without its denominator misreads the record. Neither is an audited measurement.
The part of the record that carries the case is what happened when members asked the company to keep its word. Nearly 70,000 overdraft-reimbursement requests arrived after 2017, and complaints about overdrafts came in daily. Roughly nine in ten of those requests were honoured — this was a channel that worked most of the time, and the order says so. Over 7,200 were declined, and the order itemises them by reason: 728 for overdrafts caused by the company's own monthly subscription-fee debit; 1,823 attributed to member-initiated manual saves; 600 because the member did not reconnect a checking account after unsubscribing; 1,347 because the company had already reimbursed that member twice; and 1,852 that the company deemed unrelated to its activity. Until at least mid-2020 the policy was two reimbursements per lifetime, and a member overdrawn a third time was refused — which the order says happened over a thousand times.
Read the third of those reason codes again, because it is the one the order singles out. Reimbursement required an active account and a still-connected checking account. A member who disconnected or cancelled after being overdrawn was refused unless and until they reactivated their account and reconnected the bank account in the app. Getting the promised remedy meant maintaining the data connection that had produced the harm. The order's only outright behavioural prohibition beyond the misrepresentation ban addresses exactly this: the operator may not require a consumer to connect their third-party bank account to an account of the operator in order to obtain reimbursement, and must pay by direct deposit or paper check.
The company could see all of it. Complaints arrived every day and the people receiving them said so in writing. One support agent logged a complaint as a user incurring overdrafts, misled by the "no overdraft guarantee" language at sign up. Another wrote of a second complaint that here was another user calling us out on that, and that they did feel like "no overdraft guarantee" is misleading and should be changed. An internal document listing common issues that receive user pushback named both the two-instance maximum and users not wanting to reconnect their checking account or reactivate their account for an overdraft reimbursement. The undertaking stood.
The order carries a third count that is easy to miss and is structurally alive today. After moving to a 2.99-dollar monthly subscription in April 2017, the company told members it did not keep their interest and no longer used the interest on their balances as a source of revenue, repeated it in a help-centre article live until at least July 2019, and told individual complainants it did not keep their interest or profit from it. In fact members received a fixed savings bonus of 0.1 to 1 percent of balance and the company retained the remaining net interest. The current terms state the position the other way round: the operator may earn compensation in the form of commission or interest on members' funds deposited with its partner banks, and the member will not earn or be paid interest, dividends or earnings on those funds. Interest on member accounts is a named revenue line of 17.414 million dollars in the acquirer's fiscal 2025 accounts, against subscription revenue of 19.465 million.
What the order does is worth stating precisely, because the headline invites a stronger reading. All three counts are deception counts under Consumer Financial Protection Act sections 1031(a) and 1036(a)(1)(B). There is no unfairness count and no abusiveness count. There is no model-accuracy requirement, no validation obligation, no cap on overdrafts caused, no independent monitor and no ongoing public reporting of the rate. The order prohibits the specified misrepresentations, prohibits the reconnection condition, imposes a civil money penalty of 2,700,000 dollars, and requires a reserve of not less than 68,145 dollars for redress to members whose requests were denied between 1 January 2017 and the effective date because they exceeded the reimbursement cap or did not reconnect. Trade reporting puts the distribution at 68,145 dollars across 1,947 members, about 35 dollars each. The penalty is roughly forty times the redress, the redress class covers only two of the five documented denial reason codes, and 68,145 dollars is a floor to be reserved rather than a measure of harm.
The governance the order does install reaches upward rather than inward. Board means Oportun's board of directors, which may delegate review to its Audit and Risk Committee with reporting back at least quarterly; that body must review every submission; compliance reports are due at 90 days and at one year, board-approved and sworn under penalty of perjury; the order must be distributed to executive officers and to future officers and any successor entity for five years; and the Bureau retains a standing right to interview employees and compel documents. The recordkeeping clause is where the second decision surface surfaces: the operator must retain all consumer complaints and reimbursement requests, the results of Digit's auto-reimbursement tool, and any responses. The adjudication of the claims was itself at least partly automated.
Hello Digit consented to all of it without admitting or denying any of the findings of fact or conclusions of law, except the facts necessary to establish the Bureau's jurisdiction; the separate stipulation phrases the consent as being without admitting or denying any wrongdoing. Oportun told trade press it disagreed with the Bureau but wanted to resolve the matter. Its securities filings state that it believes the business practices of the company, including Digit's, have been in full compliance with applicable laws, and that it agreed to the order in the interest of resolving the matter. An independent legal reading published the day after the order characterised the counts as messaging deception rather than a finding that the algorithm was unlawful, and observed from the defence side that the Bureau's press-release framing leaned harder on the word algorithm than the counts did. That observation is that side's opinion, carried here rather than adopted.
Then look at what happened next, because it is the reason this file is written in the present tense. The product was not withdrawn. It was rebranded Oportun Set & Save, and the terms were rewritten. Where the undertaking had been, the current terms carry a Disclaimer of Warranty of Purpose: each prediction merely represents an attempt to predict the relevant facts regarding the linked bank account, accuracy is not guaranteed, the service might not predict an overdraft that actually occurs, the service is provided as is and as available, and sophisticated algorithms cannot anticipate everything. Responsibility for avoiding an overdraft is routed to member-set controls the terms say the member must monitor. The reimbursement channel survives with a different quota: on a help-centre page that could not be fetched directly and is treated here as corroborated rather than verified, save-caused fees are reimbursed up to four times a calendar month within a two-day window, on a screenshot the member supplies. And the deployment grew. The acquirer reports more than 12.8 billion dollars set aside since 2015 and about 1,800 dollars saved per member per year, and on 27 July 2026 launched Smart Bills, described as an artificial-intelligence extension of the same engine that identifies recurring obligations and reserves for them ahead of the due date. Every figure in that paragraph after the terms is an unaudited operator claim.
The order remains live. As of the run date the Bureau's enforcement page lists the matter as Post Order / Post Judgment, the administrative docket holds only the two filings of 10 August 2022 with no termination entry, and the acquirer's annual report of February 2026 and quarterly report of August 2026 both still disclose it. That is worth stating as a finding rather than an assumption, because the Bureau terminated several consent orders of this vintage early during 2025 — U.S. Bank, Apple, Bank of America and Navy Federal Credit Union are documented — and this one is not among the terminations located. By its own terms it runs to 10 August 2027.
The sociotechnical reading
The useful thing about this case is that the governed surface and the failing surface are different objects, and everyone's attention goes to the wrong one.
The failing surface is a forecast. It reads an account that is one to three days out of date, computes an amount, and moves money into an interval it cannot see. Its error is a timing error in a conserved quantity rather than a misclassification, and the loss is asymmetric in a way the marketing denied outright: saving too little costs nobody anything, and saving too much costs a member thirty or thirty-five dollars immediately, charged by a bank the operator does not control. The loss also concentrates precisely on the members whose buffers are thin, which is to say on the population the product is sold to. None of that is a defect. It is what forecasting a volatile quantity and acting on the forecast means, and the order says the company knew it from the beginning.
The governed surface is a promise. All three counts are about words, and the remedy the order asks for is words. What follows from that is the case's central lesson and it is not a comfortable one: model quality and legal exposure are decoupled here in a way they are not in an underwriting case. The compliant response to being told your undertaking oversold your algorithm is not to improve the algorithm. It is to withdraw the undertaking. That is what happened: the no-overdraft guarantee became a Disclaimer of Warranty of Purpose, the perfect-amount headline came down, and the residual risk stayed exactly where it was — except that it now sits with the member, who is told to monitor a Safe Saving Level and to make sure it is working correctly for their specific situation. The order permits this completely. It requires no accuracy standard of any kind.
Now look at where the governance actually lived, because it was not on the transfer. The company measured its own error rate with precision, through nearly 70,000 reimbursement requests and daily complaints. It read that measurement: an internal document names the reimbursement cap and the reconnection requirement as recognised friction. Its own agents identified the problem correctly and in writing, one of them saying the language was misleading and should be changed. And what the organisation did with all of that was govern the claims channel — quotas, causal exclusions, a lifetime cap, a reason code for fees it judged unrelated — while nothing in the record shows any of it returning to the decision that produced the fees. Roughly nine in ten claims were paid. The failure is not that the company refused to pay; it is that the only thing the measurement could reach was the payment.
There is a measurement pathology underneath that worth naming on its own. Reimbursement required a live account and a still-connected checking account, so a member who left after being overdrawn forfeited the claim, and 600 refusals turned on exactly that. The observation channel was gated on continued exposure. The people most damaged by the system were the people most likely to be missing from the record that measured the damage, which means the error rate the company could see was bounded below by its own precondition, and no amount of care in reading that record recovers them. The order prohibits the condition. It does not, and could not, recover the observations.
The money in the order tells its own story. A 2,700,000-dollar penalty against a 68,145-dollar redress floor is roughly forty to one, and the asymmetry is not an oversight: the redress class is small because most requests were paid, and it covers only members refused under the cap or the reconnection rule, so two of the five documented refusal grounds are outside it entirely. Read together, the two figures say that the sanction was for the conduct and the repair was for the narrow slice of it the class definition could reach. Anyone quoting 68,145 dollars as the cost of the harm is quoting a reserve floor.
Then there is the shape of the oversight the order builds, which is unusual and instructive. It reaches upward, to the acquirer's board and its Audit and Risk Committee, with quarterly reporting, sworn compliance reports and a five-year distribution obligation that follows the entity to any successor. It reaches nowhere near the algorithm. So this deployment now has the strongest governance layer it has ever had, over the promise and the redress, and the same absence of authority it always had over the money-moving decision. Meanwhile the investigation itself travelled through a corporate acquisition: the civil investigative demand issued in June 2020 and was disclosed in diligence before the deal closed in December 2021, so the enforcement risk was priced into the transaction rather than discovered after it.
The last thing is the one that makes this a live case rather than a historical one. Every external channel that might have produced an independent read of this forecast is either absent or closed. No monitor was appointed, no validation was required, no researcher has examined the engine, and the aggregate private route is shut by a binding arbitration clause with an express class-action and jury waiver. The regulator was the only aggregate channel available, and what the regulator asked for was a change to the words. Four years into a five-year order, the same actuator is moving more money than it was, and a second channel built the same way now reserves against members' recurring bills ahead of the due date. Whether it is better at that than the first channel is at the moment the operator's question alone.
The concepts used in this reading are defined in the Field Guide; the governance responses live in the Practice Library. The model organization for this case can be stress-tested in the PAN Lab.