(Credit: code6d/iStockphto.com)

The Consumer Financial Protection Bureau has sent a message to banks: When peddling overdraft services, keep an eye on third-party vendors hired to call and enroll customers.

Santander Bank learned that lesson the hard way Thursday. The CFPB fined the Delaware-based bank $10 million for charging customers for overdraft services without their consent. With a rule on overdraft programs expected to come out of the CFPB this year, the fine reflected the agency’s increased attention on a financial service that generated billions of dollars in revenue for banks last year, according to a recent agency report.

The CFPB faulted Santander for lax oversight of its third-party telemarketers, who enrolled customers in overdraft protection between 2010 and 2014—in some cases, without asking if they wanted the service. In charging those customers $35 per overdraft, Santander violated a 2010 rule that requires banks and credit unions to obtain affirmative consent, according to the CFPB consent order.

“Santander tricked consumers into signing up for an overdraft service they didn’t want and charged them fees,” Richard Cordray, director of the CFPB, said in a prepared statement. “Santander’s telemarketer used deceptive sales pitches to mislead customers into enrolling in overdraft service. We will put a stop to any such unlawful practices that harm consumers.”

Wilmer Cutler Pickering Hale and Dorr represented Santander at the CFPB. The bank said in a statement: “We regret that the vendor we hired to promote this service may not have followed our instructions and we did not supervise them as closely as we should have. These actions, which occurred several years ago, do not reflect our values and fell short of the high expectations we have for ourselves and our vendors.”

Santander’s statement said the bank is “terminating our relationship with the vendor and are continuing to implement additional controls to ensure more effective oversight of our vendors and our processes.”

According to the CFPB, Santander rewarded its third- party telemarketers with higher pay for persuading customers to opt into overdraft services. In some of the calls, consumers said they did not want to sign up for overdraft service but requested more information. The telemarketers still enrolled these consumers in the service, setting them up for the $35 overdraft fee.

During a pilot test of the call campaign in 2010, Santander learned that the customer service representatives were being “overly aggressive,” according to the consent order. In response, Santander temporarily halted the program to conduct more training. But in the years that followed, the customer service representatives returned to their former ways, according to the CFPB, deviating from scripts and misrepresenting that the service was free when, in fact, it could cost cost customers hundreds of dollars in fees.

Under the terms of the consent order, Santander is required to contact the customers who were enrolled through the telemarketer and ask whether they wish to keep the overdraft service. Santander is also prohibited from using a vendor to telemarket overdraft services. For other financial products, the bank is required to develop a revised policy to improve its oversight of telemarketers.

The consent order included transcripts of conversations between telemarketers and customers, showing that the CFPB is “looking behind the curtain at actual bank practices and not just policies,” said Rachel Rodman, counsel at Arnold & Porter.

“If you have a sales and marketing program around your overdraft service, you should be taking a very careful look at what your reps are saying to customers,” said Rodman, a former CFPB attorney. “The CFPB is going to look at those specifics. They looked at calls, they didn’t just look at procedures here.”

Read the CFPB consent order below.