Court filing
DX 10.B - Expert Rebuttal Report of Russell Cronan — Bofa Ca Unemployment (Dkt. 666.1)
Filed February 17, 2026 in Bofa Ca Unemployment; one of 1415 filings from this case.
Record facts
| Court | U.S. District Court for the Southern District of California |
|---|---|
| Filed | 2026-02-17 |
U.S. District Court for the Southern District of California · No. 3:21-md-02992-GPC-MSB · Doc. 666-1 · 2026-02-17 · Docket on CourtListener
Full text
DX 10.B
FILED
PROVISIONALLY
UNDER SEAL WITH
REDACTIONS
PURSUANT TO
STIPULATED
PROTECTIVE ORDER
Case 3:21-md-02992-GPC-MSB Document 666-1 Filed 02/17/26 PageID.58608
Page 1 of 43
HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY
UNITED STATES DISTRICT COURT
SOUTHERN DISTRICT OF CALIFORNIA
SAN DIEGO DIVISION
IN RE: BANK OF AMERICA
CALIFORNIA UNEMPLOYMENT
BENEFITS LITIGATION
Case No. 1-MD-02992-GPC-MSB
EXPERT REBUTTAL REPORT OF RUSSELL CRONAN
April 4, 2025
HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY
Case 3:21-md-02992-GPC-MSB Document 666-1 Filed 02/17/26 PageID.58609
Page 2 of 43
Case 3:21-md-02992-GPC-MSB Document 666-1 Filed 02/17/26 PageID.58610
Page 3 of 43
HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY
3
I.
Assignment
1.
I was asked by Goodwin Procter LLP, on behalf of Bank of America, N.A. (“Bank
of America” or the “Bank”) to address certain opinions and assumptions put forth in (a) the Expert
Report of J. Daniel Kreis dated March 4, 2025 (“Kreis Report”) and (b) the Expert Report Of
William J. Abernathy, Jr. dated March 3, 2025 (“Abernathy Report”).
2.
My background and qualifications, which include approximately 30 years working
as a federal bank compliance examiner, are detailed in my expert report dated March 4, 2025
(“Cronan Report”). All opinions expressed herein are my own. I have not provided expert
testimony or authored any publications since I submitted the Cronan Report. In preparing this
report, I personally considered various documents produced in this litigation and other materials
which are identified in Appendix B to the Cronan Report. Any additional materials not identified
in the Cronan Report are listed in Appendix A to this report. I also reviewed the materials listed
in the Kreis Report and the Abernathy Report as well as the other expert reports of J. Daniel Kreis
in this matter dated August 29, 2024 (the “Kreis Class Cert Report”) and November 21, 2024 (the
“Kreis Class Cert Rebuttal Report”) and the expert report of William J. Abernathy Jr. in this matter
dated November 19, 2024 (the “Abernathy Class Cert. Rebuttal Report”).
3.
In conducting my work on this matter, I have been assisted by individuals at Ankura
Consulting Group, LLC (“Ankura”),1 who worked at my direction and under my supervision. All
opinions expressed herein are my own.
1 Ankura is a professional services and consulting firm that provides dispute-related,
investigative, financial, and operational consulting services to various types of organizations.
Case 3:21-md-02992-GPC-MSB Document 666-1 Filed 02/17/26 PageID.58611
Page 4 of 43
HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY
4
4.
I reserve the right to supplement or amend my report should new information
become available. I am prepared to testify at trial on the topics addressed in this report and in the
Cronan Report.
II.
Summary of Opinions
5.
I have reviewed the Kreis Report and the Abernathy Report and continue to stand
by the opinions expressed in the Cronan Report. In this report, I respond below to several issues
raised in those reports.
6.
First, Mr. Abernathy offers the extraordinary and unfounded implication that the
Bank knowingly or willfully violated the Electronic Fund Transfer Act (“EFTA”) and Regulation
E when it implemented the Claim Fraud Filter (“CFF”) in response to unprecedented levels of
fraud, and that it further sought to shield this decision from its regulators because it supposedly
“knew or should have known”2 that its regulators would have found certain aspects of the CFF
unacceptable.3 His lone support for this serious and unsupported allegation is his hindsight-based
reference to the consent orders the Bank subsequently entered into with the Office of the
Comptroller of the Currency (“OCC”) and the Consumer Financial Protection Bureau (“CFPB”)
in 2022; however, the fact the Bank ultimately entered into those consent orders does not mean
the Bank’s decision to implement the CFF was unreasonable at the time the decision was made,
let alone a willful violation of EFTA and Regulation E.
2 See Abernathy Report ¶ 26.
3 Per Mr. Abernathy, it was “completely unreasonable” for the Bank to believe the CFF would be
acceptable to its regulators and “the fact that the Bank could have easily communicated this plan
to its regulators, but did not, indicates that the Bank was aware and concerned that the Claim
Fraud Filter did not comply with the Bank’s obligations…” See Abernathy Report ¶ 27 through
¶ 28.
Case 3:21-md-02992-GPC-MSB Document 666-1 Filed 02/17/26 PageID.58612
Page 5 of 43
HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY
5
There were sound reasons why the Bank would not seek advance approval
from its regulators before implementing the CFF, as both Messrs. Abernathy and Kreis opine the
Bank should have done. Based on my extensive experience as a federal bank examiner, had the
Bank requested and then in turn waited for regulatory guidance prior to taking action in response
to the explosion of prepaid card fraud, such inaction would have allowed the fraud to continue
unabated. In my opinion, the OCC would not consider a bank allowing uncontrolled fraud losses
to be an effectively managed risk. Indeed, the OCC could deem a bank’s inaction in the face of
uncontrolled fraud to be an unsafe and unsound banking practice.
7.
Second, Mr. Kreis asserts that the Bank could have adopted strategies other than
CFF Indicator 1 to address the operational challenges related to cardholder claims of unauthorized
ATM withdrawals.5 Notably, Mr. Kreis bases his conclusions about claims-handling on a pre-
pandemic, business-as-usual environment in which a claims system is not actively being targeted
and taken advantage of by criminals and fraudsters. He does not account for the circumstances of
the global pandemic and related safety-and-soundness obligations financial institutions are
required to address. It is my opinion that the alternative scenarios proffered by Mr. Kreis that he
claims the Bank could have undertaken -- i.e., increasing staffing, increasing
,
and prioritizing the investigation of high-dollar claims -- were not viable solutions in the face of
the unprecedented wave of fraud that infiltrated Bank of America’s prepaid debit card program for
4 Declaration of Laura Brys in Support of Defendant’s Opposition to Plaintiffs’ Motion for Class
Certification, Ex. (“DX”) 6, See Michael Letson October 23, 2024 Declaration, ¶ 10 through ¶
27.
5
Case 3:21-md-02992-GPC-MSB Document 666-1 Filed 02/17/26 PageID.58613
Page 6 of 43
HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY
6
California’s Employment Development Department (“EDD”) and specifically targeted the Bank’s
systems, and it was reasonable for the Bank to come to that conclusion.
8.
.6 However, Mr. Kreis ignores the fact that neither EFTA nor
Regulation E contemplates industry standards as it relates to written explanations. Notably, EFTA
and Regulation E provide flexibility relating to banks’ obligations to report the results of
investigations, specifying broadly that banks are to provide “… a written explanation of the
institution's findings.”7 As Mr. Kreis notes, the claim denial letters set forth the following “reason”
for the claim denial: “Your claim has been closed because we believe the account or the claim
have been the subject of fraud or suspicious activity.”8 Based on my experience as a regulator, the
aforementioned letters did provide a written explanation of the reason for the Bank’s denial of the
claims. Further, in concluding that the stated “reason” was somehow insufficient, Mr. Kreis
appears to be selective in his reliance on the July 2022 consent orders. On the one hand, Mr. Kreis
cites the July 2022 consent orders as “supporting [his] opinion” that the Bank “believed that its
regulators would not have approved use of the CFF”;9 however, he makes no mention of the fact
that the CFPB consent order, even years after the fact, did not take issue with the written
explanation contained in the Bank’s claim denial letters.
9.
6 See Kreis Report ¶ 77 through ¶ 80.
7 See 12 CFR § 1005.11(d)(1).
8 See Kreis Report ¶ 79.
9 See Kreis Report ¶ 49.
Case 3:21-md-02992-GPC-MSB Document 666-1 Filed 02/17/26 PageID.58614
Page 7 of 43
Case 3:21-md-02992-GPC-MSB Document 666-1 Filed 02/17/26 PageID.58615
Page 8 of 43
HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY
8
in 2022; however, the fact the Bank ultimately entered into those consent orders does not mean
the Bank’s decision to implement the CFF was not reasonable at the time the decision was made,
let alone a willful violation of EFTA and Regulation E.13
A.
The Bank Could Not Have Realistically Delayed Action Pending Solicitation
and Receipt of Regulatory Guidance.
11.
Mr. Abernathy asserts it was “unreasonable for the Bank to fail to communicate
with its regulators that it was about to implement a new process” related to its EFTA and
Regulation E investigations.15 This statement ignores the urgent nature of the Bank’s need to
address the unprecedented levels of fraud impacting the EDD program and that delaying the
implementation of the CFF until after soliciting and receiving regulatory guidance would have
allowed the fraud to continue unabated.
12.
In my experience, large banks have knowledgeable compliance and legal staffs and
access to experienced outside counsel for relevant legal advice. As such, these banks make a
myriad of operational decisions without approaching regulators for guidance. Indeed, this is the
understanding and expectation of regulators, all the more so when banks are responding to rapid
changes in circumstances.
13 Mr. Kreis likewise refers to the 2022 consent order as “supporting [his] opinion” that the Bank
“believed that its regulators would not have approved use of the CFF.” See Kreis Report ¶ 49.
Mr. Kreis is apparently referring to the CFPB consent order as the OCC consent order is not
listed among his materials relied upon. See Kreis Appendix B.
14 DX 6, See Michael Letson October 23, 2024 Declaration, ¶ 10 through ¶ 27.
15 See Abernathy Report ¶ 27.
16 See Bank Of America’s Responses And Objections To Plaintiffs’ Sixth Set Of Interrogatories,
Case No. 3-21-md-02992-LAB-MSB, pages 7-9.
Case 3:21-md-02992-GPC-MSB Document 666-1 Filed 02/17/26 PageID.58616
Page 9 of 43
HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY
9
The governance exercised by Bank of America, including the participation of the Bank’s legal
team, among other groups, is consistent with my expectations.
13.
Furthermore, bank regulators have their own processes and approvals to work
through such that responding to a bank seeking regulatory guidance can be a time-consuming
undertaking. I have personally seen routine regulatory inquiries (e.g., a simple Regulation B
violation determination) take weeks to be resolved at the CFPB. In another example involving a
member of my examination team at the OCC, the OCC took months to respond to and opine on a
question related to the Community Reinvestment Act. It is important to note that both of these
examples took place when the agencies were operating under business-as-usual circumstances. In
contrast, during the pandemic, bank regulators themselves, similar to the banks they regulated,
faced unprecedented operational challenges (e.g., transitioning to conducting remote
supervision).19 These challenges would have likely delayed regulatory response time to an even
greater degree than such responses in a business-as-usual environment. Further, because the
17 See, for example, BANA_EDD_MDL-00705467- BANA_EDD_MDL-00705470,
BANA_EDD_MDL-00701607 - BANA_EDD_MDL-00701608, BANA_EDD_MDL-00705493
- BANA_EDD_MDL-00705497.
18 See BANA_EDD_MDL-00497802 - BANA_EDD_MDL-00497804.
19 See “Bank Supervision: Lessons Learned from Remote Supervision During Pandemic Could
Inform Future Disruptions,” U.S. Government Accountability Office, GAO-22-104569,
September 2022. https://www.gao.gov/assets/gao-22-104659.pdf (Last accessed April 4, 2025).
(“To manage pandemic-related challenges to their supervisory missions, banking regulators
deferred examination activities, expanded off-site monitoring of institutions, adjusted telework
policies, and provided technology tools and internal guidance to examiners.”)
Case 3:21-md-02992-GPC-MSB Document 666-1 Filed 02/17/26 PageID.58617
Page 10 of 43
HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY
10
present issue for Bank of America involved two separate federal regulatory agencies (i.e., the
CFPB and OCC) that each had responsibility for and jurisdiction over different but interwoven
elements of the Bank’s operations (i.e., the CFPB over EFTA and Regulation E, and the OCC over
safety and soundness and compliance, which includes the Bank’s Bank Secrecy Act (“BSA”) /
Anti-Money Laundering (“AML”) obligations), the two agencies would have had to confer and
come to agreement, thus further extending the timeline. As a result, Bank of America likely would
not have received a prompt response under the hypothetical circumstance that it sought regulatory
guidance as to how it should respond to rapidly-rising EDD prepaid card fraud.
14.
In support of his position that “even a small financial institution has the ability to
reach out to regulators” for approval, Mr. Kreis cites to an example of a FinTech firm, Upstart,
that applied for and received a No-action Letter (“NAL”) from the CFPB regarding its online
lending platform.20 To be clear, contrary to Mr. Kreis’s suggestion, applying for an NAL was
simply not an option that was available to the Bank relating to its operational decision to implement
the CFF. For context, under an approved NAL, the CFPB agrees to not make supervisory findings
or bring a supervisory or enforcement action against a company with respect to certain
requirements relating to innovative financial products or services promising substantial consumer
benefit that are covered under the NAL.21 Importantly, because NALs relate only to the
introduction of a novel financial product or service,22 they simply do not apply to the situation in
which the Bank hypothetically seeks a regulatory interpretation with respect to an operational
20 See Kreis Report, ¶ 49. Notably, NALs would not require approval from the OCC, which was
the Bank’s primary regulator.
21 See “Policy on No-Action Letters; Information Collection,” Federal Register, Vol. 81, No. 34,
February 22, 2016, page 8686, https://www.govinfo.gov/content/pkg/FR-2016-02-22/pdf/2016-
02390.pdf (Last accessed April 4, 2025).
22 Id.
Case 3:21-md-02992-GPC-MSB Document 666-1 Filed 02/17/26 PageID.58618
Page 11 of 43
HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY
11
process change (e.g., the implementation of the CFF). Indeed, Mr. Kreis identifies no evidence
whatsoever that this option was available to the Bank.
15.
It is further worth noting that even with respect to Mr. Kreis’s own inapposite
example, Upstart subsequently requested early termination of the NAL, citing “…a need to be able
to respond to the rapid pace of change in credit markets,” and “… because [they] would like to
make time-sensitive model changes that are not possible if the CFPB were to conduct the
appropriate level of monitoring and review.”24 The CFPB itself noted that “Upstart has correctly
identified that this review [by the CFPB to study the potential implications of Upstart adding
variables to its underwriting and pricing model] would prevent [Upstart] from making quick
business decisions with regard to its model.”25 The early termination of Upstart’s NAL
underscores the industry’s need to be able to make time-sensitive business judgments while
waiting on regulatory opinion. Indeed, had the Bank sought a regulatory interpretation, and waited
for a response before implementing the CFF, as Messrs. Abernathy and Kreis advise, it would have
prevented the Bank from addressing the unprecedented levels of fraud that were impacting the
23 See Cronan Report Section V. See Cronan Report ¶ 43 through ¶ 52.
24 See Order to Terminate No-Action Letter, CFPB, Upstart Network, Inc., In re November 30,
2020 No-Action Letter, June 8, 2022, pages 1-2,
https://files.consumerfinance.gov/f/documents/cfpb_upstart-no-action-letter-
termination_order_2022-06.pdf (Last accessed April 4, 2025).
25 See Order to Terminate No-Action Letter, CFPB, Upstart Network, Inc., In re November 30,
2020 No-Action Letter, June 8, 2022, page 2,
https://files.consumerfinance.gov/f/documents/cfpb_upstart-no-action-letter-
termination_order_2022-06.pdf (Last accessed April 4, 2025).
Case 3:21-md-02992-GPC-MSB Document 666-1 Filed 02/17/26 PageID.58619
Page 12 of 43
HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY
12
EDD program and the Bank -- and may have allowed significant additional fraud to victimize
taxpayers and the Bank.
16.
After conducting a review of its own NAL policy in 2022, the CFPB issued a policy
statement concluding that the NAL policies utilized by Upstart and in place during the pandemic
“failed to advance their stated objective of facilitating consumer-beneficial innovation” and cited
“a number of potential abuses and challenges with the NAL policy.”26 One such example of
“abuses and challenges” cited by the CFPB was Upstart’s NAL. The CFPB first noted that it “did
not have enough time to review the implications of the significant changes” to Upstart’s credit
model and so terminated the NAL.27 The CFPB also pointed out that -- despite initially
granting a NAL to Upstart -- significant concerns subsequently arose with respect to the model’s
compliance with the Equal Credit Opportunity Act.28 Thus, Mr. Kreis’s example does nothing to
support his assertion that the Bank should have sought regulatory guidance prior to
implementing the CFF because the NAL process was not an option for the Bank and it
further ignores that Upstart requested early termination of the NAL that it found too restrictive
for making timely business decisions.
17.
Based on my experience as a regulator, it was incumbent on Bank of America to
take all reasonable actions to stem the tide of unprecedented fraud and potential fraud losses, rather
than wait for regulators to eventually weigh in with guidance. Each passing day without action
would have meant an unabated rise in fraudulent unauthorized transaction claims that the Bank
believed were associated with fraudulent benefits accounts, which the OCC could have considered
26 See Policy Statement on No Action Letters, CFPB, Federal Register, Vol. 90, No. 6, Friday,
January 10, 2025, page 1971, https://www.govinfo.gov/content/pkg/FR-2025-01-10/pdf/2025-
00378.pdf (Last accessed April 4, 2025).
27 Id.
28 Id.
Case 3:21-md-02992-GPC-MSB Document 666-1 Filed 02/17/26 PageID.58620
Page 13 of 43
HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY
13
in and of itself an unsafe and unsound banking practice (as discussed below). As such, it is my
opinion that it was reasonable for the Bank to believe that implementing automated tools such as
the CFF to address the explosion in prepaid fraud, rather than solicit and wait for regulatory
guidance, was a prudent course of action.
B.
It Was Reasonable for the Bank to Believe the Implementation of the CFF
Would Have Been Acceptable to the Bank’s Regulators.
18.
Based on my experience with the OCC, the OCC would not consider a bank
allowing uncontrolled fraud losses to be an effectively managed risk. The OCC could thus deem
a bank’s inaction in the face of uncontrolled fraud to be an unsafe and unsound banking practice.
As I noted in the Cronan Report,29 the OCC’s Policies and Procedures Manual (“PPM”) related to
Civil Money Penalties indicates an unsafe or unsound practice includes a “…lack of action…the
possible consequences of which, if continued, would be abnormal risk or loss or damage to an
institution, its shareholders, or the Deposit Insurance Fund.”30 The manual relatedly says, “‘Risk
of loss’ refers to any time the bank was in danger of sustaining a financial loss as a result of the
misconduct.”31 Based on the above, it would have been reasonable for the Bank to believe the
OCC could consider a lack of action on its part to control fraud losses to be an unsafe and unsound
practice. If fact, as noted in the Cronan Report, Bank employee Michael Letson described the
Accordingly, the Bank undertook mitigation steps to address the
29 See Cronan Report ¶ 19.
30 See PPM-5000-7, Section: Bank, Supervision Subject: Civil Money Penalties, November 13,
2018 | OCC, page 14.
31 See PPM-5000-7, Section: Bank, Supervision Subject: Civil Money Penalties, November 13,
2018 | OCC, page 15.
32 See Cronan Report ¶ 45 through ¶ 48. DX 6, See Michael Letson October 23, 2024
Declaration, ¶ 10 through ¶ 27.
Case 3:21-md-02992-GPC-MSB Document 666-1 Filed 02/17/26 PageID.58621
Page 14 of 43
HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY
14
prepaid card fraud through its development of the CFF. Reports related to unemployment
insurance fraud from the Financial Crimes Enforcement Network (“FinCEN”)33
34 in March 2020 and May 2020, respectively, support the Bank’s belief that such
mitigation steps were reasonable. Indeed, in September 2020, the U.S. Department of Justice
established a National Unemployment Insurance Fraud Task Force indicating that “[f]raudsters,
some of which are transnational criminal organizations, are using the stolen identities of U.S.
citizens to open accounts and file fraudulent claims for UI benefits, exploiting the unprecedented
expansion of these benefits provided in response to economic disruption caused by the COVID-
19 pandemic.”35
19.
In my experience, an unsafe and unsound practice in itself does not indicate that a bank
is in an unsafe and unsound condition. Rather, such practices could potentially lead to the bank
being in an unsafe and unsound condition. For example, a practice of not addressing rapidly
increasing fraud across the various areas of a bank would likely eventually put any bank in an
unsafe and unsound condition.
33 See “The Financial Crimes Enforcement Network (FinCEN) Encourages Financial Institutions
to Communicate Concerns Related to the Coronavirus Disease 2019 (COVID-19) and to Remain
Alert to Related Illicit Financial Activity,” FinCEN Press Release, March 16, 2020,
https://www.fincen.gov/news/news-releases/financial-crimes-enforcement-network-fincen-
encourages-financial-institutions (Last accessed April 4, 2025).
34 See BANA_EDD_MDL-00205361.
35 See "Unemployment Insurance Fraud Consumer Protection Guide," U.S. Department of
Justice, National Unemployment Insurance Fraud Task Force, September 21, 2020,
https://www.oig.dol.gov/public/Unemployment%20Insurance%20Fraud%20Consumer%20Prote
ction%20Guide,%20Final.pdf (Last Accessed April 4, 2025).
36 See Cronan Report ¶ 19.
Case 3:21-md-02992-GPC-MSB Document 666-1 Filed 02/17/26 PageID.58622
Page 15 of 43
HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY
15
20.
Further to this point, I am aware that in July 2022 Bank of America entered into a
consent order with the OCC around the administration of the Bank’s prepaid cards for
unemployment benefits. The OCC’s order specifically states that the Bank engaged in “unsafe or
unsound practice(s)” -- it notably did not say the Bank was in an unsafe and unsound condition.37
C.
Mr. Abernathy’s Reliance on the Consent Orders as the Basis for His
Opinion That the Bank Could Not Have Reasonably Anticipated Regulatory
Approval Is a Product of Hindsight.
21.
Mr. Abernathy’s opinion that the Bank “could not have reasonably believed” that
the CFF complied with EFTA and Regulation E when it implemented the CFF38 is colored with
hindsight, as it is based on the fact the Bank subsequently entered into consent orders with the
OCC and CFPB. Mr. Abernathy’s reliance on the CFPB and OCC consent orders does not account
for a practical reality of enforcement activity: agency priorities can experience shifts with changes
in presidential administrations and corresponding leadership appointments, and such a priority
shift happened here between the time the Bank made the decision to implement the CFF in late
2020 and the time the Bank entered into the CFPB and OCC consent orders in July 2022.
22.
In my experience, different administrations and supervision and enforcement
personnel may interpret and enforce regulations differently, particularly where the regulation itself
does not contain specific requirements or provide specific guidance, as is the case with EFTA and
Regulation E. Further, their interpretations of a given regulation may (and often does) differ.
23.
As I noted in the Cronan Report, EFTA and Regulation E allow for flexibility given
the need to respond to changing circumstances.39 Likewise, the nature of an EFTA and Regulation
37 See United States of America Department of the Treasury Office of the Comptroller of the
Currency – Consent Order: In the Matter of: Bank of America, N.A. Charlotte, North Carolina,
July 14, 2022, page 1.
38 See Abernathy Report Section V ¶ 2 through ¶ 3.
39 See Cronan Report ¶ 27 through ¶ 28.
Case 3:21-md-02992-GPC-MSB Document 666-1 Filed 02/17/26 PageID.58623
Page 16 of 43
HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY
16
E examination allows for flexibility in recognition of the potential for broad variances as it relates
to the type of claims made by consumers. For these reasons, differing views across different
administrations and appointed agency leaders can have a meaningful impact on whether or not an
enforcement action may or may not be imposed.
24.
In 2020, the OCC and CFPB, under the leadership of a Republican administration,
issued guidance and bulletins acknowledging the impact of COVID-19 on the operations of
financial institutions and potential CARES Act-related fraud, and indicated that the agencies would
provide flexibility as banks sought to respond to the pandemic. At the outset of the pandemic,
OCC Bulletin 2020-34 acknowledged the fraud challenges the pandemic would likely pose for
financial institutions, particularly those charged with implementing programs under the CARES
Act.40 The OCC stated that “compliance with the BSA remains crucial to protecting national
security by combating money laundering and related crimes . . . during national emergencies such
as the COVID-19 pandemic” and proceeded to identify known scams and criminal attempts to
infiltrate programs implemented under the CARES Act, “creating further challenges for financial
institutions.”41 The early interagency guidance further stated: “[c]onsistent with long-standing
practices, the OCC will consider the unusual circumstances faced during the COVID-19 crisis
when reviewing BSA compliance programs and determining any supervisory response.”42
25.
Additionally, in June 2020, the OCC issued Bulletin 2020-64, which outlined
supervisory principles for assessing bank safety and soundness given the ongoing impact of the
40 See “Bank Secrecy Act/Anti-Money Laundering: OCC Supports FinCEN’s Regulatory Relief
and Risk-Based Approach for Financial Institution Compliance in Response to COVID-19,”
OCC Bulletin 2020-34, OCC, April 7, 2020, https://www.occ.gov/news-
issuances/bulletins/2020/bulletin-2020-34.html (Last accessed April 4, 2025).
41 Id.
42 Id.
Case 3:21-md-02992-GPC-MSB Document 666-1 Filed 02/17/26 PageID.58624
Page 17 of 43
HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY
17
pandemic.43 The interagency examiner guidance provided that “examiners will consider the
unique, evolving, and potential long-term nature of the issues confronting banks and will exercise
appropriate flexibility in their supervisory response.”44 Similarly, a March 2020 press release from
the CFPB noted “that it is providing needed flexibility to enable financial companies to work with
customers in need as they respond to the COVID-19 pandemic.”45
26.
Financial institutions reasonably rely on such agency pronouncements and
guidance, particularly during periods of crisis, as they respond to dynamic circumstances. Further,
given the unprecedented nature of the pandemic, its impact on financial institutions and consumers,
and rapidly changing circumstances, this regulatory flexibility afforded to banks was important
and necessary. When banks were facing new challenges they could not have reasonably expected
to foresee, it was reasonable for banks to expect they would be provided some flexibility in
responding to the crisis in ways they believed to be reasonable. In Bank of America’s case
specifically, it was reasonable for the Bank to expect they would be afforded some flexibility to
respond to the explosion of EDD prepaid debit card fraud.
27.
In January 2021, a new Democratic presidential administration appointed new
agency heads, rescinded many earlier pandemic-related pronouncements, and announced that prior
pronouncements and statements offering flexibility and acknowledging the challenges financial
43 See “Examinations: Interagency Examiner Guidance for Assessing Safety and Soundness
While Considering the Effect of COVID-19 on Institutions,” OCC Bulletin 2020-64, OCC, June
23, 2020, https://www.occ.gov/news-issuances/bulletins/2020/bulletin-2020-64.html (Last
accessed April 4, 2025).
44 Id.
45 See “CFPB Provides Flexibility During COVID-19 Pandemic,” Bureau of Consumer Financial
Protection, March 26, 2020, https://www.consumerfinance.gov/about-us/newsroom/cfpb-
provides-flexibility-during-covid-19-pandemic (Last accessed April 4, 2025) (emphasis added).
Case 3:21-md-02992-GPC-MSB Document 666-1 Filed 02/17/26 PageID.58625
Page 18 of 43
HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY
18
institutions would not be honored.46 Instead, agencies like the CFPB stated that they would take
the opposite approach in enforcing (and sometimes second-guessing) decisions made by financial
institutions during the COVID-19 crisis. In January of 2021, Acting Director of the CFPB, Dave
Uejio, stated in a press release that there would be a “change of direction” and that “[m]oving
forward, the CFPB [would] take aggressive action to ensure that regulated companies follow the
law and meet their obligations to assist consumers during the COVID-19 pandemic.”47 That the
OCC and CFPB under a different administration ultimately pursued aggressive enforcement
actions against the Bank (and others) does not mean it was unreasonable for the Bank, in
consultation with its compliance and legal team, to adopt the CFF to address the real-time fraud
that was targeting the EDD prepaid debit cards.
28.
In my opinion, it was further reasonable for the Bank to believe that its regulators
would view the Bank’s response to pandemic-driven fraud favorably, particularly where the OCC
and CFPB themselves acknowledged that circumstances were not business-as-usual, and the OCC
specifically acknowledged the challenges in dealing with COVID-19 and CARES Act-related
fraud.48 At the very least, it was reasonable for the Bank to assume that good-faith efforts to swiftly
46 See e.g. “The Bureau is taking much-needed action to protect consumers, particularly the most
economically vulnerable,” Consumer Financial Protection Bureau, January 28, 2021,
https://www.consumerfinance.gov/about-us/blog/the-bureau-is-taking-much-needed-action-to-
protect-consumers-particularly-the-most-economically-vulnerable/ (Last accessed April 4, 2025).
47 Id (emphasis added).
48 See “Statement on Bureau Supervisory and Enforcement Response to COVID-19 Pandemic,”
Bureau of Consumer Financial Protection, March 26, 2020,
https://files.consumerfinance.gov/f/documents/cfpb_supervisory-enforcement-statement_covid-
19_2020-03.pdf (Last accessed April 4, 2025). See “Semiannual Risk Perspective From the
National Risk Committee,” OCC, Spring 2020 (Page 1), https://www.occ.gov/publications-and-
resources/publications/semiannual-risk-perspective/files/pub-semiannual-risk-perspective-
spring-2020.pdf (Last accessed April 4, 2025).
Case 3:21-md-02992-GPC-MSB Document 666-1 Filed 02/17/26 PageID.58626
Page 19 of 43
HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY
19
address the massive and unprecedented fraud targeting a government program and the Bank’s
claim system would not be second-guessed.
29.
That the agencies retroactively rescinded the prior administration’s announcements
months after the Bank acted, and pivoted to a more “aggressive” enforcement posture provides
critical context in refuting Messrs. Abernathy and Kreis’s opinions that the mere existence of the
July 2022 consent orders establishes that the Bank’s decision to implement the CFF at the height
of the pandemic was not reasonable, let alone the extraordinary implication that the Bank knew its
regulators would disapprove of its decision.
D.
Mr. Abernathy Has Not Established the Bank Was Found to Have
Committed Reckless Violations.
30.
Mr. Abernathy further justifies his opinion by noting that the OCC consent order
found that Bank of America’s violations supported actions against the Bank under 12 U.S.C. §
1818(b) and (i)(2)(B).49 He further notes that these specific provisions authorize “second-tier
penalties for ‘reckless’ violations of law or ‘breaches of fiduciary duty’ that are ‘part of a pattern
of misconduct’ or ‘results in pecuniary gain or other benefit’ to the bank” and goes on to state that
“the Bank’s regulators levied significant second-tier penalties based on this level of
misconduct…”50 Mr. Abernathy concludes that the fact that the consent orders imposed penalties
under these provisions is “telling,” implying that the regulators made a finding of recklessness or
some other heightened scienter.51 In my opinion, Mr. Abernathy has not established that the OCC
found the Bank to have committed any “reckless violations of law or breaches of fiduciary duty
that are part of a pattern of misconduct or results in pecuniary gain or other benefit” to the Bank.
49 See Abernathy Report ¶ 31 through ¶ 32.
50 See Abernathy Report ¶ 32.
51 Id.
Case 3:21-md-02992-GPC-MSB Document 666-1 Filed 02/17/26 PageID.58627
Page 20 of 43
HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY
20
This is all the more so given that the OCC consent order includes no such express finding whereas
other OCC consent orders do.52
31.
The OCC’s PPM describes how the OCC assesses Tier 2 civil money penalties,
under the statutes discussed above, which can be for a range of reasons. For example, the PPM
notes that Tier 2 penalties can be assessed for various reasons such as “violations of law,” including
certain unsafe and unsound practices, “which cause or are likely to cause more than a minimal loss
to the institution...”53 As noted above, The PPM further says, “An unsafe or unsound practice is
any action, or lack of action, which is contrary to generally accepted standards of prudent
operation, the possible consequences of which, if continued, would be abnormal risk or loss or
damage to an institution, its shareholders, or the Deposit Insurance Fund.”54 Based on this
guidance, the OCC could levy a Tier 2 penalty against a bank that, say, did not take prompt action
to stem fraud losses. Ultimately, it is unclear why the OCC issued Tier 2 penalties in this instance
-- the consent order itself is silent on this issue, and Mr. Abernathy offers nothing more than
conjecture to support his implication.
52 Compare United States of America Department of the Treasury Office of the Comptroller of
the Currency – Consent Order: In the Matter of: Bank of America, N.A. Charlotte, North
Carolina, July 14, 2022 to United States of America Department of the Treasury Office of the
Comptroller of the Currency – Consent Order: In the Matter of: Ralph Derrickson, August 17,
2023, page 2, https://www.occ.gov/static/enforcement-actions/ea2023-026.pdf (Last accessed on
April 4, 2025). (“Respondent engaged in violations of law, engaged in reckless unsafe or
unsound practices, and breached his fiduciary duty to the Bank; which violations, practices, or
breaches were part of a pattern of misconduct.”)
53 See PPM-5000-7, Section: Bank, Supervision Subject: Civil Money Penalties, November 13,
2018 | OCC, page 3.
54 See PPM-5000-7, Section: Bank, Supervision Subject: Civil Money Penalties, November 13,
2018 | OCC, page 14 (emphasis added).
Case 3:21-md-02992-GPC-MSB Document 666-1 Filed 02/17/26 PageID.58628
Page 21 of 43
HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY
21
E.
The CFF Was a Reasonable and Effective Fraud Rule That Regulators
Typically Would Not Second Guess in Hindsight or Assess in the Manner
Proposed by Mr. Kreis.
32.
In my experience, this understanding is inherent in bank examiners’ assessment
of such processes, and for this reason, the OCC does not focus on outcomes or results with
hindsight; rather, the OCC generally considers the facts and circumstances surrounding a given
fraud rule.
33.
Based on my
experience, regulators would view a fraud rule or process that identifies
to be an extremely reasonable and effective mechanism for identifying and deterring fraud.
34.
Based on my experience and my review of the Expert Rebuttal Report of Teresa A.
Pesce dated April 4, 2025 (“Pesce Rebuttal Report”), even if one were to accept the error rates Mr.
Kreis alleges as accurate (and I do not have a basis to believe or accept that they are), regulators
would typically view a fraud rule that successfully identifies more than one-third of accounts or
55 See Cronan Report ¶ 65.
56 See Cronan Report Section V. See Cronan Report ¶ 43 through ¶ 52.
57 DX 6, See Michael Letson October 23, 2024 Declaration, ¶ 34.
58 DX 6, See Michael Letson October 23, 2024 Declaration, ¶ 36. See Pesce Rebuttal Report
Section VI.
Case 3:21-md-02992-GPC-MSB Document 666-1 Filed 02/17/26 PageID.58629
Page 22 of 43
HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY
22
transactions as likely fraudulent as a reasonable and effective mechanism for identifying and
deterring fraud.
35.
Mr. Kreis opines otherwise.
This statement appears to be based on Mr. Kreis’s view that “an
average claims analyst has an average claims audit overturn rate of approximately 1% or less.”61
36.
Mr. Kreis’s focus on outcomes (i.e., reconsideration and overturn rates) does not
mean there was not a reasonable basis to believe the CFF was effective. Based on my experience,
as it relates to banks’ use of a tool like the CFF, regulators principally focus on whether the
methodology and criteria developed by an institution is reasonable, rather than purely evaluating
outcomes.62 First, this is because it is the regulators’ role to ensure the bank is being managed in
a safe and sound manner and acting in compliance with applicable laws and regulations; it is
decidedly not the regulators’ role to micromanage a bank’s operational decisions. Second,
focusing purely on outcomes can obscure important context that may have informed the bank’s
methodology and criteria.
59 See e.g. DX 6, See Michael Letson October 23, 2024 Declaration, ¶ 34 through ¶ 36. See
Pesce Rebuttal Report ¶ 16.
60 See Kreis Report ¶ 72.
61 See Kreis Report ¶ 68.
62 During my time at the OCC, I worked extensively with BSA/AML, which has overlap and
commonalities with fraud mitigation.
Case 3:21-md-02992-GPC-MSB Document 666-1 Filed 02/17/26 PageID.58630
Page 23 of 43
HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY
23
37.
Here, context is important. For example, the inverse of the 68% average
reconsideration rate cited by Mr. Kreis indicates that – in the context of the massive fraud targeting
the EDD prepaid card program -- nearly one-third of claimants did not even attempt to challenge
the denial. The fact that the remaining approximately two-thirds of claimants did is not dispositive
that those were thus legitimate claims (as indicated by approximately 20% being denied a second
time).
IV.
Mr. Kreis's Proposed Alternative Approaches Ignore the Reality of the Bank’s
Position During Unprecedented Circumstances and Would Have Been Insufficient.
38.
Mr. Kreis ignores the Bank’s safety and soundness obligations imposed by the
OCC, which included its obligation to control fraud. Instead, Mr. Kreis improperly bases his
conclusions about claims-handling on a pre-pandemic, business-as-usual environment in which a
claims system is not being actively targeted by criminals and fraudsters, and in which it would be
possible to methodically review each and every claim before the criminals and fraudsters could
abscond with additional stolen funds. It does not appropriately consider how the unprecedented
pandemic circumstances, and the Bank’s safety-and-soundness and compliance obligations,
including those required of a bank to effectuate BSA/AML, can affect a financial institution’s
EFTA and Regulation E investigative processes.
39.
Mr. Kreis critically ignores that, in light of the unprecedented unemployment
benefits and unauthorized transaction claims fraud driven by the unpredictable circumstances of
the pandemic, Bank of America’s business-as-usual EFTA and Regulation E manual investigative
processes put the Bank at risk both for meeting its EFTA and Regulation E obligations (e.g., the
required timing of investigations and provisional credits) and its safety and soundness
requirements (i.e., operational risk management expectations of the OCC, which includes fraud
mitigation). In my experience as a regulator, on the one hand, banks are generally expected to
Case 3:21-md-02992-GPC-MSB Document 666-1 Filed 02/17/26 PageID.58631
Page 24 of 43
HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY
24
issue provisional credits to the extent they cannot conduct investigations in a timely matter.
40.
As explained above, the OCC expects that banks will adequately manage risk, and
that the agency will hold bank management accountable to the extent they do not do so. As further
explained, the OCC would not consider uncontrolled fraud losses to be an effectively managed
risk.
A.
The Exponential Increase in Claims Could Not Have Reasonably Been
Addressed in a Timely Manner Through Additional Staffing.
41.
Mr. Kreis’s proposed alternative solution of hiring additional claims staff64 fails to
account for operational challenges, which were exacerbated by the pandemic in unprecedented
ways.
The pandemic created many
operational challenges for employers experiencing a first-of-its-kind migration to mass remote
63 DX 6, See Michael Letson October 23, 2024 Declaration, ¶ 27.
64 See Kreis Report ¶ 53.
65 See Cronan Report ¶ 38.
Case 3:21-md-02992-GPC-MSB Document 666-1 Filed 02/17/26 PageID.58632
Page 25 of 43
HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY
25
work, which presented challenges as to training, and access to systems and data. Of note, staffing
is an operational risk reviewed by the OCC, so Bank of America had to thoughtfully and
deliberately cope with these challenges to ensure it met OCC expectations in this area.
42.
It has been my experience over 30 years that banks (and particularly large banks)
commonly have dedicated units that conduct investigations, including EFTA and Regulation E
error investigations. These units are staffed by highly-specialized and trained analysts because the
work is complex and difficult. Mr. Kreis seems to agree when he states, “To ensure EFTA/Reg E
compliance, it is a standard practice in the banking and financial services industry for debit card
issuers to have a department of trained personnel who are dedicated to investigating claims
(‘claims analysts’).”66
43.
Even in a business-as-usual environment, my experience is that it takes months to
properly onboard and train claims analysts. Mr. Kreis suggests using contractors, but even if a
bank can onboard contractors (or new employees) who are familiar with EFTA and Regulation E
investigations, these individuals would still require significant training on the bank’s processes,
systems, and standards. Rapidly adding personnel with the necessary knowledge, skills, and
aptitude was even more difficult during the pandemic given the logistical challenges with remote
hiring and training.67
44.
Mr. Kreis notes that he personally managed an engagement with Accenture “where
it provided human resources to support the development of enhanced customer service operations
for a leading US lender.”68 “Enhancing customer service operations” is not akin to conducting
EFTA and Regulation E investigations under the
which is Mr. Kreis’s purported
66 See Kreis Report ¶ 20.
67 DX 5, See Stephen Hindle October 24, 2024 Declaration, ¶ 24.
68 See Kreis Report ¶ 53.
Case 3:21-md-02992-GPC-MSB Document 666-1 Filed 02/17/26 PageID.58633
Page 26 of 43
HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY
26
benchmark. It is unclear what precisely Mr. Kreis means when he refers to “customer service
operations for a leading US lender,” but that could involve tasks as simple as fielding basic
customer inquiries related to, for example, simple rate quotes and loan payoff information. In
contrast, conducting regulatory investigations under the Bank’s
or other EFTA and
Regulation E investigation processes would require requisite regulatory and procedural
knowledge, as well as a comprehensive understanding of numerous bank systems.
45.
Claims analysts also needed to have secure means to access all systems and
databases necessary to conduct and document investigations and secure methods of
communicating with consumers, which added further complexity to any such hiring during the
novel work-from-home era introduced by the pandemic. Likewise, during the pandemic, increased
employee absenteeism due to illness or caring for those who were ill would have negatively
impacted the situation.
46.
If a bank were to hire unqualified analysts, or any other employees, and/or fail to
train them properly, the OCC would criticize management for those failures. The OCC expects
bank management to staff bank business units with knowledgeable people in the case of a
compliance matter like EFTA and Regulation E.69 Over my 30 years as a regulator, I have written
or contributed to many “Matters Requiring Attention,” directing bank management to improve the
training and/or quality of bank staff.
47.
Even if the Bank could have hired immediately when claims first began to spike, it
would not have had a timely impact on the backlog of claims due to the necessary on-boarding and
ramp-up time for these positions. At the time, the Bank had no way of knowing if the increased
69 DX 111, See Comptroller's Handbook: Compliance Management Systems, June 2018 | OCC
(pages 6-7).
Case 3:21-md-02992-GPC-MSB Document 666-1 Filed 02/17/26 PageID.58634
Page 27 of 43
HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY
27
claims would be short-lived or sustained given the uncertain nature of the pandemic, so it did not
know if mass hiring of employees or contractors was appropriate. The OCC will likewise criticize
banks for over-hiring, too, if it presents an unnecessary drag on the bank’s earnings.
B.
Increasing
Would Have Risked Increased Fraud Losses.
48.
Mr. Kreis’s suggestion that Bank of America could have simply increased
likewise misses the mark, as it would not have prevented -- and instead likely would
have exacerbated -- fraud losses that the Bank had regulatory obligations to control. Based on my
experience, while using an
achieves the objective of expediting some claims,
increasing an
in turn increases the number and amount of payments that might
otherwise be denied as a result of an investigation. Among other things, it introduces a risk that
any provisional credit extended pursuant to fraudulent circumstances (the crux of the fraud scheme
against the Bank) effectively guarantees loss and could run afoul of the Bank’s safety and
soundness obligations.
49.
It was reasonable for the Bank to
at a time when it
was experiencing a targeted attack on its claim system designed to take advantage of provisional
credits and the Bank’s inability to review claims before payment.
C.
Prioritizing Higher Dollar Claims for Investigation Would Have Exposed the
Bank to Claims It Disadvantaged/Harmed Customers.
50.
Prioritizing the investigation of higher dollar claims, an alternative recommended
by Mr. Kreis, would have run the risk of disadvantaging customers with lower-dollar claims and
would have put the Bank at significant risk of an unfair, deceptive, or abusive acts or practice
(“UDAAP”) violation under the Dodd-Frank Act.70 Even absent other violations or regulatory
70 See 12 U.S.C. § 5536(a)(1)(B). I further note that neither EFTA nor Regulation E contemplate
whether the order in which claims should be prioritized should be based on dollar value.
Case 3:21-md-02992-GPC-MSB Document 666-1 Filed 02/17/26 PageID.58635
Page 28 of 43
HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY
28
findings (e.g., unsafe and unsound banking practices), UDAAP violations on their own can result
in consent orders, remediations, and civil money penalties.71
51.
In order for an act (one instance) or practice (more than one instance) to be
considered an unfair violation, it has to meet three broad and subjective criteria, which are laid out
in the CFPB Examination Manual:
“(1) It causes or is likely to cause substantial injury to consumers;
(2) The injury is not reasonably avoidable by consumers; and
(3) The injury is not outweighed by countervailing benefits to consumers or to
competition.” 72
52.
As to whether the act or practice “causes or is likely to cause substantial injury to
consumers,” the CFPB Examination manual notes, in part: “An act or practice that causes a small
amount of harm to a large number of people may be deemed to cause substantial injury.… Actual
injury is not required in every case. A significant risk of concrete harm is also sufficient.”73
53.
As an examiner involved with many UDAAP issues and discussions at the CFPB,
it is my opinion that the CFPB would likely find that consumers who filed smaller claims first but
were delayed in getting provisional or permanent credits while the Bank (hypothetically)
prioritized the investigations of larger claims filed later in time had suffered “substantial injury.”
71 I understand that the CFPB and OCC cited UDAAP violations in their respective consent orders.
Even if they had not done so (i.e., viewed the CFF filter approach as compliant) or even if the
Bank hypothetically had not implemented the CFF at all -- and instead instituted the suggested
prioritization approach to address a backlog) the Bank would still have been at significant risk of
a UDAAP violation for these actions unrelated to those UDAAP violations found in the consent
orders.
72 See Unfair, Deceptive, or Abusive Acts or Practices, CFPB Consumer Laws and Regulations,
Manual V.2, October 2012, pages UDAAP 1- UDAAP 2 (As found in October 2012 CFPB
Supervision and Examination Manual, pages 174-175).
73 See Unfair, Deceptive, or Abusive Acts or Practices, CFPB Consumer Laws and Regulations,
Manual V.2, October 2012, page UDAAP 2 (As found in October 2012 CFPB Supervision and
Examination Manual, page 175).
Case 3:21-md-02992-GPC-MSB Document 666-1 Filed 02/17/26 PageID.58636
Page 29 of 43
HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY
29
54.
As to whether the “injury is not reasonably avoidable by consumers,” the CFPB
Examination manual notes, in part: “Consumers cannot reasonably avoid injury if the act or
practice interferes with their ability to effectively make decisions or to take action to avoid
injury….”74
55.
It is my opinion, as a former CFPB examiner, that the CFPB would likely find that
consumers would have no insight into nor control over the Bank’s (hypothetical) processing of
larger claims over earlier-filed, smaller claims and so could not reasonably avoid the injury.
56.
As to whether the “the injury is not outweighed by countervailing benefits to
consumers or to competition,” it is my opinion that the CFPB would likely find that the Bank’s
(hypothetical) practice of prioritizing high-dollar claims would be injurious in its net effects (i.e.,
not outweighed by offsetting consumer or competitive benefits). I am not aware of a potential
UDAAP violation where such countervailing benefits were deemed present and thus prevented a
UDAAP finding.
V.
EFTA and Regulation E Do Not Contemplate Industry Standards as It Relates to
Written Explanations.
57.
Mr. Kreis indicates that “[t]he claim denial letter that the Bank sent to EDD
cardholders whose claims were denied, or whose prior permanent credit was rescinded, by CFF
Indicator 1 was contrary to industry standards.”75
74 Id.
75 See Kreis Report Section VII.I.
Case 3:21-md-02992-GPC-MSB Document 666-1 Filed 02/17/26 PageID.58637
Page 30 of 43
HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY
30
This language in the Bank’s template letter reads, “Your claim
has been closed because we believe the account or the claim have been the subject of fraud or
suspicious activity.”77
58.
Related to this language, Mr. Kreis notes, “…the Bank’s reason provided by its
letters is contrary to industry standards for at least three reasons…” including “[it] is contrary to
industry standards…not to provide the cardholder a single and reasonably clear reason why the
claim was actually denied….” Immediately following that, Mr. Kreis says “…Although it could
be consistent with industry standards to provide two reasons reason [sic] for denying the claim
connected by an “or,” the two reasons need to be closely related conceptually…”78 These two
statements made by Mr. Kreis are contradictory, and he seems to be allowing for both scenarios
where one or two reasons provided by the Bank would be consistent with industry standards.
59.
In my opinion, Mr. Kreis’s interpretation of industry standards is irrelevant because
neither EFTA nor Regulation E contemplate industry standards in this context. EFTA and
Regulation E require banks to provide to consumers written explanations of the results of its
investigations, but the requirements are very broad, noting: “The institution’s report of the results
of its investigation shall include a written explanation of the institution's findings and shall note
the consumer's right to request the documents that the institution relied on in making its
determination.”79 As Mr. Kreis notes, the claim denial letter set forth the following “reason” for
the claim denial: “Your claim has been closed because we believe the account or the claim have
76 See Kreis Report ¶ 78.
77 See Kreis Report ¶ 79.
78 See Kreis Report ¶ 80.
79 See 12 CFR 1005.11(d)(1).
Case 3:21-md-02992-GPC-MSB Document 666-1 Filed 02/17/26 PageID.58638
Page 31 of 43
Case 3:21-md-02992-GPC-MSB Document 666-1 Filed 02/17/26 PageID.58639
Page 32 of 43
Case 3:21-md-02992-GPC-MSB Document 666-1 Filed 02/17/26 PageID.58640
Page 33 of 43
HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY
33
Bank could not identify all fraudsters, especially given the scope and type of fraud at issue. In
addition, the EDD program itself did not effectively vet EDD cardholders92 and several reports
have even noted that government agencies, with all of their financial and intelligence resources,
could not identify all fraudsters in these types of unemployment insurance programs.93
62.
63.
Further, as I noted in the Cronan Report, it is my experience that banks that enter
into regulatory settlements or consent orders typically take an extremely consumer-friendly
approach to ensure that every potentially harmed consumer receives compensation, even if that
means that some (and often many) unharmed consumers are also compensated.95
92 See “Examining Widespread Fraud in Pandemic Unemployment Relief Programs”, Report
Prepared by the House Committee on Oversight and Accountability Majority Staff, September
10, 2024, page 7. https://oversight.house.gov/wp-content/uploads/2024/09/UI-Report-FINAL.pdf
(Last accessed April 4, 2025).
93 See “Unemployment Insurance: Estimated Amount of Fraud During Pandemic Likely Between
$100 Billion and $135 Billion,” U.S. Government Accountability Office, GAO-23-106696,
September 12, 2023. https://www.gao.gov/products/gao-23-106696 (Last accessed April 4,
2025). See “COVID-19 Fraud Enforcement Task Force 2024 Report,” Council of Inspectors
General on Integrity and Efficiency, April 2024.
https://www.justice.gov/coronavirus/media/1347161/dl?inline (Last accessed April 4, 2025).
94 See BANA_EDD_MDL-00102557 (BANA_EDD_MDL-00102554-BANA_EDD_MDL-
00102577).
95 See Cronan Report ¶ 13.
Case 3:21-md-02992-GPC-MSB Document 666-1 Filed 02/17/26 PageID.58641
Page 34 of 43
Case 3:21-md-02992-GPC-MSB Document 666-1 Filed 02/17/26 PageID.58642
Page 35 of 43
HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY
35
VII.
Conclusion
66.
I have reviewed the Kreis Report and the Abernathy Report and continue to stand
by the opinions expressed in the Cronan Report. In this report, I respond below to several issues
raised in those reports.
67.
First, Mr. Abernathy offers the extraordinary and unfounded implication that the
Bank knowingly or willfully violated the EFTA and Regulation E when it implemented the CFF in
response to unprecedented levels of fraud, and that it further sought to shield this decision from its
regulators because it supposedly “knew or should have known”101 that its regulators would have
found certain aspects of the CFF unacceptable.102 His lone support for this serious and unsupported
allegation is his hindsight-based reference to the consent orders the Bank subsequently entered
into with the OCC and the CFPB in 2022; however, the fact the Bank ultimately entered into those
consent orders does not mean the Bank’s decision to implement the CFF was unreasonable at the
time the decision was made, let alone a willful violation of EFTA and Regulation E.
There were sound reasons why the
Bank would not seek advance approval from its regulators before implementing the CFF, as both
Messrs. Abernathy and Kreis opine the Bank should have done. Based on my extensive experience
101 See Abernathy Report ¶ 26.
102 Per Mr. Abernathy, it was “completely unreasonable” for the Bank to believe the CFF would
be acceptable to its regulators and “the fact that the Bank could have easily communicated this
plan to its regulators, but did not, indicates that the Bank was aware and concerned that the
Claim Fraud Filter did not comply with the Bank’s obligations…” See Abernathy Report ¶ 27
through ¶ 28.
103 DX 6, See Michael Letson October 23, 2024 Declaration, ¶ 10 through ¶ 27.
Case 3:21-md-02992-GPC-MSB Document 666-1 Filed 02/17/26 PageID.58643
Page 36 of 43
HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY
36
as a federal bank examiner, had the Bank requested and then in turn waited for regulatory guidance
prior to taking action in response to the explosion of prepaid card fraud, such inaction would have
allowed the fraud to continue unabated. In my opinion, the OCC would not consider a bank
allowing uncontrolled fraud losses to be an effectively managed risk. Indeed, the OCC could deem
a bank’s inaction in the face of uncontrolled fraud to be an unsafe and unsound banking practice.
68.
Second, Mr. Kreis asserts that the Bank could have adopted strategies other than
CFF Indicator 1 to address the operational challenges related to cardholder claims of unauthorized
ATM withdrawals.104 Notably, Mr. Kreis bases his conclusions about claims-handling on a pre-
pandemic, business-as-usual environment in which a claims system is not actively being targeted
and taken advantage of by criminals and fraudsters. He does not account for the circumstances of
the global pandemic and related safety-and-soundness obligations financial institutions are
required to address. It is my opinion that the alternative scenarios proffered by Mr. Kreis that he
claims the Bank could have undertaken -- i.e., increasing staffing, increasing
and prioritizing the investigation of high-dollar claims -- were not viable solutions in the face of
the unprecedented wave of fraud that infiltrated Bank of America’s EDD prepaid debit card
program and specifically targeted the Bank’s systems, and it was reasonable for the Bank to come
to that conclusion.
69.
However, Mr. Kreis ignores the fact that neither EFTA
nor Regulation E contemplates industry standards as it relates to written explanations. Notably,
104
105 See Kreis Report ¶ 77 through ¶ 80.
Case 3:21-md-02992-GPC-MSB Document 666-1 Filed 02/17/26 PageID.58644
Page 37 of 43
HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY
37
EFTA and Regulation E provide flexibility relating to banks’ obligations to report the results of
investigations, specifying broadly that banks are to provide “… a written explanation of the
institution's findings.”106 As Mr. Kreis notes, the claim denial letters set forth the following
“reason” for the claim denial: “Your claim has been closed because we believe the account or the
claim have been the subject of fraud or suspicious activity.”107 Based on my experience as a
regulator, the aforementioned letters did provide a written explanation of the reason for the Bank’s
denial of the claims. Further, in concluding that the stated “reason” was somehow insufficient,
Mr. Kreis appears to be selective in his reliance on the July 2022 consent orders. On the one hand,
Mr. Kreis cites the July 2022 consent orders as “supporting [his] opinion” that the Bank “believed
that its regulators would not have approved use of the CFF”;108 however, he makes no mention of
the fact that the CFPB consent order, even years after the fact, did not take issue with the written
explanation contained in the Bank’s claim denial letters.
70.
In my experience, this is simply wrong.
(here,
whether because they submitted a claim by mistake or under false pretenses). This is particularly
106 See 12 CFR § 1005.11(d)(1).
107 See Kreis Report ¶ 79.
108 See Kreis Report ¶ 49.
109 See Abernathy Report ¶ 34.
110 Id.
Case 3:21-md-02992-GPC-MSB Document 666-1 Filed 02/17/26 PageID.58645
Page 38 of 43
Case 3:21-md-02992-GPC-MSB Document 666-1 Filed 02/17/26 PageID.58646
Page 39 of 43
APPENDIX A
HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY
1
In RE Bank of America California Unemployment Benefits Litigation
Expert Rebuttal Report of Russell Cronan
List of Materials Considered
I incorporate by reference the materials listed in Appendix B to the Cronan Report. In addition, I
considered the following additional materials in preparing this rebuttal report.
1. Expert Reports and Declarations
Declaration of Stephen Hindle, dated October 24, 2024
Expert Report of William J. Abernathy, Jr., dated March 3, 2025
Expert Report of J. Daniel Kreis, dated March 4, 2025
Expert Rebuttal Report of Teresa A. Pesce, dated April 4, 2025
2. Case Filings
Bank Of America’s Responses and Objections to Plaintiffs’ Sixth Set of Interrogatories,
dated April 11, 2024
3. Other Produced Documents
BANA_EDD_MDL-00003887 - BANA_EDD_MDL-00003911
BANA_EDD_MDL-00004535 - BANA_EDD_MDL-00004580
BANA_EDD_MDL-00006482 - BANA_EDD_MDL-00006535
BANA_EDD_MDL-00100634 - BANA_EDD_MDL-00100679
BANA_EDD_MDL-00205361
BANA_EDD_MDL-00497802 - BANA_EDD_MDL-00497804
BANA_EDD_MDL-00559693 - BANA_EDD_MDL-00559980
Case 3:21-md-02992-GPC-MSB Document 666-1 Filed 02/17/26 PageID.58647
Page 40 of 43
HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY
2
BANA_EDD_MDL-00701607 - BANA_EDD_MDL-00701608
BANA_EDD_MDL-00705467 - BANA_EDD_MDL-00705470
BANA_EDD_MDL-00705493 - BANA_EDD_MDL-00705497
4. Publicly Available Documents
Consumer Financial Protection Bureau, “CFPB Provides Flexibility During COVID-19
Pandemic,” March 26, 2020, available at https://www.consumerfinance.gov/about-
us/newsroom/cfpb-provides-flexibility-during-covid-19-pandemic/
Consumer Financial Protection Bureau, “CFPB Supervision and Examination Manual,”
Version 2, October 2012, available at
https://files.consumerfinance.gov/f/201210_cfpb_supervision-and-examination-manual-
v2.pdf?source=post_page---------------------------
Consumer Financial Protection Bureau, “Statement on Bureau Supervisory and
Enforcement Response to COVID-19 Pandemic,” March 26, 2020, available at
https://files.consumerfinance.gov/f/documents/cfpb_supervisory-enforcement-
statement_covid-19_2020-03.pdf
Consumer Financial Protection Bureau, Upstart Network, “Order to Terminate No-Action
Letter,” dated June 8, 2022, available at
https://files.consumerfinance.gov/f/documents/cfpb_upstart-no-action-letter-
termination_order_2022-06.pdf
Dave Uejio, Consumer Financial Protection Bureau, “The Bureau is taking much-needed
action to protect consumers, particularly the most economically vulnerable,” January 28,
2021, available at https://www.consumerfinance.gov/about-us/blog/the-bureau-is-taking-
much-needed-action-to-protect-consumers-particularly-the-most-economically-
vulnerable/
Federal Register, Vol. 81, No.34, Wanda Cain, “Policy on No-Action Letters; Information
Collection,” U.S Government Publishing Office, February 22, 2016, available at
https://www.govinfo.gov/content/pkg/FR-2016-02-22/pdf/2016-02390.pdf
Federal Register, Vol. 90, No. 6, CFPB, “Policy on No-Action Letters,” U.S Government
Publishing Office, January 10, 2025, available at
https://www.govinfo.gov/content/pkg/FR-2025-01-10/pdf/2025-00378.pdf
Case 3:21-md-02992-GPC-MSB Document 666-1 Filed 02/17/26 PageID.58648
Page 41 of 43
HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY
3
FinCEN, “The Financial Crimes Enforcement Network (FinCEN) Encourages Financial
Institutions to Communicate Concerns Related to the Coronavirus Disease 2019
(COVID-19) and to Remain Alert to Related Illicit Financial Activity,” March 16, 2020,
available at https://www.fincen.gov/news/news-releases/financial-crimes-enforcement-
network-fincen-encourages-financial-institutions
Office of the Comptroller of the Currency, “Bank Secrecy Act/Anti-Money
Laundering: OCC Supports FinCEN’s Regulatory Relief and Risk-Based Approach for
Financial Institution Compliance in Response to COVID-19,” OCC Bulletin 2020-34,
April 7, 2020, available at https://www.occ.gov/news-issuances/bulletins/2020/bulletin-
2020-34.html
Office of the Comptroller of the Currency, “Examinations: Interagency Examiner
Guidance for Assessing Safety and Soundness While Considering the Effect of COVID-
19 on Institutions,” OCC Bulletin 2020-64, June 23, 2020, available at
https://www.occ.gov/news-issuances/bulletins/2020/bulletin-2020-64.html
Office of the Comptroller of the Currency, “Semiannual Risk Perspective,” Spring 2020,
available at https://www.occ.gov/publications-and-resources/publications/semiannual-
risk-perspective/files/pub-semiannual-risk-perspective-spring-2020.pdf
Office of the Comptroller of the Currency, “Semiannual Risk Perspective,” Fall 2020,
available at https://www.occ.gov/publications-and-resources/publications/semiannual-
risk-perspective/files/pub-semiannual-risk-perspective-fall-2020.pdf
U.S. Department of Justice National Unemployment Insurance Fraud Task Force,
"Unemployment Insurance Fraud Consumer Protection Guide," September 21, 2020,
available at
https://www.oig.dol.gov/public/Unemployment%20Insurance%20Fraud%20Consumer%
20Protection%20Guide,%20Final.pdf
U.S. Department of Justice, Council of the Inspectors General on Integrity and
Efficiency, “COVID-19 Fraud Enforcement Task Force 2024 Report” April 2024,
available at https://www.justice.gov/coronavirus/media/1347161/dl?inline
U. S. Government Accountability Office, “Bank Supervision: Lessons Learned from
Remote Supervision during Pandemic Could Inform Future Disruptions,” September
2022, available at https://www.gao.gov/assets/gao-22-104659.pdf
U. S. Government Accountability Office, “Unemployment Insurance: Estimated Amount
of Fraud during Pandemic Likely between $100 Billion and $135,” September 12, 2023,
available at www.gao.gov/products/gao-23-106696
Case 3:21-md-02992-GPC-MSB Document 666-1 Filed 02/17/26 PageID.58649
Page 42 of 43
HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY
4
United States of America Department of the Treasury Office of the Comptroller of the
Currency, Consent Order, In the Matter of Ralph Derrickson dated August 17, 2023,
available at https://www.occ.gov/static/enforcement-actions/ea2023-026.pdf
United States of America Department of the Treasury Office of the Comptroller of the
Currency, Bank of America Consent Order for Civil Money Penalty dated July 14, 2022,
available at https://occ.gov/static/enforcement-actions/ea2022-024.pdf
Note: I also reviewed the materials listed in Appendix B of the Expert Report of J. Daniel
Kreis dated March 4, 2025 and the materials listed in Appendix B of the Expert Report of
William J. Abernathy Jr. dated March 3, 2025.1
1 Materials listed in Appendix B of the Expert Report of William J. Abernathy Jr. dated March 3, 2025 include three
documents for which not enough information was provided to identify the documents: (1) “Matthew Riffee Email re
BofA Response to Plaintiffs' Interrogatories, Set 3” (2) “Matthew Riffee Email re BofA's Responses to ROGs, Set 4
& Exs 9-10” and (3) “CFPB Press Release.”
Case 3:21-md-02992-GPC-MSB Document 666-1 Filed 02/17/26 PageID.58650
Page 43 of 43File and source
- File
- gov.uscourts.casd.709615.666.1.pdf
- Size
- 1,226,900 bytes
- SHA-256
- 6d5457c7c25616efe12036c4b0bf48bca8f2f15a36df4a42cbe9f417fcfab8c0
- Original
- PACER (login required)