ANTWERP, Ohio–The group of credit unions pursuing legal action against Fiserv over alleged cybersecurity deficiencies and costly contract termination fees has gained its first community bank plaintiff, expanding a series of lawsuits challenging the financial technology giant’s security practices and treatment of financial institution customers.
The Antwerp Exchange Bank Co., a community bank with branches in Ohio and Indiana, filed suit Oct. 8 in the U.S. District Court for the Northern District of Ohio, alleging Fiserv misrepresented the security of its technology systems, failed to adequately protect confidential customer information and sought to impose substantial fees on institutions attempting to leave its platforms.
The lawsuit represents the latest development in a growing legal challenge by smaller financial institutions against Fiserv, as the CU Daily has reported.
Charles Nerko, managing partner of NERKO PLLC, which represents the bank and credit union plaintiffs, said the addition of a community bank marks an expansion of the coalition’s efforts.
“We’re excited that a community bank has joined the coalition of credit unions taking Fiserv to court to seek accountability and fee relief,” Nerko said in a statement provided to The CU Daily. “The legal system gives credit unions and community banks a powerful tool to hold core processors accountable.”
NERKO PLLC represents Antwerp Exchange Bank alongside co-counsel Hecht Partners and Ogletree Deakins.
Bank Alleges Security Deficiencies Across Multiple Systems
Founded in 1893, Antwerp Exchange Bank alleges in its 43-page complaint that Fiserv failed to provide cybersecurity protections consistent with its contractual representations and federal security standards.
The lawsuit specifically alleges deficiencies in multifactor authentication (MFA), which requires users to verify their identities through more than one authentication factor.
According to the complaint, Fiserv represented that its cybersecurity practices aligned with standards established by the National Institute of Standards and Technology (NIST) and other recognized security organizations.
However, the bank alleges several Fiserv systems either lack MFA or rely on less secure authentication methods, including codes delivered by email or text message.
The complaint identifies alleged deficiencies in several products and platforms, including:
- Premier, Fiserv’s core account processing system.
- Virtual Branch, an online banking platform.
- Client360, a customer support and administrative portal.
- Integrated Teller, used for branch transactions.
- Business Process Manager and Fiserv Web Director.
- Online and mobile banking applications.
Additional Allegations
The bank alleges the systems provide access to sensitive information, including account numbers, transaction histories, Social Security numbers and other personally identifiable information.
It further contends Fiserv employs stronger authentication protections for its own corporate information than it provides for certain financial institution customers.
The bank claims those differences contradict Fiserv’s assurances that it would protect customer information using safeguards comparable to those employed for its own confidential data.
Seven-Figure Exit Fees Challenged
The lawsuit also challenges Fiserv’s alleged practice of imposing substantial early termination and deconversion fees when financial institutions seek to move to competing technology providers.
Antwerp Exchange Bank alleges it could face seven-figure charges if it attempts to terminate its relationship with Fiserv and transfer its customer records.
According to the complaint, those fees effectively leave the bank with a choice between continuing to use systems it considers inadequately secured or paying substantial amounts to move to another provider.
The bank argues Fiserv’s alleged misrepresentations about cybersecurity induced it to entrust sensitive customer information to the company and continue the business relationship.
The lawsuit seeks damages under the federal Defend Trade Secrets Act and Ohio Uniform Trade Secrets Act, along with injunctive relief intended to protect the bank’s confidential information.
Follows Marshall Community CU Lawsuit
The addition of Antwerp Exchange Bank follows a series of lawsuits filed by credit unions alleging similar security deficiencies and disputes involving termination fees.
As previously reported by The CU Daily, Marshall Community Credit Union in Michigan recently filed suit against Fiserv, alleging inadequate cybersecurity protections and challenging fees associated with leaving the company’s technology platforms.
The Antwerp Exchange Bank complaint specifically identifies several other credit unions that have pursued litigation against Fiserv, including Bessemer System Federal Credit Union, Cencap Federal Credit Union, Self-Help Credit Union, FiCare Federal Credit Union, POLAM Federal Credit Union, Educational & Governmental Employees Federal Credit Union and Midwest Family Federal Credit Union.
The cases involve allegations concerning Fiserv’s handling of confidential financial information, cybersecurity practices or contractual obligations.
The allegations have not been established as facts by the courts.
Coalition Points to Recent Court Ruling
The expanding coalition has also cited a recent legal development involving POLAM Federal Credit Union.
As previously reported by The CU Daily, a federal judge rejected Fiserv’s request to dismiss POLAM FCU’s lawsuit over alleged cybersecurity shortcomings.
The ruling allows the credit union’s legal challenge to proceed, although it does not establish that Fiserv violated the law or committed the alleged misconduct.
In another case, FiCare Federal Credit Union filed an emergency motion seeking records from Fiserv concerning alleged security problems involving its call center.
As previously reported by The CU Daily, FiCare alleged that Fiserv’s call center reactivated stolen debit and credit cards and that 18 fraudulent transactions had occurred.
The allegations involving FiCare remain subject to the court proceedings.
Bank Cites Other Security Incidents
In its complaint, Antwerp Exchange Bank also references reports of alleged cybersecurity incidents involving ransomware groups Everest and Cl0p.
The bank alleges it sought information from Fiserv about whether its confidential customer information had been affected by those incidents.
According to the lawsuit, Fiserv’s attorneys denied that the bank’s information had been compromised, but the bank contends it was not provided sufficient supporting documentation.
The complaint does not establish that Antwerp Exchange Bank’s customer information was stolen in either incident.
The filing also references a 2022 lawsuit brought by U.S. Courthouse SDNY Federal Credit Union, which raised concerns about online banking security and early termination fees. That litigation was resolved shortly after it was filed, according to the Antwerp Exchange Bank complaint.
Damages and Injunctive Relief Sought
Antwerp Exchange Bank is seeking monetary damages, including compensation for alleged losses and unjust enrichment, as well as exemplary damages and attorneys’ fees.
It is also requesting preliminary and permanent injunctive relief to protect its confidential customer information.
The bank has demanded a jury trial.
The lawsuit is The Antwerp Exchange Bank Company v. Fiserv Solutions LLC and Fiserv Inc., Case No. 3:26-cv-02648, in the U.S. District Court for the Northern District of Ohio.
