The Digit automated-savings tool, or Oportun Set & Save

What this models

This example runs on the Autosave-warranty-class automated savings transfer network: 11 components and 25 pathways between them. Every context in the Lab is a stylized model, never a reconstruction of any actual deployment, and each assumption behind it carries a provenance label.

Evidence base: 1 assumed · 11 published baseline. In the Lab, the shaded evidence band behind each headline readout draws its width from the least-established class below.

• baseline

  D48-derived new org (Phase 6, lending-credit-collections). REGISTER FIRST, because it governs every value here. Every conduct finding on this diagram is a finding by the federal consumer regulator in a consent order that Hello Digit, LLC agreed to without admitting or denying any of the findings of fact or conclusions of law, except the facts necessary to establish jurisdiction, which it admits; the separate stipulation phrases the consent as being without admitting or denying any wrongdoing. Nothing here was adjudicated and no court has found anything. The operator's contrary position is part of the record and travels with the finding: it told trade press that it disagreed with the Bureau but wanted to resolve the matter, countered the faulty-algorithm framing with a figure of less than 0.008 percent of save transactions causing an overdraft fee, and its securities filings state that it believes the business practices of the company, including Digit's, have been in full compliance with applicable laws.

• baseline

  ATTRIBUTION OF THE CONDUCT, and it is not the same party as the operator of the deployment. The conduct the order describes happened at Hello Digit: the product launched in February 2015, the marketing claims ran from then, the civil investigative demand issued in June 2020, and the marketing changed in mid-2020 and late 2021. Oportun Financial Corporation acquired Hello Digit, Inc. on 22 December 2021, with the investigation disclosed during acquisition diligence, and merged it into Hello Digit, LLC, the respondent named in the order. So Hello Digit is the operator of the conduct and Oportun is the acquirer that inherited a disclosed investigation and now runs the deployment. This diagram never treats the acquirer as the actor in the pre-2022 conduct, and the penalty here attaches to nothing at any other company under the same ownership.

• baseline

  TOPOLOGY. Eleven nodes, all documented, none decorative. THREE models because the record documents three separate decision surfaces: the transfer engine, whose output is a dollar amount debited from a live account; the reimbursement adjudication channel, whose existence as an at-least-partly-automated surface is established by the order's own requirement to retain the results of the auto-reimbursement tool; and the 2026 recurring-bill forecaster the operator announces as an extension of the same engine. ONE input source because the linked checking-account transaction feed is an external feed the operator holds neither the store nor the account behind, and because the regulator names its properties as causes of the harm. TWO operator classes because the sources document two groups with different authority and different documented outcomes: the function that authors the promise and the reimbursement policy, and the desk that receives the complaints and applies the policy. THREE stores because the pooled balance ledger, the complaint and reimbursement record, and the published promise and terms are three different things the record measures separately, and every count in the order is about the third of them. TWO reviewers because the record documents exactly two external review channels, which acted differently: the board layer the order installed at the acquirer, and the federal enforcement channel itself. Three further documented components are carried in the description of the element they belong to rather than drawn apart, because none of them acts on the error: the weekly transfer limits and the member-set floor bound a weekly total and inspect no transfer, and they are described on the transfer engine; the partner-bank deposit operation records rather than decides and sees no forecast, and it is described on the balance ledger; and the recovery authority the current terms grant is triggered by the state of the balance record, and it is described on that record, which is where the PAN file carries it too.

• baseline

  ABSENCES ARE DERIVED TOO, and three of them are load-bearing. There is NO third reviewer, and that is the sharpest structural fact in the file: the record documents no independent monitor, no model validator and no third-party reviewer of any kind, the order names none, and the private aggregate channel that might have produced one is closed, because the product's terms carry a binding arbitration provision with an express class-action and jury waiver and no class litigation over the autosave overdrafts was located. The regulator was the only aggregate route available. There is NO external boundary and no egress pathway: no data breach, no third-party disclosure finding and no furnishing to any consumer-reporting agency appears anywhere in this record, and drawing an egress edge would put a disclosure on the diagram that nobody has established. There is NO worklist and NO retriever: the claim volume is documented as a volume, never as a queue, a backlog or a triage list, and nothing in this deployment retrieves. There is also no scored applicant, no eligibility decision, no adverse-action notice and no appeal anywhere in this system, and no node stands for one.

• baseline

  WHERE THE LAB SHAPE DIVERGES FROM THE PAN SHAPE, and nothing is asserted here that the PAN file does not already record. Three divergences. First, PAN carries the promise as an attribute of its product-and-marketing user class; the Lab draws it as a store with its own pathways, because the governed surface in this deployment is the promise rather than the prediction and a store can be written to, read from and reconciled against, where an adjective cannot. Second, PAN has no edge kind for a check at all. Four of this board's pathways between people are checks: three are PAN peer or configuration edges REDRAWN as checks — the board layer's reach into the claims channel and into the product function, and the desk's written objection to the promise — and the fourth, the enforcement prohibition on the stated promise, has no PAN counterpart and is derived from the order's text; the widths of the three come from PAN on the stated mapping. Third, PAN carries an oversight-to-model edge at its own floor with the comment that the value is the finding; the Lab has no inhibiting edge of that shape and would have had to draw it reinforcing, so the finding is carried instead as the independent-read pathway at zero and in this note. On the recovery authority the two shapes now agree: PAN carries it inside its ledger attributes, and so does this board.

• baseline

  BASELINES, and exactly how far the PAN org carries them. The PAN entry for this deployment holds thirty-four edges. Eighteen of this network's twenty-five pathways have a one-to-one counterpart among them, and every one of those eighteen mirrors that edge's width on a single rung mapping (0.50 and above to 3, 0.30 to 0.49 to 2, 0.06 to 0.29 to 1, below 0.06 or documented absent to 0) with no exceptions. Fifteen more PAN edges are carried in the description of the pathway or component that holds their fact at this granularity, and each survivor that carries one keeps its own width rather than taking the folded one's. The remaining seven pathways are derived from the cited record directly and each says so on its own line. Four contrasts are load-bearing. The account feed reaches the forecast at the top rung while the claim record reaches it at zero, which is this file's central claim: the organisation that measured its own harm through nearly 70,000 requests measured it into a channel the decision does not read. The configuration pathway into the claims channel runs at the top rung while the one into the transfer channel runs one rung below it, so the widest authority anyone exercises in this network is over the answer to a complaint rather than over the decision that produced it. The copy of the stated terms into the claim policy runs at the middle rung while the reconciliation of a refusal against those terms runs at zero, which is the warranty stated as a picture. And the transfer's own debit lands back in the account feed at the middle rung, which is what makes the forecast an actor in the state it forecasts.

• baseline

  DEMAND 3 / CAPACITY 1. Demand 3 on two independent volume records: the acquirer reports 1.1 billion algorithmic transfers over ten-plus years, which is roughly a hundred million automated money movements a year, and more than 12.8 billion dollars set aside since 2015 with about 1,800 dollars per member per year; and the order records nearly 70,000 overdraft-reimbursement requests since 2017 with complaints arriving daily. Every transfer figure is an unaudited operator claim and is named as one wherever it is used; the claim volumes are the Bureau's. Capacity 1 is derived from an absence the regulator states in terms rather than from a staffing shortfall: the algorithm determines when and how much to save and initiates the transfer, there is no human in the transfer loop, there is no per-transfer member confirmation, and there is no check between the forecast and the debit. What the value does NOT say is that this deployment has no human channel: the support and reimbursement desk handled nearly 70,000 requests and honoured roughly nine in ten of them. That desk sits after the money has moved and the member's own bank has charged the fee. It is capacity to repair rather than capacity to decide, and the two are drawn as different pathways.

• baseline

  TWO PUBLISHED ERROR RATES, BOTH TRUE, DIFFERENT DENOMINATORS, and no parameter here is scaled by either. The order records the company's own estimate that approximately 1 to 2 percent of users experience overdrafts as a result of using the service; the acquirer's public rebuttal is that a save transaction caused an overdraft fee in less than 0.008 percent of cases. The first is denominated in USERS and the second in TRANSACTIONS. They are the same phenomenon measured at different units, they hold simultaneously on any plausible transfer volume, and presenting either as the error rate without its denominator is a misuse of the record. Neither is an audited measurement: the first is the operator's own estimate as recorded by the regulator, the second is the operator's own figure relayed through trade press. No baseline, demand value, privacy value or lever on this board is computed from either.

• baseline

  MEASURED AND RATIONED, not measured and refused, and the distinction is binding. Of nearly 70,000 reimbursement requests since 2017, over 7,200 were declined, which is roughly one in ten: this channel worked most of the time. The finding the record supports is that the refusals ran on quotas the same organisation had written for itself rather than on the unqualified promise the marketing made — two per lifetime until at least mid-2020, an exclusion for member-initiated saves, an exclusion for the company's own membership-fee debit, an exclusion for fees deemed unrelated, and a requirement to reconnect the account that had just cost the member the fee — and that nothing in the record shows the measured error rate producing any change to the transfer decision. The sharper true claim is about the shape of the measurement: because leaving the product forfeited the claim, the members most damaged were the ones most likely to leave the channel that measures the damage, so the error rate this deployment could observe was bounded below by its own precondition.

• baseline

  EVIDENCE STATUS, labelled where it is used. PRIMARY REGULATORY RECORD: the 37-page consent order with 93 numbered paragraphs, its separate stipulation, the Bureau's announcement, its enforcement action page and its administrative docket — the source of every conduct finding, every claim count, every reason-code figure and both money figures. OPERATOR DISCLOSURE UNDER SECURITIES LIABILITY: the acquirer's annual report for fiscal 2025 and its quarterly report for the period ended 30 June 2026, the source of the transfer and revenue figures and of the current status of the order. OPERATOR PRIMARY: the Set and Save terms last updated 22 July 2025, the source of the disclaimer of warranty, the transfer limits, the member-set floor, the recovery authority, the interest position and the arbitration clause. UNAUDITED OPERATOR CLAIM: everything published about the 2026 recurring-bill extension. TRADE PRESS: the redress headcount of 1,947 members at about 35 dollars each, and the operator's per-transaction rebuttal — neither appears in the order, and the headcount has one located source. LEGAL ANALYSIS, ATTRIBUTED AND NOT ADOPTED: the defence-side reading that the counts are messaging deception rather than a finding that the algorithm was unlawful. CORROBORATED BUT NOT DIRECTLY VERIFIED: the present-day reimbursement caps, whose source page returns a single-sign-on shell with no article body; nothing on this diagram rests on it alone.

• assumed

  Served people are not in the dynamics, and this file departs from its own source material to keep it that way. The evidence record describes the member as an operator of the service, because the member holds coarse controls: pause a goal, set a floor, boost a goal, disconnect, cancel. This network cannot represent them that way, because the operator classes on a Lab diagram are the people who run the system and members are served people outside it. No member, no overdraft, no bank fee and no household outcome is computed from anything drawn here. The user-denominated and transaction-denominated overdraft rates, the transfer counts, the reason-code tallies, the redress figures and the penalty are recorded external observations that set no parameter. The one place a member's own control appears is the transfer engine's description of the weekly limits and the member-set floor, stated as the product features they are rather than as a person, and setting no value on this board.

• baseline

  RE-DERIVED AT THE COARSEST FAITHFUL GRANULARITY. This network once drew fourteen components and forty-six pathways; it now draws eleven and twenty-five, and none of the facts those elements carried has left this page. Three components are described rather than drawn, as the topology note above says. The pathways folded into a neighbour are these. The balance ledger's return leg into the account feed rides on the debit that lands in the feed, the same loop taken in two steps. The adjudication tool's payment into the balance rides on the desk's credit to it, one payment drawn once. The tool's reason codes reach the desk through the claim record the desk reads. The recurring-bill channel's complaints land in the same complaint channel as the base engine's, and the product function's ownership of that channel rides on its authority over the engine the channel extends. The engine's aggregate metrics reaching the product function, and the pooled balance being read back into the forecast, are the narrow reverse reads of two pathways that are drawn, and each is stated on that pathway. The reimbursement quotas written into the claim record ride on the configuration of the reason codes they are. The desk's discretion to call a fee related or unrelated is exercised in the characterisation the desk logs. The complaint record read by the product function and the published terms read at the desk carry the same documented signal as the desk's written objection, and ride on it. The desk's quarterly reporting rides on the board layer's read of the claim record. And the enforcement prohibition on conditioning reimbursement reaches the claims channel through the redress plan the board layer reviews, so it rides on that review. Two zero-width pathways are not drawn: the reconciliation before the recovery debit, because the terms' silence about such a step is an absence of a described step rather than a finding that none happens, and the tether of the transfer limits to the transfer path, which carried no flow.

What this example does not show

• LITIGATION AND REGULATORY POSTURE, verbatim from the evidence dossier and load-bearing. Consent order in force and unterminated as of the run date (2026-08-28): the CFPB enforcement page lists the matter as 'Post Order/Post Judgment', the administrative docket for 2022-CFPB-0007 holds only the two August 10, 2022 filings (consent order, stipulation) with no termination entry, and Oportun's Form 10-K filed February 27, 2026 and Form 10-Q filed August 6, 2026 both still carry the order in their risk factors. This matters because the CFPB terminated a number of other consent orders early during 2025 — Banking Dive documents early terminations against U.S. Bank, Apple, Bank of America and Navy Federal Credit Union, plus a move to terminate a 2021 Trustmark redlining order — and this one is not among the terminations located. The DEPLOYMENT is not wound down — the same algorithm runs today at larger scale as Oportun Set & Save, with a new AI bill-forecasting extension shipped July 2026.
• REGISTER, and it governs every sentence about conduct. Every finding here is a Bureau finding in a consent order that Hello Digit, LLC agreed to without admitting or denying any of the findings of fact or conclusions of law, except the facts necessary to establish the Bureau's jurisdiction, which it admits; the separate stipulation phrases the consent as being without admitting or denying any wrongdoing. Nothing was adjudicated and no court has found anything. The operator's contrary position is part of the same record and is carried with it: it told trade press that it disagreed with the Bureau but wanted to resolve the matter, and its securities filings state that it believes the business practices of the company, including Digit's, have been in full compliance with applicable laws.
• The Bureau did NOT find the algorithm defective as a matter of law, and nothing here says it did. All three counts are deception counts under Consumer Financial Protection Act sections 1031(a) and 1036(a)(1)(B). There is no unfairness count and no abusiveness count. The order contains no model-accuracy requirement, no validation obligation, no cap on overdrafts caused and no independent monitor, and it requires no change to the algorithm at all. An independent legal reading of the order records the same characterisation and adds a defence-side observation, carried here as that side's opinion rather than adopted: that the Bureau's press-release framing leaned harder on the word algorithm than the counts did.
• TWO PUBLISHED OVERDRAFT RATES, BOTH TRUE, DIFFERENT DENOMINATORS, and they are not a dispute of fact. The order records the company's own estimate that approximately 1 to 2 percent of USERS experience overdrafts as a result of using the service. The acquirer's public rebuttal is that a save transaction caused an overdraft fee in less than 0.008 percent of cases, a rate over TRANSACTIONS. They are the same phenomenon measured at different units and hold simultaneously on any plausible transfer volume. Presenting either as the error rate without its denominator is a misuse of the record, and no parameter on this board is computed from either.
• THE REDRESS FIGURE IS A FLOOR, NOT A MEASURE OF HARM, and the asymmetry is part of the finding. The order fixes a civil money penalty of 2,700,000 dollars and requires a reserve of not less than 68,145 dollars for redress — roughly forty to one, not one to one. The redress class covers only members whose reimbursement requests were denied between 1 January 2017 and the effective date because they exceeded the reimbursement cap or did not reconnect their account, so two of the five documented denial reason codes are outside it entirely. Trade reporting puts the distribution at 68,145 dollars across 1,947 members, about 35 dollars each; that headcount has one located source and appears nowhere in the order. Nothing here presents 68,145 dollars as the value of the overdraft harm caused.
• MEASURED AND RATIONED, NOT MEASURED AND REFUSED. Of nearly 70,000 reimbursement requests since 2017, over 7,200 were declined — roughly one in ten — so this channel honoured most of what reached it. The finding this board draws is narrower and harder: the refusals ran on quotas the same organisation wrote for itself rather than on the unqualified promise the marketing made, and nothing in the record shows the measured error rate producing any change to the transfer decision. The sharper claim is about the shape of the measurement rather than its volume: because leaving the product forfeited the claim, the members most damaged were the ones most likely to leave the channel that measures the damage.
• The present-day reimbursement policy — a four-per-calendar-month cap for save-caused fees, unlimited reimbursement for fees caused by the operator's own membership or instant-withdrawal charges, a two-day window between transaction and fee, and a member-supplied screenshot — comes from a help-centre article whose live page returns a single-sign-on shell with no article body, and whose archive capture could not be reached. The text was captured from a search index. It is treated here as corroborated but not directly verified, it is never quoted as verbatim policy language, and no baseline, budget or lever on this board rests on it alone. The verified current terms independently confirm that a fee-reimbursement channel exists.
• The recovery authority described on this board's balance ledger comes from the current Set & Save terms, which state that a goal balance negative for more than five days authorises a debit of the linked bank account, that a right of setoff runs against the member's other goal balances, and that the operator may close an account at its discretion including where the linked bank account is persistently overdrawn. What is documented is an AUTHORITY the terms grant, not an observed frequency: no figure for how often it is exercised is published anywhere, and this board draws no such figure. The terms describe no step at which anyone confirms the record before the debit. That is an absence of a described step rather than evidence that the step never happens, so this board states it in the ledger's description rather than drawing a reconciliation pathway for it.
• ATTRIBUTION. The conduct the order describes happened at Hello Digit — the product launched in February 2015, the investigative demand issued in June 2020, the marketing changed in mid-2020 and late 2021. Oportun Financial Corporation acquired Hello Digit, Inc. on 22 December 2021 with the investigation disclosed during acquisition diligence, and merged it into Hello Digit, LLC, the respondent. This scenario names Hello Digit as the operator of the conduct and Oportun as the acquirer that inherited it and now runs the deployment. Nothing here attaches this order to any other deployment under the same ownership, and the parallel collections deployment at that parent is a different system, different consumers and a different legal record.
• Everything published about the July 2026 recurring-bill extension is an unaudited operator claim — the figure for money accumulated by early users, the claimed uplift over the base product, the cumulative savings totals and the third-party app ranking. It is used here for one purpose only: to establish that the deployment is live and expanding. No benefit on this board is measured from it, and no regulator, auditor or researcher has examined that channel.
• Served people are not modelled. No member, no overdraft, no bank fee and no household outcome is computed from anything on this diagram. The overdraft rates, the transfer and dollar totals, the reason-code tallies, the redress figures and the penalty are recorded external observations rather than quantities this network derives. The evidence record describes the member as an operator of the service because the member holds coarse controls; this board cannot represent them that way, and the one place a member's own control appears is the transfer engine's description of the weekly limits and the member-set floor, stated as the product features they are and drawn as no element of their own.

Sources and evidence

What this example rests on, claim by claim. Every entry resolves to the same ledger the Evidence Registry publishes.

• Hello Digit's automated-savings tool is an algorithm with a money-movement actuator rather than a decision about a person: a member grants access to a checking account through a third-party financial-technology platform the consent order does not name, and a proprietary algorithm analyses that account's transaction data to determine when and how much to save, then initiates automated clearing house transfers out of the account into pooled accounts held in the company's name at partner banks. There is no human in the transfer loop, no per-transfer consumer confirmation, no applicant, no eligibility decision, no score, and no adverse-action notice. The Consumer Financial Protection Bureau's consent order of 10 August 2022 records that since its inception the company knew its algorithm was not perfect and had limitations that hampered its ability to predict precisely how much to withdraw, and that it was aware of the underlying reasons its algorithm triggers overdrafts, naming transactions that may be stale or inaccurate due to time lags in the banking system or inaccurate data provided by third-party partners, and the impossibility of predicting all customer, bank, and automated clearing house behaviour. Settlement takes one to three days, widened to as much as five business days in some cases by the current terms. Two published overdraft rates exist and both are the operator's own, at different denominators: the order records the company's own estimate that approximately 1 to 2 percent of USERS experience overdrafts as a result of using the service, and the acquirer publicly countered that a Digit Save transaction caused an overdraft fee in less than 0.008 percent of CASES. Neither is an audited measurement, and neither may be given as the error rate without its unit.

  empirical
  • Government Consumer Financial Protection Bureau (2022, August 10). Consent Order, In the Matter of Hello Digit, LLC, File No. 2022-CFPB-0007 https://files.consumerfinance.gov/f/documents/cfpb_hello-digit-llc_consent-order_2022-08.pdf
  • Trade press Banking Dive (2022, August 11). CFPB fines fintech Digit $2.7M over 'faulty' savings algorithm https://www.bankingdive.com/news/cfpb-fines-fintech-digit-27m-faulty-algorithm-overdraft-oportun/629445/
  • Vendor Oportun, Inc. (2025, July 22). Terms and conditions: Set and Save (formerly Oportun Savings) https://oportun.com/terms/savings/

• The failure the record documents is a failure to honour the undertaking after the fact, and the channel it ran through was measured and rationed rather than measured and refused. The consent order records nearly 70,000 overdraft-reimbursement requests since 2017 and complaints about overdrafts received daily, against over 7,200 requests declined — roughly one in ten, so most of what reached the channel was paid. The order itemises the declines by reason: 728 caused by Digit's own subscription-fee debit, 1,823 attributed to consumer-initiated manual saves, 600 because the user did not reconnect a checking account after unsubscribing, 1,347 where Digit had already reimbursed the consumer twice, and 1,852 deemed unrelated to Digit activity. Until at least mid-2020 the policy was to reimburse no more than two instances per lifetime, and a consumer overdrawn a third time was refused, which the order says happened over a thousand times since 2017. Reimbursement also required an active account and a still-connected checking account, so a consumer who disconnected or cancelled after being overdrawn was refused unless and until they reactivated and reconnected in the app; the order's only outright behavioural prohibition beyond the misrepresentation ban forbids requiring a consumer to connect a third-party bank account in order to obtain reimbursement, and requires payment by direct deposit or paper check. The order also records that the error signal was fully visible inside the company: a support agent logged a complaint as a user incurring overdrafts after being misled by the no-overdraft-guarantee language at sign-up, another wrote that the language was misleading and should be changed, and an internal document listed both the two-instance maximum and users declining to reconnect among common issues that receive user pushback. The order's recordkeeping clause requires retention of all consumer complaints and reimbursement requests, the results of Digit's auto-reimbursement tool, and any responses, which is the record's evidence that the adjudication was itself at least partly automated. Nothing in the record shows overdraft outcomes being fed back into the transfer decision.

  empirical
  • Government Consumer Financial Protection Bureau (2022, August 10). Consent Order, In the Matter of Hello Digit, LLC, File No. 2022-CFPB-0007 https://files.consumerfinance.gov/f/documents/cfpb_hello-digit-llc_consent-order_2022-08.pdf
  • Government Consumer Financial Protection Bureau (2022, August 10). CFPB Takes Action Against Hello Digit for Lying to Consumers About Its Automated Savings Algorithm https://www.consumerfinance.gov/about-us/newsroom/cfpb-takes-action-against-hello-digit-for-lying-to-consumers-about-its-automated-savings-algorithm/

• The instrument is a consented administrative order, not an adjudicated finding, and what it does not require is as load-bearing as what it does. Hello Digit, LLC consented without admitting or denying any of the findings of fact or conclusions of law, except the facts necessary to establish the Bureau's jurisdiction, which it admits; the separate stipulation of 9 August 2022 phrases the consent as being without admitting or denying any wrongdoing. All three legal conclusions are deception counts under Consumer Financial Protection Act sections 1031(a) and 1036(a)(1)(B) — about the savings tool's accuracy, about the reimbursement of overdraft fees, and about the retention of interest on consumer balances. There is no unfairness count and no abusiveness count. The order imposes a civil money penalty of $2,700,000 and requires a reserve of not less than $68,145 for redress to consumers whose reimbursement requests were denied between 1 January 2017 and the effective date because they exceeded the reimbursement cap or did not reconnect their account, with any shortfall paid to the Bureau; the penalty is therefore roughly forty times the redress floor, the redress class covers only two of the five documented denial reason codes, and $68,145 is a floor to be reserved rather than a measure of the harm caused. Trade reporting, and not the order, is the single located source for the distribution figure of $68,145 across 1,947 consumers, about $35 each. On governance the order installs a compliance plan and a redress plan subject to Enforcement-Director non-objection, review of every submission by Oportun's board or its Audit and Risk Committee with reporting back at least quarterly, compliance reports at 90 days and one year approved by the board and sworn under penalty of perjury, an acknowledgment within 7 days, a distribution list within 90 days, five years of distribution to new officers and any successor entity, and a standing Bureau right to interview employees and compel documents. It imposes no model-accuracy requirement, no validation obligation, no cap on overdrafts caused, no independent monitor, and no ongoing public reporting of the overdraft rate, and requires no change to the algorithm. An independent legal analysis published the following day reads the counts the same way — messaging deception rather than a finding that the algorithm was unlawful — and adds a defence-side observation, attributed and not adopted here, that the Bureau's press-release framing leaned harder on the word algorithm than the counts did.

  empirical
  • Government Consumer Financial Protection Bureau (2022, August 10). Consent Order, In the Matter of Hello Digit, LLC, File No. 2022-CFPB-0007 https://files.consumerfinance.gov/f/documents/cfpb_hello-digit-llc_consent-order_2022-08.pdf
  • Government Consumer Financial Protection Bureau (2022, August 9). Stipulation and Consent to the Issuance of a Consent Order, In the Matter of Hello Digit, LLC (Document 2, 2022-CFPB-0007) https://files.consumerfinance.gov/f/documents/cfpb_hello-digit-llc_stipulation_2022-08.pdf
  • Trade press Consumer Finance Monitor, Ballard Spahr LLP (2022, August 11). CFPB enters into consent order with fintech company to resolve alleged UDAAP practices arising from use of algorithm https://www.consumerfinancemonitor.com/2022/08/11/cfpb-enters-into-consent-order-with-fintech-company-to-resolve-alleged-udaap-practices-arising-from-use-of-algorithm/
  • Trade press Banking Dive (2022, August 11). CFPB fines fintech Digit $2.7M over 'faulty' savings algorithm https://www.bankingdive.com/news/cfpb-fines-fintech-digit-27m-faulty-algorithm-overdraft-oportun/629445/

• The deployment was not wound down after the order; it was rebranded, disclaimed, and expanded, and the order remains live. The product now runs as Oportun Set & Save, and the terms last updated 22 July 2025 replace the undertaking with a Disclaimer of Warranty of Purpose: each prediction merely represents an attempt to predict the relevant facts regarding the linked bank account, accuracy is not guaranteed, the service might not predict an overdraft that actually occurs, the service is provided as is and as available, and sophisticated algorithms cannot anticipate everything. Responsibility for avoiding an overdraft is routed to member-set controls including a Safe Saving Level, with the terms placing on the member the duty to monitor those controls. The same terms set weekly limits of $2,000 for automatic saves and $2,000 for manual saves and a $5,000 cap per instant withdrawal, authorise a debit of the linked bank account where a balance is negative for more than five days, assert a right of setoff across the member's goal balances, permit discretionary closure where a linked account is persistently overdrawn, state that the operator may earn commission or interest on members' funds deposited with its partner banks while the member earns none, name Wells Fargo, JP Morgan Chase, and Citi as deposit destinations, and carry a binding arbitration provision with an express class-action and jury waiver. The acquirer reports 1.1 billion algorithmic transfers over ten-plus years, more than $12.5 billion set aside since 2015, restated as over $12.8 billion in July 2026, about $1,800 per member per year, and interest on member accounts of $17.414 million in fiscal 2025 against subscription revenue of $19.465 million. On 27 July 2026 it launched Smart Bills, described as an artificial-intelligence extension of the same engine that identifies recurring obligations and reserves for them ahead of the due date. Every figure in that release is an unaudited operator claim. A present-day reimbursement policy capping save-caused fees at four per calendar month within a two-day window on a consumer-supplied screenshot is corroborated from a help-centre article whose live page returns a single-sign-on shell with no article body, and is treated as corroborated rather than directly verified.

  empirical
  • Vendor Oportun, Inc. (2025, July 22). Terms and conditions: Set and Save (formerly Oportun Savings) https://oportun.com/terms/savings/
  • Vendor Oportun Financial Corporation (2026, February 27). Annual Report on Form 10-K for the fiscal year ended December 31, 2025 https://www.sec.gov/Archives/edgar/data/1538716/000153871626000015/oprt-20251231.htm
  • Vendor Oportun Financial Corporation (2026, July 27). Oportun Launches New Set and Save Smart Bills Feature to Help Members Stay Ahead of Recurring Expenses (investor press release; unaudited operator claims) https://investor.oportun.com/news-events/press-releases/detail/199/oportun-launches-new-set-save-smart-bills-feature-to
  • Vendor Oportun, Inc. (2025). Getting covered for overdraft fees (help-centre article 205360247; live page returns a single-sign-on shell with no body, text captured from a search index, corroborated but not directly verified) https://help.oportun.com/hc/en-us/articles/205360247-Getting-covered-for-overdraft-fees

• Posture, attribution, and status, each stated as the record states it. The operator disputes the substance while carrying the order: Oportun told trade press that it disagreed with the Bureau but wanted to resolve the matter and countered the faulty-algorithm framing with the per-transaction figure, and its securities filings state that it believes the business practices of the company, including Digit's, have been in full compliance with applicable laws and that it agreed to the order in the interest of resolving the matter. Attribution runs one way: the conduct described in the order occurred at Hello Digit — the product launched in February 2015, the civil investigative demand issued in June 2020, the marketing changed in mid-2020 and late 2021 — and Oportun Financial Corporation acquired Hello Digit, Inc. on 22 December 2021 with the investigation disclosed during acquisition diligence, merging it into Hello Digit, LLC, the respondent named in the order. Oportun is therefore the acquirer that inherited a disclosed investigation and now runs the deployment, and the conduct is not attributed to it as actor. Status as of the run date of 28 August 2026: the order is in force and unterminated. The Bureau's enforcement action page lists the matter as Post Order / Post Judgment; the administrative adjudication docket for 2022-CFPB-0007 holds only Document 001, the consent order, and Document 002, the stipulation, both filed 10 August 2022, with no termination entry; and Oportun's Form 10-K filed 27 February 2026 and Form 10-Q filed 6 August 2026 both still carry the order in their risk factors. That finding is stated rather than assumed because the Bureau terminated a number of consent orders of this vintage early during 2025 — trade reporting documents early terminations for U.S. Bank, Apple, Bank of America, and Navy Federal Credit Union, plus a move to terminate a 2021 Trustmark redlining order — and this one is not among the terminations located. It rests on negative evidence, an unchanged two-entry docket plus continued securities disclosure, rather than on an affirmative Bureau statement. By its own terms the order runs to 10 August 2027. A minor date discrepancy is carried rather than resolved silently: the stipulation is dated 9 August 2022, the order and docket 10 August 2022, and the acquirer's filings say 11 August 2022; 10 August 2022 is used.

  empirical
  • Government Consumer Financial Protection Bureau (2022). Enforcement action page: Hello Digit, LLC (2022-CFPB-0007) https://www.consumerfinance.gov/enforcement/actions/hello-digit-llc/
  • Government Consumer Financial Protection Bureau (2022). Administrative adjudication docket: Hello Digit, LLC (2022-CFPB-0007) https://www.consumerfinance.gov/administrative-adjudication-proceedings/administrative-adjudication-docket/hello-digit-llc/
  • Vendor Oportun Financial Corporation (2026, February 27). Annual Report on Form 10-K for the fiscal year ended December 31, 2025 https://www.sec.gov/Archives/edgar/data/1538716/000153871626000015/oprt-20251231.htm
  • Vendor Oportun Financial Corporation (2026, August 6). Quarterly Report on Form 10-Q for the quarter ended June 30, 2026 https://www.sec.gov/Archives/edgar/data/1538716/000153871626000067/oprt-20260630.htm
  • Trade press Banking Dive (2025, September 23). CFPB ends U.S. Bank, Apple consent orders early https://www.bankingdive.com/news/cfpb-terminate-orders-apple-card-us-bank-unemployment-benefits-covid-vought/760873/
  • Trade press Banking Dive (2022, August 11). CFPB fines fintech Digit $2.7M over 'faulty' savings algorithm https://www.bankingdive.com/news/cfpb-fines-fintech-digit-27m-faulty-algorithm-overdraft-oportun/629445/

Where this connects

Institutional pressures in this domain

• Vendor opacity — The deploying institution cannot inspect the model, data, or update pipeline it is accountable for.
• Compliance over substance — Paper controls (sign-offs, checklists) satisfy audits while the behavior they describe erodes.
• Data & policy drift — The world, the intake process, and the rules change under a system trained on how things used to be — two mechanisms with different remedies: the statistical properties of what the system processes move (concept drift), or the mixture of inputs arriving in deployment differs from the mixture it was trained on (covariate shift).
• Austerity & recovery incentives — Cost-cutting and overpayment-recovery targets tilt the system toward denial and enforcement errors.
• Reviewer bottleneck — One fixed-capacity checking stage sits between AI output and consequence; everything queues behind it.

All of them in context on the Lending & credit collections AI domain page.

Levers available here and the patterns behind them

• Check copied records — Reconcile copied records
• Mark AI-written records — Provenance labeling
• Understand the system — Understand the system
• Upgrade model — Improve the model
• Gate record entries — Human-in-the-loop write gating
• Pause AI on alarms — Deployment circuit-breaker
• Escalate checks — State-feedback vigilance
• Review on schedule — Oversight cadence & retrospectives
• Check with a second model — Cross-model verification
• Gate vendor updates — Vendor quality gate
• Store less data — Data minimization
• Assign a challenger — Structured dissent
• Vet connections — Connection authorization

Documented case histories

• Hello Digit's automated-savings algorithm
• Automated underwriting with its fair-lending testing on the record
• Cleared on the numbers but faulted on the explanation
• The governance an enforcement action had to write
• M-Shwari & Kenya's Digital Credit Market
• Citi Retail Services Judgmental Review & the Armenian surname screen
• Santander Consumer USA subprime vehicle loan scoring
• Credit Acceptance Corporation's net-collections score
• Wells Fargo refinance underwriting & the bridge nobody could build
• Navy Federal mortgage underwriting & three readings of one gap
• Enova International servicing defects & the debits nobody authorised
• Equifax Online Model Server coding error (2022)
• TransUnion's OFAC Name Screen & the people who could not sue
• Dave ExtraCash: an advertised ceiling, an automated amount, and a case that never asks how the amount is set
• Oportun's legal-collections filing pipeline