The company and its CEO agreed to refund about $1 million in deposits to harmed consumers and pay $100,000 in civil penalties.