“The steady drip of revelations is concerning as it makes quantifying and qualifying the extent of the internal control failures difficult,” Isaac Boltansky, an analyst at Compass Point Research & Trading, said Friday in an email. “Which is worrisome for both Washington and Wall Street.”

An internal review of the bank’s auto lending found more than 500,000 clients may have unwittingly paid for protection against vehicle loss or damage while making monthly loan payments, even though many drivers already had their own policies, Wells Fargo said in a statement late Thursday. The firm said it may pay as much as $80 million to affected clients — with extra money for as many as 20,000 who lost cars, “as an expression of our regret.”

The revelation threatens to undermine the bank’s 10-month effort to restore its image after authorities announced last year that branch workers may have opened millions of unauthorized accounts for customers. For shareholders, Thursday’s disclosure also landed without any warning, even after that earlier debacle sent the stock tumbling and prompted congressional hearings and a leadership shakeup.

‘Clearly Insufficient’

“What has been shown is that the bank was run for superior revenue growth, and the controls around managing that were clearly insufficient,” Atlantic Equities analyst Christopher Wheeler said in an email. “Management changes may have to be more extensive to try and shake off the new and lower-quality reputation.”

Wells Fargo shares fell 2.5 percent to $53.37 at 12:09 p.m. in New York, the worst performance in the KBW Bank Index. The stock has dropped 3.1 percent this year, compared with the 3.9 percent advance of the 24-company index.

The San Francisco-based lender said it began reviewing the insurance issue about 12 months ago after hearing from clients.

“Upon our discovery, we acted swiftly to discontinue the program and immediately develop a plan to make impacted customers whole,” Franklin Codel, the bank’s head of consumer lending, said in the statement. The bank’s leaders “are extremely sorry for any harm this caused our customers, who expect and deserve better from us,” he said.

Kevin J. Barker, a Piper Jaffray & Co. analyst, questioned why Wells Fargo waited until now to release details. He said lawsuits could cost the bank “multiples more” than the $80 million disclosed Thursday and further harm its relationship with some customers.

‘Collateral Damage’

“Why didn’t the company address these issues publicly while they were already dealing with the account scandal?” Barker wrote Friday in a note to investors. “What other collateral damage may have been caused by the repossession of these cars on peoples’ lives?”

The bank notified its main regulator, the Office of the Comptroller of the Currency, “very promptly” after receiving a number of customer complaints in July of 2016, Codel said Friday in a phone interview, without giving a specific date. It also notified the Federal Reserve and the Consumer Financial Protection Bureau around the same time, he said.

“They were aware early on, and we’ve had regular conversations with them as we both made business decisions and started working on the remediation,” Codel said.

Bryan Hubbard, an OCC spokesman, said the agency can’t comment “on ongoing supervisory matters” at a bank it regulates or “potential pending actions.”

An examination of the program found that an external vendor didn’t adequately ensure customers weren’t charged for the coverage if they already had their own policies, according to the bank’s statement. The bank’s program for collateral protectioninsurance insurance, or CPI, was scrapped in September.

Other Victims

One group of about 490,000 customers unnecessarily paid for CPI for at least some period, the bank said. Collectively, they will receive about $25 million in refunds.

Wells Fargo also described two smaller groups of victims where the impact on individuals may have been more severe:

About 60,000 clients lived in five states that don’t allow CPI to be imposed on borrowers without a specific notification, which the bank said they didn’t receive. That group will get $39 million. An estimated 20,000 customers may have had cars repossessed because the additional costs from CPI, the bank said. It expects to spend $16 million on that group, compensating them for their vehicles. The amounts “will depend on each customer’s situation and also will include payment above and beyond the actual financial harm as an expression of our regret for the situation,” Wells Fargo said.

The bank announced the measures a few hours after New York Times columnist and editor Gretchen Morgenson said she had obtained a 60-page report by consulting firm Oliver Wyman examining how CPI was imposed on customers of the bank’s Dealer Services unit. The document shows Wells Fargo stopped sharing in commissions from the insurance sales in February 2013, she wrote.

Refunds Coming

Catherine Pulley, a Wells Fargo spokeswoman, declined to provide a copy of the consultant’s report. The report, commissioned to help the lender decide how to respond to its customers, was completed in February, according to a person with knowledge of the matter, who asked not to be identified discussing internal affairs.

Wells Fargo reviewed policies placed from 2012 to 2017, according to its statement. The company will start sending letters and refund checks to customers next month, and expects the process will be complete by the end of the year. The lender also promised to work with credit bureaus to amend customers’ records.

The bank has been trying to move past the account scandal that erupted publicly in September when it paid $185 million in fines. In that case, Wells Fargo initially faulted low-level staff, saying it had fired more than 5,300 employees over five years as it sought to stamp out their abuses. That backfired as workers came forward, saying they faced intense pressure to meet unrealistic quotas.

The bank struck a different tone Thursday.

“We take full responsibility for our failure to appropriately manage the CPI program,” Codel said in the statement. The bank has publicly promised that it will do better, he said. “Our actions over the past year show we are acting on this commitment.”