The firm said it may pay as much as $80 million to affected clients -- with extra money for as many as 20,000 who lost cars, “as an expression of our regret.”

The revelation threatens to undermine the bank’s 10-month effort to restore its image after authorities announced last year that branch workers may have opened millions of unauthorized accounts for customers.

For shareholders, Thursday’s disclosure also landed without any warning, even after that earlier debacle sent the stock tumbling and prompted congressional hearings and a leadership shakeup.

‘Clearly insufficient’

“What has been shown is that the bank was run for superior revenue growth, and the controls around managing that were clearly insufficient,” Atlantic Equities analyst Christopher Wheeler said in an email. “Management changes may have to be more extensive to try and shake off the new and lower quality reputation.”

Wells Fargo said it began reviewing the insurance issue about 12 months ago after hearing from clients.

“Upon our discovery, we acted swiftly to discontinue the program and immediately develop a plan to make impacted customers whole,” Franklin Codel, the bank’s head of consumer lending, said in the statement. The bank’s leaders “are extremely sorry for any harm this caused our customers, who expect and deserve better from us,” he said.

An examination of the program, which was scrapped in September, found that an external vendor didn’t adequately ensure customers weren’t charged for the coverage -- known as collateral protection insurance -- if they already had their own policies, according to the bank’s statement.

About 490,000 customers unnecessarily paid for CPI for at least some period of time, the bank said. Collectively, they will receive about $25 million in refunds.

Other victims

Wells Fargo also described two smaller groups of victims where the impact on individuals may have been more severe:

About 60,000 clients lived in five states that don’t allow CPI to be imposed on borrowers without a specific notification, which the bank said they didn’t receive. That group will get $39 million.

An estimated 20,000 customers may have had cars repossessed because the additional costs from CPI, the bank said. It expects to spend $16 million on that group, compensating them for their vehicles.

The amounts “will depend on each customer’s situation and also will include payment above and beyond the actual financial harm as an expression of our regret for the situation,” Wells Fargo said.

The bank announced the measures a few hours after New York Times columnist and editor Gretchen Morgenson said she had obtained a 60-page report by consulting firm Oliver Wyman examining how CPI was imposed on customers of the bank’s Dealer Services unit.

The document shows Wells Fargo stopped sharing in commissions from the insurance sales in February 2013, she wrote.

Catherine Pulley, a Wells Fargo spokeswoman, declined to provide a copy of the consultant’s report. The report, commissioned to help the lender decide how to respond to its customers, was completed in February, according to a person with knowledge of the matter, who asked not to be identified discussing internal affairs.

Refunds coming

Wells Fargo reviewed policies placed from 2012 to 2017, according to its statement. The company will start sending letters and refund checks to customers next month, and expects the process will be complete by the end of the year. The lender also promised to work with credit bureaus to amend customers’ credit records.

Unnecessary or undisclosed insurance attached to loans has caused scandals at other major banks.

British lenders for years sold payment protection insurance on their consumer loans that customers didn’t want or need, and since 2011 have set aside more than $40 billion for the cost of reimbursing them.

The San Francisco-based bank has been trying to move past the account scandal that erupted publicly in September when it paid $185 million in fines.

In that case, Wells Fargo initially faulted low-level staff, saying it had fired more than 5,300 employees over five years as it sought to stamp out their abuses. That backfired as workers came forward, saying they faced intense pressure to meet unrealistic quotas.

The bank struck a different tone Thursday.

“We take full responsibility for our failure to appropriately manage the CPI program,” Codel said in the statement. The bank has publicly promised that it will do better, he said. “Our actions over the past year show we are acting on this commitment.”

Copyright 2018 Bloomberg. All rights reserved. This material may not be published, broadcast, rewritten, or redistributed.