Expert Declaration of Russell Cronan (Exhibit 3) — In re Bank of America California Unemployment Benefits Litigation (Dkt. 350-4, S.D. Cal. No. 3:21-md-02992)

Record facts

U.S. District Court for the Southern District of California · No. 3:21-md-02992-GPC-MSB · Doc. 350-4 · 2024-10-24 · Docket on CourtListener

Full text

EXHIBIT 3
FILED 
PROVISIONALLY 
UNDER SEAL WITH 
REDACTIONS 
PURSUANT TO 
STIPULATED 
PROTECTIVE ORDER
Case 3:21-md-02992-GPC-MSB     Document 350-4     Filed 10/24/24     PageID.10994 
Page 1 of 36

HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY 
UNITED STATES DISTRICT COURT 
SOUTHERN DISTRICT OF CALIFORNIA 
SAN DIEGO DIVISION 
IN RE: BANK OF AMERICA 
CALIFORNIA UNEMPLOYMENT 
BENEFITS LITIGATION 
 Case No. 3:21-md-02992-GPC-MSB 
DECLARATION OF RUSSELL CRONAN 
October 24, 2024 
FILED PROVISIONALLY UNDER SEAL
PURSUANT TO STIPULATED PROTECTIVE ORDER
Case 3:21-md-02992-GPC-MSB     Document 350-4     Filed 10/24/24     PageID.10995 
Page 2 of 36

HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY 
2 
 
Table of Contents 
 
I. 
Qualifications......................................................................................................................... 3 
II. 
Scope of Declaration ......................................................................................................... 5 
III. 
Summary of Opinions ....................................................................................................... 6 
IV. 
Relevant Background ....................................................................................................... 7 
A. 
Regulators Expect Banks to Manage the Institution’s Safety and Soundness, 
Including the Development of Procedures for Preventing Fraud Losses. ........................... 7 
B. 
The Regulation E Investigative Process .......................................................................... 9 
C. 
Regulators Afford Banks Latitude in Conducting Reasonable Investigations. ........ 11 
D. 
Reasonable Investigations Can Include Automated Tools. ......................................... 13 
V. 
It Was Reasonable for Bank of America to Believe that Its Response to the Explosion 
of Pandemic-Era Prepaid Card Fraud Would Have Been Acceptable to the Bank’s 
Regulators. ................................................................................................................................... 14 
VI. 
 
 ............................. 18 
VII. 
The Kreis Report Ignores the Reality of the Bank’s Position During Unprecedented 
Circumstances. ............................................................................................................................ 22 
 
 
 
 
 
 
 
 
 
 
 
 
Case 3:21-md-02992-GPC-MSB     Document 350-4     Filed 10/24/24     PageID.10996 
Page 3 of 36

HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY 
3 
I. 
Qualifications 
1. 
I am currently the President of Compliance Risk Advisors LLC, which is a limited 
liability company I founded in 2021.  Prior to founding Compliance Risk Advisors, since mid-
2019, I provided similar independent consulting services.  During this time as a consultant, I have 
advised depository institutions, nonbank depository institutions, FinTech firms, and government 
entities regarding regulatory compliance matters, which in the banking industry generally refers to 
a framework of consumer-centric regulations, including Regulation E, among many others. 
2. 
Prior to becoming an independent consultant, I worked for approximately 30 years 
as a federal bank examiner, specializing in compliance, at the Federal Deposit Insurance 
Corporation (“FDIC”), the Federal Reserve Bank of St. Louis, the Office of the Comptroller of the 
Currency (“OCC”), and the Consumer Financial Protection Bureau (“CFPB”). 
3. 
I achieved Commissioned Examiner status at each of these agencies.  Earning a 
commission confers on an examiner the opportunity and responsibility to be an Examiner in 
Charge, which is the professional responsible for the successful planning, execution, and 
completion of examinations or a series of examination activities over an examination cycle.   
4. 
As an examiner and Examiner in Charge, I participated in thousands of examination 
activities for hundreds of depository and non-depository institutions, including many of the largest 
banks in the United States.  In numerous cases, this included assessing procedures for their 
effectiveness in complying with all aspects of Regulation E, including procedures for resolving 
Regulation E errors.  My assignments included but were not limited to: 
a. 
Serving as the CFPB’s Examiner in Charge (a/k/a Lead Examiner) for one of the 
top five largest banks in the country by asset size.  In this role, I was responsible 
for the day-to-day implementation of the CFPB’s supervision/examination 
Case 3:21-md-02992-GPC-MSB     Document 350-4     Filed 10/24/24     PageID.10997 
Page 4 of 36

HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY 
4 
function, which included evaluating the bank’s procedures for their effectiveness 
in complying with Regulation E. 
b. 
Serving as the OCC’s Compliance Functional Examiner in Charge for a $38 billion 
bank (among the top 10 in the country in terms of its mortgage lending operation) 
which was in the OCC’s Large Bank Supervision program.  In this role, I was 
responsible 
for 
the 
day-to-day 
implementation 
of 
the 
OCC’s 
supervision/examination of procedures for effectiveness in consumer compliance, 
which at that time included Regulation E compliance. 
5. 
In my 30 years of conducting regulatory examinations, I developed an extensive 
knowledge of regulations, industry practices, and how banks manage -- and are expected to manage 
-- their procedures for meeting their compliance obligations.  With respect to Regulation E 
specifically, I reviewed many banks’ investigation processes and assessed their reasonableness.  In 
doing so, I developed a deep understanding of how different banks and how the different bank 
regulatory agencies approach these investigations, along with a deep understanding of practices 
across the industry. 
6. 
In addition, during my 30 years with these agencies, I further buttressed my industry 
expertise by (1) completing thousands of hours of classroom and on-the-job training sponsored by 
the agencies; and (2) attending scores of ongoing compliance conferences and schools sponsored 
by the agencies and industry groups (e.g., the American Bankers Association). 
7. 
In further recognition of my knowledge and expertise relating to banking matters, 
I earned four industry certifications: (1) Certified Regulatory Compliance Manager, which is the 
industry’s leading compliance certification from the American Bankers Association; (2) Certified 
Risk Professional (Compliance) from the Bankers Administration Institute; (3) Certified Anti-
Case 3:21-md-02992-GPC-MSB     Document 350-4     Filed 10/24/24     PageID.10998 
Page 5 of 36

HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY 
5 
Money Laundering Specialist, which is the industry’s leading certification regarding the Bank 
Secrecy Act, anti-money laundering, and Office of Foreign Assets Control compliance from the 
Association of Certified Anti-money Laundering Specialists; and (4) Anti-money Laundering 
Professional from the Bankers Administration Institute. 
8. 
My curriculum vitae is attached as Appendix A.  I am being compensated at a rate 
of $650 per hour.  In conducting my work on this matter, I have been assisted by individuals at 
Ankura Consulting Group, LLC (“Ankura”),1 who worked at my direction and under my 
supervision.  All opinions expressed herein are my own. I have not provided expert testimony in 
the past four years, and I have not authored any publications in the past 10 years.  In preparing this 
declaration, I personally considered various documents produced in this litigation and other 
materials, which are identified in Appendix B. 
II. 
Scope of Declaration 
9. 
I have been retained by Goodwin Procter LLP, on behalf of Bank of America, N.A. 
(“Bank of America” or the “Bank”) in connection with this matter.  This declaration (1) provides 
background on the Electronic Fund Transfer Act (“EFTA”) (5 U.S.C. 1693 et seq.) as implemented 
by Regulation E and the Regulation E investigative process, including the nature of Regulation E 
claims-handling, both leading up to and during the global pandemic, (2) discusses the impact of 
the unprecedented explosion of prepaid-card fraud during the pandemic on Bank of America’s 
Regulation E investigative process, and (3) addresses certain opinions and assumptions put forth 
in the Expert Class Certification Report of J. Daniel Kreis dated August 29, 2024 (“Kreis Report”) 
 
1 Ankura is a professional services and consulting firm that provides dispute-related, 
investigative, financial, and operational consulting services to various types of organizations. 
Case 3:21-md-02992-GPC-MSB     Document 350-4     Filed 10/24/24     PageID.10999 
Page 6 of 36

HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY 
6 
and certain assumptions put forth in the Expert Class Certification Report of Greg J. Regan dated 
August 29, 2024 (“Regan Report”).2 
III. 
Summary of Opinions 
10. 
First, as a former banking regulator, it is my experience that regulators have 
historically afforded banks discretion in balancing the institution’s safety and soundness and 
consumer protection obligations.  This includes discretion to determine the appropriate scope of 
Regulation E investigations.  Therefore, it is my opinion that, given the unprecedented fraud facing 
Bank of America during the pandemic, it was reasonable for the Bank to believe that its use of the 
Claim Fraud Filter would have been viewed as acceptable by its regulators. 
11. 
Second, as a former banking regulator, it is my experience that no monitoring 
systems designed to detect unusual/suspicious/illegal activity, including fraud, will successfully 
detect 100% of such activity.  It is also my experience that banks that enter into regulatory 
settlements or consent orders typically take an extremely consumer-friendly approach, to ensure 
that every potentially harmed consumer receives compensation, even if that means that unharmed 
consumers are also compensated.  Therefore, it is my opinion that 
 
. 
12. 
Third, as a former banking regulator, it is my experience that regulators have 
historically viewed banks’ actions and inactions in the context of the circumstances in which those 
 
2 This declaration does not respond to all of the opinions in the Kreis Report and the Regan 
report. It only responds to those specific opinions or assumptions that counsel has asked me to 
respond to for purposes of opposing Plaintiffs’ Motion for Class Certification.  I reserve the right 
to respond to additional opinions or assumptions in the Kreis Report and/or Regan Report if 
asked to do so by counsel in the future. 
 
Case 3:21-md-02992-GPC-MSB     Document 350-4     Filed 10/24/24     PageID.11000 
Page 7 of 36

HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY 
7 
actions and inactions occur.  Therefore, it is my opinion that Plaintiffs’ expert Kreis’s focus on 
Bank of America’s pre-pandemic manual investigation procedures, while ignoring the pandemic 
circumstances in which the Bank was confronted with unprecedented fraud and an unprecedented 
number of error claims, renders his conclusions unreliable.  It is also my opinion that neither of 
the alternative solutions that Kreis proffers – that the Bank should have simply increased hiring or 
paid lower value claims without any investigation at all – were viable solutions to the 
unprecedented wave of fraud facing the Bank.     
IV. 
Relevant Background 
A. 
Regulators Expect Banks to Manage the Institution’s Safety and Soundness, 
Including the Development of Procedures for Preventing Fraud Losses. 
13. 
Bank of America’s prudential regulator, the OCC, oversees safety and soundness, 
which includes an institution’s obligations to control operational losses, including fraud losses.  
The OCC expects banks to identify, measure, monitor, and control risk through risk-management 
programs that promptly adapt to changing circumstances and risk features, including fraud 
typologies and fraud losses.   
14. 
These safety and soundness obligations are clearly set forth in several OCC 
Comptroller’s Handbooks.  These Handbooks, which span several series and which I referred to 
regularly over my career as an examiner, notably include a Safety and Soundness series (e.g., 
Corporate and Risk Governance and Internal Control).   
15. 
In general, the guidance outlined in these Handbooks (some of which are codified 
in regulations) provides that a financial institution will implement and oversee systems to identify, 
Case 3:21-md-02992-GPC-MSB     Document 350-4     Filed 10/24/24     PageID.11001 
Page 8 of 36

HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY 
8 
measure, monitor, and control risk.3  This would include losses, and specifically fraud losses, to 
the bank.  It is further expected that these systems will evolve as risks do.  The Comptroller’s 
Handbook related to Internal Control notes that a bank is “responsible for establishing and 
maintaining effective internal control that meets statutory and regulatory requirements and 
responds to changes in the bank’s environment and conditions.”4  There is yet additional guidance 
related specifically to the risks that fraud presents to a bank’s safety and soundness.5 
16. 
Moreover, “covered banks” (i.e., those with more than $50 billion in assets), which 
includes Bank of America, are subject to heightened standards of risk management.6  Banks 
meeting this definition generally have more complex operations and face higher levels of risk in 
their operations.  Consequently, the OCC expects such covered banks to have more robust risk 
management systems to identify, measure, monitor, and control risk.  The OCC applies enhanced 
scrutiny to banks covered by the heighted standards, as described by then Comptroller of the 
Currency, Thomas Curry, when he noted, “The 2008 financial crisis demonstrated that much 
stronger supervisory standards would be necessary to manage the risks associated with large, 
complex financial institutions… As a result, the OCC raised its standards for risk management, 
corporate governance, and control to help ensure these institutions effectively anticipate, evaluate, 
and mitigate the risks they face.”7 
 
3 Declaration of Laura Brys in Support of Defendant’s Opposition to Plaintiffs’ Motion for Class 
Certification, Ex. (“DX”) 106, See Comptroller's Handbook: Corporate and Risk Governance | 
OCC (page 42).   
4 DX 107, See Comptroller's Handbook: Internal Control | OCC (page 15).   
5 DX 108, See OCC Bulletin 2019-37, July 24, 2019. 
6 DX 109, See Comptroller's Handbook: Large Bank Supervision | OCC (page 13).   
7 See OCC News Release, “OCC Finalizes Its Heightened Standards for Large Financial 
Institutions”, September 2, 2014.  https://www.occ.gov/news-issuances/news-releases/2014/nr-
occ-2014-117.html (Last accessed October 17, 2024).  
 
Case 3:21-md-02992-GPC-MSB     Document 350-4     Filed 10/24/24     PageID.11002 
Page 9 of 36

HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY 
9 
17. 
The OCC expects that banks will adequately manage risk, and the agency will hold 
bank management accountable to the extent they do not do so.  In such cases, bank management, 
and the bank itself, can receive lower ratings, supervisory actions, and informal enforcement 
actions.  Lower ratings that result in a troubled condition designation can result in higher deposit 
insurance premiums, among other adverse consequences.  In cases where the OCC judges risk 
management to be materially deficient, a bank could receive a formal enforcement action, and/or 
a civil money penalty, and/or a banker could receive a civil money penalty and/or be banned from 
banking.  Over my 30-year regulatory career, I wrote or contributed to many “Matters Requiring 
Attention” and formal enforcement actions that directed bank management to develop and/or 
enhance risk management practices.    
18. 
Based on my own experience with the OCC, the OCC would not consider 
uncontrolled fraud losses to be an effectively managed risk, and the OCC could deem it an unsafe 
and unsound banking practice.8  
 
 
 This would be an unacceptable risk from 
the perspective of the OCC. 
B. 
The Regulation E Investigative Process 
19. 
The U.S. Congress enacted the EFTA in 1978 with the purpose of providing “a 
basic framework establishing the rights, liabilities, and responsibilities of participants in electronic 
fund transfer systems.”9  Regulation E implemented the EFTA and provided certain protections to 
consumers when they use electronic fund transfers, including requiring financial institutions to 
 
8 See 12 CFR Appendix-A-to-Part-30 A. 4. 
9 See Public Law 95-630; 92 Stat. 3728.   
Case 3:21-md-02992-GPC-MSB     Document 350-4     Filed 10/24/24     PageID.11003 
Page 10 of 36

HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY 
10 
implement error correction resolution procedures. Among other things, Regulation E outlines what 
constitutes an error, of which unauthorized transactions are one example, and sets forth what is 
required of banks in investigating consumers’ error claims (including unauthorized transactions).  
20. 
 From my decades of experience as a federal banking regulator with multiple 
agencies, I understand and have applied these requirements during examinations across the 
industry when evaluating the effectiveness of institutions’ processes for compliance.  As an 
examiner at each of the major banking regulators, including Bank of America’s two primary 
banking regulators (i.e., the OCC and the CFPB), I have reviewed every aspect of the Regulation E 
investigative processes, across many banks, from start to finish. 
21. 
My evaluation of the processes institutions use to comply with Regulation E begins 
with the premise that an account must be established primarily for personal, family, or household 
purposes in order to be subject to the investigative requirements under Regulation E.10    Notably, 
regulators do not consider accounts established by criminals as a means of committing fraud as 
being subject to Regulation E.  That was unambiguously the case throughout my 30 years with the 
agencies, and I am aware of no regulator that would have regarded it as consistent with the intent 
and purpose of Regulation E for its consumer protections to apply to criminals to aid them in 
stealing money from publicly insured depository institutions.   
22. 
Additionally, regulators make distinctions in terms of items that constitute errors 
under Regulation E and those that do not.  These distinctions are important because errors under 
Regulation E generally require investigation by the relevant bank, which may also include the bank 
extending provisional credit under the error resolution process.  Claims of unauthorized 
 
10 See 12 CFR § 1005.2(b)(1).  
Case 3:21-md-02992-GPC-MSB     Document 350-4     Filed 10/24/24     PageID.11004 
Page 11 of 36

HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY 
11 
transactions and requests for certain information are examples of errors under Regulation E.11   
Regulators have not considered the act of freezing an account in response to suspected fraud to 
implicate Regulation E.12    
C. 
Regulators Afford Banks Latitude in Conducting Reasonable Investigations. 
23. 
If a consumer alleges an error recognized under Regulation E – for example, an 
unauthorized transaction – the processes expected of financial institutions include an investigation 
to determine if an error occurred.  Because the statute does not set forth specific parameters on 
what an investigation should entail, regulators allow institutions some latitude in exercising their  
judgment in determining the scope of a particular investigation based on the range of 
circumstances and conditions that can arise.  In fact, every regulatory agency I have worked with 
expects banks to exercise such judgment. 
24. 
To that end, the regulatory agencies require banks to maintain risk management 
systems that are designed to adapt to changing circumstances and risk and will criticize banks who 
do not do so.13  As an example, if a bank introduces a new card product that, based on the sheer 
volume of new transactions, results in a surge in the number of error claims, regulators will expect 
the bank to adapt its processes in order to effectively handle the increased volume of claims.  One 
way a bank might do so would be to automate aspects of the investigative process to increase the 
efficiency of its claims-handling process.   
25. 
In my experience, regulators understand that Regulation E allows for innovation so 
that banks can appropriately respond to the kind of dynamic and sometimes novel challenges that 
 
11 See 12 CFR § 1005.11(a)(1). 
12 Id. 
13 These risk management expectations are laid out in various regulatory examination materials, 
such as the OCC Comptroller’s Handbooks, which are discussed in more detail below. 
Case 3:21-md-02992-GPC-MSB     Document 350-4     Filed 10/24/24     PageID.11005 
Page 12 of 36

HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY 
12 
will arise over time.  Over the course of my 30-year career as an examiner, some of the very real 
challenges banks faced included natural disasters, system failures, distressed economic conditions, 
and the scarcity of qualified personnel, among several others. The flexibility to respond to 
changing circumstances is fundamental to banks’ effective risk management and is likewise a 
feature of investigations under Regulation E. 
26. 
This approach is consistent with commentary issued by the Board of Governors of 
the Federal Reserve System (“FRB”), which administered Regulation E before the enactment and 
implementation of the Dodd-Frank Wall Street Reform and Consumer Protection Act, to facilitate 
compliance by financial institutions within the Regulation.  The FRB commented that: 
a. 
“Because the nature of a consumer’s allegation of error can vary, the scope 
of an investigation may vary;”14 and 
b. 
“Institutions have flexibility to determine what information is relevant to a 
meaningful investigation of the error in question.”15   
27. 
This language has guided bank regulators when assessing the reasonableness of 
banks’ investigations, and I applied it many times over several decades.  As an examiner, I did not 
apply a rigid set of criteria as to the specific form an investigation must take because I understood 
from my years of training and experience that the reasonableness of a bank’s investigative process 
was dependent on the conditions and circumstances in which the investigation was conducted and 
the bank needed latitude to be able to adapt its approach accordingly.  This was not merely my 
experience.  Specific criteria and instructions prescribing the form of a Regulation E investigation 
simply do not exist.  
 
 
14 DX 110, See Bd. of Govs. of Fed. Reserve System, Electronic Fund Transfers, 71 Fed. Reg. 
1638, 1654 (Jan. 10, 2006) (emphasis added). 
15 Id. (emphasis added). 
Case 3:21-md-02992-GPC-MSB     Document 350-4     Filed 10/24/24     PageID.11006 
Page 13 of 36

HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY 
13 
D. 
Reasonable Investigations Can Include Automated Tools. 
28. 
Over the course of my work as a federal banking examiner, I observed banks that 
have automated various elements of the investigation process, not only in response to high volumes 
but even during generally uneventful time periods.  Examples include automated information 
gathering through web interfaces, automated calculation of provisional credits and consumer 
liability, and automated generation of consumer communications. The adoption of such automated 
features to aid or support an investigation has only become more prevalent over time.   
29. 
During my 30 years working with each of the current federal banking regulatory 
agencies, no regulator to my knowledge has ever considered such features inherently unreasonable 
in terms of a Regulation E investigation.  I also did not participate in any examinations where a 
financial institution’s use of automation in conducting Regulation E investigations was criticized 
by the regulators as a per se violation of Regulation E.  Nor did I hear or read about such criticism 
during my time as a banking regulator or since.   
30. 
Further to that end, there are a number of companies that sell automated solutions 
to support compliance with Regulation E’s investigation requirements.16  I have not reviewed and 
am not endorsing these companies or products; however, the mere fact that they are permitted to 
offer these products to the regulated banking industry speaks to the point that the usage of such 
automation is an accepted industry concept.  In other words, if the regulators believed the mere 
use of these products as part of an investigation violated Regulation E, there would likely be public 
records indicating as much. Therefore, the fact that these companies actively market these products 
to banks supports my own direct experience that there is no prohibition against banks’ use of 
automation in conducting Regulation E investigations. 
 
16 Examples include Financial Back Office Automation (“FINBOA”) and Fiserv. 
Case 3:21-md-02992-GPC-MSB     Document 350-4     Filed 10/24/24     PageID.11007 
Page 14 of 36

HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY 
14 
31. 
In brief, financial institutions understand Regulation E to require reasonable 
investigations of error claims.  Prior to the consent orders entered into between Bank of America 
and the CFPB and OCC in July 2022, I am not aware of any specific prescriptive elements about 
the nature of the investigation to be conducted, including any specific prescriptions about the use 
of automated fraud strategies.17  In my experience, Regulation E allows for innovation so that 
banks can appropriately respond to the kind of dynamic and sometimes novel challenges that will 
arise over time. 
V. 
It Was Reasonable for Bank of America to Believe that Its Response to the Explosion 
of Pandemic-Era Prepaid Card Fraud Would Have Been Acceptable to the Bank’s 
Regulators.  
32. 
In typical circumstances, a financial institution’s adherence to safety and soundness 
principles would not affect the conduct of its Regulation E investigations.  But that unusual 
scenario is exactly what occurred with the unprecedented spike in fraud experienced by 
California’s Employment Development Department (“EDD”) and, in turn, Bank of America, 
during the summer of 2020.18 Those extraordinary circumstances were the backdrop in which the 
Bank modified its approach to conducting its Regulation E investigations. 
33. 
Financial institutions need processes to comply with Regulation E’s requirements 
on issuing provisional credit equal to an alleged error amount while investigating the error.  During 
the pandemic, criminals took advantage of these processes to defraud Bank of America (among 
other institutions) on an unprecedented scale and would have continued to do so had the Bank not 
altered its pre-pandemic approach.19 
 
17 There is no additional guidance from the Federal banking regulators of which I am aware that 
provides additional information for the industry to consider when conducting investigations. 
18 DX 6, See Michael Letson October 23, 2024 Declaration, ¶ 10 through ¶ 25. 
19 Id. 
Case 3:21-md-02992-GPC-MSB     Document 350-4     Filed 10/24/24     PageID.11008 
Page 15 of 36

HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY 
15 
34. 
As Bank employee Michael Letson noted in his February 16, 2024 deposition, 
 
 
 
 
   
35. 
Beginning around the summer of 2020, the Bank began to recognize a new fraud 
scenario referred to as 
  
 
 
 
 
 
 
36. 
The Bank’s 
 
 in the face of the unprecedented level of fraud and the corresponding rise in 
Regulation E error claims.24  As Michael Letson further stated in his February 16, 2024 deposition, 
 
 
20 See Michael Letson February 16, 2024 Deposition transcript; pages 169-170. 
21 DX 6, See Michael Letson October 23, 2024 Declaration, ¶ 27. 
22 A California State Auditor Report from January 2021, states, “…EDD’s lack of preparation 
left it unable to manage two important fraud-related situations that arose during its 2020 
pandemic response.  In September 2020, because of fraud concerns, EDD directed Bank of 
America to freeze 344,000 debit cards (accounts) that it used to provide benefit payments to 
claimants… EDD was also unprepared to prevent payment of fraudulent claims filed under the 
names of incarcerated individuals, the total of which is an estimated $810 million.”  DX 88, See 
BANA_EDD_MDL-00080296 (BANA_EDD_MDL-00080294-BANA_EDD_MDL-00080352).  
DX 6, See Michael Letson October 23, 2024 Declaration, ¶ 27. 
23 See William Matthew Martin February 14, 2024 Deposition transcript; pages 102-103.  DX 6, 
See Michael Letson October 23, 2024 Declaration, ¶ 10 through ¶ 25. 
24 DX 6, See Michael Letson October 23, 2024 Declaration, ¶ 26 through ¶ 27. 
Case 3:21-md-02992-GPC-MSB     Document 350-4     Filed 10/24/24     PageID.11009 
Page 16 of 36

HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY 
16 
 
    
37. 
Based on my experience as a regulator, I would expect that as the nature of the error 
claims changed (e.g., 
 
) and the volume of such claims dramatically 
increased, the Bank would have adapted to the changing risk.  In my experience, a reasonable 
adaptation would include leveraging automation and other tools to identify indicia of potential 
fraud.  Large banks have long used automated processes to identify indicia of potentially fraudulent 
activity based on various sources (e.g., information about emerging typologies provided by law 
enforcement or regulatory agencies, historical industry knowledge, and a bank’s own observations 
and experience).      
38. 
I understand that the Bank did so adapt, and that in doing so, the Bank 
 
 
26  I understand that the Bank used the CFF 
to conduct investigations 
 
  Based on my review of the discovery record in this 
case, 
 
 
 
25 See Michael Letson February 16, 2024 Deposition transcript; pages 108-109. 
26 See Michael Letson February 16, 2024 Deposition transcript; pages 97-98, 332-333.  DX 6, 
See Michael Letson October 23, 2024 Declaration, ¶ 26 through ¶ 38. 
27 See William Matthew Martin February 14, 2024 Deposition transcript; pages 24-25. 
Case 3:21-md-02992-GPC-MSB     Document 350-4     Filed 10/24/24     PageID.11010 
Page 17 of 36

HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY 
17 
  
 
  
39. 
As I described above, regulators historically have permitted and expected that 
financial institutions will adapt their investigation procedures to changing circumstances.  Had I 
reviewed this situation as an examiner, I would have expected that the Bank would have altered 
its approach to Regulation E investigations given the dramatic change in circumstances.  Based on 
my experience and longstanding industry practice, the Bank’s use of automation was not 
unreasonable or impermissible simply because the fraud targeted Regulation E error claims.  
40. 
The unprecedented spike in fraud that arose in connection with the pandemic-era 
unemployment benefits programs administered by the EDD is the kind of circumstance regulators 
historically have considered in assessing the reasonability of the investigation procedure deployed 
in response.  This element of discretion allows financial institutions and the agencies supervising 
them to structure and adapt their investigations to take into account a variety of factors such as the 
overall fraud environment and the dollar value of the claims. 
41. 
To this point, a California State Auditor Report from January 2021 noted that “EDD 
did not take substantive action to bolster its fraud detection efforts for its UI program until months 
into the pandemic, resulting in payments of about $10.4 billion for claims that it has since 
determined may be fraudulent because it cannot verify the claimants’ identities.”30   
 
28 DX 23, See Bank of America’s Responses And Objections To Plaintiff Yick’s Fourth Set Of 
Interrogatories, Case No. 3:21-md-02992-GPC-MSB, page 8. 
29 See Plaintiffs’ Notice of Motion and Motion for Class Certification, Case No. 3:21-md-02992-
GPC-MSB, page 3. 
30 DX 88, See BANA_EDD_MDL-00080296 (BANA_EDD_MDL-00080294-
BANA_EDD_MDL-00080352). 
Case 3:21-md-02992-GPC-MSB     Document 350-4     Filed 10/24/24     PageID.11011 
Page 18 of 36

HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY 
18 
42. 
Based on the materials I have reviewed in this case and as informed by my 30 years 
of experience with the OCC, CFPB, Federal Reserve, and FDIC, in my opinion, the manner in 
which the Bank conducted its Regulation E investigations was principally a reflection of its efforts 
to balance its safety and soundness obligations and its Regulation E obligations in the face of 
unprecedented fraud and claim volume.  The Bank would have understood and expected that, based 
on their expertise in the industry, regulators would have considered these circumstances in 
evaluating the reasonableness of the Bank’s processes.  To that point, my knowledge gained 
through 30 years as an examiner was built upon the vast institutional experience of the regulatory 
agencies (over 160 years, in the OCC’s case), which was in turn imparted to examiners such as 
myself.    
43. 
I am aware that, in July 2022, Bank of America entered into consent orders with 
the CFPB and the OCC regarding, among other issues, its use of the CFF in connection with 
Regulation E investigations.   
44. 
In my opinion, based on my experience and perspective as a former regulator, the 
Bank’s approach to modifying its Regulation E investigative process was a reasonable response in 
light of the unprecedented fraud environment it was facing and its urgent need to address its safety 
and soundness obligations.  It is further my opinion, based on my experience and perspective as a 
former regulator, that it was reasonable for Bank of America to believe that its regulators would 
consider its approach to modifying its Regulation E investigative process a reasonable response to 
the proliferation of benefits and cardholder fraud.  
VI. 
 
 
 
 
 
45. 
I understand that Plaintiffs define their Claim Denial class as “[a]ll Bank of 
America EDD cardholders who notified the Bank that an unauthorized transaction had occurred 
Case 3:21-md-02992-GPC-MSB     Document 350-4     Filed 10/24/24     PageID.11012 
Page 19 of 36

HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY 
19 
on their Bank of America EDD debit card account (‘Claim’) at an automated teller machine 
(‘ATM’), and whose Claim the Bank denied or closed at any time from September 28, 2020 
through June 8, 2021, based solely on Indicator 1 of the Bank’s CFF.”31   
46. 
 
 
   
47. 
 
 
 
 
 
   
48. 
 
 
   
49. 
 
 
 
  
 
31 See Regan Report ¶ 4. 
32 See Regan Report ¶ 31. 
33 See BANA_EDD_MDL-00102557 (BANA_EDD_MDL-00102554-BANA_EDD_MDL-
00102577). 
34 See Memorandum of Points and Authorities in Support of Motion for Class Certification, Case 
No. 3:21-md-02992-GPC-MSB, page 3, citing Regan Report ¶ 35. 
Case 3:21-md-02992-GPC-MSB     Document 350-4     Filed 10/24/24     PageID.11013 
Page 20 of 36

HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY 
20 
50. 
 
 
 
 
 
 
 
 
 
   
51. 
 
 
 
  
 
 
 
 
   
52. 
 
  
53. 
 
 
 
Case 3:21-md-02992-GPC-MSB     Document 350-4     Filed 10/24/24     PageID.11014 
Page 21 of 36

HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY 
21 
 
  In my experience, regulators 
do not expect financial institution processes to identify and exclude 100% of illicit activity, 
including fraud.  Regulators understand that it is not possible to identify all fraud.  Therefore, 
regulators focus (and expect banks to focus) on processes for identifying fraud, not necessarily the 
result.  
54. 
Based on my expertise and experience as a former regulator, and understanding of 
the rampant nature of fraud targeting the unemployment benefits program during the pandemic,  
 
 
 
55. 
 
 
  In my opinion, this assumption is not 
warranted either.  As the Kreis Report acknowledges, 
 
 
 
  Regulation E’s investigation requirements often result in business 
decisions that are skewed towards payment, as reflected by the fact that the Regulation places the 
burden on the financial institution to provide credit for unauthorized transaction error claims unless 
the bank can show that the transaction was authorized.  As a result, it is my experience that 
Regulation E investigation procedures tend to overpay, because regulators focus on instances in 
 
35 DX 6, See Michael Letson October 23, 2024 Declaration, ¶ 7. 
Case 3:21-md-02992-GPC-MSB     Document 350-4     Filed 10/24/24     PageID.11015 
Page 22 of 36

HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY 
22 
which procedures resulted in improperly denied payments where the financial institution did not 
meet its burden of proof. 
56. 
Banks’ procedures and processes are intended to help the institutions manage risk 
by determining the likelihood that a particular transaction is authorized.  In my decades of 
experience with the agencies, I reviewed many banks’ procedures and investigative processes in 
that context and never attempted to determine whether a bank had conclusively and accurately 
determined whether or not fraud had occurred.  
VII. 
The Kreis Report Ignores the Reality of the Bank’s Position During Unprecedented 
Circumstances. 
57. 
The Kreis Report ignores the Bank’s safety and soundness obligations imposed by 
the OCC, which included its obligation to control fraud.  Instead, the Kreis Report improperly 
bases its conclusions on claims-handling in a pre-pandemic, business-as-usual environment.  It 
does not appropriately consider how pandemic circumstances and safety-and-soundness 
obligations can affect a financial institution’s Regulation E investigative processes.  
58. 
 
 
 
 
  In my experience as a regulator, 
on the one hand, banks are generally expected to pay claims to the extent they cannot conduct 
investigations in a timely matter. However, on the other hand, paying all claims without 
investigation, particularly in the overwhelming fraud environment of the summer of 2020, 
 
 
 
   
Case 3:21-md-02992-GPC-MSB     Document 350-4     Filed 10/24/24     PageID.11016 
Page 23 of 36

HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY 
23 
59. 
As explained above, the OCC expects that banks will adequately manage risk and 
that the agency will hold bank management accountable to the extent they do not do so.  As further 
explained, the OCC would not consider uncontrolled fraud losses to be an effectively managed 
risk. 
60. 
The Kreis Report’s proposed alternative solution of hiring additional claims staff 
fails to account for operational challenges, which were exacerbated by the pandemic in 
unprecedented ways. The pandemic created many operational challenges for employers 
experiencing a first-of-its-kind migration to mass remote work, which presented challenges as to 
training, and access to systems and data.  Of note, staffing is an operational risk reviewed by the 
OCC, so Bank of America had to thoughtfully and deliberately cope with these challenges to 
ensure it met OCC expectations in this area. 
61. 
It has been my experience over 30 years that banks (and particularly large banks) 
commonly have dedicated units that conduct investigations, including Regulation E error 
investigations.  These units are staffed by highly-specialized and trained analysts because the work 
is complex and difficult.   
62. 
Even in a business-as-usual environment, my experience is that it takes months to 
properly onboard and train claims analysts.  The Kreis Report suggests using contractors, but even 
if a bank can onboard contractors (or new employees) who are familiar with Regulation E 
investigations, these individuals would still require significant training on the bank’s processes, 
systems, and standards. Rapidly adding personnel with the necessary knowledge, skills, and 
aptitude was even more difficult during the pandemic given the logistical challenges with remote 
hiring and training.36  Claims analysts also needed to have secure means to access all systems and 
 
36 DX 5, See Stephen Hindle October 24, 2024 Declaration, ¶ 24. 
Case 3:21-md-02992-GPC-MSB     Document 350-4     Filed 10/24/24     PageID.11017 
Page 24 of 36

HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY 
24 
databases necessary to conduct and document investigations and secure methods of 
communicating with consumers, which added further complexity to any such hiring during the 
novel work-from-home era introduced by the pandemic.  Likewise, during the pandemic, increased 
employee absenteeism due to illness or caring for those who were ill would have negatively 
impacted the situation. 
63. 
If a bank were to hire unqualified analysts, or any other employees, and/or fail to 
train them properly, the OCC would criticize management for those failures.  The OCC expects 
bank management to staff bank business units with knowledgeable people in the case of a 
compliance matter like Regulation E.37  Over my 30 years as a regulator, I have written or 
contributed to many “Matters Requiring Attention,” directing bank management to improve the 
training and/or quality of bank staff. 
64. 
Even if the Bank had hired immediately when claims first began to spike, it would 
not have had a timely impact on the backlog of claims due to the necessary on-boarding and ramp-
up time for these positions. At the time, the Bank had no way of knowing if the increased claims 
would be short-lived or sustained given the uncertain nature of the pandemic, so it did not know if 
mass hiring of employees or contractors was appropriate.  The OCC will likewise criticize banks 
for over-hiring, too, if it presents an unnecessary drag on the bank’s earnings. 
65. 
The Kreis Report’s suggestions to increase autopay thresholds likewise misses the 
mark, as it would not have prevented -- and instead would have exacerbated -- fraud losses that 
the Bank had regulatory obligations to control.  Among other things, it ignores that any provisional 
credit extended pursuant to fraudulent circumstances (the crux of the fraud scheme against the 
 
37 DX 111, See Comptroller's Handbook: Compliance Management Systems, June 2018 | OCC 
(pages 6-7). 
Case 3:21-md-02992-GPC-MSB     Document 350-4     Filed 10/24/24     PageID.11018 
Page 25 of 36

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Case 3:21-md-02992-GPC-MSB     Document 350-4     Filed 10/24/24     PageID.11019 
Page 26 of 36

Case 3:21-md-02992-GPC-MSB     Document 350-4     Filed 10/24/24     PageID.11020 
Page 27 of 36

Page 2 of 7 
Accomplishments 

Selected by then CFPB implementation staff as one of two examiners detailed
from OCC to the CFPB, prior to agency start up.

Received examiner commission.

Selected as the Examiner in Charge of one of the agency’s first exams, which was
the second largest bank in the Midwest Region and the 18th largest bank in the
nation by assets.

Selected as Lead Examiner/Central Point of Contact to lead the agency’s day-to-
day examination function at the largest bank in the Midwest Region and the fifth
largest bank in the nation by assets.

Received Midwest Region’s first Spotlight Award.

Received Spot Award for exceptional accomplishment in support of CFPB’s
mission.
Office of the Comptroller of the Currency 
1998 to 2011 
Job Titles:  National Bank Examiner (Consumer/CRA), and BSA/AML Policy Specialist 
Duties 

Through exams, and other data analysis, analyze banks' risk profiles,
management, personnel, processes, and systems to comply with consumer
protection laws, fair lending laws, informational reporting laws, anti-money
laundering laws, economic sanctions laws, and community development laws;
and opine on the banks’ performance.

Develop risk assessment summaries, core risk assessments, and supervisory
strategies; plan examinations; assemble, coordinate, and supervise exam teams;
lead team members in obtaining and analyzing numerous data to conclude on the
banks’ risk profiles, FFIEC ratings, and compliance with various laws and
regulations; document and report findings, both in writing and orally, to senior
bank management and senior OCC management; provide guidance to and
development of team members, as needed; provide timely and candid team
member evaluation and feedback; and, provide an equal opportunity work
environment.

Develop and train employees, other regulators, and bankers through teaching
schools; speaking at conferences, and meetings; providing on-the-job training;
and serving as a Coach (i.e., trainer) in the BSA/AML Examiner Specialized
Skills Program (ESSP) national training initiative.

Partner with various other departments and entities to achieve objectives.

Represent the OCC at interagency meetings, bankers’ outreach, conferences, and
schools, including teaching BSA/AML at schools sponsored by the FFIEC and
international organizations.

Perform community contacts with government officials, development officials,
academic officials, and other community leaders.
HIGHLY CONFIDENTIAL - ATTORNEYS’ EYES ONLY 
Case 3:21-md-02992-GPC-MSB     Document 350-4     Filed 10/24/24     PageID.11021 
Page 28 of 36

Page 3 of 7 

While assigned to Compliance Policy as a BSA/AML Specialist at OCC
headquarters:
o
Assist on or lead, as requested or assigned, high-risk or complex
examinations.
o
Provide examination support regarding complex exams or analysis.
through coaching and Currency Transaction Report (CTR) and Suspicious
Activity Report (SAR) data management.
o
Provide expert guidance and information to field staff, bankers, and senior
OCC management.
o
Develop written policy and procedure and guidance for OCC and
interagency use.
o
Plan, organize, and execute project management responsibilities.
o
Plan, organize, and conduct meetings with other OCC staff and with
interagency staff.
o
Plan, organize, develop, and make presentations to international bank
supervisors (i.e., Japan, Russian Federation, and Republic of Korea).

While assigned to the Large Bank Quality Assurance unit:
o
Developed, implemented, and led the Compliance Quality Assurance
function in the Large Bank line of business, ensuring that OCC staff
supervising the country’s largest banks were following agency policy and
procedures; ensuring that systemic and bank-specific issues and risks were
appropriately identified and managed; and ensuring that best practices
were identified for possible replication.
Accomplishments 

Received examiner commission.

Earned three U.S. Treasury Department Special Act or Service Awards.

Earned Letter of Appreciation from The Association of Supervisors of Banks of
the Americas, which was then comprised of banking supervisors from 34
countries.

Selected as the Compliance Functional Examiner in Charge at a $21B high-risk
Mid-size Bank (responsible for managing day-to-day supervision of all
compliance risk).

Selected as the Compliance Functional Examiner in Charge at a $38B Large
Bank, which was a top 10, nation-wide mortgage originator (responsible for
managing day-to-day supervision of all compliance risk).

Selected as one of three examiners to participate in the Developmental Program in
the Chief National Bank Examiner’s Office.

Selected to develop, implement, and lead the Compliance Quality Assurance
function in the Large Bank line of business.

Selected to lead the design, development, and presentation of BSA/AML training
for the Large Bank line of business, which fulfilled a commitment from then
Comptroller of the Currency Dugan to Congress.

Selected as one of 14 OCC staff to participate in the BSA/AML Foreign
Technical Assistance Program in cooperation with the U.S. Department of State.
HIGHLY CONFIDENTIAL - ATTORNEYS’ EYES ONLY 
Case 3:21-md-02992-GPC-MSB     Document 350-4     Filed 10/24/24     PageID.11022 
Page 29 of 36

Page 4 of 7 

Selected to instruct AML schools sponsored by the OCC (including one
international school), the FFIEC, and an international school sponsored by the
U.S. Department of State.

Selected as one of seven charter OCC personnel to serve on a BSA/AML Team to
examine the five highest risk community national banks.

Selected as first Chairman of the Midwestern District Anti-Money Laundering
Team.

Founding member and Chairman of the BSA/AML Interagency Working Group
(included reps. from about 20 state and federal regulatory and law enforcement
agencies).

Selected as a member of the U.S. Department of Justice’s Eastern District of MO
Anti-Terrorism Advisory Council.
NationsBank, N.A.   
1997 to 1998 
Job Title:  Vice President and Program Support Manager 
Duties 

Lead and manage the startup of the Program Support department in St. Louis,
which covered lending-related compliance in states west of the Mississippi River,
and Illinois.

Guide, advise, and otherwise support and serve internal customers.

Develop and implement my department’s budget and operating plan.

Partner with various other departments and entities to achieve objectives.

Supervise two officer-level employees and one clerical employee.

Provide guidance to and development of team members, as needed; provide
timely and candid team member evaluation and feedback; and provide an equal
opportunity work environment.
Accomplishments 

Successful startup of the Department itself.

Successfully led and managed a Home Mortgage Disclosure Act data integrity
scrub project, which included more than 7,000 files (supervised numerous clerical
employees, two officer-level employees, and coordinated with a large consulting
firm who assisted with the project).
Federal Reserve Bank of St. Louis  
1996 to 1997 
Job Title:  Bank Examiner (Consumer Affairs) 
HIGHLY CONFIDENTIAL - ATTORNEYS’ EYES ONLY 
Case 3:21-md-02992-GPC-MSB     Document 350-4     Filed 10/24/24     PageID.11023 
Page 30 of 36

Page 5 of 7 
Duties 

Through exams, and other data analysis, analyze banks' risk profiles,
management, personnel, processes, and systems to comply with consumer
protection laws, fair lending laws, informational reporting laws, and community
development laws; and opine on the banks’ performance.

Plan examinations; coordinate and supervise exam teams; lead team members in
obtaining and analyzing numerous data to conclude on the banks’ risk profiles,
FFIEC ratings, and compliance with various laws and regulations; document and
report findings, both in writing and orally, to senior bank management, and, in
some cases, senior Reserve Bank management; provide guidance to and
development of team members, as needed; provide timely and candid team
member evaluation and feedback; and provide an  equal opportunity work
environment.

Develop and train employees and bankers through speaking at conferences and
meetings; and providing on-the-job training.

Partner with various other departments and entities to achieve objectives.

Represent the Federal Reserve Bank of St. Louis at interagency meetings,
bankers’ outreach, conferences, and schools.

Perform community contacts with government officials, development officials,
academic officials, and other community leaders.
Accomplishments 

Received examiner commission.

Selected as sole Federal Reserve Bank of St. Louis representative on a Federal
Reserve System task force established to risk base the Consumer Affairs
examination process across the nation’s twelve Reserve Banks.

Selected to chair the Federal Reserve Bank of St. Louis' risk-based compliance
examination committee.
Federal Deposit Insurance Corporation 
1989 to 1996 
Job Titles:  Bank Examiner, and Compliance Examiner 
Duties 

Through exams, and other data analysis, analyze banks' management, capital
adequacy, asset quality, earnings performance, liquidity posture; processes,
personnel, and systems to comply with safety and soundness regulations and
standards, consumer protection laws, fair lending laws, informational reporting laws,
anti-money laundering laws, economic sanctions laws, and community development
laws; and opine on banks’ performances.

Plan examinations; assemble, coordinate, and supervise exam teams; lead team
members in obtaining and analyzing numerous data to conclude on the banks’ risk
profiles, FFIEC ratings, and compliance with various laws and regulations; document 
and report findings, both in writing and orally, to senior bank and agency 
HIGHLY CONFIDENTIAL - ATTORNEYS’ EYES ONLY 
Case 3:21-md-02992-GPC-MSB     Document 350-4     Filed 10/24/24     PageID.11024 
Page 31 of 36

Page 6 of 7 
management. 

Provide guidance to and development of team members, as needed; provide timely
and candid team member evaluation and feedback; and provide an equal opportunity
work environment.

Assist Division of Liquidation during closing of a failed bank chain.

Work as a Review Examiner/Case Manager during Regional Office Detail
assignments (review and process exam reports; take, document, and resolve consumer
complaints and inquires; answer questions from field examiners; project work).

Perform community contacts with government officials (including tribal
governments), development officials, academic officials, and other community
leaders.
Accomplishments 

Received examiner commission.

Promoted to the next higher grade (i.e., 12), within one year of commissioning, which
was the fastest possible time.

Recommended for two Sustained Superior Performance Awards.

Selected for two Regional Office Detail assignments.

Selected to assist the Division of Liquidation during closing of a failed bank chain.
I have held other professional jobs in the banking industry, and details are available upon 
request.  
EDUCATION 
University of Mississippi  
Oxford, MS 
Bachelor of Business Administration 
Major: Banking and Finance  
GPA: 3.4/4.0  
Job-related training:  
Many company-sponsored schools and seminars covering:  Accounting, auditing, capital 
analysis, credit analysis, investment analysis, earnings analysis, liquidity analysis, real 
estate appraisal analysis, written and oral communications, computer skills, management 
and leadership development, personal development, anti-money laundering laws, 
economic sanctions laws, consumer protection laws, informational reporting laws, fair 
lending laws, housing development, development issues on American Indian 
Reservations, and community development in general. 
Industry Certifications: 

Received Certified Regulatory Compliance Manager (CRCM) designation.

Received Certified Risk Professional (CRP) with Compliance Emphasis
designation.
HIGHLY CONFIDENTIAL - ATTORNEYS’ EYES ONLY 
Case 3:21-md-02992-GPC-MSB     Document 350-4     Filed 10/24/24     PageID.11025 
Page 32 of 36

Page 7 of 7 

Received Certified Anti-Money Laundering Specialist (CAMS) designation.

Received Anti-Money Laundering Professional (AMLP) designation.
HIGHLY CONFIDENTIAL - ATTORNEYS’ EYES ONLY 
Case 3:21-md-02992-GPC-MSB     Document 350-4     Filed 10/24/24     PageID.11026 
Page 33 of 36

 
 
APPENDIX B 
 
HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY 
 
In RE Bank of America California Unemployment Benefits Litigation 
Declaration of Russell Cronan 
List of Materials Considered 
 
1. Expert Reports and Declarations 
 
Expert Class Certification Report of J. Daniel Kreis dated August 29, 2024   
 
Expert Class Certification Report of Greg J. Regan, CPA/CFF, CFE dated August 29, 
2024   
 
Expert Declaration of Stephen Hindle signed on October 24, 2024 
 
Declaration of Michael J. Letson in Support of Defendant’s Memorandum in Opposition 
to Plaintiffs’ Motion for Class Certification signed on October 23, 2024  
 
2. Case Filings 
 
Bank of America’s Responses and Objections to Plaintiff Yick’s Fourth Set of 
Interrogatories dated January 2, 2024 
 
Bank of America’s Second Set of Responses and Objections to Plaintiff Yick’s Seventh 
Set of Interrogatories (Interrogs. 39 & 42) dated April 23, 2024 
 
Plaintiffs’ Notice of Motion and Motion for Class Certification filed on August 29, 2024 
 
Memorandum of Points and Authorities in Support of Motion for Class Certification 
dated August 29, 2024 
 
Plaintiff Second Amended Master Consolidated Complaint dated July 16, 2024 
 
3. Depositions 
 
William Matt Martin Deposition Transcript  
 
Michael Letson Deposition Transcript   
 
4. Other Produced Documents 
 
 BANA_EDD_MDL_00080294-BANA_EDD_MDL-00080352 
 
BANA_EDD_MDL-00102554-BANA_EDD_MDL-00102577  
Case 3:21-md-02992-GPC-MSB     Document 350-4     Filed 10/24/24     PageID.11027 
Page 34 of 36

 
 
 
 
HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY 
 
 
 
5. Publicly Available Documents 
 
95th Congress, Public Law 95-630, November 10, 1978, available at 
https://www.govinfo.gov/content/pkg/STATUTE-92/pdf/STATUTE-92-Pg3641.pdf  
 
Authenticated U.S. Government Information, Federal Reserve System, 12 CFR Part 205, 
January 10, 2006, available at https://www.govinfo.gov/content/pkg/FR-2006-01-
10/pdf/06-145.pdf  
 
Bank of America Consent Order dated July 14, 2022  
 
Code of Federal Regulations, Title 12, “Appendix A to Part 30 – Interagency Guidelines 
Establishing Standards for Safety and Soundness,” available at 
https://www.ecfr.gov/current/title-12/chapter-I/part-30/appendix-
Appendix%20A%20to%20Part%2030  
 
Consumer Financial Protection Bureau, “Electronic Fund Transfers FAQs,” Version 2, 
December 13, 2021 available at 
https://files.consumerfinance.gov/f/documents/cfbp_electronic-fund-transfers-faqs.pdf  
 
Consumer Financial Protection Bureau, “Supervision and Examination Manual,” March 
2019, available at https://files.consumerfinance.gov/f/documents/cfpb_supervision-and-
examination-manual_2023-09.pdf 
 
Consumer Financial Protection Bureau, “Supervisory Highlights,” Fall 2014, available at 
https://files.consumerfinance.gov/f/201410_cfpb_supervisory-highlights_fall-2014.pdf 
Consumer Financial Protection Bureau, “Supervisory Highlights,” Issue 18, Winter 2019, 
available at https://files.consumerfinance.gov/f/documents/cfpb_supervisory-
highlights_issue-18_032019.pdf  
 
Consumer Financial Protection Bureau, “Supervisory Highlights,” Issue 25, Fall 2021, 
available at https://files.consumerfinance.gov/f/documents/cfpb_supervisory-
highlights_issue-25_2021-12.pdf  
 
Consumer Financial Protection Bureau, “Supervisory Highlights,” Issue 28, Fall 2022, 
available at https://files.consumerfinance.gov/f/documents/cfpb_supervisory-
highlights_issue-28_2022-11.pdf  
 
Consumer Financial Protection Bureau, “Supervisory Highlights,” Winter 2015, available 
at https://files.consumerfinance.gov/f/201503_cfpb_supervisory-highlights-winter-
2015.pdf 
Case 3:21-md-02992-GPC-MSB     Document 350-4     Filed 10/24/24     PageID.11028 
Page 35 of 36

 
 
 
 
HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY 
 
 
Consumer Financial Protection Bureau, 12 CFR, Ҥ 1005.11 Procedures for resolving 
errors,” available at https://www.consumerfinance.gov/rules-policy/regulations/1005/11/  
 
Consumer Financial Protection Bureau, 12 CFR, “§ 1005.2 Definitions,” available at 
https://www.consumerfinance.gov/rules-policy/regulations/1005/2/  
 
Office of the Comptroller of the Currency, “OCC Finalizes Its Heightened Standards for 
Large Financial Institutions,” September 2, 2014, available at https://www.occ.gov/news-
issuances/news-releases/2014/nr-occ-2014-117.html  
 
Office of the Comptroller of the Currency, OCC Bulletin 2019-37, “Operational Risk: 
Fraud Risk Management Principles,” July 24, 2019, available at 
https://www.occ.gov/news-issuances/bulletins/2019/bulletin-2019-37.html  
 
Office of the Comptroller of the Currency, Administrator of National Banks, “Internal 
Control,” available at https://www.occ.gov/publications-and-
resources/publications/comptrollers-handbook/files/internal-control/pub-ch-internal-
control.pdf  
 
Office of the Comptroller of the Currency, Comptroller’s Handbook, “Compliance 
Management Systems,” June 2018, available at https://www.occ.gov/publications-and-
resources/publications/comptrollers-handbook/files/compliance-mgmt-systems/pub-ch-
compliance-management-systems.pdf   
 
Office of the Comptroller of the Currency, Comptroller’s Handbook, “Corporate and Risk 
Governance,” July 2019, available at https://www.occ.gov/publications-and-
resources/publications/comptrollers-handbook/files/corporate-risk-governance/pub-ch-
corporate-risk.pdf  
 
Office of the Comptroller of the Currency, Comptroller’s Handbook, “Large Bank 
Supervision,” Version 1.0, June 2018, available at https://www.occ.gov/publications-and-
resources/publications/comptrollers-handbook/files/large-bank-supervision/pub-ch-large-
bank-supervision.pdf  
 
Note: I also reviewed the materials listed in Appendix B of the Expert Class Certification 
Report of J. Daniel Kreis dated August 29, 2024. 
 
Case 3:21-md-02992-GPC-MSB     Document 350-4     Filed 10/24/24     PageID.11029 
Page 36 of 36

File and source

File

gov.uscourts.casd.709615.350.4.pdf

Size

2,375,505 bytes

SHA-256

bd6fb90176282e8f1804e92a4803abbe46d25dba76cd3df00a0734cff44fe502

Our copy

gov.uscourts.casd.709615.350.4.pdf

Original

PACER (login required)