pay a $1 million “civil penalty” to CFPB’s victim relief fund