Exhibit 29 — In re Bank of America California Unemployment Benefits Litigation (Dkt. 566-5, S.D. Cal. No. 3:21-md-02992)

Record facts

U.S. District Court for the Southern District of California · No. 3:21-md-02992-GPC-MSB · Doc. 566-5 · 2025-10-17 · Docket on CourtListener

Full text

HX 29
Case 3:21-md-02992-GPC-MSB     Document 566-5     Filed 10/17/25     PageID.33553 
Page 1 of 27

 
#2022-023 
UNITED STATES OF AMERICA 
DEPARTMENT OF THE TREASURY 
OFFICE OF THE COMPTROLLER OF THE CURRENCY 
 
 
In the Matter of: 
 
Bank of America, N.A. 
Charlotte, North Carolina 
) 
) 
) 
) 
) 
 
 
AA-ENF-2022-21 
 
 
CONSENT ORDER 
 
WHEREAS, the Office of the Comptroller of the Currency (“OCC”) has supervisory 
authority over Bank of America, N.A., Charlotte, North Carolina (“Bank”); 
WHEREAS, the OCC intends to initiate cease and desist proceedings against the Bank 
pursuant to 12 U.S.C. § 1818(b), through the issuance of a Notice of Charges, related to: (1) the 
administration of the Bank’s prepaid cards for unemployment benefits, specifically engagement 
in (i) unsafe or unsound practice(s), including deficiencies in its risk management, operational 
processes and controls, internal audit, and investigation and resolution of consumer claims of 
unauthorized transactions; and (ii) unfair and deceptive practices in violation(s) of Section 5 of 
the Federal Trade Commission Act (“FTC Act”), 15 U.S.C. § 45(a)(1); and (2) engaging in 
unsafe or unsound practices related to deficiencies in its enterprise-wide complaints risk 
management framework; 
WHEREAS, in the interest of cooperation and to avoid additional costs associated with 
administrative and judicial proceedings with respect to the above matter, the Bank, by and 
through its duly elected and acting Board of Directors (“Board”), consents to the issuance of this 
Consent Order (“Order”), by the OCC through the duly authorized representative of the 
Comptroller of the Currency (“Comptroller”); and 
NOW, THEREFORE, pursuant to the authority vested in the OCC by Section 8(b) of 
Case 3:21-md-02992-GPC-MSB     Document 566-5     Filed 10/17/25     PageID.33554 
Page 2 of 27

 
 
2 
 
the Federal Deposit Insurance Act, as amended, 12 U.S.C. § 1818(b), the OCC hereby orders 
that: 
ARTICLE I 
JURISDICTION 
(1) 
 The Bank is an “insured depository institution” as that term is defined in 
12 U.S.C. § 1813(c)(2). 
(2) 
The Bank is a national banking association within the meaning of 12 U.S.C. 
§ 1813(q)(1)(A), and is chartered and examined by the OCC. See 12 U.S.C. § 1 et seq. 
(3) 
The OCC is the “appropriate Federal banking agency” as that term is defined in 
12 U.S.C. § 1813(q) and is therefore authorized to initiate and maintain this cease and desist 
action against the Bank pursuant to 12 U.S.C. § 1818(b). 
ARTICLE II 
COMPTROLLER’S FINDINGS 
 
The Comptroller finds, and the Bank neither admits nor denies, the following: 
(1) 
For several years, the Bank issued and administered prepaid debit cards to 
distribute unemployment insurance benefits (“UI Prepaid Cards”) to consumers that were 
loaded with benefit funds issued by certain states, hereinafter referred to as the Unemployment 
Benefits Prepaid Card Program (“Program”).  
(2) 
In March 2020, millions became unemployed and Congress enacted the 
Coronavirus Aid, Relief, and Economic Security Act (“CARES Act”), which created the new 
Pandemic Unemployment Assistance (“PUA”) benefit. The CARES Act and PUA expanded 
unemployment benefits eligibility and provided greater benefit amounts than previously 
available. As a result, the size of the Program increased substantially (from under one million 
Case 3:21-md-02992-GPC-MSB     Document 566-5     Filed 10/17/25     PageID.33555 
Page 3 of 27

 
 
3 
 
unique cards loaded in January 2020 to over six million in July 2020), as did the volume of 
benefits issued by the states and loaded onto UI Prepaid Cards (from approximately $1 billion 
in January 2020 to over $27 billion in July 2020). Along with the increases in Program 
participants and benefits, the Program experienced an increase in fraud, including with respect 
to unauthorized transaction claims.  
(3) 
The Bank failed to establish effective risk management over the Program, and, 
beginning in 2020, denied or delayed many consumers’ access to unemployment benefits when 
consumers filed or attempted to file UI Prepaid Card unauthorized transaction claims. 
Specifically, the Bank: 
(a) 
applied an automated fraud filter between September 28, 2020 and June 8, 
2021 to decision UI Prepaid Card error claims that met certain criteria 
(“Fraud Filter”) without conducting a sufficient investigation to: (i) deny 
many consumers’ claims of unauthorized transactions on their UI Prepaid 
Cards, and (ii) “freeze” or “block” the UI Prepaid Card accounts 
associated with the claims. Consumers with frozen or blocked accounts 
could not access the unemployment benefits in their UI Prepaid Card 
accounts until the Bank removed the freeze or block.  
(b) 
failed to provide timely and full provisional or final credit to many 
consumers entitled to such credits who reported unauthorized transactions 
on their UI Prepaid Card accounts. 
(c) 
retroactively applied the Fraud Filter to many consumers’ claims of 
unauthorized transactions on their UI Prepaid Card accounts without 
conducting further investigation and providing advance notice, which 
Case 3:21-md-02992-GPC-MSB     Document 566-5     Filed 10/17/25     PageID.33556 
Page 4 of 27

 
 
4 
 
incorrectly resulted in the reversal of provisional and final credits that the 
Bank previously provided to those consumers. 
(d) 
impeded many consumers’ ability to regain access to their unemployment 
benefits through the UI Prepaid Cards and to request reconsideration of 
their unauthorized transaction claims as a result of operational 
deficiencies. 
(e) 
provided consumers deceptive disclosures and notices with respect to 
liability for unauthorized transactions, processing of unauthorized 
transaction claims, and account freezes and blocks. 
(4) 
Overall, the Bank has the following deficiencies in its administration of the 
Program: 
(a) 
inadequate risk management practices in both the front-line units and 
independent risk management, including ineffective oversight, risk 
assessment, monitoring, and reporting; 
(b) 
inadequate internal controls, including those relating to contract 
management; 
(c) 
inadequate oversight, risk management, and monitoring of UI Prepaid 
Card unemployment benefits vendors (“Program Vendors”); and 
(d) 
inadequate oversight and coverage by the Bank’s independent audit 
function. 
(5) 
In addition, the Bank failed to establish an effective enterprise-wide complaints 
risk management framework that is commensurate with the Bank’s size, complexity, and risk 
profile. Specifically, the complaint risk management framework lacks an effective: 
Case 3:21-md-02992-GPC-MSB     Document 566-5     Filed 10/17/25     PageID.33557 
Page 5 of 27

 
 
5 
 
(a) 
process to identify, measure, manage, and report complaints;  
(b) 
complaint resolution process; and  
(c) 
quality assurance process. 
(6) 
By reason of the deficiencies and conduct described in Paragraphs (2) through (5) 
of this Article, the Bank engaged in unsafe or unsound practices and engaged in unfair and 
deceptive practices in violation of Section 5 of the FTC Act, 15 U.S.C. § 45(a). These violations 
and practices support actions against the Bank under 12 US.C. § 1818(b) and (i)(2)(B). 
(7) 
The Bank has begun taking corrective actions and has committed to taking 
necessary and appropriate steps to remedy the deficiencies identified by the OCC and to assist 
and remediate harmed consumers. 
ARTICLE III 
COMPLIANCE COMMITTEE 
(1) 
Within thirty (30) days of the date of this Order, the Board shall maintain a 
Compliance Committee of at least three (3) members of which a majority shall be directors who 
are not employees or officers of the Bank or any of its subsidiaries or affiliates. The Board shall 
submit in writing to the Examiner-in-Charge the names of the members of the Compliance 
Committee within ten (10) days of their appointment. In the event of a change of the 
membership, the Board shall submit in writing to the Examiner-in-Charge within ten (10) days 
the name of any new or resigning committee member. The Compliance Committee shall monitor 
and oversee the Bank’s compliance with the provisions of this Order. The Compliance 
Committee shall meet at least quarterly and maintain minutes of its meetings at which 
compliance with this Order is discussed. 
Case 3:21-md-02992-GPC-MSB     Document 566-5     Filed 10/17/25     PageID.33558 
Page 6 of 27

 
 
6 
 
(2) 
Within sixty (60) days after the effective date of this Order, and thereafter within 
forty-five (45) days after the end of each subsequent quarter, the Bank shall prepare and submit 
to the Compliance Committee a written progress report setting forth in detail: 
(a) 
a description of the corrective actions needed to achieve compliance with 
each Article of this Order, 
(b) 
the specific corrective actions undertaken to comply with each Article of 
this Order,  
(c) 
the results and status of the corrective actions, and 
(d) 
the person(s) responsible for the completion of outstanding corrective 
actions. 
(3) 
The Compliance Committee shall forward a copy of the report, with any 
additional comments by the Committee, to the Board. 
(4) 
The Compliance Committee shall forward a copy of the report, with any 
additional comments by the Committee or Board, to the Examiner-in-Charge within fifteen (15) 
days of the first Compliance Committee meeting following the Committee’s receipt of such 
report. 
ARTICLE IV 
ACTION PLAN 
(1) 
Pursuant to the timeframe for completion and other requirements set forth in 
Article V of this Order, the Bank shall develop a UI Prepaid Card Oversight and Risk 
Management Program (“ORMP”) containing a complete description of the actions necessary to 
achieve compliance with Article V of this Order. Separately, the Bank shall develop a Consent 
Order Action Plan (“COAP”) containing a complete description of the actions necessary to 
Case 3:21-md-02992-GPC-MSB     Document 566-5     Filed 10/17/25     PageID.33559 
Page 7 of 27

 
 
7 
 
achieve compliance with Articles VI through X of this Order. The components of the COAP 
shall be completed within the timeframes set forth in Articles VI through X of this Order, if 
specified. Collectively, the ORMP and COAP are referred to collectively in this Order as the 
“Plans.” At the time the Bank is required to submit the ORMP pursuant to Article V, Paragraph 
(4), the Bank shall submit the Board-approved COAP to the Examiner-in-Charge for review and 
prior written determination of no supervisory objection. 
(2) 
The Plans shall also specify the: 
 
 
(a) 
reasonable and well-supported timelines for completion of the corrective 
  
 
 
actions required by this Order, and 
(b) 
the person(s) responsible for completion of the corrective actions required 
by this Order. 
 
(3) 
The timelines contained in the Plans shall be consistent with any deadlines set 
forth in this Order, including any modifications to the Order made pursuant to Article XIV, 
Paragraph (5). 
 
(4) 
In the event the Examiner-in-Charge requires changes to the Plans, the Bank shall 
incorporate the required changes into the Plan(s) and submit the revised Plan(s) to the Examiner-
in-Charge for review and prior written determination of no supervisory objection.  
(5) 
Within thirty (30) days following receipt of the Examiner-in-Charge’s written 
determination of no supervisory objection to the Plans, the Board shall adopt the Plans and 
thereafter ensure that Bank management implements and adheres to the Plans, including the 
timelines set forth within the Plans. 
 (6) 
The Bank shall not take any action that will cause a significant deviation from, or 
Case 3:21-md-02992-GPC-MSB     Document 566-5     Filed 10/17/25     PageID.33560 
Page 8 of 27

 
 
8 
 
material change to, the Plans. Where the Bank makes a determination to modify the Plans, the 
Bank shall submit the revised Plan(s) containing the proposed modifications to the Examiner-in-
Charge for prior written determination of no supervisory objection. Upon receipt of a written 
determination of no supervisory objection from the Examiner-in-Charge, the Board shall timely 
adopt the revised Plan(s) and thereafter ensure that Bank management implements and adheres to 
the revised Plan(s), including the timelines set forth within the revised Plan(s). 
ARTICLE V 
UI PREPAID CARD OVERSIGHT AND RISK MANAGEMENT PROGRAM 
 
 
(1) 
Within sixty (60) days of the date of this Order, the Bank shall perform and 
submit to the Examiner-in-Charge for review and prior written determination of no supervisory 
objection, the Program Risk Assessment and Program Risk Assessment Report as defined in and 
required by Paragraph (2) of this Article and the Program Gap Analysis Report as defined in and 
required by Paragraph (3) of this Article. Within five (5) business days of receipt of the 
Examiner-in-Charge’s written determination of no supervisory objection to each of the Program 
Risk Assessment, the Program Risk Assessment Report, and the Program Gap Analysis Report, 
the Bank shall submit the respective item to the Compliance Committee. 
 (2)   
The Bank shall perform a comprehensive and holistic risk assessment of the 
Program  (“Program Risk Assessment”) that shall address all significant risks to include at a 
minimum transaction and card volumes and trends; operational risks, including capacity 
limitations or obstacles with product service or delivery; requisite staffing skills and expertise; 
compliance with applicable consumer protection and information security laws and regulations; 
and fraud risk volume, fraud sources, and types of fraud. The Bank shall also prepare a report of 
Case 3:21-md-02992-GPC-MSB     Document 566-5     Filed 10/17/25     PageID.33561 
Page 9 of 27

 
 
9 
 
the Program Risk Assessment (“Program Risk Assessment Report”) that summarizes the 
findings from the Program Risk Assessment.  
(3) 
The Bank shall conduct an analysis of its current controls and risk management 
processes over the Program to identify gaps (“Program Gap Analysis”). At a minimum, the 
Program Gap Analysis shall address the adequacy of operational controls, fraud investigations, 
fraud rules and/or strategies, claims intake and processing, accounting practices, complaints 
management, claims and complaints quality assurance processes, systems and data management, 
and Program Vendor risk management. The Bank shall also prepare a report of the Program Gap 
Analysis (“Program Gap Analysis Report”) that summarizes the findings from the Program Gap 
Analysis. 
 
(4) 
Within thirty (30) days following receipt of the Examiner-in-Charge’s written 
determination of no supervisory objection to the Program Risk Assessment, the Program Risk 
Assessment Report, and the Gap Analysis Report, the Bank shall submit to the Examiner-in-
Charge for review and prior written determination of no supervisory objection, an acceptable 
Board-approved UI Prepaid Card ORMP that at a minimum shall include: 
(a)  
policies, procedures, systems, and controls to effectively identify, 
measure, monitor, and control risks associated with the Bank’s 
administration of the Program, including those risks identified in the 
Program Risk Assessment required by Paragraph (2) of this Article.  
(b) 
corrective actions to address the gaps identified in the Program Gap 
Analysis required by Paragraph (3) of this Article. 
(c) 
an effective oversight and risk management framework that establishes the 
roles and responsibility for respective front-line units and independent risk 
Case 3:21-md-02992-GPC-MSB     Document 566-5     Filed 10/17/25     PageID.33562 
Page 10 of 27

 
 
10 
 
management for Program operations consistent with the Bank’s 
Enterprise-Wide Risk Framework. 
(d) 
policies and procedures to ensure effective and timely execution of 
training to Bank employees and employees of Program Vendors and 
comprehensive measures for assessing the effectiveness of such training. 
(e) 
measures to ensure Program Vendors adhere to the Bank’s established 
Enterprise-Wide Vendor Risk Management Policy and comply with all 
applicable consumer protection laws and regulations and that at a 
minimum shall: 
(i) 
ensure comprehensive and timely quality assurance activities and 
monitoring activities to identify, measure, monitor, and control 
risks identified by the Program Risk Assessment required by 
Paragraph (1) of this Article. 
(ii) 
ensure business level Program Vendor scorecards and enterprise-
wide and business level reporting clearly escalate performance 
issues, control lapses, or non-compliance with all applicable 
consumer protection laws and regulations and Bank policies and 
procedures. 
(f) 
standard reporting for the Program, which, at a minimum, shall include 
performance metrics, risk indicators, and complaints trends. 
(g) 
effective independent risk management for the Program that adheres to the 
Bank’s Enterprise-Wide Risk Management Framework and includes, at a 
minimum: 
Case 3:21-md-02992-GPC-MSB     Document 566-5     Filed 10/17/25     PageID.33563 
Page 11 of 27

 
 
11 
 
(i) 
periodic comprehensive and holistic risk assessments of the 
Program, to occur at least annually, that identify the risks specified 
in Paragraph (1) of this Article and specify the actions taken to 
identify, measure, monitor, and control the risks; and 
(ii) 
independent coverage plans and testing sufficient to detect, 
mitigate, and manage operational control lapses and non-
compliance with all applicable consumer protection laws and 
regulations and Bank policies and procedures. 
 
(5) 
Within thirty (30) days following receipt of the Examiner-in-Charge’s written 
determination of no supervisory objection to the ORMP, the Board shall adopt, and Bank 
management, subject to Board oversight consistent with Article XI, shall immediately implement 
and thereafter ensure adherence to the ORMP. Any amendment to the ORMP must be submitted 
to the Examiner-in-Charge for review and prior written determination of no supervisory 
objection. 
ARTICLE VI 
ENTERPRISE-WIDE COMPLAINTS RISK MANAGEMENT FRAMEWORK  
 
 
(1) 
Within sixty (60) days of the date of this Order, the Bank shall submit to the 
Examiner-in-Charge for review and prior written determination of no supervisory objection a 
Board-approved enterprise-wide complaints risk management framework (“Complaints 
Framework”). 
 
(2) 
The Complaints Framework shall at a minimum include an effective 
enterprise complaints policy, inclusive of an expanded complaints definition, and the 
identification and description of effective procedures for adequately and timely identifying, 
Case 3:21-md-02992-GPC-MSB     Document 566-5     Filed 10/17/25     PageID.33564 
Page 12 of 27

 
 
12 
 
tracking, documenting, analyzing, managing, monitoring, escalating, reporting, and resolving 
consumer customer complaints. This Complaints Framework shall also include quality assurance 
measures to ensure Bank adherence to the Complaints Framework. 
 
(3) 
Within sixty (60) days following receipt of the Examiner-in-Charge’s written 
determination of no supervisory objection to the Complaints Framework or to any subsequent 
amendment to the Complaints Framework, the Board shall adopt the Complaints Framework and 
shall ensure that Bank management, subject to Board oversight consistent with Article XI, shall 
implement and thereafter ensure adherence to the Complaints Framework. Any amendment to 
the Complaints Framework must be submitted to the Examiner-in-Charge for review and prior 
written determination of no supervisory objection. 
ARTICLE VII 
CONTRACT APPROVAL AND REVIEW PROCESS 
(1) 
Within thirty (30) days of the date of this Order, the Bank shall develop the 
criteria it will use to determine if a contract, including nonstandard contracts, pursuant to which 
the Bank is providing significant services and acting as a vendor of such services, poses 
significant risks to the Bank in various scenarios, including adverse conditions. 
 
(2) 
Within thirty (30) days of the date of this Order, the Bank shall create an 
inventory of existing contracts and newly signed contracts executed more than thirty (30) days 
prior to the date of submission of the inventory that meet the criteria developed pursuant to 
Paragraph (1) of this Article and submit this inventory to the Examiner-in-Charge.  
(3) 
The Bank shall update the inventory required by Paragraph (2) of this Article on 
an annual basis and submit the updated inventory to the Examiner-in-Charge.  
Case 3:21-md-02992-GPC-MSB     Document 566-5     Filed 10/17/25     PageID.33565 
Page 13 of 27

 
 
13 
 
 
(4) 
Within one hundred fifty (150) days of the date of this Order, the Bank shall 
conduct risk assessments of all existing contracts listed in the inventory required by Paragraph 
(2) of this Article. 
(5) 
Within one hundred fifty (150) days of the date of this Order, the Bank shall 
review and revise, as appropriate, its enterprise-wide framework for contract review and 
approval for contracts where the Bank is providing significant services and acting as a vendor of 
such services, including nonstandard contracts, to ensure at a minimum that its contract approval 
and review process includes: 
(a) 
policies and procedures for assessing the risks of new contracts that meet 
the criteria required by Paragraph (1) of this Article, which assessment 
shall occur prior to entering the contract; 
(b) 
policies and procedures for conducting periodic assessments of the risks, 
of all existing contracts listed in the inventory required by Paragraph (2) of 
this Article, which assessments should occur at least annually; and 
(c) 
policies and procedures for developing and implementing plans that 
adequately measure, monitor, and provide for controls that adapt 
commensurate with changing risk levels for the risks identified pursuant to 
the assessments required by Paragraphs (4), (5)(a) and (5)(b) of this 
Article. 
 
(6) 
Upon adoption of the revised enterprise-wide framework for contract approval 
and review as described in Paragraph (5) of this Article, Bank management, subject to Board 
oversight consistent with Article XI, shall implement and thereafter ensure adherence to the 
revised enterprise-wide framework for contract review and approval and any amendments 
Case 3:21-md-02992-GPC-MSB     Document 566-5     Filed 10/17/25     PageID.33566 
Page 14 of 27

 
 
14 
 
thereto. The Board shall ensure that the Bank conducts the assessments, develops, implements, 
and adheres to the requirements of this Article. 
ARTICLE VIII 
INTERNAL AUDIT 
 
(1) 
Within sixty (60) days of the date of this Order, Internal Audit shall revise the 
audit plan to ensure comprehensive end-to-end coverage of the Program’s operations and risk 
management processes and that at a minimum includes the testing of controls over the Program’s 
operations, claims and reconsiderations, and adherence to all applicable consumer protection 
laws and regulations and Bank policies and procedures. 
 
(2) 
Consistent with the Bank’s established Internal Audit policies and procedures, 
Internal Audit shall report all Program control deficiencies; UI Prepaid Card claims-related and 
other operational errors; Program internal misconduct; and Program violations of applicable 
laws, including consumer protection laws and regulations, and of Bank policies and procedures 
to the Board and management in a timeframe consistent with the Bank’s established Internal 
Audit policies and procedures. 
ARTICLE IX 
REMEDIATION 
 
(1) 
Within ninety (90) of days of the date of this Order, the Bank shall submit to the 
Examiner-in-Charge for review and prior written determination of no supervisory objection a 
Board-approved acceptable remediation plan (“Remediation Plan”). 
 
(2) 
At a minimum, the Remediation Plan shall include: 
(a) 
a description of a well-supported methodology to be used to identify 
harmed consumers as a result of the practices described in Article II, 
Case 3:21-md-02992-GPC-MSB     Document 566-5     Filed 10/17/25     PageID.33567 
Page 15 of 27

 
 
15 
 
Paragraph (3), and a calculation of the time necessary to compile a list of 
potential harmed consumers. 
(b) 
a description of the procedures and process used to remediate each harmed 
consumer meeting the methodology referred to in Paragraph 2(a) of this 
Article, including for claim amounts wrongfully withheld or denied, 
benefit amounts frozen or blocked, and any consequential financial harm. 
At a minimum, these procedures shall include:  
(i) 
a lump sum consequential harm payment to harmed consumers, 
that is calculated pursuant to the methodology required by 
Paragraph (2)(c) of this Article; 
(ii) 
an individualized review process administered by an independent 
third-party payment administrator that allows harmed consumers to 
request an individualized review to establish consequential harm 
not satisfied by the lump sum payment described in Paragraph 
2(b)(i) of this Article (“Individualized Review Process”); and 
(iii) 
a description of the plan for developing effective disclosures and 
communications used to inform harmed consumers of 
Individualized Review Process and the type of supporting 
information that will be required, as well as the circumstances 
under which such supporting information will be required.  
(c) 
a description of the methodology used to calculate the amount of 
remediation to be paid to each harmed consumer. This methodology shall 
include compensation for the financial harm suffered due to loss of access 
Case 3:21-md-02992-GPC-MSB     Document 566-5     Filed 10/17/25     PageID.33568 
Page 16 of 27

 
 
16 
 
to unemployment funds, including but not limited to, the wrongly denied 
unauthorized transaction claim amounts and the loss of access to the UI 
Prepaid Card balances that were frozen or blocked as described in Article 
II Paragraph 3(a).  
  
 
(d) 
a description of the procedures for the issuance and tracking of  
 
 
 
remediation and the disclosures and communications required by 
 
 
 
Paragraph (2)(b)(iii) of this Article. 
(e) 
a description of the procedure for monitoring compliance with the 
Remediation Plan. 
 
(3) 
The Bank shall remediate financial injury and make restitution to each harmed 
consumer in accordance with the Remediation Plan required by Paragraph (1) of this Article. No 
amount paid under the Remediation Plan is paid to reimburse the OCC or any other government 
or governmental entity for investigation or litigation costs, or in lieu of a fine or penalty. 
 
(4) 
Within thirty (30) days following receipt of the Examiner-in-Charge’s written 
determination of no supervisory objection to the Remediation Plan or to any subsequent 
amendment to the Remediation Plan, the Board shall adopt and Bank management, subject to 
Board oversight consistent with Article XI, shall immediately implement and thereafter ensure 
adherence to the Remediation Plan. Any amendment to the Remediation Plan must be submitted 
to the Examiner-in-Charge for review and prior written determination of no supervisory 
objection. 
 
 
Case 3:21-md-02992-GPC-MSB     Document 566-5     Filed 10/17/25     PageID.33569 
Page 17 of 27

 
 
17 
 
ARTICLE X 
ASSESSMENT OF REMEDIATION 
 
(1) 
There shall be a periodic independent review and assessment of compliance with 
the terms of the Remediation Plan (“Remediation Review”) in accordance with Paragraph (2) of 
this Article, which Review shall include an assessment of: 
(a) 
the application of the methodology used to determine the population of 
harmed consumers, 
(b) 
the Claims Process and the adherence to procedures specified for the 
Claims Process, 
(c) 
the application of the methodology used to determine the amount of 
remediation for each harmed consumer,  
(d) 
the sufficiency of the disclosures and communications required by 
Paragraph (2)(b)(iii) of Article IX,  
(e) 
the effectiveness of the process used to issue and track remediation 
payments to harmed consumers and the disclosures and communications 
required by Paragraph (1)(b)(iii) of Article IX, and  
(f) 
the process used for monitoring compliance with the Remediation Plan. 
(2) 
The Remediation Reviews shall occur at least every six months, beginning from 
the date of this Order, during the development and execution of the Remediation Plan and the 
findings shall be memorialized in writing. Within thirty (30) days of completing the Remediation 
Review, the Bank shall provide the written findings of the Remediation Review to the 
Compliance Committee and the Examiner-in-Charge. 
 
Case 3:21-md-02992-GPC-MSB     Document 566-5     Filed 10/17/25     PageID.33570 
Page 18 of 27

 
 
18 
 
(3) 
Any communications, workpapers, or work product related to the Remediation 
Reviews shall be made available to the OCC immediately upon request of the Examiner-in-
Charge. 
ARTICLE XI 
GENERAL BOARD RESPONSIBILITIES 
 
(1) 
The Board shall ensure that the Bank has timely adopted and implemented all 
corrective actions required by this Order, and shall verify that the Bank adheres to the corrective 
actions and that the corrective actions are effective in addressing the Bank’s deficiencies that 
resulted in this Order. 
 
(2) 
In each instance in which this Order imposes responsibilities upon the Board, it is 
intended to mean that the Board shall: 
(a) 
authorize, direct, and adopt corrective actions on behalf of the Bank as 
  
may be necessary to perform the obligations and undertakings imposed on 
  
the Board by this Order; 
(b) 
ensure the Bank has sufficient processes, management, personnel, control 
  
systems, and corporate and risk governance to implement and adhere to all 
  
provisions of this Order; 
(c) 
require that Bank management and personnel have sufficient training and 
authority to execute their duties and responsibilities pertaining to or 
resulting from the Order;  
(d) 
hold Bank management and personnel accountable for executing their 
duties and responsibilities pertaining to or resulting from this Order; 
Case 3:21-md-02992-GPC-MSB     Document 566-5     Filed 10/17/25     PageID.33571 
Page 19 of 27

 
 
19 
 
(e) 
require appropriate, adequate, and timely reporting to the Board by Bank 
management of corrective actions directed by the Board to be taken under 
the terms of this Order; and 
(f) 
address any noncompliance with corrective actions in a timely and 
appropriate manner. 
ARTICLE XII 
WAIVERS 
(1) 
The Bank, by executing and consenting to this Order, waives: 
(a) 
any and all rights to the issuance of a Notice of Charges pursuant to  
12 U.S.C. § 1818; 
(b) 
any and all procedural rights available in connection with the issuance of 
this Order; 
(c) 
any and all rights to a hearing and a final agency decision pursuant to  
12 U.S.C. § 1818 and 12 C.F.R. Part 19; 
(d) 
any and all rights to seek any type of administrative or judicial review of 
this Order; 
(e) 
any and all claims for fees, costs, or expenses against the OCC, or any of 
its officers, employees, or agents related in any way to this enforcement 
matter or this Order, whether arising under common law or under the 
terms of any statute, including, but not limited to, the Equal Access to 
Justice Act, 5 U.S.C. § 504 and 28 U.S.C. § 2412;  
(f) 
any and all rights to assert these proceedings, the consent to and/or the 
issuance of this Order, as the basis for a claim of double jeopardy in any 
Case 3:21-md-02992-GPC-MSB     Document 566-5     Filed 10/17/25     PageID.33572 
Page 20 of 27

 
 
20 
 
pending or future proceedings brought by the United States Department of 
Justice or any other governmental entity; and 
(g) 
any and all rights to challenge or contest the validity of this Order. 
ARTICLE XIII 
OTHER PROVISIONS 
 
(1) 
As a result of this Order, the Bank is not: 
(a) 
precluded from being treated as an “eligible bank” for the purposes of  
12 C.F.R. Part 5, unless the Bank fails to meet any of the requirements 
contained in subparagraphs (1) – (4) of 12 C.F.R. § 5.3, Definitions, 
Eligible bank or eligible savings association, or is otherwise informed in 
writing by the OCC; 
(b) 
subject to the restrictions in 12 C.F.R. § 5.51 requiring prior notice to the 
OCC of changes in directors and senior executive officers or the 
limitations on golden parachute payments set forth in 12 C.F.R. Part 359, 
unless the Bank is otherwise subject to such requirements pursuant to  
12 C.F.R. § 5.51(c)(7)(i) and (iii); and 
(c) 
precluded from being treated as an “eligible bank” for the purposes of  
12 C.F.R. Part 24, unless the Bank fails to meet any of the requirements 
contained in 12 C.F.R. § 24.2(e)(1)-(3) or is otherwise informed in writing 
by the OCC.  
(2) 
This Order supersedes all prior OCC communications issued pursuant to 12 
C.F.R. §§ 5.3, 5.51(c)(7)(ii), and 24.2(e)(4). 
 
 
Case 3:21-md-02992-GPC-MSB     Document 566-5     Filed 10/17/25     PageID.33573 
Page 21 of 27

 
 
21 
 
ARTICLE XIV 
CLOSING 
 
(1) 
This Order is a settlement of the cease and desist proceedings against the Bank 
contemplated by the OCC, based on the unsafe or unsound practices and/or violations of law 
described in the Comptroller’s Findings set forth in Article II of this Order. The OCC releases 
and discharges the Bank from all potential liability for a cease and desist order that has been or 
might have been asserted by the OCC based on the practices and/or violations described in 
Article II of this Order, to the extent known to the OCC as of the effective date of this Order. 
Nothing in this Order, however, shall prevent the OCC from: 
(a) 
instituting enforcement actions other than a cease and desist order against 
the Bank based on the Comptroller’s Findings set forth in Article II of this 
Order; 
(b) 
instituting enforcement actions against the Bank based on any other 
findings; 
(c) 
instituting enforcement actions against institution-affiliated parties (as 
defined by 12 U.S.C. § 1813(u)) based on the Comptroller’s Findings set 
forth in Article II of this Order, or any other findings; or 
(d) 
utilizing the Comptroller’s Findings set forth in Article II of this Order in 
future enforcement actions against the Bank or its institution-affiliated 
parties to establish a pattern or the continuation of a pattern. 
(2) 
Nothing in this Order is a release, discharge, compromise, settlement, dismissal, 
or resolution of any actions, or in any way affects any actions that may be or have been brought 
Case 3:21-md-02992-GPC-MSB     Document 566-5     Filed 10/17/25     PageID.33574 
Page 22 of 27

 
 
22 
 
by any other representative of the United States or an agency thereof, including, without 
limitation, the United States Department of Justice. 
(3) 
This Order is:  
(a) 
a “cease-and-desist order issued upon consent” within the meaning of  
12 U.S.C. § 1818(b); 
(b) 
a “cease-and-desist order which has become final” within the meaning of  
12 U.S.C. § 1818(e); 
(c) 
an “order issued with the consent of the depository institution” within the 
meaning of 12 U.S.C. § 1818(h)(2); 
(d) 
an “effective and outstanding . . . order” within the meaning of 12 U.S.C.  
§ 1818(i)(1); and 
(e) 
a “final order” within the meaning of 12 U.S.C. § 1818(i)(2) and (u). 
(4) 
This Order is effective upon its issuance by the OCC, through the Comptroller’s 
duly authorized representative. Except as otherwise expressly provided herein, all references to 
“days” in this Order shall mean calendar days and the computation of any period of time 
imposed by this Order shall not include the date of the act or event that commences the period of 
time.  
(5) 
The provisions of this Order shall remain effective except to the extent that, and 
until such time as, such provisions are amended, suspended, waived, or terminated in writing by 
the OCC, through the Comptroller’s duly authorized representative. If the Bank seeks an 
extension, amendment, suspension, waiver, or termination of any provision of this Order, the 
Board or a Board-designee shall submit a written request to the Deputy Comptroller asking for 
the desired relief. Any request submitted pursuant to this paragraph shall include a statement 
Case 3:21-md-02992-GPC-MSB     Document 566-5     Filed 10/17/25     PageID.33575 
Page 23 of 27

 
 
23 
 
setting forth in detail the circumstances that warrant the desired relief or prevent the Bank from 
complying with the relevant provision(s) of the Order, and shall be accompanied by relevant 
supporting documentation. The OCC’s decision concerning a request submitted pursuant to this 
paragraph, which will be communicated to the Board in writing, is final and not subject to further 
review. 
(6) 
The Bank will not be deemed to be in compliance with this Order until it has 
adopted, implemented, and adhered to all of the corrective actions set forth in each Article of this 
Order; the corrective actions are effective in addressing the Bank’s deficiencies; and the OCC 
has verified and validated the corrective actions. An assessment of the effectiveness of the 
corrective actions requires sufficient passage of time for the Bank to demonstrate the sustained 
effectiveness of the corrective actions. 
(7) 
This Order is not a contract binding on the United States, the United States 
Treasury Department, the OCC, or any officer, employee, or agent of the OCC and neither the 
Bank nor the OCC intends this Order to be a contract. 
(8) 
Each citation, issuance, or guidance referenced in this Order includes any 
subsequent citation, issuance, or guidance that replaces, supersedes, amends, or revises the 
referenced cited citation, issuance, or guidance. 
(9) 
This Order applies to the Bank and all its subsidiaries. 
(10) 
No separate promise or inducement of any kind has been made by the OCC, or by 
its officers, employees, or agents, to cause or induce the Bank to consent to the issuance of this 
Order. 
(11) 
All reports, plans, or programs submitted to the OCC pursuant to this Order shall  
 
 
Case 3:21-md-02992-GPC-MSB     Document 566-5     Filed 10/17/25     PageID.33576 
Page 24 of 27

 
 
24 
 
be forwarded, by overnight mail or via email, to the following: 
Robert Barnes 
Examiner-in-Charge 
National Bank Examiners 
Bank of America, N.A. 
201 N. Tryon Street,  NC1-022-19-01 
Charlotte, NC 28255 
or other such individuals or addresses as directed by the OCC. 
(12) 
The terms of this Order, including this paragraph, are not subject to amendment or 
modification by any extraneous expression, prior agreements, or prior arrangements between the 
parties, whether oral or written. 
 
 
 
IN TESTIMONY WHEREOF, the undersigned, authorized by the Comptroller as his duly 
authorized representative, has hereunto set her signature on behalf of the Comptroller.  
 
  //s//  Digitally Signed, Dated: 2022.07.14 
 
  
 
 
Tanya K. Smith 
Deputy Comptroller 
Large Bank Supervision 
 
Case 3:21-md-02992-GPC-MSB     Document 566-5     Filed 10/17/25     PageID.33577 
Page 25 of 27

 
 
25 
 
IN TESTIMONY WHEREOF, the undersigned, as the duly elected and acting Board of 
Directors of the Bank of America, N.A., Charlotte, North Carolina have hereunto set their 
signatures on behalf of the Bank. 
  /s/ 
 
 
 
 
 
 
 
 
07/12/2022 
Brian T. Moynihan 
/s/ 
 
Date 
13 Jul, 2022 
Sharon L. Allen  
/s/ 
 
Date 
13 Jul, 2022 
Frank P. Bramble, Sr.  
/s/ 
 
Date 
13 Jul, 2022 
Pierre J.P. de Weck  
/s/ 
 
Date 
07/13/2022 
Arnold W. Donald  
/s/ 
 
Date 
13 Jul, 2022 
Linda P. Hudson  
/s/ 
 
Date 
12 Jul, 2022 
Monica C. Lozano  
/s/ 
 
Date 
12 Jul, 2022 
Lionel L. Nowell, III  
/s/ 
 
Date 
12 Jul, 2022 
Denise L. Ramos  
/s/ 
 
Date 
13 Jul, 2022 
Clayton S. Rose  
 
Date 
 
Case 3:21-md-02992-GPC-MSB     Document 566-5     Filed 10/17/25     PageID.33578 
Page 26 of 27

 
 
26 
 
/s/ 
 
12 Jul, 2022 
Michael D. White  
/s/ 
 
Date 
13 Jul, 2022 
Thomas D. Woods  
/s/ 
 
Date 
12 Jul, 2022 
R. David Yost  
/s/ 
 
Date 
07/13/2022 
Maria T. Zuber 
 
Date 
 
 
Case 3:21-md-02992-GPC-MSB     Document 566-5     Filed 10/17/25     PageID.33579 
Page 27 of 27

File and source

File

gov.uscourts.casd.709615.566.5.pdf

Size

415,626 bytes

SHA-256

9798b2912fa0b5538fa4bdedce007a9c178666ee2f38101916eb8f79b6f551bb

Our copy

gov.uscourts.casd.709615.566.5.pdf

Original

PACER (login required)