The Office of the Comptroller of the Currency on April 9 assessed a $25 million penalty against Bank of America and its credit card subsidiary FIA Card Services, and ordered restitution totaling approximately $459.5 million to 1.9 million consumer accounts.

The OCC found that the bank's billing practices, specifically add-on charges for identity theft protection, violated Section 5 of the Federal Trade Commission Act, which prohibits unfair and deceptive acts or practices.

The $25 million civil money penalty reflects a number of factors, including the scope and duration of the violation and financial harm to consumers from the unfair practices.

The restitution will be paid to the U.S. Treasury to benefit consumers who enrolled in and paid for identity theft protection products between October 2000 and September 2011, but did not receive the full benefit of the products, the OCC said. The restitution will include the full amount paid for these products, plus any associated over-limit fees and finance charges.

The OCC order also requires the bank to improve governance of third-party vendors associated with add-on consumer products and submit a risk management program for add-on consumer products marketed or sold by the bank or its vendors.

The OCC is coordinating its action with the CFPB, which also issued a separate order against the bank. Restitution payments pursuant to the OCC's order will satisfy identical obligations required by the CFPB.