2023 Annual Report of the Council of Inspectors General on Financial Oversight

Summary

The July 2023 Annual Report of the Council of Inspectors General on Financial Oversight (CIGFO). The message from the Acting Chair, signed /s/ Rich Delmar, Acting Chair, states that CIGFO issued forward-looking crisis guidance in June 2022, found in the Appendix, and in 2021 convened a working group to review the Financial Stability Oversight Council (FSOC) response to Executive Order 14030, Climate-related Financial Risk. The table of contents lists separate sections for Offices of Inspector General, including the Federal Deposit Insurance Corporation, U.S. Securities and Exchange Commission and Department of the Treasury, and for the Special Inspector General for the Troubled Asset Relief Program. The Appendix is titled CIGFO Guidance in Preparing for and Managing Crises.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Full text

JULY 2023
Annual Report of the
Council of Inspectors General
on Financial Oversight

 THIS PAGE INTENTIONALLY LEFT BLANK

Message from the Chair
i
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Message from the Acting Chair
On July 10, 2010, the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank) was
signed into law, creating both the Financial Stability Oversight Council (FSOC) and the Council of
Inspectors General on Financial Oversight (CIGFO). Chaired by the Treasury Secretary, FSOC is
charged with identifying threats to the financial stability of the country, promoting market discipline, and
responding to emerging risks to the stability of the nation’s financial system. CIGFO, which includes the
Inspectors General (IG) of nine major government financial entities, was established to facilitate
information sharing among the IG members, provide a forum for discussion of IG member work as it
relates to the broader financial sector, and evaluate the effectiveness and internal operations of FSOC.
This past year, as the Nation emerges from the Coronavirus Disease 2019 (COVID-19) pandemic,
CIGFO continued to monitor the ongoing response of FSOC and its member agencies related to the
public health and financial crisis. CIGFO also continued to monitor developments in challenges to the
stability of the U.S. financial system such as climate-related financial risks and digital assets.
We are mindful of new risks and emerging challenges as well. As pointed out in FSOC’s 2022 Annual
Report, U.S. economic growth slowed in 2022, which may be the result of a convergence of factors: the
war in Ukraine, the tightening of monetary policy, and lingering supply chain disruptions. Meanwhile, the
country continues to experience annual inflation at its highest levels in 40 years. And in March 2023, the
failure of three financial institutions triggered extraordinary actions on the part of the Federal
Government. Taken together, these factors have caused a sense of economic uncertainty and a period
of financial and economic stress unseen since perhaps the Great Recession of 2008 which precipitated
the passage of Dodd-Frank and the creation of FSOC. It is imperative that now, more than ever, FSOC
and CIGFO remain diligent in fulfilling their responsibilities and duties.
Dodd-Frank grants CIGFO the authority to convene working groups, by a majority vote, for the
purpose of evaluating the effectiveness and internal operations of FSOC. CIGFO has, since 2011,
established working groups that are comprised of staff from the CIGFO member Inspector General
offices to conduct these reviews of FSOC operations and we have continued this important work this
past year. In June 2022, CIGFO issued forward-looking crisis guidance compiled by a working group
based on lessons learned from the experiences of federal agencies during prior crises and any learned
during the pandemic. This guidance can be found in the Appendix to this report. In 2021, CIGFO
convened another working group to review FSOC’s response to Executive Order 14030, Climate-related
Financial Risk, which is expected to be completed in the summer of 2023.
CIGFO’s monitoring activities also include sharing financial regulatory information that enhances the
knowledge and insight of its members about specific issues related to members’ current and future
work. For example, during its quarterly meetings, CIGFO members discussed FSOC’s efforts to assess
climate-related financial risk, reports and developments in the digital asset space and the recent financial
institution failures; as well as legislative activities that could impact the financial regulatory system.
In the coming year, CIGFO members will continue, through their individual and joint work, to help
strengthen the financial system by oversight of FSOC and its Federal member agencies.

/s/

Rich Delmar
Acting Chair, Council of Inspectors General on Financial Oversight
Acting Inspector General, Department of the Treasury

ii
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

THIS PAGE INTENTIONALLY LEFT BLANK

iii
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Table of Contents

Council of Inspectors General on Financial Oversight ............................................................................... 1
The Council of Inspectors General on Financial Oversight Reports......................................................... 2
Office of Inspector General Board of Governors of the Federal Reserve System
and Consumer Financial Protection Bureau ................................................................................................. 3
Office of Inspector General Commodity Futures Trading Commission ................................................. 14
Office of Inspector General Federal Deposit Insurance Corporation .................................................... 17
Office of Inspector General Federal Housing Finance Agency ................................................................ 34
Office of Inspector General U.S. Department of Housing and Urban Development ..........................42
Office of Inspector General National Credit Union Administration ........................................................ 50
Office of Inspector General U.S. Securities and Exchange Commission ................................................ 53
Special Inspector General for the Troubled Asset Relief Program .......................................................... 61
Office of Inspector General Department of the Treasury ........................................................................ 66
Appendix: CIGFO Guidance in Preparing for and Managing Crises .............................................................. 85

iv
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

THIS PAGE INTENTIONALLY LEFT BLANK

Council of Inspectors General on Financial Oversight
1
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Council of Inspectors General on Financial Oversight
The Council of Inspectors General on Financial Oversight (CIGFO) was established by the
Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act), and meets
on a quarterly basis to facilitate the sharing of information among Inspectors General. The
CIGFO members discuss the ongoing work of each Inspector General who is a member of the
Council, with a focus on concerns that may apply to the broader financial sector, and
exchange ideas about ways to improve financial oversight. The CIGFO publishes an annual
report that includes separate sections within the exclusive editorial control of each Inspector
General. Those sections describe the concerns and recommendations of each Inspector
General and a discussion of ongoing and completed work.
During the course of the year, the CIGFO continued to monitor coordination efforts among
and between Financial Stability Oversight Council (FSOC) members. Specifically, CIGFO
members were briefed on and/or discussed the following:
•
U.S. Department of Housing and Urban Development Office of Inspector
General work relating to Ginnie Mae’s preparedness in responding to potential
future crises
•
Department of the Treasury report: Crypto-Assets, Implications for Consumers,
Investors, and Businesses
•
Executive Order 14067 – Ensuring Responsible Development of Digital Assets
•
FSOC’s Report on Digital Asset Financial Stability Risks and Regulation
•
Legislative matters of interest, including proposed legislation on various digital
asset topics and banking regulation
•
FSOC’s responses to the financial sector disturbances generated by failures in
financial institutions with services concentrated in the technology industry

Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

2
The Council of Inspectors General on Financial Oversight Reports

The Council of Inspectors General on Financial
Oversight Reports
The Dodd-Frank Act authorizes CIGFO to convene a working group, by a majority vote,
for the purpose of evaluating the effectiveness and internal operations of the FSOC.

To date, CIGFO has issued the following reports—

•
2012 - Audit of the Financial Stability Oversight Council’s Controls over Non-public Information
•
2013 - Audit of the Financial Stability Oversight Council’s Designation of Financial Market
Utilities
•
2014 - Audit of the Financial Stability Oversight Council’s Compliance with Its Transparency
Policy
•
2015 - Audit of the Financial Stability Oversight Council’s Monitoring of Interest Rate Risk to the
Financial System
•
2017 - Audit of the Financial Stability Oversight Council’s Efforts to Promote Market Discipline
•
2017 - Corrective Action Verification of FSOC’s Implementation of CIGFO’s Audit
Recommendations in the 2013 Audit of FSOC’s Financial Market Utility
Designation Process
•
2018 - Top Management and Performance Challenges Facing Financial Regulatory
Organizations
•
2019 - Audit of the Financial Stability Oversight Council’s Monitoring of
International Financial Regulatory Proposals and Developments
•
2019 - Top Management and Performance Challenges Facing Financial-Sector Regulatory
Organizations
•
2020 - Survey of FSOC and its Federal Member Agencies’ Efforts to Implement the Cybersecurity
Act of 2015
•
2020 - Council of Inspectors General on Financial Oversight Presidential Transition Handbook
•
2022 - CIGFO Guidance in Preparing for and Managing Crises
The corrective actions described by FSOC, with respect to the audits listed above, met
the intent of our recommendations and may be subject to verification in future CIGFO
working group reviews.

Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General Board of Governors of the Federal Reserve System and Consumer Financial Protection Bureau 3

Office of Inspector General
Board of Governors of the Federal Reserve System
and Consumer Financial Protection Bureau
We provide independent oversight by conducting audits, evaluations, investigations, and other reviews of
the programs and operations of the Board of Governors of the Federal Reserve System (Board) and the
Consumer Financial Protection Bureau (CFPB) and demonstrate leadership by making recommendations
to improve economy, efficiency, and effectiveness, and by preventing and detecting fraud, waste, and
abuse.
Background
Congress established our office as an independent oversight authority for the Board, the
government agency component of the broader Federal Reserve System, and the CFPB.

Under the authority of the Inspector General Act of 1978, as amended (IG Act), we conduct
independent and objective audits, evaluations, investigations, and other reviews related to the
programs and operations of the Board and the CFPB.
•
We make recommendations to improve economy, efficiency, and effectiveness, and
we prevent and detect fraud, waste, and abuse.
•
We share our findings and make corrective action recommendations to the Board
and the CFPB; we do not manage agency programs or implement changes.
•
We keep the Board chair, the CFPB director, and Congress fully informed of our
findings and corrective action recommendations, as well as the agencies’ progress in
implementing corrective action.

In addition to the duties set forth in the IG Act, Congress has mandated additional
responsibilities for our office. Section 38(k) of the Federal Deposit Insurance Act (FDI Act)
requires us to review failed financial institutions supervised by the Board that result in a
material loss to the Deposit Insurance Fund (DIF) and produce a report within 6 months. The
Dodd-Frank Wall Street Reform and Consumer Protection Act amended section 38(k) of the
FDI Act by raising the materiality threshold and requiring us to report on the results of any
nonmaterial losses to the DIF that exhibit unusual circumstances warranting an in-depth review.

Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

4
Office of Inspector General Board of Governors of the Federal Reserve System and Consumer Financial Protection Bureau

Section 211(f) of the Dodd-Frank Act also requires us to review the Board’s supervision of any
covered financial company that is placed into receivership under title II of the act and produce a
report that evaluates the effectiveness of the Board’s supervision, identifies any acts or
omissions by the Board that contributed to or could have prevented the company’s
receivership status, and recommends appropriate administrative or legislative action.

The Federal Information Security Modernization Act of 2014 (FISMA) established a legislative
mandate for ensuring the effectiveness of information security controls over resources that
support federal operations and assets. In a manner consistent with FISMA requirements, we
perform annual independent reviews of the Board’s and the CFPB’s information security
programs and practices, including testing the effectiveness of security controls and techniques
for selected information systems.

Section 15010 of the Coronavirus Aid, Relief, and Economic Security (CARES) Act established
the Pandemic Response Accountability Committee (PRAC) within the Council of the Inspectors
General on Integrity and Efficiency (CIGIE). PRAC is required to conduct and coordinate
oversight of covered funds and the coronavirus response to detect and prevent fraud, waste,
abuse, and mismanagement and identify major risks that cut across programs and agency
boundaries. PRAC is also required to submit reports related to its oversight work to relevant
federal agencies, the president, and appropriate congressional committees. The CIGIE chair
named our inspector general as a member of PRAC, and as such, we participate in PRAC
meetings, conduct PRAC oversight activities, and contribute to PRAC reporting responsibilities.

The economic disruptions caused by the COVID-19 pandemic resulted in an abrupt shock to
financial markets and affected many credit channels relied on by households, businesses, and
state and local governments. In response, the Board took steps to support the flow of credit to
U.S. households and businesses. Notably, the Board used its emergency lending authority under
section 13(3) of the Federal Reserve Act to create lending programs, with the approval of the
secretary of the U.S. Department of the Treasury, to ensure liquidity in financial markets and to
provide lending support to various sectors of the economy. In addition, the CFPB has continued
to play a vital role throughout the pandemic by enforcing federal consumer protection laws and
protecting consumers from abuse.

OIG Reports and Other Products Related to the Broader Financial Sector
In accordance with section 989E(a)(2)(B) of the Dodd-Frank Act, the following highlights the
completed and ongoing work of our office, with a focus on issues that may apply to the broader
financial sector.

Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General Board of Governors of the Federal Reserve System and Consumer Financial Protection Bureau 5

COMPLETED WORK
Major Management Challenges for the Board and the CFPB

Although not required by statute, we annually report on the major management challenges
facing the Board and the CFPB. These challenges identify the areas that, if not addressed, are
most likely to hamper the Board’s and the CFPB’s accomplishment of their strategic
objectives.

The major management challenges for the Board that apply to the financial sector will be issued
in the second quarter of 2023.1
1 The major management challenges for the Board were subsequently issued in May 2023 and are available here

Among other items, we identified four major management challenges for the CFPB:

•
Ensuring an Effective Information Security Program
•
Managing Human Capital to Maintain a Talented, Diverse, Inclusive, and Engaged
Workforce
•
Continuing to Refine the Supervision and Enforcement Strategy
•
Managing Consumer Complaints

OIG Closing of 22-0028-I Board Trading Activity, July 11, 2022

In response to a request from the Board, we initiated separate investigations of Board and
Reserve Bank officials’ trading activities. We found that former Vice Chair Richard Clarida’s
and Chair Jerome Powell’s trading activities did not violate the laws, rules, regulations, or
policies as investigated by our office. We found, however, that (1) former Vice Chair Clarida
failed to report several trades on his 2019 and 2020 Office of Government Ethics Forms 278
as required by Office of Government Ethics regulation 5 C.F.R. part 2634 and (2) on behalf of
a Powell family trust, in December 2019, a trust financial advisor executed five trades during a
Federal Open Market Committee trading blackout period. The investigation of senior Reserve
Bank officials is ongoing.

2022 Audit of the Board’s Information Security Program,
OIG Report 2022-IT-B-013, September 30, 2022

The Office of Management and Budget’s (OMB) fiscal year 2022 guidance for FISMA reporting
directs IGs to evaluate the maturity level (from a low of 1 to a high of 5) of their agency’s
information security program across several core areas. These core areas align with the
requirements in Executive Order 14028, Improving the Nation’s Cybersecurity, as well as
recent OMB guidance on modernizing federal cybersecurity. The guidance notes that level 4
(managed and measurable) represents an effective level of security. We assessed the
effectiveness of the Board’s (1) security controls and techniques for select information
systems and (2) information security policies, procedures, and practices.

.

Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

6
Office of Inspector General Board of Governors of the Federal Reserve System and Consumer Financial Protection Bureau

The Board’s information security program continues to operate effectively at a level-4
(managed and measurable) maturity. Since our review last year, we found that the Board has
developed a strategy for implementing a zero trust architecture in accordance with Executive
Order 14028 and has continued implementing the U.S. Department of Homeland Security’s
Continuous Diagnostics and Mitigation program, which provides cybersecurity tools,
integration services, and dashboards to participating agencies to help them improve their
respective security posture. However, the Board can strengthen its cybersecurity risk
management processes.

The Board has taken sufficient actions to close three of the nine recommendations from our
prior FISMA audit reports that were open at the start of this audit. This report contains one
new recommendation and one matter for management consideration designed to strengthen
the Board’s information security program in the area of cybersecurity risk management. The
Board concurred with our recommendation.

Observations on Cybersecurity Risk Management Processes for Vendors Supporting the
Main Street Lending Program and the Secondary Market Corporate Credit Facility,
OIG Report 2022-IT-B-015, November 9, 2022

The Board established the MSLP and the Secondary Market Corporate Credit Facility to help
certain businesses, nonprofits, and employers through the COVID-19 pandemic. We assessed
processes for managing cybersecurity risks for third-party vendors supporting the MSLP and
the Secondary Market Corporate Credit Facility.

Overall, we found that System officials quickly established vendor contracts that generally met
cybersecurity best practices. However, we identified ways to strengthen third-party
cybersecurity risk management processes for future scenarios and found that Board and
Reserve Bank information security program policy requirements for vendor risk management
do not fully align.

Our report does not contain recommendations.

The Board Can Enhance the Effectiveness of Certain Aspects of Its Model Risk
Management Processes for the SR/HC-SABR and BETR Models,
OIG Report 2022-SR-B-016, December 7, 2022

The Board uses supervisory models to advance the risk-focused supervision of financial
institutions. Because they inform the Board’s supervision activities, these models must be
sound and produce reasonable and reliable outputs. We assessed the effectiveness of the
Board’s model risk management processes for the Supervision and Regulation Statistical
Assessment of Bank Risk (SR-SABR), Holding Company Statistical Assessment of Bank Risk
(HC-SABR) (together, SR/HC-SABR), and Bank Exams Tailored to Risk (BETR) models, which
the Board uses to monitor risks at community and regional banking organizations.

Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General Board of Governors of the Federal Reserve System and Consumer Financial Protection Bureau 7

We found that the Board can enhance model risk management by ensuring timely review and
validation of the SR/HC-SABR and BETR models, developing a comprehensive model
inventory of top-tier supervisory models, and developing a formal mechanism for tracking the
findings and recommendations of internal groups that review and validate models.
Our report contains recommendations designed to enhance the effectiveness of the Board’s
model risk management processes for the SR/HC-SABR and BETR models. The Board
concurred with our recommendations.

The Board Can Enhance Certain Governance Processes Related to Reviewing and
Approving Supervisory Proposals, OIG Report 2022-SR-B-017, December 7, 2022

As part of its oversight of financial institutions, the Board develops supervisory proposals,
which include guidance addressing significant supervision matters as well as stress tests to
evaluate the resilience of large banks. We assessed the effectiveness of the Board’s processes
and practices for reviewing and approving supervisory proposals.

We found several ways for the Board to enhance its review and approval of supervisory
proposals. For example, it can improve how it informs and consults Board members and can
clarify when and how it solicits public feedback on these proposals. It can also clarify how
some of the Board’s operations should be executed in the absence of a vice chair for
supervision, including delegated actions related to stress testing proposals.

Our report contains recommendations designed to enhance the effectiveness of the Board’s
processes and practices for reviewing and approving supervisory proposals. The Board
concurred with our recommendations.

The Board Can Enhance Enterprise Practices for Data Management Roles and
Responsibilities, OIG Report 2023-MO-B-001, January 18, 2023

The Board relies extensively on data to conduct research, analysis, and policymaking;
supervise and regulate certain financial institutions and activities; oversee important aspects of
the nation’s payments system; and promote consumer protection, fair lending, and community
development. We evaluated the agency’s practices related to roles and responsibilities for
managing data.

The Board uses a decentralized data management model, resulting in varying definitions,
training methods, and approaches to data inventory across agency divisions. Further, the chief
data officer has not been formally granted authority over data management and governance,
which may lead to challenges implementing action plans outlined in the Board’s data strategy.

Our report contains recommendations designed to enhance enterprise practices related to
data management roles and responsibilities, training, and data inventory management. Our

Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

8
Office of Inspector General Board of Governors of the Federal Reserve System and Consumer Financial Protection Bureau

report also recommends that authority for data management and governance be delegated to
the chief data officer. The Board concurred with our recommendations.

2022 Audit of the CFPB’s Information Security Program, OIG Report 2022-IT-C-014,
September 30, 2022

OMB’s fiscal year 2022 guidance for FISMA reporting directs IGs to evaluate the maturity
level (from a low of 1 to a high of 5) of their agency’s information security program across
several core areas. These core areas align with the requirements in Executive Order 14028,
Improving the Nation’s Cybersecurity, as well as recent OMB guidance on modernizing federal
cybersecurity. The guidance notes that level 4 (managed and measurable) represents an
effective level of security. We assessed the effectiveness of the CFPB’s (1) security controls
and techniques for select information systems and (2) information security policies,
procedures, and practices.

The CFPB’s information security program continues to operate effectively at a level-4
(managed and measurable) maturity. Since our review last year, we found that the CFPB has
developed its zero trust strategy implementation plan, which outlines the various initiatives
and budgetary requirements for the implementation of the agency’s zero trust architecture by
fiscal year 2024. In addition, we found that the CFPB has improved its maturity in the areas of
information security continuous monitoring and supply chain risk management. However, the
CFPB can strengthen policies, procedures, and processes in the areas of data loss prevention,
software asset management, and continuity planning to ensure that its program remains
effective.

The CFPB has taken sufficient actions to close recommendations related to system
authorization and change control processes from our prior FISMA audit reports that were
open at the start of this audit. This report includes six new recommendations designed to
strengthen the CFPB’s information security program in the areas of data protection and
privacy, software asset management, and continuity planning. Our report also includes a
matter for management consideration related to the development of procedures for using a
third-party service to monitor vendors’ compliance with the CFPB’s cybersecurity
requirements. The CFPB concurred with our recommendations.
The CFPB Is Generally Prepared to Implement the OPEN Government Data Act and Can
Take Additional Steps to Further Align With Related Requirements,
OIG Report 2022-MO-C-012, September 28, 2022

The Open, Public, Electronic, and Necessary Government Data Act of 2018 (OPEN
Government Data Act) is focused on improving the availability, transparency, and quality of
federal data; it also adds new requirements relating to data governance, data management, and
transparency processes. The CFPB’s Office of the Chief Data Officer has primary
responsibility for ensuring that the agency complies with the OPEN Government Data Act
and other related requirements. We assessed the CFPB’s compliance with finalized OMB

Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General Board of Governors of the Federal Reserve System and Consumer Financial Protection Bureau 9

guidance on OPEN Government Data Act requirements, examined the agency’s readiness to
implement the act’s draft guidance, and identified lessons learned from other federal
organizations that may enhance the CFPB’s readiness to implement the act.

The CFPB generally complies with finalized OMB phase I guidance related to the OPEN
Government Data Act. In addition, we found that the CFPB continues to make progress and
is generally prepared to implement draft OMB phase II guidance related to the act, once
finalized. However, the CFPB can take additional steps to further align with requirements of
the OPEN Government Data Act and related phase I and phase II guidance. Specifically, we
found that the CFPB can enhance its data governance by making some technical updates to its
Policy on Information Governance to reflect the agency’s current operating structure.
Additionally, the CFPB will obtain additional organizational benefits by preparing a draft
strategic information resources management plan to more readily comply with phase II
guidance, once finalized.

We made two recommendations to enhance the CFPB’s preparedness to implement the
requirements of the OPEN Government Data Act and related guidance. The CFPB concurred
with our recommendations.

ONGOING WORK
Evaluation of the Board’s and the Federal Reserve Banks’ Access Controls and Practices
for Disposing of Confidential Information in Select Applications Used for Supervising
Community and Regional Banking Organizations

During the supervisory process, Board and Reserve Bank employees review, create, and store
information, such as records collected from supervised institutions, that is exempt from public
disclosure and that may include personally identifiable information. To protect this
information from accidental disclosure or access by unauthorized parties, the Board and the
Reserve Banks must have adequate controls. Inadequate safeguards for confidential
information could have adverse implications for supervised institutions, their customers, and
the Federal Reserve System. We are assessing the Board’s and the Reserve Banks’ access
controls and practices for disposing of confidential supervisory information and sensitive
personally identifiable information in select applications used for supervising community
banking organizations and regional banking organizations.

Review of the Board’s Approach to Climate Risk Supervision at Financial Institutions

As noted in the Board’s November 2020 Supervision and Regulation Report, Federal Reserve
System supervisors are responsible for ensuring that supervised institutions operate in a safe
and sound manner and can continue to provide financial services to their customers in the
face of all types of risk, including those related to climate change. The report noted, however,
that assessing and managing climate related risks presents several challenges and that

Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

10 Office of Inspector General Board of Governors of the Federal Reserve System and Consumer Financial Protection Bureau

supervisors are seeking to better understand, measure, and mitigate climate-related financial
risks. Further, the report stated that supervisors will continue to work with other agencies
and authorities on this endeavor. The Board established the Supervision Climate Committee
to promote the resilience of supervised institutions to climate-related financial risks and is in
the process of developing its supervisory approach on this topic. We will be issuing an Insights
Paper identifying key areas of consideration as the Board develops and implements a
supervisory approach for climate risks at financial institutions.

Evaluation of the Board’s and the Federal Reserve Banks’ Ethics Programs Pertaining to
Personal Investment and Trading Activities2

2 The evaluation was subsequently completed in April 2023 and the report is available here
As the central bank of the United States, the Board must maintain impartiality and avoid even
the appearance of conflicts of interest to inspire public trust in the nation’s financial system.
The Board recently announced a broad set of new investment and trading rules that, among
other things, will prohibit the purchase of individual securities, restrict active trading, and
increase the timeliness of reporting and public disclosure. We are assessing the design and
effectiveness of these new rules as well as the Board’s and the Reserve Banks’ approach to
monitoring personal investment and trading activities for possible conflicts of interest

Evaluation of the Federal Reserve System’s Loan Purchase Processes for Its Main Street
Lending Program (MSLP)

In response to the COVID-19 pandemic, the Board established the MSLP—composed of five
different lending facilities—to facilitate lending to small and medium-sized for-profit and
nonprofit organizations. Through the MSLP, the Federal Reserve Bank of Boston purchased
1,830 loans amounting to approximately $17.5 billion from lenders; the majority of these
loans were purchased during the last 2 months of the program. We are assessing the design
and operating effectiveness of the System’s processes for loan purchases.

Audit of the Board’s Hiring Practices and Their Effect on Workforce Diversity

The Board’s activities affect the lives of every American, and its continued success depends on
its ability to attract a talented and diverse workforce that is representative of our nation’s
diversity. We are assessing the Board’s hiring processes and procedures, determining the
extent to which the Board’s workforce diversity has changed since our 2015 diversity and
inclusion report, and examining the effect that the Board’s hiring practices may have on
workforce diversity.

.

Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General Board of Governors of the Federal Reserve System and Consumer Financial Protection Bureau 11

Evaluation of the Federal Reserve System’s Loan Administration Processes for Its Main
Street Lending Program (MSLP)

In response to the COVID-19 pandemic, the Board established the MSLP—composed of five
different lending facilities—to facilitate lending to small and medium-sized for-profit and
nonprofit organizations. Through the MSLP, the Federal Reserve Bank of Boston is
responsible for administering the loans, including assessing overall credit risk and identifying
substandard loans. We are assessing the MSLP’s processes for loan administration, including
the design and operating effectiveness of internal controls.

Monitoring of the Federal Reserve’s Lending Programs

In response to the economic effects of the COVID-19 pandemic, the Federal Reserve created
new lending programs to provide loans to employers, certain businesses, and communities
across the country to support the U.S. economy. Specifically, the following programs were
created: the Main Street Lending Program, the Paycheck Protection Program Liquidity Facility,
the Municipal Liquidity Facility, the Primary Market Corporate Credit Facility, and the
Secondary Market Corporate Credit Facility. We initiated an active monitoring effort of these
programs to gain an understanding of the operational, governance, reputational, and financial
matters associated with them. Through this monitoring effort, we refine our focus on the
programs and identify areas for future audits or evaluations.

2023 Audit of the Board’s Information Security Program

The Federal Information Security Modernization Act of 2014 (FISMA) requires that each
agency inspector general conduct an annual independent evaluation of its respective agency’s
information security program and practices. To meet FISMA requirements for 2023, we are
conducting an audit of the Board’s information security program. Our objectives are to
evaluate the effectiveness of the Board’s (1) security controls and techniques for select
information systems and (2) information security policies, procedures, standards, and
guidelines. We will use the results from our audit to respond to the Office of Management
and Budget’s fiscal year 2023 FISMA reporting metrics for inspectors general.

Evaluation of the Board’s and the Federal Reserve Banks’ Cybersecurity Incident Response
Process for Supervised Institutions

As cybersecurity threats have become more frequent and more sophisticated over the last
several years, cybersecurity has become a significant area of focus for financial institutions, the
Board, and other federal financial regulators. Supervised institutions must report significant
cybersecurity incidents to their primary federal regulator. After a supervised institution
reports a cybersecurity incident to the Board, the Federal Reserve System assesses the
severity of the incident on the institution and the financial sector, assigns a severity rating, and
develops communications for internal and external stakeholders. We are assessing the
Board’s and the Reserve Banks’ cybersecurity incident response process for supervised
institutions.

Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

12 Office of Inspector General Board of Governors of the Federal Reserve System and Consumer Financial Protection Bureau

Review of the Supervision of Silvergate Bank

In March 2023, the California Department of Financial Protection and Innovation announced
that Silvergate Bank, a state member bank located in La Jolla, California, and supervised by the
Federal Reserve Bank of San Francisco, had voluntarily begun the process of liquidation. On
March 14, 2023, we initiated an independent review assessing the Board’s and the Federal
Reserve Bank of San Francisco’s supervision of the institution, and we will make
recommendations as appropriate.

Material Loss Review of Silicon Valley Bank

In March 2023, the California Department of Financial Protection and Innovation (DFPI)
closed Silicon Valley Bank, a state member bank located in Santa Clara, California, and
supervised by the Federal Reserve Bank of San Francisco. The DFPI appointed the Federal
Deposit Insurance Corporation (FDIC) as receiver. As of December 31, 2022, Silicon Valley
Bank had total assets of approximately $209 billion. On March 14, 2023, we initiated an
engagement addressing the supervision of Silicon Valley Bank. In a March 26, 2023, press
release, the FDIC estimated the cost of the failure to the Deposit Insurance Fund to be
approximately $20 billion, which exceeds the statutory threshold requiring us to conduct a
material loss review. Accordingly, our engagement will become a material loss review.

Evaluation of the Federal Reserve System’s Vendor Selection and Management Processes
Related to the Federal Reserve Bank of New York’s (FRB New York) Emergency Lending
Programs3

3 The evaluation was subsequently completed in April 2023 and the report is available here
As part of its emergency lending program, FRB New York operated six emergency lending
facilities, five of which were supported by multiple vendor contracts. FRB New York awarded
some of its emergency lending program–related contracts noncompetitively because of the
exigent circumstances, and other contracts pose potential conflict-of-interest risks to the
System. FRB New York’s reliance on vendors highlights the importance of its monitoring of
vendor performance. We are assessing the Board’s and FRB New York’s processes related to
vendor selection and management for FRB New York’s emergency lending programs.

Evaluation of the CFPB’s Process for Conducting Enforcement Investigations

The Dodd-Frank Act authorizes the CFPB to take appropriate enforcement actions to
address violations of federal consumer financial laws. The CFPB’s Division of Supervision,
Enforcement and Fair Lending is responsible for this function and conducts investigations to
assess whether financial institutions are complying with applicable federal consumer financial
laws. According to the CFPB’s 2022 performance plan and report, filing enforcement actions
timely is an important measure of the CFPB’s effectiveness because timely filing is a deterrent

.

Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General Board of Governors of the Federal Reserve System and Consumer Financial Protection Bureau 13

and provides consumers with greater protections. The report also details a performance goal
for the expected time frame for filing or settling an enforcement action following the initiation
of an investigation. We are assessing the Division of Supervision, Enforcement and Fair
Lending’s process for conducting enforcement investigations.

2023 Audit of the CFPB’s Information Security Program

The Federal Information Security Modernization Act of 2014 (FISMA) requires that each
agency inspector general conduct an annual independent evaluation of its respective agency’s
information security program and practices. To meet FISMA requirements for 2023, we are
conducting an audit of the CFPB’s information security program. Our objectives are to
evaluate the effectiveness of the CFPB’s (1) security controls and techniques for select
information systems and (2) information security policies, procedures, standards, and
guidelines. We will use the results from our audit to respond to the Office of Management
and Budget’s fiscal year 2023 FISMA reporting metrics for inspectors general.

Evaluation of the CFPB’s Examiner Commissioning Program

The CFPB’s Division of Supervision, Enforcement and Fair Lending is staffed with examiners
who conduct supervisory reviews and examinations of institutions under the CFPB’s
jurisdiction. Given these responsibilities, examiners play a key role in executing the CFPB’s
mission. In October 2014, the CFPB transitioned from its Interim Examiner Commissioning
Program to its formal Examiner Commissioning Program (ECP). Successful completion of the
ECP is a significant milestone in an examiner’s career, signifying an examiner’s attainment of
the broad-based technical expertise, knowledge, skills, and tools necessary to perform the
duties of a commissioned examiner. We completed an evaluation of the program in
September 2017 that resulted in recommendations designed to enhance the effectiveness of
the ECP, which have since been implemented. For this evaluation, we plan to assess how the
program has been operating over the last few years. Specifically, we will assess the CFPB’s
approach to examiner commissioning, including the case study component of the program.
Further, we plan to benchmark the CFPB’s ECP against other financial regulators’ examiner
commissioning programs.

14
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General Commodity Futures Trading Commission

Office of Inspector General
Commodity Futures Trading Commission
The CFTC OIG acts as an independent Office within the CFTC that conducts audits, investigations,
reviews, inspections, and other activities designed to identify fraud, waste and abuse in connection
with CFTC programs and operations and makes recommendations and referrals as appropriate.
Background
The CFTC OIG was created in 1989 in accordance with the 1988 amendments to the Inspector
General Act of 1978 (P.L. 95-452). OIG was established as an independent unit to:
•
Promote economy, efficiency and effectiveness in the administration of CFTC programs
and operations and detect and prevent fraud, waste and abuse in such programs and
operations;
•
Conduct and supervise audits and, where necessary, investigations relating to the
administration of CFTC programs and operations;
•
Review existing and proposed legislation, regulations and exchange rules and make
recommendations concerning their impact on the economy and efficiency of CFTC
programs and operations or the prevention and detection of fraud and abuse;
•
Recommend policies for, and conduct, supervise, or coordinate other activities carried
out or financed by such establishment for the purpose of promoting economy and
efficiency in the administration of, or preventing and detecting fraud and abuse in, its
programs and operations; and
•
Keep the Commission and Congress fully informed about any problems or deficiencies in
the administration of CFTC programs and operations and provide recommendations for
correction of these problems or deficiencies.

CFTC OIG operates independently of the Agency, and has not experienced interference from
the CFTC Chairman or Commissioners in connection with the conduct of any investigation,
inspection, evaluation, review, or audit, and our investigations have been pursued regardless of
the rank or party affiliation of the target. The CFTC OIG consists of the Inspector General, the

15
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General Commodity Futures Trading Commission

Deputy Inspector General/Chief Counsel, the Assistant Inspector General for Auditing, the
Assistant Inspector General for Investigations (vacant), one Attorney-Advisor, two Auditors,
and one Senior Program Analyst. The CFTC OIG obtains additional audit, investigative, and
administrative assistance through consultancies, contracts and agreements.

Role in Financial Oversight

The CFTC OIG has no direct statutory duties related to oversight of the futures, swaps and
derivatives markets; rather, the CFTC OIG acts as an independent Office within the CFTC that
conducts audits, investigations, reviews, inspections, and other activities designed to identify
fraud, waste, and abuse in connection with CFTC programs and operations, and makes
recommendations and referrals as appropriate. The CFTC’s yearly financial statement and
Customer Protection Fund audits are conducted by an independent public accounting firm, with
OIG oversight.

Recent, Current or Ongoing Work in Financial Oversight

In addition to our work on CIGFO projects described elsewhere in this report, CFTC OIG
continued the following projects during the past year:

2021-I-4 Pay Protection Program Proactive Investigation

In May 2021, OIG began a proactive investigation (2021-I-4) in coordination with CIGIE’s
Pandemic Response Accountability Committee (PRAC), CIGIE’s Pandemic Analytics Center for
Excellence, and the Small Business Administration, involving multiple phases. The first Phase
identified CFTC employees who had obtained PPP loans and whether proper authorization for
outside business activities had been obtained. CFTC OIG made recommendations to the
Agency to improve the business processes and disclosures concerning outside business
activities. Phase II and Phase III involve potential oversight issues. The Phase II and Phase III
objectives are to:

•
Identify CFTC registrants who have received PPP loans, with the potential goal of
recommending that CFTC increase oversight efforts to assure CFTC’s no-action relief
is followed properly, if warranted, as well as other potential recommendations with
regard to the oversight of registrants who have received PPP loans (including issues, if
any, indicating potential systemic impact), and indicia of fraud in connection with the
PPP loans identified.

•
Identify CFTC contractors who obtained PPP loans to identify any indicia of fraud or
potential reputational risks to the Agency.

OIG contracted with a third-party vendor to provide analytic support to examine the millions
of records received in this investigation. OIG has shared its findings and has collaborated with
other CIGFO OIGs on investigative methods to maximize the value of this investigation to the

16
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General Commodity Futures Trading Commission

oversight community. We reported our ongoing work on this project last year. During this
year we suspended this project due to staff departures. At the close of the year, we were in the
process of hiring attorneys with backgrounds in financial market regulation and/or
microeconomics, as well as expert consultants.

White Paper Evaluating CFTC Experience with Digital Assets

Digital assets—including, among other things, cryptocurrency—have been widely adopted and
used by both market participants and ordinary consumers. The CFTC has played an active role
in the digital asset space, offering information to the public in the form of education and
guidance as well as prosecuting digital asset-related conduct that violates the Commodity
Exchange Act. We reported our ongoing work on this project last year. During this year we
suspended this project due to staff departures. At the close of the year, we were in the process
of hiring attorneys with backgrounds in financial market regulation and/or microeconomics, as
well as expert consultants.

17
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General Federal Deposit Insurance Corporation

Office of Inspector General
Federal Deposit Insurance Corporation
The FDIC OIG mission is to prevent, deter, and detect fraud, waste, abuse, and misconduct in FDIC
programs and operations; and to promote economy, efficiency, and effectiveness at the Agency.
Background
The Federal Deposit Insurance Corporation (FDIC) was created by the Congress in 1933 as an
independent agency to maintain stability in the Nation’s banking system by insuring deposits and
independently regulating state-chartered, non-member banks. The FDIC insures $10.07 trillion in
deposits at about 4,706 institutions, and promotes the safety and soundness of these institutions
by identifying, monitoring, and addressing risks to which they are exposed. The Deposit
Insurance Fund balance totaled $128.2 billion as of December 31, 2022.
The FDIC is the primary Federal regulator for approximately 3,032 of the insured institutions. An
equally important role for the FDIC is as Receiver for failed institutions; the FDIC is responsible
for resolving the failed institution and managing and disposing of its remaining assets.
The Office of Inspector General (OIG) at the FDIC is an independent and objective oversight
unit established under the Inspector General (IG) Act of 1978, as amended. Our mission is to
prevent, deter, and detect fraud, waste, abuse, and misconduct in FDIC programs and
operations; and to promote economy, efficiency, and effectiveness at the Agency. We pursued
audits, evaluations, and other reviews throughout the year in carrying out this mission. Of
particular interest for this CIGFO report and implications for the broader financial sector, our
audit and evaluation work covered topics such as information security program controls and
practices pursuant to the Federal information Security Modernization Act of 2014, background
investigations for privileged account holders, security controls over the FDIC’s wireless network,
implementation of the FDIC’s information technology (IT) examination program, and security
controls over the FDIC’s Windows Active Directory.

18
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General Federal Deposit Insurance Corporation

Importantly, and in connection with matters affecting the financial sector, in February 2023, our
Office also published its assessment of the Top Management and Performance Challenges Facing
the FDIC. Our Top Management and Performance Challenges document summarizes the most
serious challenges facing the FDIC and briefly assesses the Agency’s progress to address them, in
accordance with the Reports Consolidation Act of 2000 and Office of Management and Budget
Circular A-136 (revised August 10, 2021).

In addition to the above areas related to the broader financial sector, our Office conducted
significant investigations into criminal and administrative matters often involving sophisticated,
complex multi-million-dollar frauds. These schemes involve bank fraud, embezzlement, money
laundering, currency exchange manipulation, and other crimes involving banks, executives,
directors, officials, insiders, and financial professionals. We are also working to detect and
investigate cyber-criminal cases that threaten the banks and banking sector. Our cases reflect
the cooperative efforts of other OIGs, U.S. Attorneys’ Offices (USAO), FDIC Divisions and
Offices, and others in the law enforcement community throughout the country. These working
partnerships contribute to ensuring the continued safety and soundness of the Nation’s banks
and help ensure integrity in the FDIC’s programs and activities.
Our Office also continues to play a key role in the investigation of individuals and organized
groups perpetrating fraud through the Paycheck Protection Program (PPP) under the
Coronavirus Aid, Relief, and Economic Security Act (CARES Act) and American Rescue Plan
(ARP). To date, we have opened 190 cases associated with fraud in the CARES Act and ARP
programs. We strongly support the Pandemic Response Accountability Committee’s Fraud Task
Force and the Department of Justice’s COVID-19 Fraud Enforcement Task Force. We will
continue to work in close collaboration with our law enforcement partners.
The FDIC OIG is also participating in the CIGFO Working Group that is examining FSOC’s
response to the Executive Order on climate-related financial risk.

FDIC OIG Audits and Evaluations Made Significant Recommendations for
Improvements to the FDIC

During the 12-month period ending March 31, 2023, the FDIC OIG issued six audit and
evaluation products and made 57 recommendations to strengthen controls in FDIC programs
and operations. In the write-ups below, we discuss certain of our issued products, as they
cover issues relevant to the broader financial sector.

The FDIC’s Information Security Program – 2022

We issued our report on The FDIC’s Information Security Program--2022. The audit evaluated
the effectiveness of the FDIC’s information security program and practices, as required by the
Federal Information Security Modernization Act of 2014 (FISMA). The OIG engaged the
professional services firm of Cotton & Company Assurance and Advisory, LLC to conduct
this audit.

19
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General Federal Deposit Insurance Corporation

Department of Homeland Security (DHS) FISMA Reporting Metrics require OIGs to assess
the effectiveness of their agencies’ information security programs and practices using a
maturity model. In Fiscal Year 2022, OIGs were required to evaluate a subset of 20 metrics.
The FDIC’s information security program was operating at a Maturity Level 4 (managed and
measurable). The overall maturity level for FY 2022 was determined by a simple majority
where the most frequent level (mode) across the 20 metric questions served as the overall
rating. This mode-based scoring methodology does not fully capture the nature, scope, and
magnitude of the risk posture of the agency’s IT security. As a result, an agency may still face
significant risks even if its rating score is considered to be managed and measurable. We
cautioned the FDIC against complacency since deficiencies remain in the information security
program at the FDIC.

The FDIC had established certain information security program controls and practices that
were consistent with policy, standards, and guidelines. However, the audit report describes
significant control weaknesses that reduced the effectiveness of the FDIC’s information security
program and practices, including the following:

•
The FDIC’s Supply Chain Risk Management (SCRM) Program Lacked
Maturity: The FDIC was still developing its policies and procedures to address the
SCRM finding from the FISMA report for 2021. Additionally, we found, in our OIG
evaluation report of the FDIC’s SCRM program (issued March 2022) that the FDIC
had not implemented several objectives outlined in its SCRM Implementation Project
Charter; did not conduct supply chain risk assessments in accordance with best
practices; had not ensured that its Enterprise Risk Management processes fully capture
supply chain risks; and FDIC Contracting Officers did not maintain contract
documents in the proper system. We issued nine recommendations, five of which
remained unimplemented.

•
The FDIC Did Not Adequately Oversee and Monitor Information Systems:
The FDIC Chief Information Officer Organization had not completed the
authorization in accordance with the National Institute of Standards and Technology
Risk Management Framework for approximately 52 percent of its legacy systems and
subsystems (as of May 19, 2022).

•
The FDIC Did Not Address Flaw Remediation Plans of Action and
Milestones (POA&M) in a Timely Manner: The FDIC had 31 POA&Ms related to
flaw remediation open past their estimated completion dates (as of June 21, 2022).
These POA&Ms covered, for example, patch management, security updates for
software products, and outdated versions or unapplied security updates for certain
applications.

•
The FDIC Did Not Configure Privileged Accounts in Accordance with the
Principle of “Least Privilege”: We were conducting another audit of the FDIC’s
security controls over its Windows Active Directory at the time of the FISMA audit.

20
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General Federal Deposit Insurance Corporation

During the course of our work, we identified instances where accounts were
configured with elevated account settings; however, there was no justification
provided for such settings, and the elevated settings were no longer needed for
administrators to perform their business roles. Additionally, we identified concerns
relating to the Background Investigations for Privileged Account Holders at the FDIC
and issued a Management Advisory Memorandum in June 2022.

•
The FDIC Did Not Fully Implement Its Document Labeling Guide: In our
FISMA report dated October 2021, we recommended that the FDIC implement
document labeling guide requirements across the organization. However, the FDIC
had not yet fully implemented this recommendation and did not anticipate
implementation until later in 2022.

The report contained a recommendation for the FDIC to address the 31 flaw remediation
POA&Ms. It also contained a listing of three unimplemented recommendations from prior
FISMA reports.

Background Investigations for Privileged Account Holders

While conducting an ongoing audit of security controls over the FDIC’s Windows Active
Directory, which we describe in more detail below, we identified concerns related to the
FDIC’s policies and procedures for ensuring that certain contractors and employees who
require privileged access to FDIC information systems and data have background
investigations commensurate with appropriate determinations of risk. A privileged account
holder may have access and authority to control and monitor systems, and perform
administrative functions that ordinary users are not authorized to perform. We issued a
Memorandum to convey the need for controls to address associated risks.

The Office of Management and Budget Circular A-130 requires that agencies implement
access control policies for information resources that ensure individuals have the appropriate
background investigation conducted prior to granting access. We reviewed 144 privileged
account holders to determine whether the FDIC conducted background investigations
commensurate with position risk designation levels recorded in the FDIC’s personnel system.
We identified one exception and another case where a contractor had privileged access until
the contractor’s background investigation was unfavorably adjudicated. We also determined
that the FDIC did not have policies or procedures in place to re-evaluate risk designations
and background investigation levels for FDIC employees or contractors who transition from
being non-privileged account holders to privileged account holders or whose privileged access
is increased after they have already started work at the FDIC. Such controls can help ensure
that the FDIC considers the risks resulting from a contractor or employee’s change in
privileged access and that the appropriate background investigation level is in place before
granting the privileged access.

21
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General Federal Deposit Insurance Corporation

The FDIC agreed that procedures could be improved in this area and planned to perform
follow-up work to further assess the extent of risk associated with our observations and
make improvements to procedures and processes as warranted by the end of calendar year
2022.

Security Controls Over the FDIC’s Wireless Networks

The term, “Wi-Fi,” refers to wireless technology that allows internet enabled devices (laptops,
tablets, and smartphones) to connect to wireless access points and communicate through a
wireless network. Wi-Fi technology offers benefits to organizations; however, it also
introduces security risks to the confidentiality, availability, and integrity of FDIC data and
systems because it is not bound by wires or walls. If not properly configured, Wi-Fi
technology is susceptible to signal interception and attack.

We conducted a review to determine whether the FDIC has implemented effective security
controls to protect its wireless networks.

We found that the FDIC did not comply or partially complied with five practices
recommended by the National Institute of Standards and Technology and guidance from the
FDIC and other Federal agencies in the following areas:

•
Configuration of Wireless Networks:  The FDIC did not properly configure its
Policy Manager, which enforces security policies for wireless network connectivity.
Also, the FDIC’s CIOO Wi-Fi Operations Group did not have control or awareness
of the set-up and configuration of numerous wireless devices operating in FDIC
buildings and facilities.

•
Wireless Signal Strength:  The FDIC did not have processes to examine and
modify the signal strength of wireless devices/networks broadcasting throughout its
buildings and leaking outside of FDIC facilities.

•
Security Assessments and Authorizations:  The FDIC did not maintain a current
Authorization to Operate for its wireless network and did not conduct sufficient
continuous monitoring testing activities to support the Agency’s ongoing authorization
of its wireless network.

•
Vulnerability Scanning:  The FDIC did not include certain wireless infrastructure
devices in its vulnerability scans. In addition, the FDIC did not use credentialed scans
on wireless infrastructure devices.

22
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General Federal Deposit Insurance Corporation

•
Wireless Policies, Procedures, and Guidance:  The FDIC did not maintain
policies and procedures addressing key elements of the FDIC’s wireless networks,
including roles and responsibilities for the CIOO’s Wi-Fi Operations Group;
procedures for remediating wireless equipment alerts; standards for configuration
settings; updates of wireless inventory records; and detection of rogue access points.

As a result, the FDIC faced potential security risks based upon its wireless practices and
controls, including unauthorized access to the FDIC networks and insecure wireless devices
broadcasting Wi-Fi signals. The FDIC had effective controls related to physical access controls
of wireless devices, access control and encryption, monitoring of user internet destinations on
its wireless networks, and disabling legacy wireless networks.

We made eight recommendations intended to strengthen the security controls over the
FDIC’s wireless networks and protect the confidentiality, availability, and integrity of FDIC
systems and data. Management concurred with our recommendations. We engaged the
professional services firm of TWM Associates, Inc. to conduct the technical aspects of this
review.

Implementation of the Information Technology Risk Examination (InTREx) Program

Cyber risks present some of the greatest systemic threats facing the financial services sector –
both domestically in the United States, and globally. The FDIC – along with the Federal
Reserve Board (FRB) and Office of the Comptroller of the Currency – have all recognized
that cybersecurity is a critical challenge facing the banking industry. These threats include
ransomware attacks, denial of service, data breaches, phishing, and supply chain vulnerabilities.
And they are increasing in both sophistication and frequency. Banks also may suffer
cybersecurity incidents through their interconnections with third-party providers that deliver
administrative or management services to financial institutions, such as accounting, human
resources, and transaction processing.

The FDIC supervises banks to ensure that their operations function in a safe and sound
manner, and comply with all laws and regulations. The FDIC examines institutions to assess
their financial condition, management practices – as well as the banks’ capabilities to identify
and address Information Technology (IT) and cyber risks, and to maintain appropriate internal
controls.

In June 2016, the FDIC implemented the InTREx program. We conducted an audit to
determine whether the InTREx program effectively assesses and addresses IT and cyber risks
at financial institutions.

We found that the FDIC needs to improve its InTREx program to effectively assess and
address IT and cyber risks at financial institutions. Specifically, we found the following
weaknesses in the program that limited the ability of examiners to assess and address IT and
cyber risks at financial institutions:

23
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General Federal Deposit Insurance Corporation

•
The InTREx program was outdated and did not reflect current Federal guidance and
frameworks for three of four InTREx Core Modules;

•
The FDIC did not communicate or provide guidance to its examiners after updates
were made to the program;

•
FDIC examiners did not complete InTREx examination procedures and decision
factors required to support examination findings and examination ratings;

•
The FDIC had not employed a supervisory process to review IT workpapers prior to
the completion of the examination, in order to ensure that findings were sufficiently
supported and accurate;

•
The FDIC did not offer training to reinforce InTREx program procedures to promote
consistent completion of IT examination procedures and decision factors;

•
The FDIC’s examination policy and InTREx procedures were unclear, which led
examiners to file IT examinations workpapers in an inconsistent and untimely manner;

•
The FDIC did not provide guidance to examination staff on reviewing threat
information to remain apprised of emerging IT threats and those specific to financial
institutions;

•
The FDIC was not fully utilizing available data and analytic tools to improve the InTREx
program and identify emerging IT risks; and

•
The FDIC had not established goals and performance metrics to measure its progress
in implementing the InTREx program.

The weaknesses detailed above collectively demonstrated the need for the FDIC to take
actions to ensure that its examiners effectively assess and address IT and cyber risks during IT
examinations. We made 19 recommendations to address these weaknesses.

Security Controls Over the Windows Active Directory

It is important for the FDIC to ensure that only individuals with a business need are allowed
access to its many systems that contain sensitive information. The FDIC uses Active Directory
(AD) to centrally manage user identification, authentication, and authorization. AD
infrastructure is an attractive target for attackers because the same functionality that grants
legitimate users access to systems and data can be hijacked by malicious actors for nefarious
purposes.

24
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General Federal Deposit Insurance Corporation

We performed an audit to assess the effectiveness of controls for securing and managing the
Windows AD to protect the FDIC’s network, systems, and data. We engaged the
professional services firm of Cotton & Company Assurance and Advisory, LLC (Cotton) to
conduct this audit.

The FDIC had not fully established and implemented effective controls for securing and
managing the Windows AD to protect the FDIC’s network, systems, and data in 7 of the 12
areas we assessed. The FDIC needed to improve controls in the following areas:

•
Password Management:  We identified weaknesses in how the FDIC managed
passwords and password changes. In addition, multiple privileged users (a) reused their
passwords; (b) shared their passwords across multiple accounts; and (c) did not
change their passwords for over a year.

•
Account Configuration:  Privileged accounts were configured with excessive
privileges. Such privileges were not justified as necessary and could allow attackers to
inflict significant damage if these accounts were compromised.

•
Access Management:  The FDIC account deletion setting did not remove over 900
users after they exceeded the required thresholds related to account inactivity. In
addition, the FDIC suspended its automated account inactivity setting for a month in
late 2021 without compensating controls.

•
Privileged Account Management:  Three FDIC users held privileged access for
almost a year after the access was no longer required for their positions.

•
Windows Operating System Maintenance:  Several servers and a workstation
were running unsupported versions of the Windows or Windows Server Operating
System.

•
AD Policies and Procedures:  The AD Operations Manual included inaccurate
information about the FDIC’s implementation of AD.

•
Audit Logging and Monitoring:  The FDIC did not enable performance monitoring
on two domain controllers supporting its AD infrastructure.

The FDIC’s ineffective AD security controls could pose significant risks to FDIC data and
systems. In addition, the cumulative impact of these weaknesses could result in an attacker
covertly obtaining administrative privileges to the FDIC’s AD, potentially allowing the attacker
to obtain, manipulate, or delete data across the network, causing serious damage to the FDIC
and its mission and reputation. Moreover, account misconfigurations by the FDIC may
provide FDIC employees and contractors unnecessary elevated privileges on the FDIC’s
network.

25
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General Federal Deposit Insurance Corporation

We found that the FDIC had effective controls in the remaining five control areas we
assessed related to configuration management, contingency planning, patch management,
vulnerability remediation, and defining key AD points of contact.

We made 15 recommendations to address the AD security control weaknesses in the 7 areas
listed above. The FDIC concurred with all recommendations.

The FDIC OIG Assessed the Top Management and Performance Challenges
Facing the FDIC

The FDIC plays a unique role in support of the U.S. financial system. At the time we issued
our Top Management and Performance Challenges report in February 2023, the FDIC insured
nearly $10 trillion in deposits at more than 4,700 banks, supervised over 3,200 banks, and
oversaw the $125 billion DIF that protects bank depositor accounts and resolves failing banks.
The readiness of the FDIC to execute all facets of its mission promotes confidence and
stability in the Nation’s financial system.

Our report noted that banks are facing a rising interest rate environment while the U.S.
economy faces inflationary pressure and continued uncertainties remain resulting from
Russia’s invasion of Ukraine. Banks have also adopted new technologies and third-party
partnerships to engage customers at a time of increasing cyber security breaches. Banks are
also entering into markets for digital assets, which may increase money laundering and
terrorist financing risks. The FDIC’s operating environment is also changing. The FDIC moved
to a hybrid working environment and faces increased retirements and resignations among
FDIC personnel.

In light of these circumstances, our report summarized the most serious challenges facing the
FDIC and briefly assessed the Agency’s progress to address them, pursuant to the Reports
Consolidation Act of 2000 and Office of Management and Budget Circular A-136 (revised
August 27, 2020). Our report is based on the OIG’s experience and observations from our
oversight work, reports by other oversight bodies, review of academic and relevant literature,
perspectives from Government agencies and officials, and information from private-sector
entities. To compile this report, we received input and considered comments from the FDIC,
and while exercising our independent judgment, we incorporated suggestions where
appropriate and fair.

We identified nine Top Challenges facing the FDIC that could impact its capabilities to
promote public confidence and financial stability:

Preparing for Crises in the Banking Sector. The FDIC has a unique mission to administer
the DIF and insure Americans’ bank deposits against losses during crises. The FDIC’s effective
maintenance of the DIF, supervision of banks, and resolution of failed banks provides financial
stability to the United States. The FDIC faces crisis readiness challenges to fully develop its
plans to respond to an unfolding crisis, including exercising the orderly

26
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General Federal Deposit Insurance Corporation

liquidation of systemically important entities. Further, FDIC readiness and supervisory
activities should take into account climate-related risks. FDIC supervisory processes should
also be agile to respond to evolving risks such as fraud in crises-related Government-
guaranteed loan programs and the evasion of US-imposed economic and trade sanctions.

Mitigating Cybersecurity Risks at Banks and Third Parties. Cybersecurity has been
identified as the most significant threat to the banking sector and the critical infrastructure of
the United States. The FDIC faces challenges to ensure that examiners have the skillsets and
knowledge to conduct information technology examinations that adequately identify and
mitigate cybersecurity risks at banks and their third-party service providers. Further, the
FDIC should ensure that it has effective processes for the intake of banks’ cybersecurity
incident reports and uses these reports to mitigate identified risks, identify trends and
patterns of nefarious activity, and adjust supervisory processes. Mitigating cybersecurity risk is
critical, as a cyber incident at one bank or third-party service provider has the potential to
cause contagion within the financial sector.

Supervising Risks Posed by Digital Assets. About 52 million Americans have invested in
digital assets and 136 FDIC-insured banks have ongoing or planned digital asset activities. The
FDIC should work with other regulators to provided clarity regarding the regulation of digital
assets. The FDIC should also have examiners with appropriate skillsets and examination
processes to assess the safety and soundness of banks’ digital asset activities and identify
consumer risks. Further, the FDIC should ensure that its examinations, policies, and
procedures address consumer risks regarding digital assets, including the relationship of
deposit insurance and digital assets.

Fostering Financial Inclusion for Underserved Communities. Federal statute mandates that
the FDIC study the unbanked market in the United States and identify the primary issues that
prevent unbanked individuals from establishing conventional accounts in financial institutions.
Converting the information gleaned from the study of unbanked individuals into effective
actions that banks can take to increase access to the financial system for unbanked individuals
is a challenging endeavor for the FDIC. Further, the FDIC should also ensure that its
examiners have the skills, capabilities, and procedures to assess the effect of banks’ use of
artificial intelligence in decision making. Artificial Intelligence can be beneficial by increasing the
speed and reducing the cost of bank operations, but it can also result in biases against
individuals when the algorithms or data used for these decisions are flawed.

Fortifying IT Security at the FDIC. The FDIC is custodian of about 1.8 petabytes of sensitive
and Personally Identifiable Information relating to failed banks and more than 4,700 insured
banks. The FDIC continues to face challenges to ensure that it has strong information security
processes to guard against persistent and increasing cyber threats against Federal agencies.
Security control weaknesses of FDIC systems limit the effectiveness of FDIC controls, which
places the confidentiality, integrity, and availability of FDIC systems and data at risk. The FDIC
should have robust personnel security and suitability program and privacy controls to
safeguard IT access to sensitive information and guard against insider threats.

27
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General Federal Deposit Insurance Corporation

Managing Changes in the FDIC Workforce. A total of 21 percent of the FDIC workforce
was eligible to retire in 2022, and that figure would climb to 38 percent within 5 years (2027).
These retirements may have a significant impact on key Divisions involved in Crises Readiness
efforts and for subject matter experts in areas such as consumer compliance and information
technology. At the same time, the FDIC is experiencing increased resignations of its
examiners-in-training. Absent effective human capital management, the FDIC may lose
valuable knowledge and leadership skill sets upon the departure of experienced examiners,
managers, and executives. Meeting these challenges is especially important as the FDIC shifts
its operations to a hybrid environment.

Improving the FDIC’s Collection, Analysis, and Use of Data. Data and information can
enhance the FDIC’s and its supervised banks’ capabilities to mitigate threats to the U.S.
financial system. The FDIC faces challenges in receiving and using reliable information.
Specifically, the FDIC should establish processes to acquire, analyze, and disseminate threat
information from Government partners, databases, and repositories. Such information
informs senior FDIC officials and decision-makers, FDIC examiners and Regional personnel,
its supervisory program officials, and banks. Further, the FDIC should improve the reliability
of its internal data to ensure that the FDIC Board and senior management can confidently use
the data to assess program effectiveness.

Strengthening FDIC Contracting and Supply Chain Management. The FDIC awards
nearly $600 million in contracts every year. Over a 5-year period, the FDIC awarded more
than 2,600 contracts valued at $2.85 billion. The FDIC faces challenges to establish an
effective contract management program that ensures the FDIC receives goods and services
according to contract terms, price, and timeframes. An effective FDIC procurement program
is important because the FDIC relies on contractor services for day-to-day activities and
especially during crises. The FDIC should also have programs in place to mitigate security
risks associated with the supply chains for contracted goods and services. Weaknesses in
contractor-provided software to Government agencies have exposed examples of these
supply chain risks. Further, the FDIC should have whistleblower processes and provisions
within FDIC contracts to protect contractor personnel who report allegations of contractor
violations and gross mismanagement.

Implementing Effective Governance at the FDIC. Effective governance allows FDIC Board
members and senior FDIC officials to proactively manage risk, formulate regulatory policy,
and provide clear guidance to banks and FDIC Regional Offices. Through these processes, the
FDIC can allocate resources, prioritize and improve the flow of risk information to decision
makers, and work toward achieving the FDIC’s mission. The FDIC should ensure that risks to
the FDIC are identified and monitored through an effective

28
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General Federal Deposit Insurance Corporation

Enterprise Risk Management Program. The FDIC should also ensure that OIG-identified
program weaknesses are promptly resolved and remediated. FDIC program performance
should be measured using outcome measures to assess whether the FDIC is meeting a
program’s strategic objectives. The FDIC should also clarify its implementation of Executive
Branch best practices, ensure the validity of its rulemaking process, and promulgate rules
based on rigorous cost benefit analyses.

The FDIC has taken certain concrete and measurable steps to address some of these
Challenges, as noted in our Challenges report. We also recognized that there may have been
other ongoing plans, inputs, intentions, or future activities that were still under development
at the time of our issuance of the report.

FDIC OIG Investigations Helped Ensure Integrity in the Banking Sector and Addressed
Fraud in the Federal Pandemic Response

Our Office is committed to partnerships with other OIGs, the Department of Justice (DOJ),
and other state and local law enforcement agencies in pursuing criminal acts affecting banks
and in helping to deter fraud, waste, abuse, and misconduct. We play a key role in
investigating sophisticated schemes of bank fraud, embezzlement, money laundering, cyber-
crime, and currency exchange rate manipulation—fraudulent activities affecting FDIC-
supervised or insured institutions. Whether it is bank executives who have caused the failures
of banks, or criminal organizations stealing from Government-guaranteed loan programs --
these cases often involve bank directors and officers, Chief Executive Officers, attorneys, real-
estate insiders, financial professionals, crypto-firms and exchanges, Financial Technology
(FinTech) companies, and international financiers.

The OIG also actively participates in many financial fraud and cyber working groups
nationwide to keep current with new threats and fraudulent schemes that can undermine the
integrity of the FDIC’s operations and the financial services industry as a whole.

Our investigative results over the 12 months ending March 31, 2023, included the following:
106 indictments; 115 convictions; 83 arrests; and potential monetary recoveries (fines,
restitution, asset forfeitures, settlements, and special assessments) of more than $378.1
million.

As illustrated in the case examples that follow, we continue to identify financial fraud schemes
that affect FDIC-supervised and insured institutions. We also partner with other agencies,
including the Small Business Administration (SBA), to identify fraud in the guaranteed loan
portfolios of FDIC-supervised institutions. These investigations are important, as large-scale
fraud schemes can significantly affect the financial industry and the financial condition of FDIC-
insured institutions. In this regard, and as illustrated below, we continue to investigate
Paycheck Protection Program (PPP) cases of individuals defrauding the Government-
guaranteed loan program intended to help those most in need during the pandemic crisis. In
fact, since inception of the Coronavirus Aid, Relief, and Economic Security Act (CARES Act),

29
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General Federal Deposit Insurance Corporation

we have been involved in 190 such cases. Notably, during the period April 1, 2022 through
March 31, 2023, the FDIC OIG’s efforts related to the Federal Government’s COVID-19
pandemic response resulted in 73 indictments and informations; 50 arrests or self-surrenders;
and 69 convictions involving fraud in the CARES Act Programs. Fines, restitution ordered,
settlements, and asset forfeitures resulting from these cases totaled in excess of $52 million.

Examples to illustrate the varied nature of our impactful investigative cases follow.

Rancher Sentenced for Running $244 Million “Ghost Cattle” Scam

Cody Allen Easterday (Easterday) was sentenced to 132 months imprisonment, 3 years of
supervised release, and ordered to pay $244,031,132 in restitution in the Eastern District of
Washington. Easterday previously pleaded guilty to one count of wire fraud after having
orchestrated and carried out a massive, brazen, and long-term “ghost cattle” scheme where
he fraudulently billed Tyson Foods and another company more than $244 million dollars for
the purchase and feeding of cattle that never existed. Easterday ultimately carried out the
fraud in order to cover significant losses sustained in commodity trades through CME Group,
Inc. and further used fraud proceeds for his personal use and benefit. The scheme was the
largest-ever criminal fraud scheme prosecuted in the Eastern District of Washington.

Easterday is the owner of Easterday Ranches, Easterday Farms, and Easterday Farms Dairy. He
used loan advances and accounts held at Rabobank, N.A. (now Mechanics Bank) and Rabo
AgriFinance to facilitate and fund market manipulation in Live Cattle and Feeder Cattle
commodity futures contracts. CME Group, Inc., the world’s largest financial derivatives
exchange, was defrauded when Easterday submitted falsified paperwork that resulted in CME
exempting Easterday Ranches from otherwise-applicable position limits in live cattle futures
contracts. In order to cover approximately $200 million in commodity futures contracts
trading losses, Easterday created and submitted false and fraudulent invoices totaling more
than $244 million to Tyson Foods and another company between approximately 2016 and
November 2020. These false and fraudulent invoices sought and obtained reimbursement
from Tyson Foods and the other victim company for the purported costs of purchasing and
raising hundreds of thousands of cattle that neither Easterday nor Easterday Ranches ever
purchased, and that did not actually exist. The remainder of the $244 million Easterday stole
from Tyson and the other victim company was converted to Easterday’s personal use and for
the benefit of the Easterday farming empire – an empire that, by 2020, included more than
22,000 acres of farmland, 150 employees, revenues of over $250,000,000, and even a private
plane and hangar. Easterday’s conduct also led Easterday Ranches and Easterday Farms to
default on a $45 million loan issued by Washington Trust Bank. It is also alleged that Easterday
may have misrepresented his assets to lenders in connection with the purchase of a dairy farm
in 2019.

30
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General Federal Deposit Insurance Corporation

Source: Fraud Section of the Criminal Division of DOJ.
Responsible Agencies:  FDIC OIG and United States Postal Inspection Service (USPIS).
Prosecuted by the Fraud Section of the Criminal Division of DOJ and the USAO, Eastern District of
Washington.

Former Bank President and CEO Found Guilty of Fraud Resulting in the Failure of
First NBC Bank

Former First NBC Bank President and Chief Executive Officer (CEO) Ashton J. Ryan, Jr. was
convicted at trial by a Federal jury on 46 counts of bank fraud, conspiracy, and false bank
entries. From 2006 through April 2017, Ryan and others conspired to defraud First NBC Bank
through a variety of schemes. Ryan was the President and CEO of the Bank for most of its
existence. Ryan and others conspired to defraud First NBC Bank by disguising the true
financial status of certain borrowers and their troubled loans, concealing the true financial
condition of the Bank from the Board of Directors, auditors, and examiners.

When members of the Board or the Bank’s outside auditors or examiners asked about loans
to these borrowers, Ryan and others made false statements about the borrowers and their
loans, omitting the truth about the borrowers’ inability to pay their debts without getting new
loans. As a result, the balance on these borrowers’ loans continued to grow resulting,
ultimately, in the failure of First NBC. The Bank’s failure cost the FDIC’s Deposit Insurance
Fund slightly under $1 billion.

Source:  This investigation was initiated from a complaint received by the FDIC.
Responsible Agencies:   FDIC OIG, Federal Bureau of Investigation, and FRB OIG.
Prosecuted by the USAO, Eastern District of Louisiana.

Hilo Man Receives 42 Months in Prison for Defrauding Covid-19 Relief Programs

Carey Mills, of Hilo, Hawaii, was sentenced to 42 months in Federal prison for wire fraud in
connection with a scheme to defraud the Federal government of program funds intended for
COVID-19-related relief. Mills pleaded guilty to a single-count information on May 17, 2022.
In addition to a term of imprisonment, the Court also imposed a 5-year term of supervised
release and ordered Mills to pay restitution to the SBA in the amount of $937,575.

From May to August 2020, Mills submitted multiple applications for PPP and Economic Injury
Disaster Loan (EIDL) funds on behalf of three businesses under his control, Kanaka Maoli
Hookupu Center, New Way Horizon Travel, and Uilani Kawailehua Foundation, each time
utilizing interstate wires. To support the applications, Mills submitted fraudulent payroll
documents and IRS forms, which included false employee and wage payment records. As a
result of these applications, Mills received $937,575 in the form of three forgivable PPP loans
and one EIDL grant to which he was not entitled.

31
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General Federal Deposit Insurance Corporation

Mills used the Federal relief money to fund personal expenses, including the purchase of eight
vehicles and two residential properties. The Mills case was the first COVID-19 program fraud
sentencing in the District of Hawaii.

Source:  This investigation was initiated from a referral from the USAO-Hawaii and U.S. Treasury
Inspector General for Tax Administration (TIGTA).
Responsible Agencies:  FDIC OIG, TIGTA, SBA OIG, and Homeland Security-Investigation.
Prosecuted by the USAO, Hawaii.

Former Wells Fargo Executive Agrees to Plead Guilty to Obstructing a Bank Examination
Involving the Opening of Millions of Accounts Without Customer Authorization

Carrie L. Tolstedt, the former head of Wells Fargo Bank’s retail banking division, agreed to
plead guilty to obstructing a government examination into the bank’s widespread sales
practices misconduct, which included opening millions of unauthorized accounts and other
products. The Office of the Comptroller of the Currency (OCC), which investigated
misconduct at Wells Fargo, also reached a resolution with Tolstedt in a regulatory
proceeding. As part of the consent order resolving that matter, Tolstedt agreed to a ban from
working in the banking industry and to pay a $17 million civil penalty.

From approximately 2007 to September 2016, Tolstedt was Wells Fargo’s senior executive
vice president of community banking and was head of the Community Bank, which operated
Well Fargo’s consumer and small business retail banking business. The Community Bank
managed many of the products that Wells Fargo sold to individual customers and small
businesses, including checking and savings accounts, CDs, debit cards, bill pay, and other
products.

Wells Fargo previously admitted that, from 2002 to 2016, excessive sales goals led
Community Bank employees to open millions of accounts and other financial products that
were unauthorized or fraudulent. In the process, Wells Fargo collected millions of dollars in
fees and interest to which it was not entitled, harmed customers’ credit ratings, and unlawfully
misused customers’ sensitive personal information.

Many of these practices were referred to within Wells Fargo as “gaming.” Gaming strategies
included using existing customers’ identities – without their consent – to open accounts.
Gaming practices included forging customer signatures to open accounts without
authorization, creating PINs to activate unauthorized debit cards, and moving money from
millions of customer accounts to unauthorized accounts in a practice known internally as
“simulated funding.”

32
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General Federal Deposit Insurance Corporation

Gaming also included opening credit cards and bill pay products without authorization,
altering customers’ contact information to prevent customers from learning of unauthorized
accounts and to prevent Wells Fargo employees from reaching customers to conduct
customer satisfaction surveys, and encouraging customers to open accounts they neither
wanted nor needed.

According to the plea agreement, Tolstedt was aware of sales practices misconduct within the
Community Bank and the fact that employees were terminated each year for gaming. By no
later than 2006, Tolstedt was learning about the gaming practices from corporate
investigations and, over time, learned that terminations for gaming in the Community Bank
were steadily increasing, that the misconduct was linked in part to sales goals within the
Community Bank, and that termination numbers likely underestimated the scope of the
problem.

Although the Community Bank eventually took steps purportedly designed to proactively
identify sales misconduct, the measures used by the bank flagged only a small portion of the
potentially problematic activity for investigation. As of July 2014, only the most egregious .01
to .05 percent of employees engaging in activity considered a “red flag” for sales practices
misconduct were investigated – with the remaining 99.95 to 99.99 percent left unexamined
under this process.

In May 2015, Tolstedt participated in the preparation of a memorandum, which she knew
would be provided to the OCC in connection with its examination of sales practice issues at
Wells Fargo. To minimize the scope of the sales practices misconduct within the Community
Bank, Tolstedt corruptly obstructed the OCC’s examination by failing to disclose statistics on
the number of employees who were terminated or resigned pending investigation for sales
practices misconduct. She also failed to disclose that the Community Bank proactively
investigated only a very small percentage of employees who engaged in activity flagged as
potential sales practices misconduct.

Wells Fargo in 2020 acknowledged the widespread sales practices misconduct within the
Community Bank and paid a $3 billion penalty in connection with agreements reached with
the United States Attorneys’ Offices for the Central District of California and the Western
District of North Carolina, the Justice Department’s Civil Division, and the Securities and
Exchange Commission.

Responsible Agencies:  FDIC OIG, FBI, Federal Housing Finance Agency OIG, FRB OIG, and the
USPIS. The Office of the Comptroller of the Currency and the Securities and Exchange Commission
provided additional investigative assistance.
Prosecuted by the USAO, Central District of California; USAO, Western District of North Carolina;
and Major Frauds Section, DOJ.

33
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General Federal Deposit Insurance Corporation

Business Email Compromise Subject Sentenced

On September 2, 2022, Muhammed Naveed was sentenced to serve 46 months in prison for
his role in a business email compromise (BEC) scheme. Naveed was also ordered to pay
restitution of $446,000 for his role in the operation of an unlicensed money transmitting
business.

The investigation into suspected computer intrusion and BEC scheme identified fraudulent
emails from spoofed domains that were used to trick numerous companies to unwittingly
transmit funds from FDIC-insured institutions to the subject controlled accounts rather than
to accounts intended by the companies. During the course of the investigation, Naveed was
identified as a money mule—that is, an individual who transfers money acquired illegally on
behalf of others, and his business, Blacksmith Corporation, was identified as having received
money as a result of this fraudulent scheme.

Source: FBI.
Responsible Agencies:  FDIC OIG and FBI.
Prosecuted by the USAO, Eastern District of Virginia.

***

Learn more about the FDIC OIG at www.fdicoig.gov or follow us on Twitter at FDIC_OIG.

34
Office of Inspector General Federal Housing Finance Agency
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General
Federal Housing Finance Agency
The Federal Housing Finance Agency (FHFA) Office of Inspector General (OIG) promotes the economy,
efficiency, and integrity of FHFA programs and operations, and deters and detects fraud, waste, and
abuse, thereby supporting FHFA’s mission. We accomplish our mission by conducting audits,
evaluations, compliance reviews, investigations, and other independent oversight of the Agency’s
programs and operations, engaging in robust enforcement efforts to protect the interests of the
American taxpayers, and keeping our stakeholders fully and currently informed of our work.
Background

The Housing and Economic Recovery Act of 2008 established the Federal Housing Finance
Agency (FHFA or Agency) in July 2008. FHFA serves as regulator and supervisor of several
entities: Fannie Mae and Freddie Mac (the Enterprises); Common Securitization Solutions, LLC,
an affiliate of each Enterprise (CSS); the Federal Home Loan Banks (FHLBanks) (collectively, the
Enterprises, CSS, and the FHLBanks are the regulated entities); and the FHLBanks’ fiscal agent,
the Office of Finance. FHFA is responsible for ensuring the regulated entities’ safety and
soundness so that they serve as a reliable source of liquidity and funding for housing finance and
community investment. As of December 31, 2022, the Enterprises collectively reported more
than $7.5 trillion in assets and the FHLBanks reported more than $1.2 trillion.
Since September 2008, FHFA also has served as the Enterprises’ conservator. Initially, the
conservatorships were intended to be a temporary measure during a period of extreme stress
to stabilize the mortgage markets and promote financial stability. They are now in their fifteenth
year.

Office of Inspector General Federal Housing Finance Agency
35
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

OIG’s Risk-Based Oversight Strategy

FHFA’s dual roles as the regulated entities’ supervisor and the Enterprises’ conservator
present unique challenges for OIG. Consequently, OIG structures its oversight program to
rigorously examine FHFA’s exercise of its dual responsibilities, which differ significantly
from those of the typical federal financial regulator. Given the regulated entities’ size and
complexity and FHFA’s unique responsibilities, OIG must make informed and targeted
choices about what we audit, evaluate, review for compliance, and investigate.

Management and Performance Challenges

Each year we assess and identify FHFA’s top management and performance challenges and
align our work with those challenges. Our memorandum to the FHFA Director identifying
FHFA’s management and performance challenges for Fiscal Year 2023 is available on our
website. It reports on the most serious challenges which, if not addressed, could adversely
affect FHFA’s accomplishment of its mission. A summary of the oversight activities during
FY 2023 is discussed in our Annual Plan.

The management and performance challenges for FY 2023 are:

•
Effective supervision of the regulated entities
•
Stewardship of the Enterprise conservatorships
•
Oversight of information risk for the regulated entities
•
Oversight of counterparty risk, third-party risk, and fourth-party risk for the regulated
entities

•
Oversight of model risk for the regulated entities
•
Oversight of people risk for the regulated entities
•
Oversight of resiliency risk for the regulated entities
The first four challenges reiterate themes we identified in prior years. For FY 2023, we
also highlight FHFA’s oversight of key operational risks at the regulated entities, including
model risk, people risk, and resiliency risk. Importantly, these challenges interconnect.

Significant Reports

OIG focuses much of its oversight activities on identifying vulnerabilities in these areas and
recommending positive, meaningful actions that the Agency could take to mitigate these
risks and remediate identified deficiencies.

36
Office of Inspector General Federal Housing Finance Agency
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Taken together, this body of work provides important insights across FHFA’s programs
and operations, including the entities under the Agency’s purview.

Enterprises

In addition to its statutory charge to serve as the Enterprises’ regulator and supervisor,
since 2008, FHFA has also served as their conservator. In AUD-2023-003, we reported
that FHFA made conservatorship decisions in accordance with its conservatorship decision
policy and procedures and performed conservatorship monitoring and surveillance. We
found certain instances where FHFA’s document management and retention practices
adversely impacted FHFA’s ability to demonstrate its rationale for certain decisions. We
also found that FHFA’s current policies and procedures increase the risk that
conservatorship decision activity would not be conducted in accordance with FHFA
management’s intentions. We highlighted information related to another aspect of FHFA’s
Enterprise engagement in EVL-2023-001. Announced in December 2021, FHFA conducted
an independent review of a sample of appraisal reports and concluded that valuation bias
persists in housing finance in America. FHFA told us that the Agency made referrals to the
Department of Housing and Urban Development and also made information available to
the Department of Justice and Consumer Financial Protection Bureau. Although the
Agency had not filed complaints with the state licensing authorities responsible for
investigating complaints against appraisers, doing so would provide those authorities with
the actionable information needed to initiate investigations of the appraisers FHFA
identified. These two reports resulted in four recommendations, which the Agency
accepted. In WPR-2022-001, we explained that Fannie Mae and Freddie Mac rely on
numerous third parties to originate and service mortgages and to provide a wide array of
services essential to their business operations. Third parties to the Enterprises rely on
their own third parties, which are fourth parties to the Enterprises. Like third parties,
fourth parties pose risk to the Enterprises that must be managed, and the Enterprises face
challenges managing that risk, particularly related to their limited direct oversight of fourth
parties.

CSS

FHFA is the regulator and supervisor for the Enterprises’ affiliate, CSS, which provides vital
services to them, including securities issuance and administration. These services are
critical to the Enterprises’ role in the secondary market. As we explained in WPR-2023-
001, the magnitude and complexity of the data and technology involved in operating the
underlying platform present a high level of inherent risk. Board and senior management
shortcomings could also increase management risk. EVL-2023-002 reported that in early
2022, the Deputy Director of the Division of Enterprise Regulation (DER) appointed the
CSS examiner-in-charge to be responsible for CSS-specific examinations. We confirmed
that the scope of the 2022 annual examination included the CSS Board of Managers, and
the CSS examiner-in-charge will consider the Board’s activities when assigning the
examination rating. However, we observed that DER has a key person dependency

Office of Inspector General Federal Housing Finance Agency
37
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

because of its level of reliance on the CSS examiner-in-charge. We also noted DER’s
outdated examination guidance for CSS-related examinations. Our evaluation resulted in
two recommendations to the Agency, both of which it accepted. A follow-up compliance
review, COM-2023-001, found that CSS adhered to the timing and format requirements in
a relevant FHFA advisory bulletin for its monthly reports to DER. Thus, the advisory
bulletin has provided a framework under which DER can oversee CSS’ cyberattack risks.

FHLBank System

FHFA also serves as supervisor and regulator of the FHLBank System. As we explained in
WPR-2023-002, the FHLBank System plays an important role in providing liquidity to
member institutions and supporting housing and community development. However,
trends in advances reinforce that the FHLBank risk landscape is susceptible to sudden
shifts in demand driven by economic events, underscoring the importance of managing and
mitigating associated risks. Tied to the FHLBanks’ housing and community development
mission, in AUD-2023-001, we found that FHFA’s Division of Federal Home Loan Bank
Regulation performed annual examinations of the FHLBanks’ affordable housing programs
in accordance with its guidance. We also found that the division did not plan or perform
an in-depth review of a significant area within one of the higher risk affordable housing
programs for more than 10 years. The division officials told us that this in-depth review
was delayed awaiting the amendment of an affordable housing program regulation, which
took longer than expected, and was not fully applied until 2021. The audit resulted in three
recommendations, which were accepted by FHFA. More broadly, COM-2023-004 found
that the Division of Federal Home Loan Bank Regulation complied with its revised
Minimum Frequency Guidelines for how often certain examination work programs must
be performed.

Agency Operations

Our body of work encompasses not only FHFA’s oversight of the regulated entities but
also the Agency’s internal operations. FHFA must manage information risk as a core
component of Agency operations. In AUD-2023-002, we identified multiple exceptions to
federal requirements and FHFA standards and guidelines regarding FHFA’s oversight of its
cloud system and implementation of select controls for which FHFA management is
responsible. In our view, these exceptions occurred with sufficient frequency to warrant
heightened management attention to the cybersecurity risk posed to its cloud system, and
we offered six recommendations to the Agency, which it accepted. Regarding retired
electronic media, in COM-2023-003, we found that FHFA secures retired electronic media
behind two physical barriers and maintains documentation demonstrating accountability
for devices as they are transferred between divisions and, ultimately, outside of the
Agency. As we first identified in 2020, we found that FHFA still did not consistently
perform inventories of its retired electronic media and did not reconcile discrepancies in
its inventory records. Thus, we reopened our 2020 recommendation, which FHFA
accepted. In follow-up work on FHFA’s offboarding controls, COM-2022-008, we found

38
Office of Inspector General Federal Housing Finance Agency
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

that the Agency largely adhered to the tested Offboarding Procedures, but it did not
satisfy its own requirements to collect and destroy Personal Identity Verification cards
from one out of four personnel possessing such cards who separated from FHFA during
the review period. This high failure rate demonstrated that FHFA had not effectively
implemented a recommendation from our related 2019 audit. We re-opened that
recommendation as a result. In response, FHFA committed to abide by applicable federal
standards regarding the collection and destruction of Personal Identity Verification cards.

Investigative Accomplishments

OIG’s investigative mission is to prevent and detect fraud, waste, and abuse in the
programs and operations of FHFA and its regulated entities. OIG’s Office of Investigations
executes its mission by investigating allegations of significant criminal and civil wrongdoing
that affect the Agency and its regulated entities. The Office conducts investigations in strict
accordance with professional guidelines established by the Attorney General of the United
States and also with CIGIE’s Quality Standards for Investigations.
The Office of Investigations is comprised of highly trained law enforcement officers,
investigative counsels, analysts, and attorney advisors. We maximize the impact of our
criminal and civil law enforcement efforts by working closely with federal, state, and local
law enforcement agencies nationwide.

OIG’s Office of Investigations serves as the primary federal law enforcement organization
that specializes in deterring and detecting fraud perpetrated against the Enterprises, which
collectively hold more than $7.5 trillion of mortgages on their balance sheets. Each year,
the Enterprises acquire millions of mortgages worth hundreds of billions of dollars. The
Office of Investigations also investigates cases involving the 11 regional FHLBanks, which
have over $1.2 trillion in assets, and, in some instances, cases involving banks that are
members of the FHLBanks.

Notable Criminal Cases

Former Attorney Found Guilty in Multimillion-Dollar Embezzlement Conspiracy
Resulting in the Failure of a Bank, Illinois

On March 10, 2023, in the Northern District of Illinois, after a four-week long trial, former
attorney and real estate developer Robert Kowalski was convicted by a federal jury of
embezzlement, bankruptcy fraud, and tax fraud charges for his role in an embezzlement
conspiracy that led to the 2017 failure of Washington Federal Bank for Savings, a member
bank of the FHLBank of Chicago.

Washington Federal was shut down in December 2017 after the Office of the Comptroller
of the Currency determined that the bank was insolvent and had at least $66 million in
nonperforming loans.

Office of Inspector General Federal Housing Finance Agency
39
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Evidence at trial revealed Kowalski diverted more than $8 million from the bank, plus
property that was rightly the collateral of the bank for other loans. His receipt of
embezzled funds was concealed by entering them on the bank’s records as loan
disbursements.

Mortgage Broker and Document Preparer Sentenced in Origination Fraud
Scheme, California

In December 2022, in Los Angeles County Superior Court, a mortgage broker and
document preparer were sentenced for their roles in a loan origination scheme that led to
over $25 million in exposure for the Enterprises and the approval of fraudulent mortgage
loans worth over $8 million.

Alex Dadourian was sentenced to 64 months in prison, while Vartan Pirlant was sentenced
to six months in jail, 180 days of home confinement, and two years of probation.
Dadourian and Pirlant were also ordered to pay over $8.1 million and $20,000 (jointly and
severally), respectively, in restitution.

Dadourian, a licensed mortgage broker for Success Funding, conspired with Pirlant, a
document preparer, to defraud financial lenders by taking out 17 mortgage loans based on
fraudulent applications and supporting documentation. Together they forged employment
verifications and education records used to assess creditworthiness, as well as inflated
earnings statements. Dadourian received more than $254,000 in fees and commissions.

$495 Million Settlement in Principle Reached with Credit Suisse to Resolve Allegations
Fraud and Deceit in Sale of Toxic Mortgage-Backed Securities,
New Jersey
 of

On October 24, 2022, a consent order and final judgment was entered in Mercer County
New Jersey Superior Court against Credit Suisse Securities (USA) LLC, Credit Suisse First
Boston Mortgage Securities Corp., and DLJ Mortgage Capital, Inc. (collectively Credit
Suisse) for $495 million to resolve a state lawsuit arising from the offer and sale of
residential mortgage-backed securities. Many of the loans securitized and sold to investors
were guaranteed by the GSEs.

In December 2013, a civil complaint was filed against Credit Suisse by the New Jersey
Attorney General’s Office on behalf of the New Jersey Bureau of Securities.

According to the complaint, Credit Suisse made material misrepresentations in the offering
documents about the risks of the residential mortgage-backed securities, including failing to
disclose material defects of the underlying mortgages. Credit Suisse packaged billions of
dollars’ worth of defective residential loans into publicly traded residential mortgage-
backed securities, which were sold to unsuspecting investors through registration
statements, prospectuses, and other offering materials containing fraudulent
representations about the quality of the underlying loans.

40
Office of Inspector General Federal Housing Finance Agency
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Additionally, the lawsuit alleged: that Credit Suisse failed to disclose to investors the
wholesale abandonment of underwriting guidelines designed to ensure that the mortgage
loans underlying its securities trusts were made in accordance with appropriate lending
guidelines; that numerous loan originators had poor track records of defaults and
delinquencies; and that some loan originators had even been suspended from doing
business with Credit Suisse.

Conspirator Sentenced in Deed Fraud Scheme, Texas

On February 9, 2023, in the Southern District of Texas, Clarence Roland III was sentenced
to 120 months in prison, three years supervised release, and ordered to pay over $3.2
million in restitution and over $1.9 million in a money judgment for his role in a deed fraud
scheme where several of the properties were secured with mortgages acquired by the
Enterprises. Roland was previously convicted by a federal jury of conspiracy to commit
wire fraud affecting a financial institution, wire fraud, and money laundering.
According to court documentation, Roland conspired with Arlando Jacobs in a scheme to
cancel and challenge mortgage loans held in the name of Jacobs or others.

Jacobs was previously sentenced in the Eastern District of Texas to 51 months in prison,
five years supervised release, and ordered to pay $7.6 million in restitution.

According to testimony, Roland and Jacobs solicited other conspirators to establish over
11 business entities or shell companies and office spaces with mailing addresses to carry
out their scheme. Roland and others then fraudulently acquired real property by
manipulating and filing false deeds and other documents. The conspirators fabricated a
series of documents to falsely create the appearance of transferred ownership of real
property to the shell companies. They signed documents claiming to represent one of the
many entities in the transactions including Fannie Mae. Roland sold the properties and
received profits from the sales. The original mortgage liens were not paid off and the
mortgage holders were ultimately defrauded.

Business Owner Sentenced in Paycheck Protection Program Fraud Scheme,
New Jersey

On June 7, 2022, in the District of New Jersey, Gregory Blotnick was sentenced to 51
months in prison, two years supervised release, and ordered to pay over $4.5 million in
restitution and forfeiture for his role in a scheme that defrauded multiple FHLBank
member banks to fraudulently obtain over $6.8 million in Paycheck Protection Program
forgivable loans. He previously pleaded guilty to wire fraud and money laundering.

According to court documentation, Blotnick submitted 21 fraudulent Paycheck Protection
Program loan applications to 13 lenders on behalf of nine purported businesses that he
controlled. He falsified information to the lenders, including number of employees, federal

Office of Inspector General Federal Housing Finance Agency
41
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

tax returns for his purported businesses, and payroll documentation. Of the approximately
$6.8 million sought, Blotnick obtained over $4.5 million in Paycheck Protection Program
funds and then misused the loan proceeds, including by transferring funds to brokerage
accounts where he placed more than $3 million in losing stock trades.

42
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General U.S. Department of Housing and Urban Development

Office of Inspector General
U.S. Department of Housing and Urban Development
The U.S. Department of Housing and Urban Development (HUD), Office of Inspector General (OIG),
safeguards HUD’s programs from fraud, waste, and abuse and identifies opportunities for HUD
programs to progress and succeed.
Background
HUD’s mission is to create strong, sustainable, inclusive communities and quality affordable
homes for all. HUD is working to strengthen the housing market to bolster the economy and
protect consumers; meet the need for quality affordable rental homes; use housing as a
platform for improving quality of life; and build inclusive and sustainable communities free from
discrimination. Its programs are funded through roughly $75 billion in annual congressional
appropriations. While organizationally located within HUD, HUD OIG provides independent
oversight of HUD programs and operations.
HUD has two component entities that have a major impact on the Nation’s financial system:
the Federal Housing Administration (FHA) and the Government National Mortgage Association
(Ginnie Mae). As one of the largest providers of mortgage insurance in the world, FHA
provides lenders with protection against losses when homeowners and owners of multifamily
properties and healthcare facilities default on their loans. FHA has insured approximately 53.7
million single-family properties since its inception in 1934. FHA reported that in fiscal year 2022
it endorsed 982,202 home mortgages (valued at more than $255 billion) through its forward
mortgage program, 70% of which were to purchase a home. FHA’s portfolio also included
3,525 insured residential care facilities, and 61 hospitals. As of December 2021, FHA had a
combined insurance portfolio valued at $1.4 trillion.4
4 https://www.hud.gov/sites/dfiles/Housing/documents/2022FHAAnnualRptMMIFund.pdf
  FHA receives limited congressional
funding and is primarily self-funded through mortgage insurance premiums.

Ginnie Mae is a self-financing, U.S. Government corporation in HUD. It approves lenders
(known to Ginnie Mae as issuers) to issue mortgage-backed securities (MBS) secured by pools
of government-backed home loans. These loans are insured or guaranteed by FHA, HUD’s
Office of Public and Indian Housing, the U.S. Department of Veterans Affairs, and the U.S.
Department of Agriculture. Ginnie Mae guarantees investors the timely payment of principal
and interest on MBS backed by the full faith and credit of the United States government. If an

43
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General U.S Department Housing and Urban Development

issuer of an MBS fails to make the required pass-through payment of principal and interest to
investors, Ginnie Mae is required to advance the payment as part of its guarantee and, in the
instances of issuer default, will assume control of the issuer’s MBS pools and the servicing of
the loans in those pools. The purchasing, packaging, and reselling of mortgages in a security
form frees up funds that lenders use to originate more loans. In fiscal year 2022, Ginnie Mae
issued more than $653 billion MBSs, pushing the total MBS outstanding to nearly $2.3 trillion.5
5 https://www.ginniemae.gov/about_us/what_we_do/Annual_Reports/annual_report22.pdf

HUD OIG Oversight Relating to Financial Matters
HUD OIG strives to influence positive outcomes for HUD programs and operations through
timely and relevant oversight, while safeguarding HUD’s programs from fraud, waste, and abuse.
HUD OIG’s oversight efforts focus on identifying and addressing HUD’s most significant
management challenges, as highlighted in our Top Management Challenges for Fiscal Year 2023
report.6
6 Top Management Challenges Facing the U.S. Department of Housing and Urban Development for Fiscal Year
2023, issued Nov. 14, 2023, available at https://www.hudoig.gov/reports-publications/top-management-
challenges/fy-2023-top-management-challenges
  Some of the top challenges that HUD faces are affected by the dynamic financial
environment and HUD’s pandemic relief programs and funds. Ultimately, HUD OIG uses the
top challenges it identifies to drive oversight efforts, including in the following areas most
related to the financial sector:

•
Mitigating Counterparty Risks in Mortgage Programs – Through FHA and
Ginnie Mae, HUD supports sustainable homeownership and encourages investment in
affordable rental housing by insuring mortgage loans lenders provide to traditionally
underserved home buyers and to owners of various affordable rental housing, and by
guaranteeing payments to investors who purchase securities collateralized by
government-insured loans, providing liquidity in this market. FHA and Ginnie Mae
must work with outside entities, including property owners, banks, nonbank lenders,
and issuers. Each of these outside entities has responsibilities and obligations they
must meet in responsibly doing business with the government. FHA, Ginnie Mae, and
HUD must identify, mitigate, and manage risks related to each entity (also referred to
as “counterparty”) to protect the Mortgage Insurance Fund and the Guaranty Fund.

•
Fraud Risk Management - Fraud negatively impacts the administration,
effectiveness, reputation, and success of HUD’s programs in carrying out its mission.
Beyond monetary losses to the Federal taxpayer, when HUD funds are diverted to
fraud, its programs do not receive the financial support intended to meet its critical
mission. This is especially egregious since HUD’s programs are designed to assist some
of America’s most vulnerable populations and to provide emergency relief to

44
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General U.S. Department of Housing and Urban Development

Americans in urgent need of housing assistance. Every dollar diverted to fraud is a
dollar that does not go to helping these intended beneficiaries. Further, the
reputational harm caused by fraud may result in a negative shift in perception that can
lead key stakeholders to lose faith in HUD and its partners. Managing fraud risk is a
pervasive challenge across the government. It is critical that HUD address this risk
head on since fraud in HUD programs undercuts HUD’s ability to meet all of its
strategic goals.

•
Sustaining Progress in Financial Management - Throughout fiscal year 2022,
HUD continued to make progress in addressing previously identified financial
management weaknesses; however, new instances were also identified. These
weaknesses, coupled with continued weaknesses in HUD’s internal control framework
and financial management systems, demonstrate that HUD must continue to sustain
progress it has made as well as implement additional improvements to its financial
management environment to achieve a fully capable level of financial maturity. Further,
HUD and its component entities must continue sustaining improvements made in
financial management to consistently produce reliable and timely financial reports and
ensure compliance with significant laws and regulations.
In addition, following the issuance of HUD OIG’s Priority Open Recommendations, OIG has
been helping HUD resolve the most significant open recommendations, which, if implemented,
will have the greatest impact on helping HUD achieve its mission.

HUD OIG Oversight Related to the Financial Sector
During the 1-year period ending March 31, 2023, HUD OIG issued 50 audits, evaluations, and
other reviews to strengthen the programs and operations of HUD. Key oversight reports and
investigations related the broader financial sector are summarized below.
Ginnie Mae Did Not Ensure That All Pooled Loans Had Agency Insurance7
7 2023-KC-0001, available at https://www.hudoig.gov/reports-publications/report/ginnie-mae-did-not-ensure-all-
pooled-loans-had-agency-insurance
OIG performed a corrective action verification review of the actions taken by Ginnie Mae to
implement the recommendations cited in Audit Report 2016-KC-0002, Ginnie Mae Improperly
Allowed Uninsured Loans To Remain in Mortgage-Backed Securities Pools, September 21,
2016. OIG found that Ginnie Mae established both a maximum time in which single-family loans
could remain pooled without insurance and a process for requiring the removal of pooled loans
that remained uninsured after that time. However, the loan-matching process did not ensure
that pooled loans would be insured by an agency of the Federal Government, as required by

45
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General U.S Department Housing and Urban Development

the MBS Guide. As a result, OIG estimated that at least 3,200 pooled loans with a principal
balance of at least $903 million were not matched to agency insurance data files before the
certification date. OIG made two additional recommendations, one of which was that Ginnie
Mae update and synchronize its procedures to include notifications that provide issuers with
unmatched loans adequate time to take corrective action to comply with the requirements of
the MBS Guide.

Ginnie Mae Mostly Implemented a Crisis Readiness Program That Followed Federal
Guidance8

8 2023-KC-0004, available at https://www.hudoig.gov/reports-publications/report/ginnie-mae-mostly-implemented-
crisis-readiness-program-followed-federal
OIG audited Ginnie Mae’s crisis readiness and response actions before the onset of and during
the coronavirus disease 2019 (COVID-19) pandemic to determine whether Ginnie Mae had
implemented a crisis readiness program, including precrisis planning, a crisis readiness plan, and
a crisis management strategy, that followed Federal guidance. OIG determined that Ginnie Mae
generally followed Federal guidance in precrisis planning and executed its crisis management
strategy with respect to the COVID-19 pandemic. However, it did not have an agency wide
crisis readiness plan, addressing likely hazards arising from a crisis, or include all key elements in
line with crisis guidance from CIGFO. OIG recommended that Ginnie Mae develop and
implement an agency wide crisis readiness plan addressing likely hazards arising from a crisis, to
include all key elements that align with CIGFO crisis guidance.

HUD Communicated Critical Information to Homeowners About COVID-19 Policies but
Improvements Can Be Made9
9 2023-NY-0001, available at https://www.hudoig.gov/reports-publications/report/huds-communication-
homeowners-about-covid-19-policies
OIG audited HUD’s efforts to proactively communicate information to homeowners with FHA-
insured mortgages through its website, its joint website, and other proactive methods about
protections, repayment options, loss mitigation options, and responsibilities related to COVID-
19. This audit determined that HUD proactively communicated critical information to
homeowners; however, HUD’s COVID-19 Resources for Homeowners webpage did not
clearly present the deadline for requesting forbearance, detail available loss mitigation options
after forbearance, and include detailed information for homeowners with reverse mortgages.
Additionally, letters mailed to homeowners may not have been timely for some and did not
discuss loss mitigation. As a result, homeowners may not have been aware of available
protections and loss mitigation options. OIG made five recommendations to help HUD address
these issues.

46
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General U.S. Department of Housing and Urban Development

Opportunities Exist for Ginnie Mae To Improve Its Guidance and Process for Troubled
Issuers10
10 2023-KC-0003, available at https://www.hudoig.gov/reports-publications/report/opportunities-exist-ginnie-mae-
improve-its-guidance-and-process
OIG audited Ginnie Mae’s guidance and process for managing troubled issuers to assess Ginnie
Mae’s policy and procedures for rapid relocation extinguishments and assess Ginnie Mae’s
implementation of a previous OIG recommendation to develop and implement controls to
identify the total impact of a large or multiple-user default (the maximum size default Ginnie
Mae could adequately execute) and individual issuers’ ability to adapt to changing market
conditions. This audit determined that Ginnie Mae’s guidance and process for troubled issuers
contained gaps. OIG made six recommendations to help Ginnie Mae address the issues
identified.

Improvements Are Needed in HUD’s Fraud Risk Management Program11
11 2023-FO-0001, available at https://www.hudoig.gov/reports-publications/report/improvements-are-needed-huds-
fraud-risk-management-program
OIG audited HUD’s fraud risk management program at the enterprise and program-office levels
and assessed its overall maturity. OIG’s objective was to determine HUD’s progress in
implementing a fraud risk management framework at the enterprise and program-office levels
that encompasses control activities to prevent, detect, and respond to fraud. OIG found that all
four phases of HUD’s fraud risk management program were in the early stages of development,
or at an “ad hoc” maturity level. OIG recommended that HUD (1) perform a complete agency
wide fraud risk assessment and develop a plan to improve the maturity of HUD’s fraud risk
program; (2) communicate to program staff the differences among HUD’s processes for
enterprise risk management, the Payment Integrity Information Act of 2019, and HUD’s
financial risk management risk assessment; and (3) develop policies, procedures, and strategies
for collecting and analyzing data to identify fraud in HUD’s programs, promote fraud awareness,
and develop antifraud risk mitigation tools.

Investigative Activity and Outcomes
OIG also helps protect HUD from counterparty risk by conducting investigations of alleged
fraud negatively affecting the FHA insurance funds and securing recoveries. OIG also
investigates misconduct associated with the FHA and Ginnie Mae programs. For the one year
period ending March 31, 2023, HUD OIG Office of Investigation completed 80 single-family
investigations of fraud against the FHA insurance fund. Many of the investigations focused on
loan origination fraud involving forward mortgages. Recoveries from these cases totaled more
than $106 million (criminal, civil, and administrative recoveries).
Key examples of significant cases include:

47
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General U.S Department Housing and Urban Development

Investigation of Alleged Misconduct by a Ginnie Mae Senior Vice President12
12 https://www.hudoig.gov/reports-publications/investigation-summary/investigation-alleged-misconduct-ginnie-mae-
senior-vice
OIG initiated an investigation upon receipt of information alleging that a Ginnie Mae Senior Vice
President may have provided nonpublic Ginnie Mae information to representatives of a private
investment firm. The investigation found that the employee (1) provided nonpublic information
about a Ginnie Mae issuer to the firm that the employee knew or should have known was not
authorized for public release, (2) provided the firm with preferential treatment or created the
appearance that he was doing so in certain of his interactions with it, and (3) did not take
sufficient care to avoid creating the appearance that he may have been acting unlawfully in
certain of his interactions with the firm. OIG found that this conduct violated 5 CFR (Code of
Federal Regulations) 2635.703, 2635.101(b)(8), and 2635.101(b)(14). OIG referred this matter
to the appropriate office within the U.S. Department of Justice for prosecutorial consideration,
and no prosecution resulted. OIG also referred its findings in this matter to HUD and Ginnie
Mae for any administrative action they may deem appropriate.

Brothers Ordered to Pay Over Half a Million Dollars in Familial Mortgage Fraud
Scheme13
13 https://www.justice.gov/usao-md/pr/baltimore-business-owner-sentenced-federal-prison-fraudulently-obtaining-
federally
Calvin Abramowitz, a borrower, and Philip Abramowitz, a seller, were collectively sentenced in
U.S. District Court for the District of Maryland to 12 months incarceration, 36 months
supervised release, and ordered to pay $587,858 restitution to FHA, of which $378,684 is to be
paid jointly and severally pursuant to their earlier guilty pleas to conspiracy to commit bank
fraud. The defendants conspired to defraud financial institutions by failing to disclose their
familial relationship and submitting falsified documents.

Trio Sentenced to More Than 5 Years Incarceration Related to Mortgage Fraud
Conspiracy14
14 https://www.justice.gov/usao-ma/pr/salem-man-sentenced-four-years-prison-decade-long-mortgage-fraud-scheme
Joseph Bates III and George Kritopoulos, real estate developers, along with David Plunkett,
accountant, were collectively sentenced in U.S. District Court for the District of Massachusetts
to 66 months incarceration, 96 months supervised release, and ordered to pay $2,444,138
restitution to various Federal government and private entities, of which $286,155 was payable
to HUD. Kritopoulos was convicted by jury trial to conspiracy, wire fraud, aiding in the
preparation of a false tax return, obstruction of justice, and bank fraud. Bates pled guilty to
conspiracy, wire fraud, and bank fraud. Plunkett pled guilty to bank fraud and aiding in the
submission of a false tax return. From 2006 until 2015, the defendants engaged in a scheme to
defraud financial institutions by submitting fraudulent documents to qualify borrowers they
recruited for conventional and FHA-insured mortgages.

48
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General U.S. Department of Housing and Urban Development

Real Estate Professionals Sentenced to More Than 14 Years Incarceration and More
Than $10 Million in Restitution15
15 https://www.justice.gov/usao-nj/pr/essex-county-man-sentenced-108-months-prison-mortgage-and-securities-
fraud-schemes#:~:text=The%20108%2Dmonth%20sentence%20imposed,guilty%20to%20in%20this%20case
Three real estate professionals were collectively sentenced in U.S. District Court to more than
14 years’ incarceration and 15 years supervised release and ordered to pay jointly and severally
more than $10 million in restitution, of which more than $6 million is payable to the FHA. For
more than 3 years, the conspirators recruited buyers to purchase multiunit residential
properties owned by a business entity controlled by one of the subjects and used false
information about the buyers’ assets and income to support fraudulent mortgage loan
applications to a mortgage company. They falsified the buyers’ loan applications by falsely
increasing assets. They then transferred cash from the business entity’s and others’ accounts to
the buyers’ bank accounts and falsified documents to hide the transfers. After the loans were
approved, the conspirators returned the funds to the business entity. When the transactions
were closed, the conspirators defrauded the mortgage company by hiding that the business
entity and others, not the buyers, had provided the cash to close the transactions. Ultimately,
the buyers were not able to repay the loans, which resulted in losses to several financial
institutions and FHA.

Direct Endorsement Lender Agreed to Pay Over $1 Million to Resolve False Claims Act
Violations16
16 https://www.justice.gov/usao-edwa/pr/california-mortgage-lender-agrees-pay-more-1-million-resolve-fraud-
allegations
American Financial Network, an FHA direct endorsement lender, entered into a settlement
agreement with the United States to resolve allegations that the company approved mortgages
that did not meet FHA requirements. American Financial Network agreed to pay more than
$1 million, of which $518,572 is payable to FHA. For nearly 8 years, American Financial
Network knowingly failed to perform required quality control reviews and approved loans that
did not qualify for FHA insurance.

Money Mules Ordered To Pay More Than $1.2 Million in Restitution17
17 More information about the investigation is available at https://www.justice.gov/usao-edtx/pr/six-charged-
transnational-money-laundering-operation-involving-elder-fraud
Money mules John Fuss, Jeremy Christopher, Tracey Brookshier, Mary Booth, Ronnie Booth,
and Perry Crenshaw were collectively sentenced in U.S. District Court to 64 months
incarceration, 6 years supervised release, and 13 years probation and ordered to pay more than
$1.2 million in restitution to various victims. Ronnie Booth, Mary Booth, and Brookshier were
sentenced in connection with their earlier guilty pleas to aiding and abetting the operation of an
unlicensed money-transmitting business. Fuss, Jones, and Crenshaw were sentenced in
connection with their earlier guilty pleas to conspiracy to commit money laundering. For more
than 7 years, the conspirators participated in a money-laundering operation involving multiple
fraud schemes in which victims were instructed to send funds to the conspirators through

.

.

49
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General U.S Department Housing and Urban Development

intimidation or the promise of receiving a service or product in return. Victims of the mortgage
modification scheme included FHA-insured borrowers, who were solicited by individuals
purporting to be with the victims’ mortgage companies and falsely promised lower interest
rates and monthly mortgage payments. More than 1,000 victims were impacted by the various
schemes.

50
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General National Credit Union Administration

Office of Inspector General
National Credit Union Administration
The National Credit Union Administration (NCUA) Office of Inspector General (OIG) promotes the
economy, efficiency, and effectiveness of NCUA programs and operations and detects and deters fraud,
waste and abuse, thereby supporting the NCUA’s mission of providing, through regulation and
supervision, a safe and sound credit union system that promotes confidence in the national system of
cooperative credit.
Background
The Under the IG Act, the OIG conducts independent audits, investigations, and other activities
and keeps the NCUA Board and the Congress informed of its work. In addition to the duties set
out in the IG Act, the Federal Credit Union Act requires the OIG to conduct a material loss
review of an insured credit union if the loss to the NCUA’s Share Insurance Fund exceeds $25
million and an amount equal to 10 percent of the total assets of the credit union at the time in
which the NCUA Board initiated assistance or was appointed liquidating agent. In addition, for
any loss to the Share Insurance Fund that does not meet the threshold, the Federal Credit Union
Act requires the OIG to conduct a limited-scope review to determine whether unusual
circumstances exist related to the loss that would warrant conducting a full-scope MLR.

OIG Reports Related to the Broader Financial Sector
We issued a report on the Top Management and Performance Challenges facing the NCUA, and
related audit reports, which can also apply to the broader financial sector:
•
Managing Interest Rate Risk and Liquidity Risk
•
Cybersecurity and IT Governance – Protecting Systems and Data
•
Risks Posed by Third-Party Service Providers
•
Industry Consolidation and Challenges Facing Small Credit Unions
•
Supporting Diversity in the Credit Union Industry

51
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General National Credit Union Administration

With regard to the first challenge we identified, high levels of interest rate risk can increase a
credit union’s liquidity risks, contribute to asset quality deterioration and capital erosion, and put
pressure on earnings. Credit unions must be prudent and proactive in managing interest rate risk
and the related risks to capital, asset quality, earnings, and liquidity. This is particularly the case
for those credit unions whose assets are concentrated in fixed-rate long term mortgages that
were originated when interest rates were at record lows.
With regard to cybersecurity challenges, this remains a significant, persistent, and ever-changing
threat to the financial sector. Credit unions’ growing reliance on increasingly complex
technology-related operating environments exposes the credit union system to escalating
cyberattacks. Cyberattacks can affect the safety and soundness of institutions and lead to their
failure, thus causing losses to the NCUA’s Share Insurance Fund. The prevalence of malware,
ransomware, distributed denial of service attacks, and other forms of cyberattacks are causing
challenges at credit unions of all sizes, which will require credit unions to continually evolve and
adapt to the changing threat environment to ensure containment. To ensure the NCUA remains
vigilant in protecting its own systems and data, we conducted an audit to assess how well the
agency is preventing and detecting cyber threats. Specifically, our audit assessed the effectiveness
of the NCUA’s firewalls and Security Information and Event management (SIEM) solution to
determine if they were designed and implemented to prevent and detect cybersecurity threats to
the NCUA’s network. We concluded that the NCUA adequately designed and implemented its
firewall and SIEM security technologies to prevent and detect cybersecurity threats. However, we
noted weaknesses related to account recertification processes for privileged users with access to
cybersecurity tools and controls around the SIEM tool audit logging, visibility, and retention
processes.
With regard to the challenge posed by the NCUA’s lack of credit union vendor oversight
authority, the NCUA cannot accurately assess the actual risk present in the credit union system
or determine if the risk-mitigation strategies of credit union service organizations and third-party
vendors, which provide much of the industry’s information technology infrastructure, are
adequate and can effectively protect the system from potential attacks. This regulatory blind spot
leaves thousands of credit unions, millions of credit union members, and billions of dollars in
assets potentially exposed to unnecessary risks. To address this, the NCUA continues to request
comparable authority as its counterparts on the Federal Financial Institutions Examination
Council to examine credit union service organizations and third-party vendors. We conducted an
audit in 2020 that concluded that the NCUA should be provided this authority. Both GAO and
the Financial Stability Oversight Council also support providing the NCUA vendor authority. In
2022, the House Financial Services Committee approved a bill to provide the NCUA with vendor
authority and that measure was later added to the House-approved 2023 National Defense
Authorization Act (NDAA). In the Senate, S. 4698, the Improving Cybersecurity of Credit Unions
Act, was introduced to provide the NCUA this authority. However, the provision for vendor
authority was not included in the final NDAA or any other statute.

52
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General National Credit Union Administration

With regard to the challenge of industry consolidation, we noted that small credit unions face
challenges to their long-term viability for a variety of reasons, including lower returns on assets,
declining membership, high loan delinquencies, increasing non-interest expenses, and a lack of
succession planning for credit union boards and key personnel. If current consolidation trends
persist, there will be fewer credit unions in operation and those that remain will be considerably
larger and more complex. To ensure the NCUA continues to help the credit union system grow,
we have started an audit that is reviewing the NCUA’s chartering activities, including determining
whether the NCUA’s efforts to streamline its chartering process have made it more efficient and
effective for potential organizers interested in applying for a new federal credit union charter, and
whether the NCUA has adequately communicated its revised chartering process to potential
organizers interested in applying for a charter and operating a federally insured credit union.
Regarding the challenge of lack of access to the financial system by minority communities, in
September 2022, we issued a report titled Audit of the NCUA’s Minority Depository Institutions
Preservation Program (MDIPP) to determine whether the NCUA’s MDIPP achieved its goals.
Our report determined that the NCUA took actions to preserve the present number and
minority character of MDIs, provided technical assistance to prevent insolvency of MDIs,
promoted and encouraged the creation of MDIs, and provided MDIs with training, technical
assistance, and educational programs. However, based on our survey of MDIs, we believe the
NCUA should evaluate its communications with MDIs. In addition, we determined the NCUA
lacked a process to conduct a required review to determine if MDIs continue to meet the MDI
definition.
In addition to our Management Challenges report and audits related to the challenges identified in
the report, in December 2022, we issued an audit report that assessed the NCUA’s Continuity
of Operations (COOP) program, which could be instructive for the broader financial sector. Our
audit determined the COOP program operated in accordance with applicable laws, regulations,
policies, and procedures and was ready and able to execute should the need arise. However, we
also determined the NCUA should perform a full failover test of its IT network to ensure
management is made aware of any potential weaknesses and correct them, as necessary, and that
the Office of Continuity and Security Management (OCSM) and the Office of the Chief
Information Officer (OCIO) needed to improve communication with each other regarding
COOP and security matters.
We are also currently auditing the NCUA’s quality assurance program, which assesses all
activities relating to the oversight of Federally insured credit unions. The results of our audit may
raise concerns that apply to the broader financial sector.
Finally, we participated in the two CIGFO working groups that worked on the report titled
Guidance in Preparing for and Managing Crises, and the audit of FSOC’s response to the May 20,
2021, Executive Order on Climate-Related Financial Risk. We also continued to participate in a
CIGFO working group designed to coordinate investigative efforts combating fraud associated
with CARES Act stimulus programs.

53
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General U.S. Securities and Exchange Commission

Office of Inspector General
U.S. Securities and Exchange Commission
The U.S. Securities and Exchange Commission (SEC, Commission, or agency) Office of Inspector
General (OIG) promotes the integrity, efficiency, and effectiveness of the critical programs and
operations of the SEC and operates independently of the agency to help prevent and detect fraud,
waste, and abuse in those programs and operations, through audits, evaluations, investigations, and
other reviews.

Background

The SEC’s mission is to protect investors; maintain fair, orderly, and efficient markets; and
facilitate capital formation. The SEC strives to promote capital markets that inspire public
confidence and provide a diverse array of financial opportunities to retail and institutional
investors, entrepreneurs, public companies, and other market participants. Its core values consist
of integrity, excellence, accountability, teamwork, fairness, and effectiveness. The SEC’s goals are
protecting the investing public against fraud, manipulation, and misconduct; developing and
implementing a robust regulatory framework that keeps pace with evolving markets, business
models, and technologies; and supporting a skilled workforce that is diverse, equitable, inclusive,
and fully equipped to advance agency objectives.

The SEC is responsible for overseeing the nation’s securities markets and certain primary
participants, including broker-dealers, investment companies, investment advisers, clearing
agencies, transfer agents, credit rating agencies, and securities exchanges, as well as organizations
such as the Financial Industry Regulatory Authority, Municipal Securities Rulemaking Board,
Public Company Accounting Oversight Board, Securities Investor Protection Corporation, and
the Financial Accounting Standard Board. Under the Dodd-Frank Wall Street Reform and
Consumer Protection Act of 2010 (Dodd-Frank), the agency’s jurisdiction was expanded to
include certain participants in the derivatives markets, private fund advisers, and municipal
advisors.

54
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General Securities and Exchange Commission

The SEC’s headquarters are in Washington, DC, and the agency has 11 regional offices located
throughout the country. The agency’s functional responsibilities are organized into 6 divisions
and 25 offices, and the regional offices are primarily responsible for investigating and litigating
potential violations of the securities laws. The regional offices also have examination staff to
inspect regulated entities such as investment advisers, investment companies, and broker-
dealers. As of March 2023, the SEC employed 4,630 full-time equivalents.

The SEC OIG was established as an independent office within the SEC in 1989 under the
Inspector General Act of 1978, as amended (IG Act). The SEC OIG’s mission is to promote the
integrity, efficiency, and effectiveness of the SEC’s critical programs and operations. The SEC OIG
prevents and detects fraud, waste, and abuse through audits, evaluations, investigations, and other
reviews related to SEC programs and operations.

The SEC OIG Office of Audits conducts, coordinates, and supervises independent audits and
evaluations of the SEC’s programs and operations at its headquarters and 11 regional offices.
These audits and evaluations are based on risk and materiality, known or perceived vulnerabilities
and inefficiencies, and information received from the Congress, SEC staff, the U.S. Government
Accountability Office, and the public.

The SEC OIG Office of Investigations performs investigations into allegations of criminal, civil, and
administrative violations involving SEC programs and operations by SEC employees, contractors,
and outside entities. These investigations may result in criminal prosecutions, fines, civil penalties,
administrative sanctions, and personnel actions. The Office of Investigations also identifies
vulnerabilities, deficiencies, and wrongdoing that could negatively impact the SEC’s programs and
operations.

In addition to the responsibilities set forth in the IG Act, Section 966 of Dodd-Frank required the
SEC OIG to establish a suggestion program for SEC employees. The SEC OIG established its SEC
Employee Suggestion Program in September 2010. Under this program, the OIG receives,
reviews, considers, and recommends appropriate action with respect to such suggestions or
allegations from agency employees for improvements in the SEC’s work efficiency, effectiveness,
and productivity, and use of its resources, as well as allegations by employees of waste, abuse,
misconduct, or mismanagement within the SEC.

SEC OIG Work Related to the Broader Financial Sector
In accordance with Section 989E(a)(2)(B)(i) of Dodd-Frank, below is a discussion of the SEC OIG’s
completed and ongoing work, focusing on issues that may apply to the broader financial sector.

55
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General U.S. Securities and Exchange Commission

Completed Work
Enforcement Investigations: Measures of Timeliness Showed Some Improvement But
Enforcement Can Better Communicate Capabilities for Expediting Investigations and
Improve Internal Processes: Report No. 576; February 15, 2023

The SEC Division of Enforcement (Enforcement) is responsible for civil enforcement of the federal
securities laws. Each year, Enforcement advances the SEC’s mission by investigating and bringing
hundreds of actions against individuals and entities for fraud and other misconduct, and by securing
remedies that protect investors and the markets. In conducting investigations, Enforcement strives
to balance the need for complete, effective, and fair investigations with the need to file
enforcement actions in as timely a manner as possible.

We conducted this evaluation to (1) assess Enforcement’s efforts to expedite and accelerate the
pace of investigations, where possible and appropriate, and (2) review Enforcement’s performance
goal-setting and monitoring processes related to the pace of investigations.

During the period we reviewed (fiscal year [FY] 2016 to FY 2021), Enforcement’s efforts aligned
with federal and agency requirements for performance goal-setting and monitoring as part of
annual performance planning and reporting. Enforcement supported the SEC’s efforts to develop
performance plans and goals, and provided reliable data to support such goals and reporting
requirements. We reviewed and tested data supporting two prior SEC performance goals, for
which Enforcement was responsible, and noted no concerns with respect to completeness and
accuracy. Metrics associated with these goals measured (1) the pace of investigations that lead to
the filing of enforcement actions, and (2) the average number of months between the opening of
an investigation and the filing of the first enforcement action arising from that investigation. As of
October 2018, Enforcement no longer reports at the agency level on these performance goals.
Nonetheless, Enforcement actively monitored the pace of investigations through regular reports,
mandatory quarterly case review meetings, and other routine meetings.

Our analysis of case data from FY 2016 to FY 2021 found that two measures of timeliness showed
some improvement. Specifically, the average time from opening an investigation to the first filed
enforcement action decreased from 24.1 months to 22.8 months, and the percentage of first filed
enforcement actions filed within 2 years improved from 53 percent to 54 percent. However,
some respondents to a survey we conducted of Enforcement personnel disagreed that
Enforcement management had sufficiently taken actions to expedite investigations. For example,
out of about 320 staff-level respondents:

•
70 (or about 22 percent) disagreed or strongly disagreed that Enforcement
management promoted best practices regarding efficiencies in various phases of
Enforcement investigations;

•
63 (or about 20 percent) disagreed or strongly disagreed that Enforcement
management effectively promoted opportunities to leverage data analytics capabilities;
and

56
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General Securities and Exchange Commission

•
65 (or about 20 percent) disagreed or strongly disagreed that Enforcement
management provided training on tools that help staff expedite investigations.

Management provided us examples of actions taken to expedite investigations but can better
communicate across Enforcement its capabilities for expediting investigations.

Additionally, although about 87 percent of all respondents to our survey (managers and staff)
agreed or strongly agreed that Enforcement management emphasizes the importance of
expediting investigations, some respondents reported that improvements to internal processes
(including the action memo process), systems, and Enforcement staffing and workload may help
expedite investigations.

Lastly, we found significant differences in the processing times for matters under inquiry handled
by different SEC regional offices and, overall, personnel expressed concerns about the timely
closing of investigations as soon as it becomes apparent that no enforcement action will be
recommended. Timely action in these respects can help Enforcement make more efficient use of
its limited resources and focus on those matters that warrant further attention and investigation.

We issued our final report on February 15, 2023, and recommended that Enforcement: (1) review
processes for communicating across the organization information on existing capabilities and
resources that help expedite investigations, (2) develop a plan to address causes of investigative
delays noted in our survey of Enforcement personnel, and (3) review Enforcement-wide
procedures for timely processing matters under inquiry and controls that ensure investigations are
timely closed to identify and disseminate best practices. The report is available on our website at
https://www.sec.gov/files/enforcement-investigat-meas-timeliness-show-some-improvement-
enforcement-can-better-comm.pdf.

SEC’s Whistleblower Program: Additional Actions Are Needed To Better Prepare for Future
Program Growth, Increase Efficiencies, and Enhance Program Management;
Report No. 575; December 19, 2022

According to the SEC Office of the Whistleblower (OWB), assistance and information from a
whistleblower who knows of possible securities law violations can be among the most powerful
weapons in the law enforcement arsenal of the SEC. Since the inception of the SEC whistleblower
program in 2011, the Commission has awarded more than $1.3 billion to over 300 individuals. In
FY 2021, the SEC awarded more than it ever had (about $564 million) to the largest number of
whistleblowers (108) in a single year.

We conducted this audit to assess the growth of the SEC’s whistleblower program and the
functioning of key program controls. The engagement scope period was from FYs 2017 to 2021
and included whistleblower hotline calls, award claims, and awards that took place before and
after the SEC’s September 2020 adoption of amended whistleblower program rules.

57
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General U.S. Securities and Exchange Commission

We reviewed whistleblower payments for a sample of Final Orders issued in FY 2021 and
determined that, in those instances, whistleblowers were paid in accordance with applicable rules
and Final Orders. In addition, payments were approved before issuance, in accordance with
OWB’s policies and procedures. Moreover, the SEC took steps to improve whistleblower claims
processing and tracking procedures, including (1) implementing an initiative to more efficiently
develop the initial drafts of attorney declarations, (2) adopting certain rule amendments, and (3)
implementing a modernized claims tracking system. However, before these efforts, OWB was
experiencing a significant backlog in processing whistleblower claims, which increased the amount
of time whistleblowers waited before receiving the Commission’s Final Order. In addition, aspects
of some improvements were not consistently implemented or fully leveraged. As a result,
opportunities remain for OWB to further improve as the whistleblower program continues to
grow.

We also reviewed a sample of claims packages and supporting artifacts and determined that some
Claims Review Staff (CRS) determinations were approved when more than half of the CRS
members were absent or recused. This occurred because the CRS did not implement an
operating agreement detailing certain processes or control activities, such as the number of CRS
members required to approve a claims package. Because the Commission relies on the CRS with
respect to whistleblower awards, including denials and approvals of multi-million dollar awards, we
believe a lack of guidelines, rules, and standards governing CRS actions and decisions increases the
risk to the Commission’s Final Orders.

When reviewing OWB’s internal data management, we identified some inaccurate or incomplete
data. These deficiencies occurred, at least in part, because OWB did not establish effective
controls over manually inputted data entries used to track whistleblower claims and manage the
whistleblower program. Without such controls, OWB continues to risk inaccurate and
incomplete reporting of claims tracking data and, in some cases, delays in key whistleblower
program processes.

We also found that OWB took steps to effectively communicate with external parties and
promote awareness of the program. However, OWB did not always (1) timely respond to
whistleblower hotline voicemails or maintain information to assess the timeliness of responses; (2)
notify helpful whistleblowers that a time-sensitive opportunity to file a whistleblower claim was
available, as instructed by OWB policy; and (3) post to its webpage the Commission’s Final
Orders. These conditions occurred, in part, because OWB policies and procedures did not
sufficiently address these issues, creating opportunities for OWB to improve aspects of
whistleblower program communication.

Lastly, we identified two matters that did not warrant recommendations. We discussed these
matters with agency management and encourage management to consider any actions needed in
response.

58
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General Securities and Exchange Commission

We issued our final report on December 19, 2022, and made eight recommendations to help
further increase efficiencies in the SEC’s whistleblower program, better prepare for future
whistleblower program growth, reduce risk, and improve controls over whistleblower program
data and communication with external parties. The report is available on our website at
https://www.sec.gov/files/secs-whistleblower-program-additional-actions-needed-report-no-
575.pdf.

Final Management Letter: Changes to the Internal Review Process for Proposed Rules May
Impact the Office of the Advocate for Small Business Capital Formation and the Office of the
Investor Advocate; September 29, 2022

During a recent OIG evaluation, we identified a matter related to the agency’s internal
communication and coordination specific to the rulemaking process. We previously identified an
opportunity to strengthen communication and coordination across the SEC’s divisions and offices
as an emerging theme in our October 2021 statement on SEC’s management and performance
challenges (U.S. Securities and Exchange Commission, Office of Inspector General, The Inspector
General’s Statement on the SEC’s Management and Performance Challenges October 2021 [October 8,
2021]). Our observations in the course of conducting the Office of the Advocate for Small
Business Capital Formation (OASB) evaluation demonstrate that strengthening communication
and coordination remains a growth area for the SEC.

OASB and the Office of the Investor Advocate (OIAD) were established pursuant to
Congressional mandates involving a measure of independence. Among other things, these offices
are statutorily required to help ensure that the concerns of specific SEC stakeholders (namely,
small businesses and investors) are appropriately considered as decisions are being made and
policies are being adopted at the Commission, at self-regulatory organizations, and in Congress.
With respect to agency rulemaking, OASB and OIAD rely on the SEC’s rulemaking divisions and
offices to timely provide drafts of proposed rules for review and comment.

Around December 2021, the Office of the Chair modified the process for coordinating internal
reviews of draft agency rules, resulting in OASB and OIAD receiving only fatal flaw drafts of
proposed rules for a brief period. This change was neither formally documented nor
communicated to those offices, and, according to the former directors of OASB and OIAD, they
were not aware of the change until after it took effect. Although OASB and OIAD personnel
stated that they generally were able to carry out their responsibilities during this period, changes
to internal processes likely to impact their review and comment related to draft proposed agency
rules may unintentionally limit OASB’s and OIAD’s ability to fulfill their advocacy roles and carry
out office functions, and could hinder effective collaboration and information sharing across the
agency.

On September 29, 2022, we issued our final management letter on this topic. Although we
commended management’s commitment to promoting effective and collaborative information
sharing across the SEC’s divisions and offices, we encouraged the Office of the Chair to consider,
as a management practice, notifying OASB and OIAD before future changes to the rulemaking
process, potentially impacting these offices, are implemented.

59
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General U.S. Securities and Exchange Commission

This management letter is available on our website at https://www.sec.gov/files/finl-mgmt-ltr-
changes-internal-review-process-prop-rules-may-impact-oasb-capital-formation-and-oia.pdf.

OASB Complied With Statutory Requirements But Can Improve As It Matures;
Report No. 573; August 30, 2022

OASB is an independent office of the SEC established pursuant to the SEC Small Business
Advocate Act of 2016 (Advocate Act). OASB’s mission is to advance the interests of small
businesses and their investors at the SEC and in the capital markets.

We conducted this evaluation to assess OASB’s design and implementation of operations, policies,
and controls—including coordination and collaboration with other SEC divisions and offices and
external stakeholders—to determine whether OASB has met applicable statutory requirements
and strategic goals and objectives. Specifically, we sought to (1) evaluate OASB’s processes for
planning and conducting outreach and engagement activities and for assessing the performance of
such activities; (2) assess the design and implementation of OASB’s rulemaking feedback process;
and (3) verify whether OASB was organizing and executing the SEC’s annual Small Business
Forum, preparing an independent annual report, serving as a member of the Small Business
Advisory Committee, and consulting with the Investor Advocate as required.

We determined OASB effectively established a new independent organization and complied with
the statutory requirements outlined in the Advocate Act. Specifically, since commencing
operations in January 2019, OASB has done the following:

•
conducted outreach events, including educational activities;

•
assisted small businesses and their investors;

•
analyzed the potential impact of proposed self-regulatory organizations’ rules and SEC
rulemaking on small businesses and their investors;

•
consulted with the SEC Investor Advocate;

•
issued annual independent reports on activities;

•
participated on the Small Business Advisory Committee; and

•
planned, organized, and executed the SEC’s annual Small Business Forum.

Although the Advocate Act does not require OASB to coordinate with other SEC divisions and
offices, many of the OASB’s functions require OASB personnel to work closely with other
divisions and offices. We met with personnel from SEC divisions and offices that OASB
coordinated with, and none of them identified any challenges or gaps in coordination with OASB.

60
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General Securities and Exchange Commission

OASB created a Foundational Business Plan (April 2019) that identified its office’s mission and
provided a framework for reaching full-scale programming. OASB then published a strategic plan
on July 9, 2021, that outlined 4 key goals and 11 strategies. Although OASB identified goals in its
strategic plan, OASB did not develop performance measures (qualitative and/or quantitative) to
assess the efficacy of key activities in its strategic goals. Without performance measures, OASB
potentially limits (1) the effectiveness of key programmatic activities, and (2) its ability to make
data-driven improvements, as needed, to ensure that OASB achieves its strategic goals.

Furthermore, although OASB issued policies and procedures, the documents in effect at the time
of our review did not include detailed information about workflows, responsibilities, data
collection and management, or the expected timing of certain actions, all of which OASB
personnel described to us when we asked about OASB’s standard practices. In addition, OASB’s
Outreach Management System (OMS) User Guide and OMS Admin User Guide did not offer
detailed data entry information for the OMS system. Without detailed policies and procedures, as
OASB matures and grows as an organization, there is an increased risk that its processes may not
be followed correctly, reviews of SEC and self-regulatory organizations proposed rules may be
performed inconsistently, and decision making may not be documented properly.

We issued our final report on August 30, 2022, and made two recommendations to strengthen
OASB’s programs and operations as it matures, including (1) identifying and establishing
performance measures for activities, and (2) updating OASB’s policies and procedures. The report
is available on our website at https://www.sec.gov/files/oasb-complied-statutory-requirements-can-
improve-it-matures-rpt-573.pdf.

Ongoing Work

Review of SEC Controls Over Public Comments Submitted Online and Actions Taken in
Response to a Known Error

Rulemaking is the process by which federal agencies promulgate rules. In some instances,
rulemaking implements legislation passed by Congress and signed into law by the President. Other
rulemaking updates rules under existing laws or creates new rules within an agency’s authority.
Federal agencies, including the SEC, are generally required to give interested persons an
opportunity to participate in the rulemaking process through submission of written data, views, or
arguments (referred to as comments or public comments). The SEC invites interested persons to
comment on SEC proposed rules and self-regulatory organization filings, among other matters,
using several methods, including online through an internet comment form (also known as a
webform). In 2022, the SEC disclosed a technological error that resulted in a number of public
comments submitted through the Commission’s internet comment form not being received by
the Commission. Subsequently, we initiated a review of the SEC’s (1) controls over public
comment letters submitted online, and (2) actions and response efforts since notifying us of the
webform error in August 2022.

The results of our completed review will be reported in the next annual reporting period.

61
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Special Inspector General for the Troubled Asset Relief Program

Special Inspector General for the
Troubled Asset Relief Program
The mission of the Office of the Special Inspector General for the Troubled Asset Relief Program
(SIGTARP) is to prevent and detect fraud, waste, and abuse in the more than $442 billion appropriated
by Congress through the Emergency Economic Stabilization Act (EESA) and $2 billion funded through
the Consolidated Appropriations Act of 2016, and to promote economy, efficiency, effectiveness, and
accountability in these economic stability programs. SIGTARP conducts investigations of suspected illegal
activity in, and independent audits of, these EESA long-term economic stability programs.
Background
EESA has two parts:

(1) Short-term Treasury purchases of “troubled assets,” which led to investments in banks,
insurance companies and automotive companies - these programs have been largely
completed, as has SIGTARP’s work in this area; and

(2) Long-term programs intended to bring economic stability to the financial industry and
communities by protecting home values and preserving homeownership - programs that
spent over $1 billion during fiscal years 2020-2021, and will continue to operate until
2024.

Under these long-term economic stability programs, the Department of Treasury and Fannie
Mae (with assistance from Freddie Mac) run a program that funds incentives to more than 150
financial institutions, including some of the largest in our nation, to lower mortgage payments
to terms that are affordable and sustainable for homeowners at risk of foreclosure. Treasury
also funded grant-like programs administered by housing finance agencies in 19 states. This
included assistance for homeowners unemployed, underemployed, or suffering other hardships
due to the COVID-19 pandemic.

SIGTARP is primarily a federal law enforcement office. SIGTARP investigations have resulted
in criminal charges against 471 defendants with a 96% DOJ conviction rate. Courts have
sentenced to prison 321 defendants, including 75 bankers. SIGTARP’s investigations have also
resulted in DOJ, the SEC, and others bringing enforcement actions against 25 banks or
corporations, including some of the largest financial institutions.

62
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Special Inspector General for the Troubled Asset Relief Program

More than $11 billion has been recovered from SIGTARP investigations – a cumulative 28
times return on investment. So far in FY 2023, the government has recovered $1,570,420.

SIGTARP’s Select Audit Results (April 1, 2022 to March 31, 2023)

Four Released Evaluations Pertain to the Home Affordable Modification Program
(HAMP)

In April and May 2022, SIGTARP released three evaluations examining different aspects of HAMP.
In two of the evaluations, SIGTARP identified key characteristics of homeowners and mortgage
servicers in HAMP using Treasury’s data and other relevant data sources. For the third evaluation,
SIGTARP reviewed Treasury’s oversight of mortgage servicers participating in HAMP. SIGTARP
examined Treasury's oversight of HAMP servicers, as well as oversight conducted on behalf of
Treasury by Freddie Mac and Fannie Mae. The results of these evaluations provided valuable
information and recommendations to Treasury, Congress, and the public on who is currently
benefitting from HAMP and the servicers participating in the program, and how federal taxpayer
dollars are being used.

SIGTARP issued its final evaluation in March 2023. The evaluation was an analysis of previously
issued HAMP and HHF recommendations. Objectives were to summarize the findings and
recommendations SIGTARP made in its reports and other products on HHF and HAMP, to assess
the status of the recommendations, and to identify lessons learned for ongoing and future housing
programs.

SIGTARP’s products identified findings that led to 285 recommendations on the HHF (221) and
HAMP (64) programs. SIGTARP organized its recommendations by three categories including (1)
promote economy, efficiency, and effectiveness of the programs; (2) prevent and detect fraud,
waste, and abuse; and (3) promote transparency and accountability. Nearly 50% of the
recommendations aimed to promote economy, efficiency, and effectiveness of HHF and HAMP,
while 40% of the recommendations sought to prevent and detect fraud, waste, and abuse.

Treasury fully implemented 98, or 34 percent, of SIGTARP’s recommendations and partially
implemented 105, or 37 percent. Treasury’s implementation of these recommendations resulted in
program changes that enabled more eligible struggling homeowners to receive much needed
assistance, recoveries of wasted program funds, and greater protections from fraud, waste, and
abuse. Almost 30 percent of SIGTARP’s recommendations remain unimplemented, representing
missed opportunities to further enhance the programs and lessons learned for future housing and
federal programs.

63
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Special Inspector General for the Troubled Asset Relief Program

SIGTARP’s Select Investigative Results (April 1, 2022 to March 31, 2023)

Risk of Fraud, Waste, and Abuse by Financial Institutions in the HAMP Program

SIGTARP’s top law enforcement priority is to investigate and bring to justice unlawful conduct
by any of the banks and other financial institutions that received $22.3 billion in HAMP.18
18 SIGTARPs March 31, 2023 analysis of Treasury's most recent MHA data; Treasury, Housing Transaction Report,
March 2023
HAMP modifies mortgages (interest rates, terms, etc.) for homeowners at risk of foreclosure,
to make mortgage payments more affordable and sustainable for homeowners. There are over
550,000 homeowners participating in all 50 states. SIGTARP has several open, confidential
investigations.

Justice for Defendants Convicted of Scamming Homeowners Who Were Seeking
Foreclosure Assistance Through HAMP

SIGTARP has caught 121 scammers who were convicted for defrauding nearly 31,000
homeowners nationwide seeking foreclosure relief through HAMP. The courts have sentenced
101 scammers to prison.

Georgia Woman Sentenced in Connection with Defrauding TARP Recipient Bank
On August 3, 2022, Ladonna Barton was sentenced to time served, three years of supervised
release and ordered to pay restitution of $46,947 for her role in defrauding River City Bank
(RCB) in Rome, Georgia, a TARP recipient bank. Barton received loan proceeds through
materially false and fraudulent pretenses, representations and promises, as well as material
omissions during her participation in the scheme. The U.S. Attorney’s Office for the
Northern District of Georgia prosecuted this matter.

CEO of Louisiana Federal Credit Union Sentenced for Filing a False Document in
Connection with TARP
On April 6, 2022, Helen Godfrey-Smith, former Chief Executive Officer of the Shreveport
Federal Credit Union, was sentenced to one year of probation and ordered to pay a fine of
$5,000 for making and using a false document in connection with the TARP funds the
Shreveport Federal Credit Union received from the Treasury. She pled guilty to this crime in
December 2021. In December 2016, Godfrey-Smith signed a document stating the credit
union was financially healthy, when in fact the credit union was in dire fiscal condition. Due
to its dismal financial condition, the credit union was placed into a conservatorship in April
2017 and was liquidated in October 2017. The U.S. Attorney’s Office for the Western
District of Louisiana was responsible for the prosecution of this case.

64
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Special Inspector General for the Troubled Asset Relief Program

Former CEO of TARP Bank Sentenced for Participating in a Bribery Scheme in
Connection with Loans Guaranteed by the Small Business Administration
On October 6, 2022, Edward Shin was sentenced to fourteen months imprisonment, three
years of supervised release, and ordered to forfeit $5,506,050 for his role in a bribery
scheme as the former CEO of Noah Bank. Shin caused the Bank to issue millions of dollars
of SBA-guaranteed and commercial loans to companies in which he held a secret financial
interest.
These charges were brought about by a joint investigation with SIGTARP, FDIC-OIG, HSI,
and SBA-OIG. This case was prosecuted by the United States Attorney’s Office for the
Southern District of New York.

Kansas Business Owner Sentenced for Defrauding a TARP Recipient Bank
K. Kevin James owned and operated several construction companies in Kansas. These
companies secured a line of credit with Blue Valley Bank, a TARP recipient bank. Beginning in
2009 through 2011, K. Kevin James participated in a scheme to provide falsified financial
statements for the construction companies to Blue Valley Bank misrepresenting the true
financial condition of the construction companies. In May 2011, the James’ construction
companies filed for bankruptcy, resulting in a loss of over $3 million to Blue Valley Bank. On
November 14, 2022, K. Kevin James was sentenced to 12 months imprisonment and two
years of supervised release, and ordered to make $6,159,892 in restitution. The case was
prosecuted by the U.S. Attorney’s Office for the District of Kansas.

Illinois Real Estate Developer Sentenced for Scheme to Defraud TARP Bank
On December 28, 2022, See Wong, the owner of a real estate development company in
Illinois was sentenced to sixteen months in prison and two years of supervised release for
wire fraud for defrauding a bank while it was in TARP. He was also ordered to pay
$1,659,457 in restitution. To receive construction loans to build condominiums in Chicago,
the banking contracts required the defendant to put buyer deposits into an escrow account
at the bank. Instead, he diverted deposits to fund his portion of construction costs and a
personal loan to a friend. Victim purchasers lost approximately $1 million, and the bank lost
approximately $1.8 million. SIGTARP was joined in the investigation by the FBI. The U.S.
Attorney’s Office for the Northern District of Illinois prosecuted the case.

Two Defendants Convicted in Operation Phantom Bank
SIGTARP’s investigation of TARP recipient Saigon National Bank resulted in the guilty pleas of
two additional defendants. On December 2, 2022, Jack Nguyen, pled guilty to money laundering
charges and is scheduled to be sentenced on April 24, 2023. On January 20, 2023, co-defendant
Lien Tran also pled guilty to money laundering charges and is scheduled for sentencing in July
2023.

65
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Special Inspector General for the Troubled Asset Relief Program

“Operation Phantom Bank” was a long-term money laundering investigation conducted by
SIGTARP and its law enforcement partners, the FBI and Internal Revenue Service-Criminal
Investigation. This case resulted in six indictments that charged a total of 25 defendants.
Convictions to date include a former shareholder of Saigon Bank, an East West Bank Vice
President, a high-level Mexican money launderer, the former president of the Chinese
Consolidated Benevolent Association, and several domestic money launderers with ties to
Armenian Power and Chinese Triads organized crime groups. One additional defendant is
pending trial on money laundering charges and two additional defendants are currently
fugitives, one located in Hong Kong and the other in Lichtenstein. This case is being
prosecuted by the U.S. Attorney’s Office in the Central District of California.

New Jersey Defendant Sentenced for Role in Scheme to Defraud Bank and Bank
Regulators
On January 31, 2023, Gary Ketchum, who conspired with the former CEO of First State
Bank to defraud the bank and its regulator, the FDIC, was sentenced to three years of
probation and ordered to forfeit $175,000. Ketchum participated in a scheme in which
material misrepresentations were made to obtain millions of dollars in loans from First State
Bank, which were fraudulently made into a capital infusion by other co-conspirators to
deceive the FDIC on the financial strength of the bank. First State Bank previously applied
for TARP funding to bolster their financial position, but later withdrew their application. This
case was prosecuted by the U.S. Attorney’s Office in New Jersey.

Co-Conspirator Sentenced for Participating in a Bribery Scheme with Former
Bank CEO In Connection with Loans Guaranteed by the Small Business Administration
On February 2, 2023, James Kim was sentenced to one year of supervised release and
ordered to forfeit $3,670,000 for his role in a bribery scheme with the former CEO of Noah
Bank in connection with hundreds of thousands of dollars in loans guaranteed by the Small
Business Administration (SBA), and with causing the Bank to issue millions of dollars of SBA-
guaranteed and commercial loans to companies in which the former CEO had a secret
financial interest.
These charges were brought about by a joint investigation with SIGTARP, the Federal
Deposit Insurance Corporation – Office of Inspector General (FDIC-OIG), Homeland
Security Investigations (HSI), and the SBA Office of Inspector General (SBA-OIG). This case
was prosecuted by the United States Attorney’s Office for the Southern District of New
York.

66
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General Department of Treasury

Office of Inspector General
Department of the Treasury
The Department of the Treasury (Treasury) Office of Inspector General (OIG) performs independent,
objective reviews of specific Treasury programs and operations with oversight responsibility for one
federal banking agency – the Office of the Comptroller of the Currency (OCC). That federal banking
agency supervises approximately 1,100 financial institutions.
Introduction
Treasury OIG was established pursuant to the 1988 amendments to the Inspector General Act of
1978. The Treasury Inspector General is appointed by the President, with the advice and consent
of the Senate. Treasury OIG performs independent, objective reviews of Treasury programs and
operations, except for those of the Internal Revenue Service (IRS), the Troubled Asset Relief
Program (TARP), and those programs and activities under the jurisdictional oversight of the
Special Inspector General for Pandemic Recovery (SIGPR). Treasury OIG also keeps the
Secretary of the Treasury and Congress fully informed of problems, deficiencies, and the need for
corrective action. Treasury OIG is comprised of four components: (1) Office of Audit, (2) Office
of Investigations, (3) Office of Counsel, and (4) Office of Management. Treasury OIG is
headquartered in Washington, DC.
Treasury OIG has oversight responsibility for OCC, which supervises approximately 778 national
banks, 257 federal savings associations, and 49 federal branches and agencies of foreign banks. The
total assets under OCC’s supervision are $15.9 trillion. Treasury OIG also oversees four offices
created by the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank)
which are (1) the Office of Financial Research, (2) the Federal Insurance Office, (3) the Office of
Minority and Women Inclusion within Treasury’s Departmental Offices, and (4) the Office of
Minority and Women Inclusion within OCC.

67
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General Department of Treasury

Treasury OIG is also responsible for audit and investigative oversight of Treasury programs
providing financial assistance to address the economic impacts of Coronavirus Disease 2019
(COVID-19). Since March 2020, more than $645 billion of financial assistance, overseen by
Treasury OIG, has been authorized by the Coronavirus Aid, Relief, and Economic Security Act (CARES
Act)19
19 Public Law 116-136 (March 27, 2020).
 enacted on March 27, 2020; the Consolidated Appropriations Act, 202120
20 Public Law 116-260 (December 27, 2020).
 enacted on
December 27, 2020, and the American Rescue Plan Act21
21 Public Law 117-2 (March 11, 2021).
enacted on March 11, 2021. Through
these pieces of legislation, Treasury provides financial assistance to the transportation industry for
the continuation of salaries and benefits; to all 50 States, units of local government, U.S.
territories, and tribal governments to provide economic relief including rental and mortgage
assistance and support for small businesses; and to community development financial institutions
to inject emergency capital investment into low-income communities to address the ongoing
pandemic. Treasury established the Office of Recovery Programs to administer the pandemic
relief funds. The enormity of these programs requires continued coordination between the Office
of Audit, the Office of Investigations, and the Office of Counsel to handle complaints concerning
thousands of recipients and sub-recipients that received financial relief.

Treasury Management and Performance Challenges Related to Financial
Regulation and Economic Recovery

In accordance with the Reports Consolidation Act of 2000, the Treasury Inspector General
annually provides the Secretary of the Treasury with his perspective on the most serious
management and performance challenges facing the Department. In a memorandum to the
Secretary dated October 14, 2022, the Deputy Inspector General reported four management
and performance challenges that were directed towards financial regulation and economic
recovery. Those challenges are discussed below and include: COVID-19 Pandemic Relief; Cyber
Threats; Anti-Money Laundering and Terrorist Financing/Bank Secrecy Act Enforcement; and
Climate Initiatives Risk.22
22 The Treasury Inspector General’s memorandum included one other challenge not directly related to financial
regulation and economic recovery: Information Technology Acquisition and Project Management.
 The memorandum also reported a concern about regulating digital
assets.

Challenge 1: COVID-19 Pandemic Relief
The COVID-19 pandemic continues to affect the health and economic stability of
communities worldwide. In the early stages of the COVID-19 outbreak, Congress passed
legislation in succession to address the public health crisis and the economic fallout affecting
individuals, businesses, and many industry sectors. The Coronavirus Preparedness and Response
Supplemental Appropriation Act of 2020, signed into law on March 6, 2020, authorized
$8.3 billion in emergency funding to address health and medical care. 23
23 Public Law 116-123 (March 6, 2020).
 Shortly thereafter, the
Families First Coronavirus Response Act was enacted on March 18, 2020, which provided

68
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General Department of Treasury

approximately $104 billion to address the financial stress of individuals and households.24
24 Public Law 116-127 (March 18, 2020).
 The
Coronavirus Aid, Relief, and Economic Security Act (CARES Act) passed on March 27, 2020, and
provided over $2.4 trillion in health and economic relief to hospitals and healthcare providers,
individuals and households, businesses and employees, as well as, states, local and tribal
governments, and federal agencies, among others. As the public health crisis continued into
late 2020 and 2021, Congress legislated additional relief in passing the Consolidated
Appropriations Act, 2021 (CAA, 2021) on December 27, 2020, and the American Rescue Plan Act
of 2021 (ARP) on March 11, 2021. These laws provided another $900 billion and $1.9 trillion
of economic stimulus, respectively.

Treasury has been instrumental to the implementation of economic relief provisions of the
CARES Act, CAA, 2021, and ARP. As a result, Treasury’s responsibilities and workloads
expanded enormously. Treasury is tasked with disbursing over $655 billion25
25 Amount excludes Economic Impact Payments distributed by the Internal Revenue Service and support to small
businesses under the Paycheck Protection Program administered by the Small Business Administration.
 in aid to more
than 35,000 recipients, including state, local, territorial, and tribal government entities, in a
relatively short period of time and with limited staffing. The Department is challenged with (1)
filling and transitioning key leadership positions for pandemic programs not fully established,
(2) quickly establishing internal controls, guidance, and methodologies for monitoring,
reporting, and oversight of funds disbursed, (3) data collection, quality, and reliability, and (4)
lack of funding to sustain operations. In addition, Treasury must carry the administrative and
monitoring responsibilities in its new role resolving Single Audit findings and potentially
serving as cognizant agency for a significant number of entities 26
26 Single Audit Act of 1984 (P.L 98-502; October 19, 1984), as amended by the Single Audit Act Amendments of
1996 (P.L 104-156; July 5, 1996).
 under the Office of
Management and Budget’s (OMB) Uniform Administrative Requirements, Cost Principles, and Audit
Requirements for Federal Awards.27
27 https://www.ecfr.gov/current/title-2/part-200

Many of the pandemic recovery programs and provisions of the CARES Act, CAA, 2021, and
ARP are within the oversight purview of Treasury OIG and include programs that support
transportation industry workers; renters and homeowners; and state, local, territorial, and
tribal government entities through direct financial assistance. The pandemic programs
Treasury is responsible for, and their challenges are discussed below.

Financial Assistance Programs - Air Carrier Worker Support and Other Transportation
Services

Payroll Support Programs

To maintain pay and benefits of airline industry workers, Treasury implemented the Air Carrier
Worker Support Program provisions of the CARES Act that authorized up to $63 billion of
direct financial assistance for passenger air carriers, cargo air carriers, and contractors. Using
existing resources and contractor support, Treasury quickly stood up the Payroll Support

69
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General Department of Treasury

Program (PSP1). This financial support for air carrier workers was extended twice by CAA,
2021 and ARP which provided additional assistance to passenger air carriers and contractors for
up to $16 billion and $15 billion, respectively. Using the mechanisms that established PSP1,
Treasury implemented the Payroll Support Program Extension (PSP2) and the Payroll Support
Program 3 (PSP3) to make corresponding payments.
Treasury OIG will continue to audit PSP1 recipients’ certifications and plans to initiate audits
of certifications submitted by PSP2 recipients. Treasury OIG is not mandated to audit the
applicants’ certifications to receive PSP3 payments authorized under ARP. However, Treasury
disbursed financial assistance to passenger air carriers and contractors based on information
submitted by recipients on their PSP2 certifications, which we will audit. That said, Treasury
OIG plans to assess Treasury’s calculation of award amounts under PSP3 and Treasury’s post-
award monitoring of recipients under PSP1, PSP2, and PSP3. It is incumbent upon Treasury to
implement and maintain strong internal controls over recipients’ compliance with signed
terms and conditions for receiving financial assistance. That is, Treasury’s compliance
monitoring function is essential to ensuring that recipients use funds for the continuation of
salaries and benefits as intended.
Coronavirus Economic Relief for Transportation Services
Congress expanded financial support to non-air carrier transportation service providers
under the Coronavirus Economic Relief for Transportation Services (CERTS) provisions of
CAA, 2021. Treasury established the CERTS Program that provides $2 billion in non-
competitive grants to eligible companies that certify revenue loss of 25 percent or more due
to the COVID-19 pandemic. In consultation with the Department of Transportation,
Treasury provided initial guidelines on May 6, 2021, that included among other things that the
priority use of funds must be for payroll, although operating expenses and debt accrued to
maintain payroll are eligible uses. It is incumbent upon Treasury to establish and maintain
strong internal controls over recipients’ compliance with grant agreements. Although there is
no mandate directing Treasury OIG to audit CERT recipients, we plan to audit Treasury’s
administration of the program.

Financial Assistance Programs - State, Local, U.S. Territorial, and Tribal Governments
Coronavirus Relief Fund

The $150 billion Coronavirus Relief Fund (CRF), established under Title VI of the Social Security Act, as
amended by Title V of the CARES Act, continues to be a large endeavor for both Treasury and our office.
Treasury disbursed the entire $150 billion in direct payments to states, units of local government, the
District of Columbia, U.S. territories, and tribal governments. Disbursement of funds was a complicated
undertaking given the number of recipients at varying levels of government and other payment
requirements of the CARES Act. The CARES Act created a unique challenge in distinguishing between the
programmatic administrative responsibility for payments made from the CRF and the Treasury OIG’s

70
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General Department of Treasury

independent oversight. Although Treasury is authorized to make payments, the CARES Act assigned
Treasury OIG with responsibility for monitoring and oversight of the receipt, disbursement, and use of
funds. Additionally, Treasury OIG has authority to recoup funds if it is determined that recipients fail to
comply with uses of funds for COVID-19 related costs under Section 601 (d), “Uses of Funds,” of the
Social Security Act, as amended.28

28 Section 601 (d), Use of Funds, to cover only those costs of the state, tribal government, or unit of local
government that (1) are necessary expenditures incurred due to the public health emergency with respect to
COVID–19; (2) were not accounted for in the budget most recently approved as of the date of enactment of
this section for the State or government; and (3) were incurred during the period that begins on March 1, 2020,
and ends on December 31, 2021, as extended by the CAA, 2021.
Treasury also has a fundamental role to clarify its policy29
29 Coronavirus Relief Fund Guidance for State, Territorial, Local, and Tribal Governments Federal Register, Vol. 86, No. 10;
January 15, 2021.
 over the uses of funds when interpretation
matters arise. As recipients are still in the process of reporting on and closing out their awards, we
anticipate that questions will continue to arise that will require interpretation. Providing as much clarity as
possible is essential for ensuring recipients understand the compliance requirements and are accountable
and transparent in how they report uses of funds. Treasury OIG has received over 500 complaints
regarding recipient, and in some instances sub-recipient, uses of CRF proceeds that require continued
collaboration between the Department and our office.

Coronavirus State and Local Fiscal Recovery Funds

The Coronavirus State and Local Fiscal Recovery Funds provisions of ARP provide state, local, U.S.
territorial, and tribal governments another $350 billion under the Coronavirus State Fiscal Recovery Fund
and the Coronavirus Local Fiscal Recovery Fund (together referred to as SLFRF); $10 billion under the
Coronavirus Capital Projects Fund (CPF); and $2 billion under the Local Assistance and Tribal
Consistency Fund (LATCF).

SLFRF

Administering SLFRF poses challenges given the volume of recipients that Treasury must
oversee that include all 50 states, U.S. territories, tribal governments, and local government
recipients with population sizes of 250,000 or more, and approximately 26,000 Non-
Entitlement Units (NEU). States and U.S. territories were required to establish a process for
NEUs to provide pre-pandemic budget and other critical information and documentation
before distributing funds. In addition to the volume of NEUs for Treasury to oversee,
reconciliation between states’ and U.S. territories’ disbursements to NEUs and recipient
performance reporting may be challenging. That is, performance reporting for NEU funding is
the responsibility of the NEUs and not the states and U.S. territories where accountability for
the disbursement of funds resides. Furthermore, due to increased pandemic funding many
NEUs are now required to have a Single Audit or alternate compliance examination
engagement over which Treasury may have agency cognizance as detailed below related to
challenges with Treasury’s ongoing compliance monitoring of SLFRF recipients and related
administrative issues.

71
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General Department of Treasury

While Treasury has built a portal for recipient communication and reporting, there are still
challenges obtaining sufficient quality data from SLFRF recipients. Treasury allows for lengthy
narrative responses as part of the data collection that may be more cumbersome to review
and lack critical data details. Confirming data quality and timely providing data to the public
and oversight community has been challenging for Treasury. To effectively administer and
monitor SLFRF recipients’ compliance, Treasury must have access to sufficient data that
accurately reflects how recipients have expended SLFRF awards. As Treasury continues to
receive quarterly and annual reports on SLFRF recipients’ uses of funds, it is critical that
Treasury continues to refine mechanisms to ensure the data is complete, accurate, reliable,
and transparent in reflecting how recipients have expended SLFRF awards.

Treasury management has expressed difficulty finding the staff needed to administer and
monitor the SLFRF program. The Office of Recovery Programs had a number of key
leadership positions that were either vacant or temporarily staffed throughout fiscal year
2022.

CPF

As of September 2022, Treasury awarded $1.4 billion to 13 states30
30 Treasury announced awards for Louisiana, New Hampshire, Virginia, West Virginia, Kansas, Maine, Maryland,
Minnesota, Arkansas, Connecticut, Indiana, Nebraska, and North Dakota.
 from the $10 billion of
CPF available to address infrastructure challenges, such as reliable internet, that low to
moderate income and rural communities have experienced during the COVID-19 pandemic.
Although Treasury issued recipient reporting guidance for states, U.S. territories, and Freely
Associated States in August 2022, Treasury still needs to inform eligible tribal government
recipients of their reporting obligations to provide full accountability and transparency as to
how CPF awards are used. To do this, Treasury needs to begin collecting sufficient and
accurate CPF data.

LATCF

Treasury has been delayed in standing up the LATCF program, which was appropriated
$2 billion for fiscal years 2022 and 2023 to make COVID-19 assistance payments to eligible
revenue sharing counties and Tribes. Treasury issued LATCF guidance, including general
reporting requirements to eligible recipients, and as of September 30, 2022, both tribal
governments and revenue counties are able to apply for funds. Now, Treasury will need to
prepare for the collection of sufficient and accurate LATCF data for monitoring recipients’
compliance with the program.

With the overlap of recipients of CRF, SLFRF, CPF, and LATCF, Treasury OIG expects that there will be
confusion between the uses of funds requirements, and reporting mechanisms that may be a challenge for
recipients going forward. Given the volume of recipients and varying requirements under these programs,
Treasury will need to ensure that there are sufficient resources for the remaining distribution of funds and
ongoing monitoring of recipient reporting and compliance with terms and conditions for funds received.

72
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General Department of Treasury

Furthermore, with the level of funding under both CRF and SLFRF, Treasury may have agency cognizance
over many smaller local governments (particularly NEUs) and tribal governments now required to have a
Single Audit for the first time. To minimize recipient burden, Treasury developed alternate reporting
requirements for smaller SLFRF recipients, which would otherwise be subject to Single Audit. In the
Compliance Supplement for 2022, Treasury provides the option of an alternate compliance examination
engagement for SLFRF recipients meeting certain eligibility requirements. Treasury has been working with
OMB and the audit community to find a solution for receiving these reports as the Federal Audit
Clearinghouse (FAC) was not designed to collect non-audit products. Treasury plans to collect these
reports directly for fiscal year 2021 compliance examinations and is continuing to work with the FAC to
receive these reports for fiscal year 2022. While the alternative compliance examination engagement
addresses the burden to these smaller government entities and auditors, Single Audit and alternative
compliance examination procedures may be new to thousands of SLFRF recipients, so there will be much
more guidance and oversight required of Treasury in its cognizance role and related to the Compliance
Supplement. Treasury must be prepared to use results of Single Audits and alternate compliance
examinations as part of its compliance monitoring of recipients and will need the appropriate level of
staffing to address these issues on such a large scale. As discussed in more detail under the accountability
and transparency section below, Treasury is evaluating whether it will have cognizance over thousands of
non-federal recipients of SLFRF and any impacts it faces to carry out its ongoing administration and
monitoring of SLFRF recipients.

Emergency Rental Assistance and Homeowner Assistance Programs

To provide assistance to vulnerable households at risk of housing instability, Congress established two
Emergency Rental Assistance (ERA) Programs and a Homeowner’s Assistance Fund (HAF) availing over
$56 billion to households in need. Division N, Title V, Subtitle A, of CAA, 2021, created the initial ERA
Program (ERA1) and ARP created a supplemental ERA Program (ERA2) and HAF.

ERA1

Treasury established ERA1 and has disbursed most of the $25 billion appropriated by CAA,
2021. The monies have been disbursed to states (including Washington, DC), U.S. territories,
tribal governments (with a provision for the Department of Hawaiian Home Lands), and units
of local government with populations of 200,000 or greater to pay for rent, utilities, and other
housing-related expenses and arrears. In addition to disbursing the funds, Treasury provided
guidance on ERA1 fund usage and set up a Portal where government recipients are to report
on their spending.

73
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General Department of Treasury

CAA, 2021 requires that Treasury OIG conduct monitoring and oversight of the receipt,
disbursement, and use of ERA1 funds. Treasury OIG will conduct oversight with audits of
Treasury’s (1) establishment and implementation of the program, (2) payments of funds, and
(3) guidance and management over the program and will use the data reported in Treasury’s
ERA Portal to inform our monitoring function; thus, it is imperative that Treasury ensures
recipients’ compliance to Treasury ERA guidance when reporting to Treasury’s ERA Portal.
Treasury OIG is also authorized to require repayment of funds to Treasury when we
determine a recipient failed to comply with ERA1 requirements.

ERA2

For ERA2, Treasury has disbursed most of the $21.55 billion appropriated in ARP. Similar to
ERA1, ERA2 provides funding for eligible renter households’ rent, utilities, and other housing-
related expenses and arrears, but does not include tribal governments as eligible grantees.
ERA2 funds are to remain available until September 30, 2027. Treasury has also provided ERA2
guidance for the state, territory, and local, government recipients. Treasury OIG is tasked with
oversight of the program and will conduct ERA2 oversight with a similar methodology to ERA1
oversight.

HAF

ARP also created HAF to prevent mortgage delinquencies, defaults, foreclosures, loss of utility
services, and displacement by covering mortgage-related expenses, utility expenses, and
arrears for homeowners experiencing financial hardship after January 21, 2020. Treasury has
disbursed most of the $9.9 billion authorized to states (including the District of Columbia and
Puerto Rico), tribal governments (including the Department of Hawaiian Home Lands), Guam,
American Samoa, the U.S. Virgin Islands, and the Commonwealth of the Northern Mariana
Islands. The funds are available until September 30, 2025, and Treasury provided guidance on
HAF. ARP mandates that Treasury OIG provide oversight of the funds, which will include
audits of Treasury’s (1) establishment and implementation of the fund, (2) payments of funds,
and (3) guidance and management over the program.

While Treasury has issued relevant guidance for each of the programs, it is essential its program offices
continue to be responsive to recipients to clarify guidance and to provide insight into the eligible uses of
the funds Treasury distributed. Clear and timely guidance and responsiveness to recipient questions are
also critical in enabling program recipients to administer their programs and disburse funds to households
in need without delay.

State Small Business Credit Initiative

The State Small Business Credit Initiative (SSBCI), which was originally created in the Small Business Jobs
Act of 2010 to increase availability of credit for small businesses, ended in 2017. However, Section 3301 of
ARP reauthorized SSBCI and provided $10 billion in funding for the program. Under SSBCI, participating
states, U.S. territories, and tribal governments may obtain funding for programs that partner with private
lenders to extend credit to small businesses.

74
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General Department of Treasury

Additionally, ARP modified SSBCI in a number of ways including the following set-asides: (1) $500 million
in allocations to tribal governments in proportions determined appropriate by the Secretary of the
Treasury; (2) $1.5 billion in allocation to states, U.S. territories, and tribal governments for business
enterprises owned and controlled by socially and economically-disadvantaged individuals (SEDI); (3) $1
billion to be allocated as an incentive for states, U.S. territories, and tribal governments that demonstrate
robust support for SEDI businesses; (4) $500 million to be allocated to very small businesses with fewer
than 10 employees; and (5) $500 million to provide technical assistance to certain businesses applying for
SSBCI or other state or federal programs that support small businesses.

Primary oversight of the use of SSBCI funds is the responsibility of the participating state, U.S. territory or
tribal government. The participants are responsible for providing Treasury with quarterly assurances that
their programs approved for SSBCI funding comply with program requirements. However, Treasury faces
challenges in holding participants accountable for the proper use of funds, as it has not clearly defined the
oversight obligations of the states, U.S. territories, and tribal governments or specified minimum standards
for determining whether participants have fulfilled their oversight responsibilities. In the past, Treasury has
also not required participating states to collect and review compliance assurances made by lenders and
borrowers or defined what constitutes a material adverse change in a state's financial or operational
condition that must be reported to Treasury. As a result, Treasury may have difficulty finding recipients to
be in default of program requirements and holding recipients accountable.

Community Development Investment Programs31
31 Treasury OIG is required to submit to the Committee on Financial Services of the House of Representatives and
the Committee on Banking, Housing, and Urban Affairs of the Senate, and the Secretary of the Treasury, not less
frequently than 2 times per year, a report relating to the oversight provided including any recommendations for
improvements to the Community Development Investment programs.

Emergency Capital Investment Program

As authorized under CAA, 2021, Treasury has invested most of the $9 million available under the
Emergency Capital Investment Program (ECIP) in Community Development Financial Institutions (CDFI)
and Minority Deposit Institutions, providing capital to low-to-moderate income community financial
institutions that support small businesses and consumers. Treasury has experienced challenges in fully
implementing ECIP. As reported in our audit of ECIP’s implementation, Treasury had not completed key
documentation, such as policies and procedures to include a post-investment compliance and monitoring
plan to fully implement and administer investments.32
32 OIG, Audit of Treasury’s Implementation of the Emergency Capital Investment Program (OIG-22-028; March 8, 2022)
 With investments now underway, it is more
imperative that Treasury develop and implement policies and procedures to govern its post–investment
activities. Because of the demands for resources within the Office of Recovery Programs, Treasury may
continue to experience further delays and challenges administering the ECIP.

CDFI Rapid Response Program

Treasury has disbursed nearly half of the $3 billion, authorized under the CAA, 2021, under the CDFI
Fund Rapid Response Program (CDFI RRP), to deliver immediate assistance to low-income communities

75
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General Department of Treasury

through competitive grants to CDFIs. However, as reported in our audit of the CDFI RRP
implementation,33
33 OIG, Audit of the Community Development Financial Institutions Fund’s Implementation of the CDFI Rapid Response
Program (OIG-22-023; December 21, 2021).
 the CDFI Fund did not include the award term and condition for integrity and
performance matters in its assistance agreement template. Treasury OIG will confirm that CDFI Fund
included the required language in the executed assistance agreements with CDFI RRP grant recipients as
part of our ongoing mandated audits of the CDFI RRP.

CDFI Equitable Recovery Program

Awards granted under CDFI Fund Equitable Recovery Program (CDFI ERP) are intended for low- or
moderate-income minority communities that have significant unmet capital or financial service needs, and
were disproportionately impacted by the COVID-19 pandemic. This program is challenging for the CDFI
Fund to administer because of unique and complex program materials for the application process and
award administration needed to address program policy priorities in order to meet the statutory intent. In
addition, CDFI Fund plans to implement designation of minority lending institutions as defined under the
CAA, 2021 separately from the award of ERP funds.

Accountability and Transparency

In the context of this overarching challenge, Treasury OIG recognizes the breadth and scope of Treasury’s
responsibilities as it impacts programs, operations, and activities regardless of jurisdictional oversight
boundaries. Along with administering and delivering economic relief, Treasury must manage the
unprecedented oversight that pandemic relief funding is subject to. As noted above, Treasury is evaluating
whether it will have cognizance over thousands of non-federal recipients of SLFRF and be required to
carry out a larger administrative and monitoring role to ensure compliance under OMB’s Uniform
Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Among its
responsibilities as a Federal awarding agency, Treasury must follow-up on audit findings to ensure that
recipients take appropriate and timely corrective action and issue management decision letters.34
34 2 CFR § 200.521, “The management decision must clearly state whether or not the audit finding is sustained, the
reasons for the decision, and the expected auditee action to repay disallowed costs, make financial adjustments,
or take other action. If the auditee has not completed corrective action, a timetable for follow-up should be
given...” (https://www.ecfr.gov/current/title-2/subtitle-A/chapter-II/part-200/subpart-F/subject-group-
ECFR4424206eaecf751/section-200.521)
 Many
recipients are smaller governments, which for the first time are subject to Single Audit or the alternative
compliance examination available to eligible recipients meeting eligibility requirements. Regardless of
cognizance, Treasury will have to work with recipients to resolve Single Audit and alternative compliance
examination findings specific to each of its pandemic relief programs.

In addition to Treasury OIG’s ongoing work on pandemic programs, Treasury is subject to additional
Congressional oversight bodies, the Special Inspector General for Pandemic Recovery35
35 SIGPR was authorized under the CARES Act to oversee loans, loan guarantees, and other investments provided
by Treasury and must report to congress quarterly on the SIGPR’s activities and Treasury’s loan programs.
SIGPR terminates five years after enactment of the CARES Act (March 27, 2025).
 (SIGPR), the
Government Accountability Office (GAO), and the Pandemic Response Accountability Committee

76
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General Department of Treasury

(PRAC). Treasury is also accountable for providing transparency over the expenditure of pandemic relief
funds. Many reporting requirements of sections 15010 and 15011 of the CARES Act were extended
under the CAA, 2021, PRAC amendments. Most notably, Treasury is responsible for reporting obligations
and expenditures of large covered funds (over $150,000) to the PRAC. While Treasury OIG continues to
collect and report CRF data to the PRAC under an agreement with the Department, Treasury is
responsible for reporting expenditures of its other pandemic relief programs. As noted above, data
collection and quality are still challenges for Treasury under the various pandemic programs. The
Department must balance its ongoing response to the financial impacts of the public health emergency
with its responsibility to stakeholders for reporting and transparency.

Challenge 2: Cyber Threats

Cybersecurity remains a long-standing and serious challenge facing the Nation as reported by GAO as a
government-wide issue in its 2021 high-risk list published biennially.36
36 GAO, High-Risk Series, Dedicated Leadership Needed to Address Limited Progress in Most High-Risk Areas (GAO-21-
119SP: March 2021).
 A reliable critical infrastructure,
including information systems and networks, is vital to our national security and economic stability. Cyber
threats remain a persistent concern as Treasury’s information systems are critical to the core functions of
government and the Nation’s financial infrastructure, along with the financial sector it oversees. As cyber
threats continue to evolve and become more sophisticated, subtle, and easier to perform, Treasury must
fortify and safeguard its internal systems and operations while modernizing and maintaining them. Although
managing known risks is an ongoing challenge, Treasury must also be ready to reinforce and/or redirect
cybersecurity efforts when unforeseen events occur, such as the COVID-19 pandemic, the recent conflict
in the Ukraine, 37
37 A joint Cybersecurity Advisory was issued by the Cybersecurity and Infrastructure Security Agency to “warn
organizations that Russia’s invasion of Ukraine could expose organizations both within and beyond the region to
increased malicious cyber activity. This activity may occur as a response to the unprecedented economic costs
imposed on Russia as well as materiel support provided by the United States and U.S. allies and partners.” (Alert
(AA22-110A) Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure; April 20, 2022)
 the 2020 SolarWinds attack,38
38 The SolarWinds attack, reported in December 2020, was a supply chain attack that used the update mechanism
for legitimate software to distribute malicious software.
 or when serious flaws are discovered in software or
systems that allow for remote administrative-level access.39

39 Cybersecurity and Infrastructure Security Agency, Emergency Directive 22-02 Mitigate Apache Log4J Vulnerability
(April 8, 2022), Emergency Directive 22-03 Mitigate VMWare Vulnerabilities (May 18, 2022).
Threat actors frequently exploit vulnerable networks or systems in a string of trusted connections to gain
access to government systems. Organized hacking groups leverage published and unpublished
vulnerabilities and vary their methods to make attacks hard to detect and even harder to prevent.
Criminal groups and nation-states are constantly seeking to steal information; commit fraud; disrupt,
degrade, or deny access to information systems; or infiltrate information systems and maintain a presence
to enable future actions. Through information sharing, federal agencies are better prepared to thwart
potential attacks to the cyber infrastructure of the Federal government and the financial sector.

77
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General Department of Treasury

The tools used to perpetrate cyber-attacks continue to become easier to use and more widespread,
lowering the technological knowledge and resources needed to launch successful attacks of increasing
sophistication. Such attacks include distributed denial of service, phishing, fraudulent wire payments,
business email compromise, malicious spam (malspam), ransomware, and compromise of supply chains
(both hardware and software). While the federal workforce shifts from a primarily telework status to a
hybrid work environment, Treasury must remain cognizant of the increased risk profile of a remote
workforce, which provides threat actors with a broader attack surface. Increased network traffic from
remote sources provides cover for attackers to blend in with the federal workforce and launch cyber
assaults. These opportunities may allow threat actors to launch a denial of service attack upon a network
that can prevent remote workers from performing their duties and disrupt operations.

There is continuing concern over foreign adversaries creating and exploiting vulnerabilities in the Nation’s
supply chain for information and communication technology and services as evidenced by the 2020
SolarWinds attack that affected many federal agencies and private sector companies. Executive Order
(EO) 13873, Securing the Information and Communications Technology and Services Supply Chain, was issued on
May 15, 2019, to secure the supply technology and services chain by banning the import, use, or sale of
technology or services designed, developed, manufactured, or supplied from persons or companies that
are owned or controlled by governments defined as hostile to the United States.40
40 EO 13873, Securing the Information and Communications Technology and Services Supply Chain
 (May 15, 2019).
 On May 12, 2022, this
EO was extended again for 1 year.41
41 Notice on the Continuation of the National Emergency with Respect to Securing the Information and Communications
Technology and Services Supply Chain (May 12, 2022).
 There are risks that Treasury’s systems and resources already in use,
including critical infrastructure, contain components from sources that have yet to be designated as
threats. Once a source is designated as such, repairs and/or upgrades of key system components may no
longer be available. Therefore, there is risk of disruption of critical operations. Treasury will need to
continue to monitor developments in this area closely and plan for the possibility that its current supply
chain may no longer be available.

Treasury is looked upon to provide effective leadership to financial institutions in particular, and the
financial sector in general, to strengthen awareness and preparedness against cyber threats to the Nation’s
critical infrastructure. As such, effective public-private coordination is essential to the Nation’s financial and
national security. In this regard, the Office of Cybersecurity and Critical Infrastructure Protection
coordinates Treasury’s efforts to enhance the security and resilience of the financial services sector critical
infrastructure and reduce operational risk including risks associated with cybersecurity. Given the stress
that the global COVID-19 pandemic and the conflict in Ukraine place on financial institutions and the
financial sector, it is important that Treasury monitors cyber risks in these areas. That said, Treasury and
other federal agencies have yet to fully implement the National Institute of Standards and Technology
(NIST) guidance to assist federal agencies in managing cybersecurity risks.42
42 NIST, Framework for Improving Critical Infrastructure Cybersecurity (Version 1.0, February 12, 2014; superseded by
Version 1.1; April 16, 2018).
 In 2018, GAO had reported
that the extent of adoption of the NIST framework by critical infrastructure sectors was unknown since

78
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General Department of Treasury

agencies were not measuring framework implementation.43
43 GAO, Critical Infrastructure Protection: Additional Actions Are Essential for Assessing Cybersecurity Framework Adoption
(GAO-18-211; February 18, 2018)
 With respect to Treasury, GAO had
recommended that steps be taken to consult with respective sector partners to develop methods for
determining the level and type of adoption by entities across the financial services sector. In its May 10,
2022, letter44
44 GAO, Priority Open Recommendations: Department of the Treasury (GAO-22-105633; May 10, 2022)
 regarding its top open recommendations, GAO acknowledged that Treasury had developed
a cybersecurity profile for the sector that maps the NIST Cybersecurity Framework's (CSF) five core
functions45
45 The NIST Cybersecurity Framework functions include: Identify, Protect, Detect, Respond and Recover.
 to existing regulations and guidance for financial services entities but had not developed
methods to determine the level and type of framework adoption; the recommendation remained open.

The Department continues to report progress in managing risk as Treasury obtained an overall rating of
“Managing Risk” across all NIST CSF categories (Identify, Protect, Detect, Respond and Recover) on the
OMB Cybersecurity Risk Management Assessment for the first time in fiscal year 2021. Treasury also
reported the creation of enhanced risk profiles to allow senior leadership greater visibility into the risks
for all Departmental High Value Assets.46
46 High Value Assets are assets, information systems, information, and data for which an unauthorized access, use,
disclosure, disruption, modification, or destruction could cause a significant impact to the U S.’ national security
interests, foreign relations, economy, or to the public confidence, civil liberties, or public health and safety.
 While addressing increases in cyber threats, Treasury will need
to continue to balance cybersecurity demands while maintaining and modernizing Information Technology
(IT) systems.

Challenge 3: Anti-Money Laundering and Terrorist Financing/Bank Secrecy Act
Enforcement

Over the past year, the Office of Terrorism and Financial Intelligence (TFI) has remained dedicated to
countering the ability of financial networks that support terrorists, organized transnational crime, weapons
of mass destruction proliferators, and other threats to international security through intelligence analysis,
sanctions, and international private-sector cooperation. As previously reported, identifying, disrupting, and
dismantling these networks continue to be challenging as TFI’s economic authorities are key tools to carry
out U.S. policy. Additionally, criminals and other bad actors evolve and continue to develop more
sophisticated money laundering methods in an attempt to avoid detection.

TFI’s authorities are key tools in implementing U.S. policy to pressure foreign countries and regimes, such
as Russia, by using designations and economic sanctions. TFI has significantly increased sanctions against
Russia related to its actions against Ukraine and other malign activities. TFI’s counter-terrorism
designations disrupt the financial networks that support terrorist organizations. Disrupting terrorist
financing depends on a whole-of-government approach and requires collaboration and coordination within
Treasury and with other federal agencies. Collaboration and coordination are key to successfully
identifying and disrupting all of these financial networks and meeting TFI’s mission. This effort requires
effective and efficient working relationships among components within TFI and the Intelligence
Community. In an effort to effectively implement U.S. policy and disrupt these financial networks, officials
stated that TFI is moving towards a more collaborative approach to achieve its mission. Given the
criticality of Treasury’s mission and its role to carry out U.S. policy, we continue to consider anti-money

79
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General Department of Treasury

laundering and combating terrorist financing programs and operations as inherently high-risk.

Data privacy and information sharing are challenges for the Financial Crimes Enforcement Network
(FinCEN), which has experienced unauthorized disclosures of Bank Secrecy Act (BSA) information.
FinCEN is required to maintain a highly secure database for financial institutions to report BSA
information. FinCEN has previously identified that the success of that system depends on the financial
sector’s confidence that those reports are adequately protected, but data breaches threaten to undermine
that confidence. The challenge for FinCEN is to ensure the BSA information remains secure in order to
maintain the confidence of the financial sector, while meeting the access needs of law enforcement,
regulatory, and intelligence partners. FinCEN also faces an additional challenge, to develop and implement
a new secure database for small businesses to report their beneficial ownership information, as required
by the Corporate Transparency Act.47
47 Public Law 116-283 (January 1, 2021).
 However, FinCEN does not expect to implement the database
until January 2024.

Challenge 4: Climate Initiatives Risk

In January 2021, EO 14008, Tackling the Climate Crisis at Home and Abroad, identified the immediate need
for comprehensive action to address the catastrophic impacts of climate change. EO 14008 emphasizes
that U.S. leadership, and that of federal departments and agencies, will be required to significantly enhance
global action and achieve the necessary policy outcomes on climate change. Furthermore, in May 2021,
the White House introduced EO 14030, Climate-Related Financial Risk, which aims to: (a) advance
consistent, clear, intelligible, comparable, and accurate disclosure of climate-related financial risk, including
both physical and transition risks; (b) mitigate that risk and its drivers, while accounting for and addressing
disparate impacts on disadvantaged communities and communities of color and spurring the creation of
well-paying jobs; and (c) achieve the Administration’s target of a net-zero emissions economy by no later
than 2050.

The Secretary of the Treasury, as the Chair of the Financial Stability Oversight Council (FSOC), will lead
several efforts related to EO 14030. Taken together, these two EOs place an emphasis on ensuring
climate change is at the forefront of U.S. foreign policy and national security; establishing a government-
wide approach to the climate crisis; and bolstering the resiliency of our communities, states, tribes,
territories, and financial institutions to position the United States to lead the global economy to a more
prosperous and sustainable future. Treasury will play a significant role working with other federal agencies,
foreign governments, and international financial institutions to stimulate global action on addressing climate
change, environmental justice, and climate change-created economic and financial crises. In 2021, Treasury
created a new Climate Hub and appointed a Climate Counselor to coordinate and lead many of its efforts
to address climate change. The Treasury Climate Hub will coordinate and enhance existing climate-related
activities by utilizing the tools, capabilities, and expertise from across the Department – including officials
from Domestic Finance, Economic Policy, International Affairs, and Tax Policy. With a view of all Treasury
climate initiatives, the Hub will enable Treasury to prioritize climate action.

Treasury is also engaged in the Administration’s domestic efforts through its role as a leading banking
regulator, with the Office of the Comptroller of the Currency (OCC), and its responsibilities within

80
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General Department of Treasury

FSOC. Internationally, Treasury represents the United States at the G7 and G20, at the Financial Stability
Board, and other institutions and forums such as the International Monetary Fund. In October 2021,

FSOC issued its Report on Climate-Related Financial Risk, as mandated by EO 14030. In it, FSOC details the
activities of each member to date to address climate-related financial risk, including Treasury, the Office of
Financial Research, the Federal Insurance Office, and OCC. The report highlights challenges in efforts to
comprehensively understand and address climate-related financial risk. Those challenges include the types
and quality of available data and measurement tools, the ability to assess climate-related financial risks and
vulnerabilities, and how best to incorporate these risks into management practices and supervisory
expectations as appropriate. FSOC concluded the report with thirty-five recommendations. Many, if not
most, apply to Treasury, including the Office of Financial Research, the Federal Insurance Office, and
OCC. It will be important that each recommendation be addressed not only timely, but collectively with
the other FSOC members to ensure a cohesive response.

Furthermore, OCC has implemented multiple initiatives to address climate change and climate-related
financial risk. They have partnered with other Federal banking regulators to work collaboratively in
understanding the risks and development of climate-related risk management. OCC has also engaged with
international groups to share best practices. Internally, OCC established a Climate Risk Implementation
Committee chaired by a Climate Change Risk Officer to assess climate risks and advise management on
OCC policy, banking supervision, and research. These collaborations will continue to be important in
developing a common understanding of climate-related financial risks and their impact to ensure the
continued safety and soundness of the banking system. OCC also continues to work with FSOC and
other member agencies to understand the broader implications of climate-related financial risks and their
potential impact on financial stability.

Other Matter of Concern

Although we are not reporting digital assets as a management and performance challenge, we are
highlighting it as an area of concern.

Treasury supports responsible innovation and seeks to maximize the gains from this new technology while
protecting against possible risks to consumers, financial stability, and illicit finance. In the absence of
sufficient oversight and regulatory safeguards, the increase in use of digital assets could pose risks to
consumers, investors, and the broader financial system.

In March 2022, the President convened experts from across the Administration to ensure a coordinated
and comprehensive approach to digital assets policy and charged Treasury with a leadership role in this
work. EO 14067, Ensuring Responsible Development of Digital Assets, establishes the following policy
objectives with respect to digital assets: (1) protect consumers, investors, and businesses in the United
States; (2) protect the United States and global financial stability and mitigate systemic risk; (3) mitigate the
illicit finance and national security risks posed by misuse of digital assets; (4) reinforce United States
leadership in the global financial system and in technological and economic competitiveness, including
through the responsible development of payment innovations and digital assets; (5) promote access to safe
and affordable financial services; and (6) support technological advances that promote responsible
development and use of digital assets.

81
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General Department of Treasury

In September 2022, Treasury published a report on the future of the U.S. money and payments systems, in
which Treasury encourages continued work on innovations to promote a system that is more
competitive, efficient, and inclusive – and that also helps maintain and build on the United States’ global
financial leadership.48
48 Treasury Report, The Future of Money and Payments: Report Pursuant to Section 4(b) of Executive Order 14067
(September 2022).
 The report recommends advancing policy and technical work on a potential U.S.
central bank digital currency (CBDC), so that the United States is prepared if a CBDC is determined to be
in the national interest. Treasury also published a report on the implications of digital assets for consumers,
investors and businesses, laid out a detailed Action Plan to prevent digital assets from being used for
financial crimes, such as money laundering and terrorism financing, and sent a framework to the President
for international engagement on digital asset issues. In October 2022, FSOC released a report on potential
financial stability risks, and recommended steps to address gaps in the regulation of digital assets in the
United States.49
49 Financial Stability Oversight Council. Report on Digital Asset Financial Stability Risks and Oversight (October 2022).
 Following the publication of these reports, Treasury has a number of responsibilities,
including participating in an interagency working group regarding a potential CBDC and working with
other agencies to prepare resources for consumers. The Office of Domestic Finance, Office of Terrorism
and Financial Intelligence, and Office of International Affairs will be primarily driving this work, in
coordination with other parts of Treasury and the interagency working group, as appropriate.

In-Progress Work on Financial Oversight

OCC’s Supervision of Federal Branches of Foreign Banks (In Progress)

We initiated an audit of OCC’s supervision of federal branches of foreign banks. The objective of this audit
is to assess OCC’s supervision of federal branches and agencies of foreign banking organizations operating
in the United States.

OCC’s Controls over Purchase Cards (In Progress)

We initiated an audit of OCC’s controls over purchase cards. The objective for this audit is to assess the
controls in place over OCC’s purchase card use and identify any potential illegal, improper, or erroneous
transactions.

OCC’s Crisis Readiness (In Progress)

We initiated an audit of OCC’s crisis readiness. The objective for this audit is to assess OCC’s readiness
to address crises that could impact OCC’s operations and the institutions it supervises.

82
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General Department of Treasury

Corrective Action Verification (CAV) Material Loss Review of Washington Federal Bank for
Savings (In Progress)

We initiated an audit to assess whether OCC’s management has taken corrective actions in response to
the six recommendations made in the Department of the Treasury (Treasury) Office of Inspector General
audit report, Material Loss Review of Washington Federal Bank for Savings (OIG-19-009, issued
November 6, 2018).

Office of Financial Research Workforce Reshaping Efforts (In Progress)

We initiated an audit of Treasury’s Office of Financial Research’s implementation of its workforce
reshaping efforts and its compliance with applicable laws, regulations, policies, and procedures.

CDFI Fund’s Implementation of the CDFI Equitable Recovery Program (In Progress)

We initiated an audit to assess the implementation of the CDFI Fund’s CDFI Equitable Recovery Program
including making funds available, and establishing policies, procedures, as well as other program guidance
and documentation.

CDFI Fund’s Award and Post Aware Administration of the CDFI Rapid Response Program (In
Progress)

We initiated an audit to assess the compliance of the CDFI Fund’s award process for ensuring accuracy of
rapid response program (RRP) payments, and the design and implementation of the post-award
administration to include the CDFI RRP recipient monitoring process.

Failed Bank Reviews

In 1991, Congress enacted the Federal Deposit Insurance Corporation Improvement Act amending the
Federal Deposit Insurance Act (FDIA). The amendments require that banking regulators take specified
supervisory actions when they identify unsafe or unsound practices or conditions. Also added was a
requirement that the Inspector General for the primary federal regulator of a failed financial institution
conduct a material loss review when the estimated loss to the Deposit Insurance Fund is “material.” FDIA,
as amended by Dodd-Frank, defines the loss threshold amount to the Deposit Insurance Fund triggering a
material loss review as a loss that exceeds $50 million for 2014 and thereafter (with a provision to
temporarily raise the threshold to $75 million in certain circumstances). The act also requires a review of
all bank failures with losses under these threshold amounts for the purposes of (1) ascertaining the
grounds for appointing Federal Deposit Insurance Corporation (FDIC) as receiver and (2) determining

83
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General Department of Treasury

whether any unusual circumstances exist that might warrant a more in-depth review of the loss. As part of
the material loss review, OIG auditors determine the causes of the failure and assess the supervision of
the institution, including the implementation of the prompt corrective action provisions of the act.50
50 Prompt corrective action is a framework of supervisory actions for insured institutions that are not adequately
capitalized. It was intended to ensure that action is taken when an institution becomes financially troubled in
order to prevent a failure or minimize the resulting losses. These actions become increasingly severe as the
institution falls into lower capital categories. The capital categories are well-capitalized, adequately capitalized,
undercapitalized, significantly undercapitalized, and critically undercapitalized.
 As
appropriate, OIG auditors also make recommendations for preventing any such loss in the future.

From 2007 through March 2023, FDIC and other banking regulators closed 548 banks and federal savings
associations. One hundred and forty-four (144) of these were Treasury-regulated financial institutions; in
total, the estimated loss to FDIC’s Deposit Insurance Fund for these failures was $36.5 billion. Of the 144
failures, 58 resulted in a material loss to the Deposit Insurance Fund, and our office performed the
required reviews of these failures. During the period covered by this annual report, we did not perform a
material loss review or limited review of any bank failures.

OIG Investigative Accomplishments

The Office of Investigations, under the leadership of the Assistant Inspector General for Investigations,
performs investigations and conducts initiatives to detect and prevent fraud, waste, and abuse in programs
and operations within Treasury OIG’s jurisdictional boundaries, and investigates threats against Treasury
personnel and assets in designated circumstances as authorized by the Inspector General Act. The Office
of Investigations also manages the Treasury OIG Hotline to facilitate reporting of allegations involving
these programs and operations.

Significant Investigations

Subject Sentenced in Bank Fraud Investigation

On June 1, 2022, a subject was sentenced to 84 months’ incarceration, 36 months’ probation, and $8.4
million in restitution. The subject provided false documents to a financial institution and fraudulently
obtained millions in loans under false pretenses. The United States Attorney's Office (USAO) for the
Northern District of Oklahoma prosecuted our joint investigation with Internal Revenue Service -
Criminal Investigation, Federal Bureau of Investigation (FBI), and Federal Deposit Insurance Corporation –
Office of Investigations.

84
Annual Report of the Council of Inspectors General on Financial Oversight • July 2023

Office of Inspector General Department of Treasury

Former Bank President Sentenced

On June 28, 2022, the OIG completed its report of investigation for a case that was initiated upon receipt
of information from the FBI regarding a bank president who allegedly embezzled bank funds, and stole
from customer accounts to include a non-profit, and elderly citizens' accounts. Our investigation
determined the bank officer fraudulently paid for personal expenses with others’ bank funds. The subject
pled guilty to Theft by a Bank Officer and was sentenced to 24 months’ probation, a $4,000 fine, and
forfeiture of $16,000. The USAO for the Eastern District of Texas prosecuted the joint Treasury OIG and
FBI case.

Investigation of Bank Fraud and Identity Theft in North Carolina

On October 11, 2022, the final subject in a joint OIG and Fayetteville, North Carolina (NC) Police
Department investigation was sentenced. Eleven subjects conspired to defraud financial institutions by
depositing forged, counterfeit, or stolen checks using stolen identities as part of an elaborate bank fraud
scheme. The subjects were convicted and sentenced to a total of 552 months in prison, 852 months’ of
probation, and $600,000 in restitution. The case was prosecuted by the USAO for the Eastern District of
NC.

The following update is related to significant investigative activities from prior annual reports.

Subject Sentenced for Access Device Fraud Using Stolen Credit Cards

As reported in previous annual reports, our investigation of an organized criminal group using stolen
credit cards issued by Treasury-regulated financial institutions to purchase $400,000 in gift cards from
stores, identified five subjects for prosecution. One subject pled guilty in U.S. District Court, District of
Maryland, to Access Device Fraud for using stolen credit cards to purchase gift cards.

One subject, a former grocery store employee, was sentenced to 24 months of probation, a $100 special
assessment, and ordered to pay $12,000 in restitution. To date, two additional subjects have been
indicted.

Update: On November 1, 2022, the OIG completed its report of investigation for a case involving access
device fraud in a joint Treasury OIG and U.S. Postal Inspection Service investigation. Of the five subjects
identified for prosecution three were sentenced and two were declined for prosecution. The last two
subjects were criminally charged and pled guilty to conspiring to use stolen credit cards in order to
facilitate the purchase of approximately $400,000 in commercial gift cards. The final two subjects
sentenced to a total of 22 months home detention, 72 months of probation, and $364,000 in restitution.
The USAO for the District of Maryland, Greenbelt Division, prosecuted the case.

Office of Inspector General Appendix A
85

Appendix A:
CIGFO Guidance in Preparing for and Managing Crises

Council of Inspectors General
on Financial Oversight
Guidance in Preparing for and
Managing Crises
June
2022
CIGFO-2022-01

REDACTED VERSION
This is a redacted version of a publicly available report. Portions of the report containing sensitive information have been redacted.

This page is intentionally blank

iii
Council of Inspectors General on Financial Oversight • Guidance in Preparing for and Managing Crises
Table of Contents

Table of Contents
Transmittal Letter  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  v
Guidance in Preparing for and Managing Crises   .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  . 1
Collaboration and Pre-Crisis Planning Activities  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  . 6
Agencies’ Crisis Readiness Plan Elements .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  7
Agencies’ Crisis Management .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  9
Conclusion .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .12
APPENDIX I: Abbreviations   .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .13
APPENDIX II: FSOC Response   .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .14
APPENDIX III: Sources Used by the CIGFO Working Group to Develop Guidance .  .  .  .  .  .  .  .  .  .  .  .

16
APPENDIX IV CIGFO Working Group  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  . 20

This page is intentionally blank

v
Council of Inspectors General on Financial Oversight • Guidance in Preparing for and Managing Crises

June 2022
The Honorable Janet Yellen
Chair, Financial Stability Oversight Council
Washington, D .C . 20220
Dear Madam Chairwoman:
I am transmitting to you the Council of Inspectors General on Financial Oversight (CIGFO)
report titled, CIGFO Guidance in Preparing for and Managing Crises
The Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act)
authorizes CIGFO to convene working groups of its members to address issues within its
jurisdiction . Accordingly, CIGFO convened a Working Group in August 2020 to compile
forward-looking guidance for the Financial Stability Oversight Council (FSOC) and its
members to consider in preparing for and managing a crisis . This effort was undertaken at a
critical time in our nation, precipitated by the COVID-19 pandemic .
This guidance is intended to be a compilation of lessons learned drawn from the experiences
of federal agencies during prior crises and any learned during the current pandemic . This
forward-looking guidance will facilitate effective crisis response as FSOC fulfills its mission
to identify threats to the financial stability of the country, promote market discipline, and
respond to emerging threats to the stability of the U .S . financial system .
This guidance does not assess the degree to which the FSOC member agencies employ
any of the actions presented herein . Rather, the purpose of this guidance is to compile
information and activities that agencies and CIGFO Offices of Inspector General identified as
integral to pre-crisis planning and crisis management so that FSOC and its member agencies
can evaluate its existing efforts and initiate new ones, as needed, consistent with each
organization’s mission . We are not making any recommendations to FSOC as a result of this
effort .
I would like to take this opportunity to thank the FSOC members for their support, especially
those Treasury officials who assisted with this effort .
CIGFO looks forward to working with you on this and other issues . In accordance with the
Dodd-Frank Act, CIGFO is also providing this report to Congress .
Sincerely,
/s/
Richard K . Delmar
Acting Chair, CIGFO
Deputy Inspector General, Department of the Treasury

This page is intentionally blank

1
Council of Inspectors General on Financial Oversight • Guidance in Preparing for and Managing Crises
Guidance in Preparing for and Managing Crises

Guidance in Preparing for and
Managing Crises
The Council of Inspectors General on
Financial Oversight (CIGFO) provides
oversight of the Financial Stability Oversight
Council (FSOC) . CIGFO members include
nine Inspectors General (IG) with oversight
authority for the federal member agencies
of FSOC .1 I
1 The nine CIGFO members include the Inspectors General from the Board of Governors of the Federal Reserve System (FRB),
Commodity Futures Trading Commission (CFTC), U .S . Department of Housing and Urban Development (HUD), Department of the
Treasury (Treasury), Federal Deposit Insurance Corporation (FDIC), Federal Housing Finance Agency (FHFA), National Credit Union
Administration (NCUA), Securities and Exchange Commission (SEC), and the Special Inspector General for the Troubled Asset Relief
Program (SIGTARP) .
n August 2020, CIGFO convened
a Working Group to develop guidance for
FSOC and its member agencies to consider
in preparing for and managing future crises .
CIGFO derived this guidance from the
crisis response experiences of both the
contributing CIGFO Office of Inspector
General (OIG) Working Group members
(CIGFO Working Group) and the federal
agencies they oversee .2
2 The Working Group project was performed in accordance with CIGIE’s Quality Standards for Federal Offices of Inspector General
(Silver Book) . These quality standards, as contained in the Agile Products Toolkit https://www .pandemicoversight .gov/media/file/
agile-products-toolkit0pdf), include independence, analysis, evidence review, indexing and referencing, and supervision .
CIGFO OIGs
identified practices and lessons learned by
their respective agencies from prior crises
and the current pandemic .3
3 The CIGFO Working Group collected information from the OIGs for the FRB (including information relating to the Consumer
Financial Protection Bureau (CFPB)), CFTC, Treasury, FDIC, FHFA, NCUA, SEC, and SIGTARP .
The CIGFO
Working Group analyzed these submissions
and summarized the practices and lessons
learned from the financial regulators into this
guidance . In addition, the Working Group
reviewed previous reports issued by the
International Monetary Fund (IMF) and the
U .S . Government Accountability Office (GAO)
regarding crisis preparedness actions and
recommendations for FSOC . The Working
Group also interviewed FSOC officials . This
guidance does not assess the degree to
which the FSOC member agencies employ
any of the actions presented herein . Rather,
the purpose of this guidance is to compile
information and activities that agencies
and OIGs identified as integral to pre-crisis
planning and crisis management so that
FSOC and its member agencies can evaluate
their existing efforts and initiate new ones, as
needed, consistent with each organization’s
mission .
In 2010, in the wake of the 2007-2009 Great
Recession, the Dodd-Frank Wall Street
Reform and Consumer Protection Act (Dodd-
Frank Act) was enacted to “promote the

Council of Inspectors General on Financial Oversight • Guidance in Preparing for and Managing Crises
2

Guidance in Preparing for and Managing Crises
financial stability of the United States .”4
4 Dodd-Frank Wall Street Reform and Consumer Protection Act, Pub . L . No . 111-203, 124 Stat . 1376 (2010) .
 As
a part of this effort, the Dodd-Frank Act
created the FSOC, whose members include
the federal financial regulatory agencies .5
5 FSOC is composed of 15 members: 10 voting members and 5 nonvoting members . Voting members include the chair of FSOC
(Treasury Secretary); heads of FDIC, FRB, OCC, NCUA, SEC, CFTC, FHFA, and CFPB; and an independent insurance expert
appointed by the President . Nonvoting members include the directors of Treasury’s Office of Financial Research (OFR) and Federal
Insurance Office (FIO), and state regulatory representatives, one each for insurance, banking, and securities . 12 U .S .C . § 5321 .
 The
Act conferred upon FSOC the authority to
respond to emerging threats and to identify
risks to the financial stability of the United
States .6
6 Section 112(a)(1) of the Dodd-Frank Act, 124 Stat . at 1394 (codified at 12 U .S .C . § 5322(a)(1)) .
 To meet these responsibilities, the
Dodd-Frank Act assigned FSOC with, among
other duties: (1) collecting information from
member agencies; (2) facilitating information
sharing and coordination among the member
agencies; and (3) recommending to the
member agencies general supervisory
priorities and principles that reflect member
agency discussions .7
7 Section 112(a)(2) of the Dodd-Frank Act, 124 Stat . at 1395 (codified at 12 U .S .C . § 5322(a)(2)) .
During the past two years, FSOC has served
as a forum for federal and state regulators
to collect information, analyze risks, share
information, and coordinate their responses
to the economic shock caused by the
Coronavirus Disease 2019 (COVID-19) .8
8 Treasury Department, Press Release, Financial Stability Oversight Council Releases Annual Report (Dec . 3, 2020) .
However, FSOC’s coordination role is not
limited to responding to emerging threats,
such as COVID-19 . FSOC is also authorized
to identify risks to the United States’
financial stability that could arise outside of
the financial services marketplace, such as
those that could arise from a future crisis .
FSOC has an opportunity to serve in this
coordination role by collecting and sharing
information relating to crisis preparedness
and then identifying the risks to the financial
stability of the United States associated
with the failure to prepare for future crises .
Using this coordination role to focus on
crisis preparedness and identifying risks
associated with agencies’ crisis preparedness
is a role that FSOC has not undertaken --
notwithstanding multiple recommendations
by different oversight authorities .
For example, both the IMF and GAO have
recommended that FSOC enhance its
crisis preparedness role . In 2015, the IMF
recommended that FSOC assume a formal
crisis preparedness and management
role . This recommendation remains
unimplemented, and the IMF reiterated this
recommendation to FSOC in its August 2020
United States Financial System Stability
Assessment 9
9 International Monetary Fund, United States Financial System Stability Assessment (August 2020) at 80, App . VII at 105 (reiterating
the 2015 IMF recommendation to assign a formal crisis preparedness and management coordinating role to FSOC and noting that
the earlier recommendation remains unimplemented) .
 In addition, GAO recommended
in a December 2020 report that FSOC
conduct scenario-based exercises intended
to evaluate capabilities for responding to
crises .10
10 U .S . Government Accountability Office, Financial Stability: Agencies Have Not Found Leveraged Lending to Significantly Threaten
Stability but Remain Cautious Amid Pandemic (GAO-21-167) (Dec . 2020) at 58 .
 FSOC neither agreed nor disagreed
with the GAO recommendation . On January

3
Council of Inspectors General on Financial Oversight • Guidance in Preparing for and Managing Crises
Guidance in Preparing for and Managing Crises

26, 2021, the CIGFO Working Group
requested information regarding the actions
that FSOC had taken or intended to take to
address the IMF and GAO recommendations .
Subsequent to the issuance of a Discussion
Draft of this guidance on June 7, 2021, FSOC
informed the CIGFO Working Group that it
was in the process of compiling its Article
IV responses to the IMF recommendations11
11Under Article IV of the IMF’s Articles of Agreement, the IMF holds bilateral discussions with members, usually every year . FSOC’s
Article IV responses are included in the IMF report .
and would share them with the CIGFO
Working Group when the IMF report is
published . On July 22, 2021, FSOC shared the
U .S . Authorities’ Article IV responses12
12 International Monetary Fund, United States 2021 Article IV Consultation – Press Release; Staff Report; and Statement by
the Executive Director for the United States (July 2021); Appendix IV “Implementation of 2020 FSAP [Financial Sector
Assessment Program] Recommendations” contains the U .S . Authorities’ self-assessment of the status of implementation for the
recommendations of the 2020 FSAP and is not necessarily the assessment of IMF staff . https://www .imf .org/en/Publications/CR/
Issues/2021/07/22/United-States-2021-Article-IV-Consultation-Press-Release-Staff-Report-and-Statement-by-the-462540
 with
the CIGFO Working Group . FSOC asserted
that its role “is not intended to serve as the
primary responder during times of financial
crisis . Rather, its purpose is to identify
potential vulnerabilities and emerging
threats to financial stability, and to develop
recommendations for addressing those risks .”
On June 14, 2021, FSOC also reiterated its
earlier statements regarding the GAO report
(December 2020)13
13 The GAO report recommended that FSOC, in consultation with its members, “should incorporate regular scenario-based exercises
designed to evaluate individual FSOC member and collective capabilities for responding to crises into its risk-assessment activities .
These could include tabletop exercises that assume increased financial risks under plausible macroeconomic and financial
conditions that may require multiple regulators to respond .” GAO, Financial Stability: Agencies Have Not Found Leveraged Lending
to Significantly Threaten Stability but Remain Cautious Amid Pandemic, at 58 (GAO-21-167) (December 2020) . In its December 2020
response to the GAO recommendation, FSOC explained that it leverages the work and expertise of its member agencies (i .e ., heads
of federal and state financial regulatory agencies) and that a number of financial regulators organize tabletop exercises in which
FSOC staff regularly participate . FSOC further noted that it initiates additional activities, beyond those of its individual member
agencies, including rigorous analyses for interagency discussion . Id . at 82 .
 in letters to various
congressional committees but did not
describe any additional specific actions that
FSOC had initiated or intended to initiate to
address the GAO recommendation .14
14 Instead, FSOC’s correspondence to six congressional committees reiterated that it participates in tabletop exercises organized
by its member financial regulators and engages in independent activities to supplement the work of member agencies, including
generating rigorous analyses for interagency discussion .
FSOC and its member agencies have an
opportunity to work together to plan for
future crises . Our guidance outlined herein
can serve as a reference tool for both FSOC
and its member agencies . For FSOC, this
information can be used to assist in fulfilling
its coordination role and to help it identify
risks to the financial stability of the United
States by considering: (1) the type of crisis
planning materials that are available for
collection and dissemination to and from
member agencies, (2) the threats posed to
the United States’ financial stability relating
to potential gaps in crisis planning activities,
and (3) the appropriateness of prioritizing
crisis planning, consistent with member
agencies’ discussions . For member agencies,
this guidance provides information about
crisis readiness practices that can be used to:
(1) reinforce and supplement current crisis
readiness practices; (2) identify potential
gaps in current crisis readiness plans; and (3)
assist in designing and managing future crisis
programs .

Council of Inspectors General on Financial Oversight • Guidance in Preparing for and Managing Crises
4

Guidance in Preparing for and Managing Crises
Prudent crisis preparedness can help
agencies manage an array of potential
crises . According to the World Economic
Forum, risks that could affect the world
economy and the financial stability of the
United States include environmental risks
caused by extreme weather events such
as floods and hurricanes; natural disasters
such as earthquakes and tsunamis; climate
change that could amplify credit, liquidity,
and counterparty risk that challenge financial
management; technological risks such as
large-scale cyberattacks or malware causing
economic damages; violent protests; and
geopolitical risks such as terrorist attacks
and the deployment of nuclear, chemical,
biological or radiological weapons .15
15 The World Economic Forum is an international organization established in 1971 for public-private cooperation . The Global Risks
Report 2018 identified a list of hazardous risks that could affect the world economy and thereby potentially affect insured
depository institutions .
 At the
FSOC meeting on March 31, 2021, the Chair of
FSOC, the Secretary of the Treasury, stated
during the Open Session:
Climate change is obviously
the big one . It is an existential
threat to our environment, and
it poses a tremendous risk to
our country’s financial stability .
 .  .  . Our financial system must
be prepared for the market and
credit risks of these climate-
related events  .  .  .  . On all these
fronts, the [Financial Stability
Oversight] Council has an
important role to play, helping
to coordinate regulators’
collective efforts to improve the
measurement and management
of climate-related risks in the
financial system .16
16 Secretary Janet L . Yellen, Financial Stability Oversight Council meeting (Mar . 31, 2021) https://home .treasury .gov/news/press­
releases/jy0092
Such events could lead to the disruption of
key infrastructure elements for extended
periods of time, including:
•  Limited or no electrical power,
•  Limited or no email or internet
communications,
•  Disrupted food and water supplies,
and
•  Disrupted transportation routes .
In particular, the current COVID-19 pandemic
environment has highlighted the financial
system’s reliance on electrical and cyber
connections where human contact is limited .
It is important for FSOC and the financial
regulators to be able to respond to such
emerging threats, but also be prepared to
identify risks that may exist relating to the
organizations’ overall crisis preparedness .
The crisis preparedness and management
practices identified and summarized by
the CIGFO Working Group OIGs were
based upon agency planning documents to
address market disruptions; contingency and
crisis plans; stress tests; testing of market
coordination procedures; retrospective
analyses of regulator responses to prior
crises; business resiliency management
analyses; a prioritized supervision framework

5
Council of Inspectors General on Financial Oversight • Guidance in Preparing for and Managing Crises
Guidance in Preparing for and Managing Crises

in response to the COVID-19 pandemic;
crisis management plans; economic impact
analyses following a crisis; plans for cyber
incident response; lesson learned reviews;
strategic plan initiatives to improve crisis
management and response capabilities;
audits of agency responses to emerging
risks; international peer reviews of agency
approaches to supervision and regulation
following financial crises; and audits to assess
regulatory activities under Presidential Policy
Directive 21 .17
17 The Presidential Policy Directive 21, released on February 12, 2013, established a national policy on critical infrastructure security and
resilience, which is a shared responsibility among federal, state, local, tribal, and territorial entities, and public and private owners
and operators of critical infrastructure . The policy’s goals are to enhance overall coordination and collaboration and clarify the
functions, roles, and responsibilities related to critical infrastructure .
 The guidance derived from
these sources broadly fall into the following
categories:
1 .  Collaboration and Pre-Crisis Planning
Activities
•  Define agency mandates, roles, and
responsibilities
•  Facilitate information sharing
proactively
•  Strive for a shared view of market
conditions
•  Implement continuous monitoring
activities
2 .  Agencies’ Crisis Readiness Plan Elements
•  Establish individual roles and
responsibilities related to plans
•  Describe triggering events
•  Identify relevant legal authorities and
tools, and potential emergency actions
•  Develop communication plans and
options
•  Prioritize system capacity, and cyber
and information security (aligned with
existing continuity capabilities)
•  Provide for testing, evaluation, review,
revision, and training
•  Provide for reporting
3 .  Agencies’ Crisis Management
•  Implement leadership response
•  Coordinate among member agencies
•  Communicate to internal and external
stakeholders
•  Assess resources
•  Supervise markets and regulated
entities
•  Deploy response programs
•  Evaluate lessons learned
CIGFO intends this guidance to assist FSOC
and its member agencies with coordinating
and planning for future crises in order to help
identify and mitigate risks to the financial
stability of the United States associated with
potential gaps in crisis preparedness . We
provide this guidance in support of FSOC
and its member agencies’ ongoing efforts,
recognizing that some activities are already
broadly in practice, while other activities
presented here can promote new initiatives
that enhance the wider crisis planning effort .
A list of the documents collected from the
FSOC federal member agencies and their
OIGs that were considered by the CIGFO
Working Group in compiling the guidance is
provided in Appendix III .

Council of Inspectors General on Financial Oversight • Guidance in Preparing for and Managing Crises
6

Guidance in Preparing for and Managing Crises
Collaboration and Pre-Crisis
Planning Activities
A proactive crisis readiness effort involves
working collaboratively to coordinate crisis
readiness efforts across federal and state
agencies and consulting with international
agencies and organizations as needed . Pre­
crisis preparations rely on: (1) identifying
risks and conducting scenario analyses
on options for how best to contain them
before they escalate into crises, and (2)
developing plans ahead of time that outline
how an agency will respond to crises in
case they materialize, known as crisis
readiness planning . Member agencies may
have different but overlapping missions,
goals, responsibilities, and communication
strategies . For these reasons, pre-planning
and coordination among FSOC members is
critical and includes the following actions:
•  Define Agency Mandates, Roles,
and Responsibilities . Having a well-
defined mandate and clear roles and
responsibilities ensures the broad
coverage of different risk categories
while preventing the duplication of
agency efforts, both prior to and
during a crisis . Clarity in such roles and
responsibilities is critical, especially
because of the complexity and
overlapping responsibilities among FSOC
member agencies . Documenting and
understanding agency mandates and
roles during pre-crisis planning can assist
FSOC and member agencies in conveying
consistent messages to regulated entities
during a crisis .
•  Facilitate Information Sharing Proactively.
Promoting proactive information sharing
relating to crisis preparations among
the agencies facilitates coordination and
prevents duplication of efforts .
•  Strive for a Shared View of Market
Conditions. Striving to share a
common view of the overall condition
and risks within the financial markets
is essential (including as emerging
risks are identified) . Coordination of
interdisciplinary subject matter experts
enables agencies to: (1) take a holistic view
of oversight areas and associated risks;
(2) develop focused guidance; (3) share
information across internal and external
components; and (4) communicate
consistently when a crisis arises .
•  Implement Continuous Monitoring
Activities. Monitoring vulnerabilities to
the stability of the U .S . financial sector is
critical .18
18 Financial Stability Oversight Council, Department of the Treasury, 2020 Annual Report (2020) .
 The goal of pre-crisis monitoring
activities in preparing for a crisis is to
limit and mitigate risks . Such monitoring
activities include:
»  Establishing risk committees to
proactively evaluate risks to the
financial system by capturing the
collective views of multiple agencies,
categorizing risks by severity, and
reporting the consensus perspective

7
Council of Inspectors General on Financial Oversight • Guidance in Preparing for and Managing Crises
Guidance in Preparing for and Managing Crises

throughout the FSOC community;
»  Conducting market surveillance to
monitor for market disruption risk and
requiring regulated entities to disclose
market disruptions;19
19 Market surveillance includes a broader view of how risks and interconnections tie to nonfinancial businesses and the real economy .
»  Monitoring and updating counterparty
credit risk to enable FSOC and
member agencies to quickly and
accurately assess risk exposures;
»  Performing stress tests to identify
sources of strain and establish
strategies for addressing liquidity
shortfalls in emergencies;
»  Generating risk assessments that
account for a range of crisis scenarios
that could affect financial stability and
their impact and probability; and
»  Conducting supervisory reviews of
regulated entities’ preparedness and
resilience to crisis events .20
20 Supervisory reviews should be founded on detailed written standards for cyclical, process-oriented reviews of a regulated entity’s
preparedness and business resiliency plans to ensure that the regulated entity has a clearly defined path to continue mission critical
operations during a widespread disruption, such as a natural disaster or the loss of a critical computer system .
Thereafter, using the results of these
monitoring activities helps to identify the
array of risks to be addressed in crisis
readiness plans .
Agencies’ Crisis Readiness Plan
Elements
Crisis readiness plans outline how an agency
will operate in, and respond to, an array
of crisis scenarios . Crisis readiness plans
create an overarching crisis management
framework for strategic decision making,
communication, and coordination . Such a
plan or management framework can include:
(1) an agency-wide, all-hazards readiness
plan, and (2) agency-wide hazard-specific
readiness plans, as needed, that integrate
divisional plans containing requirements
unique to certain types of crises . Effective
crisis readiness planning includes input
from and consultation with relevant agency
stakeholders . Some agencies have made
crisis preparedness an explicit goal in their
strategic plans . At a minimum, these plans
achieve greater impact when they include
the following elements:
•  Establish Roles and Responsibilities.
Identify and establish the roles and
responsibilities of the individuals and
groups involved in a crisis response .
This includes identifying a high-level
crisis leadership team and describing
its responsibilities . A crisis leadership
team that includes an organization’s
senior leadership can achieve greater
impact . This team is equipped with both
an enterprise-wide perspective and

Council of Inspectors General on Financial Oversight • Guidance in Preparing for and Managing Crises
8

Guidance in Preparing for and Managing Crises
the authority to facilitate the efficient
sharing of relevant information during a
crisis and in managing the operational
readiness tasks . Prior to crises, agencies
also designate the staff responsible for
implementing each aspect of a crisis
response plan to ensure that relevant staff
understand how to execute their roles
and are prepared to do so when the need
arises .
•  Describe Triggering Events . Defining
what constitutes a crisis that would
trigger initiation of the crisis response
plan is important . When triggering events
activate the crisis plan, the responsible
crisis leadership officials would then
undertake affirmative steps to initiate the
plan .
•  Identify Relevant Legal Authorities and
Tools, and Compile a List of Potential
Emergency Actions. Prior to a crisis, it is
important to document a list of available
legal tools and authorities to assist in crisis
response . During a crisis, agencies may
not have the luxury of time and resources
to identify their relevant legal tools and
authorities . Therefore, it is beneficial
during steady state that an agency
conducts scenario planning and analysis
that thoroughly vets all legal authorities .
This list of available legal authorities can
include potential emergency actions that
leadership may consider in response to
various crisis events, as well as regulatory
authorities available to, among other
things, provide liquidity to financial
institutions, support financial market
infrastructures, facilitate the restructuring
of troubled institutions, and provide
regulatory relief . Such preparedness
efforts also can include considering
legal authorities that empower agencies
with multiple options and flexibility to
award and administer contracts and hire
and deploy staff in response to a crisis .
Agencies can also identify any legal
authorities or tools they do not have but
may need to manage risk or respond to
a crisis and take action to seek those
additional legal authorities or tools .
•
Develop Communication Plans and
Options . A checklist of potential
internal and external communication
actions for leadership to consider in
response to a crisis can be included in
the plan . Communication both during
and after the crisis event is integral
to a crisis response . The checklist can
include options for: (1) developing and
implementing a communications strategy
to promote transparency (i .e ., statements
by the agency head, Frequently Asked
Questions, webcasts, interviews, links
to temporary relief, exemptive orders,
and staff guidance); (2) creating
communication templates or leveraging
existing communication templates; and
(3) identifying potential communication
media – for example creating or using
existing public-facing websites, creating
call centers, and preparing training
materials and/or a library of program
response materials .

9
Council of Inspectors General on Financial Oversight • Guidance in Preparing for and Managing Crises
Guidance in Preparing for and Managing Crises

•  Prioritize System Capacity, and Cyber
and Information Security (Aligned
with Existing Continuity Capabilities)
Crisis readiness plans can also include
an evaluation of mission critical systems
and equipment to assess the agency’s
ability to handle a crisis . An effective
information security program that meets
federal standards includes an incident
response plan that establishes procedures
for staff to follow during cyber incidents .
The information security response plan
documents the triggers, procedures, roles
and responsibilities, including forming
an incident assessment group, and
resources for eradicating and/or limiting
the expansion of an information security
incident and minimizing its effects .
The incident response plan includes an
incident recovery plan that identifies
individuals responsible for initiating the
recovery plan, defines criteria that must
be met to return compromised services
and technology to the network, and
explains how to document the decisions
and actions taken for future reference . The
incident response plan also addresses how
to coordinate communication with internal
and external stakeholders about response
and restoration activities . These plans
and options are aligned with agencies’
business continuity plans and encompass
forecasting budget and staffing resources
to address crisis response activities
prospectively before a crisis occurs .
•  Provide for Testing, Evaluation, Review,
Revision, and Training . Crisis readiness
plans can also include a process to review,
test, and revise crisis readiness plans on
a recurring basis .21
21 For example, agencies can conduct exercises of the crisis readiness plan under different emergency scenarios . These periodic
exercises, usually occurring at least annually, are followed by an after-action review to capture observations and identify areas for
improvement .
 Training can ensure
that agency personnel have the requisite
knowledge, skills, and abilities to execute
the crisis management tasks . Training
can explain the delegations of authority
and options for potential actions . It
is important that an agency establish
feedback mechanisms to assess the
lessons learned from training, simulation
exercises, and actions undertaken during
an actual crisis event to systematically
incorporate improvements into the
crisis readiness plans . Periodic reviews
and readiness plan updates can also
reflect any changes in the operational
environment, system resources, leadership
structure, and the evolution of industry
standards, laws, and regulations .
•  Provide for Reporting . Plans can also
provide a mechanism to regularly report
to key decision makers about the agency’s
crisis readiness .
Agencies’ Crisis Management
Crisis planning and crisis management
work in tandem . Once agency leadership
determines that a crisis exists, senior agency
leaders consult and modify, as needed, the
crisis readiness plans developed during the

Council of Inspectors General on Financial Oversight • Guidance in Preparing for and Managing Crises
10

Guidance in Preparing for and Managing Crises
pre-crisis planning period . These actions
equip FSOC member agency leaders to
create the crisis management strategy .
The crisis management strategy dictates
the response to a crisis . Key elements
that contribute to effectively managing a
crisis include clear leadership response,
coordination, communication, resource
assessments, supervisory activities, and
implementation of response or rescue
programs .
•  Implement Leadership Response.
Consistent with the roles and
responsibilities outlined in their crisis
readiness plans, agencies deploy a
leadership response in which strategic
decision-making and coordination occur
at the senior agency level, and operational
and tactical authorities remain within
appropriate business areas to ensure
efficient management of incidents . The
senior crisis management team can
serve to provide strategic leadership,
set response priorities, inform and/or
consult with key governance bodies, and
escalate policy issues as appropriate .
Meanwhile, a crisis communication team
may coordinate with crisis leadership and
support consistent, timely, and effective
communication with stakeholders .
•  Coordinate Among Member Agencies . For
specific crises, using pre-existing working
groups or establishing interagency
working groups and sub-working groups
fosters the exchange of ideas, and helps to
facilitate decision-making and determine
plans for action and communications .
Working groups can assist leadership by
providing crisis support and helping to
facilitate the crisis management process,
gather status updates, develop situation
reports, facilitate an understanding of
business functional and operational
impacts across the organization, gather
information from external subject matter
experts and government authorities,
and provide situational awareness .
The working group, or sub-working
group, also can include a team to
review available data, assumptions, and
methodologies in use and recommend a
consistent analytical framework across
agencies . Standardizing data is critical
to the agencies’ collective analysis of the
economic and financial impacts of the
crisis, including the effects of the policy
actions taken in response to the crisis .
•  Communicate to Internal and External
Stakeholders . Publicly communicating
individual agency’s responses to the
crisis promotes transparency . Public
communications provide insight into each
agency’s efforts and how it is continuing
to fulfill its mission . Agencies consider
the options for communicating to agency
employees, regulated entities, and the
public . Internally, agencies may consider
interdivisional instructions for team
notifications in the event deployments
become necessary on short notice .
Internal communication provides updated
information relevant to employees via
direct communication and/or a webpage .
Communications are coordinated with
crisis leadership, as previously noted .

11
Council of Inspectors General on Financial Oversight • Guidance in Preparing for and Managing Crises
Guidance in Preparing for and Managing Crises

External communication provides for
statements by agency leaders, interviews,
guidance, websites, and call centers
as potential communication channels .
In addition, interagency guidance and
interagency statements can be effective
tools to clarify a supervisory approach and
convey that message clearly to institutions
and markets .
•  Assess Resources. Managing surge
staffing by onboarding new employees at
a pace that aligns with the crisis demands
on workforce capacities is essential . Senior
leaders responsible for crisis management
consider the need to meet both budget
and staffing increases, commensurate
with crisis demands . Understanding the
possible options available in advance can
help to expedite the potentially large-
scale hiring and onboarding of new staff
to address crisis response activities, such
as administering response programs
or responding to institutional failures .
Leaders use flexible hiring and staffing
approaches, as presented in the crisis
planning phase . This may also necessitate
flexible hiring and contracting processes
during crisis management . Pay, benefit,
and interim work schedule flexibilities, for
example, can be useful in expediting the
hiring process during a crisis . As a part of
the resource assessment, if changes to the
workforce occur as a result of the crisis,
like it did during the COVID-19 pandemic,
it is important to design training that
could be quickly transitioned to virtual
sessions and to provide remote access
to all employees . Supporting a remote
workforce required agencies to provide
technical guidance to assist in securely
connecting to agency systems . Future
crises may present different challenges
requiring agencies to assess additional
support alternatives for their workforce .
•  Supervise Markets and Regulated
Entities. Coordinating and prioritizing
supervisory activities on those markets
and entities that pose the greatest
risk is critical .22
22 To accomplish the goal of focusing supervisory activity on those markets and entities that pose the greatest risk, an agency
conducting prioritized assessments ranks the risks under its jurisdiction and analyzes staff capacity to prioritize how to deploy
limited resources . Another goal of this approach is to increase the efficiency and effectiveness of information flow collected by
the agencies related to operational changes and regulatory challenges, and to coordinate with other federal and state regulatory
agencies .
Adapting supervisory
approaches, such as: (1) focusing on
monitoring and outreach to help financial
institutions and market participants
understand the challenges and risks of the
environment, and (2) allowing temporary
changes to examination activities to
minimize disruptions . Such changes might
include granting additional time to resolve
existing noncritical supervisory findings .
During a crisis, agencies can communicate
with other federal and state regulators to
avoid duplicative efforts and to coordinate
efforts in executing revised supervisory
approaches . Notably, large interconnected
financial institutions often require
heightened supervisory attention due to
the greater complexity of their operations
and the outsized risks that they can pose
to the U .S . economy .

Council of Inspectors General on Financial Oversight • Guidance in Preparing for and Managing Crises
12

Guidance in Preparing for and Managing Crises
•  Deploy Response Programs. Response
programs typically involve government
investments, loans, guarantees, or
repayment modifications, and are
designed to address the unique
circumstances of a particular crisis .
Programs should be transparent, and
decisions relating to them should be
documented to ensure that the process
is clear and understandable, and that
there is an appropriate level of oversight .
Having specific, measurable goals for
federal rescue programs, and aligning
funding accordingly, is necessary .
Effective program design clearly identifies
the metrics by which success will be
measured and how management will
monitor and report the agency’s progress
in meeting these goals . In managing the
program, agency managers also monitor
the program’s activities, which ensures
that funds are used as intended . Regular
assessments and communication, to
include the exit path and end date for
response programs, are also useful .
•  Evaluate Lessons Learned. Following a
crisis and return to steady state, initiating
after-action reviews to examine the
cause(s) for any implementation issues,
analyzing the effectiveness of the agency’s
crisis management process, identifying
opportunities for improvement, and acting
on those opportunities for improvement
is helpful . It is important that agencies
coordinate these efforts and collaborate
to produce post-event analyses and
reports . Based on the observations in the
after-action reviews, agency leadership
should consider initiating improvement
planning . Improvements should consider
the applicability to all crisis readiness
plans, not just to the hazards and crisis
plans utilized during the preceding crisis .
Conclusion
The foregoing guidance is intended to
assist FSOC and its member agencies in
coordinating, sharing information, and
planning for future crises . For FSOC,
this guidance can be used to collect and
disseminate crisis readiness information to
member agencies as well as to assist with
assessing the risks to the United States’
financial stability associated with agencies’
crisis readiness preparedness . For member
agencies, this guidance can be used to assist
with planning for future crises . The crisis
preparedness and management practices
identified and summarized in this guidance
as well as the crisis preparedness actions
previously recommended by the IMF and
GAO can inform FSOC and its member
agencies and help to preserve the financial
stability of our nation during future crises .
On March 23, 2022, FSOC provided a written
response to this guidance document .23
23 Prior to issuance of this report, CIGFO and FSOC engaged in pre-decisional discussions to ensure a full understanding of the
report’s guidance before CIGFO received FSOC’s final management response .
FSOC’s response is included as Appendix II .

13
Council of Inspectors General on Financial Oversight • Guidance in Preparing for and Managing Crises
APPENDIX I
APPENDIX I
Abbreviations
Act/Dodd-Frank Act
Dodd-Frank Wall Street Reform and Consumer Protection Act
COVID-19
Coronavirus Disease 2019
CFPB
Consumer Financial Protection Bureau
CFTC
Commodity Futures Trading Commission
CIGFO
Council of Inspectors General on Financial Oversight
FDIC
Federal Deposit Insurance Corporation
FHFA
Federal Housing Finance Agency
FIO
Federal Insurance Office
FRB
Board of Governors of the Federal Reserve System
FSOC
Financial Stability Oversight Council
GAO
U .S . Government Accountability Office
HUD
U .S . Department of Housing and Urban Development
IG
Inspector General
IMF
International Monetary Fund
NCUA
National Credit Union Administration
OCC
Office of the Comptroller of the Currency
OFR
Office of Financial Research
OIG
Office of Inspector General
SEC
U .S . Securities and Exchange Commission
SIGTARP
Special Inspector General for the Troubled Asset Relief Program
Treasury
Department of the Treasury

Council of Inspectors General on Financial Oversight • Guidance in Preparing for and Managing Crises
14

APPENDIX II
APPENDIX II

Council of Inspectors General on Financial Oversight • Guidance in Preparing for and Managing Crises

APPENDIX III
APPENDIX III
SOURCES USED BY THE CIGFO WORKING GROUP
TO DEVELOP GUIDANCE
COLLABORATION AND PRE-CRISIS PLANNING ACTIVITIES
Commodity Futures Trading Commission . (2020, October 20) . CFTC and BoE Sign New MOU
for Supervision of Cross-Border Clearing Organizations [Press Release 8289-20] . https://
www .cftc .gov/PressRoom/PressReleases/8289-20
Commodity Futures Trading Commission . (2019, February 25) . Joint Statement by UK and US
Authorities on Continuity of Derivatives Trading and Clearing Post-Brexit [Press Release
7876-19] . https://www .cftc .gov/PressRoom/PressReleases/7876-19
Commodity Futures Trading Commission . (2020) .
 . (hereinafter “
”)
Department of the Treasury Office of Inspector General . (2013) . Safety and Soundness: OCC
Identification of Emerging Risks https://oig .treasury .gov/sites/oig/files/Audit Reports
and Testimonies/OIG13037 .pdf
Federal Deposit Insurance Corporation . (2012) . Effectively Managing FDIC’s Resources –
Meeting the Challenges of the Financial Crisis, 2008-2011 . (hereinafter “FDIC, Managing
FDIC’s Resources”)
Federal Housing Finance Agency . (2019) . AB 2019-01 Business Resiliency Management
https://www .fhfa .gov/SupervisionRegulation/AdvisoryBulletins/Pages/Business-Resiliency-
Management .aspx
16

Council of Inspectors General on Financial Oversight • Guidance in Preparing for and Managing Crises

APPENDIX III
Federal Housing Finance Agency . (2018) . AB 2018-07 Federal Home Loan Bank Liquidity
Guidance https://www .fhfa .gov/SupervisionRegulation/AdvisoryBulletins/Pages/Federal­
Home-Loan-Bank-Liquidity-Guidance .aspx
Federal Housing Finance Agency . (2013) . AB 2013-01 Contingency Planning for High-
Risk or High-Volume Counterparties https://www .fhfa .gov/SupervisionRegulation/
AdvisoryBulletins/Pages/AB-2013-01-CONTINGENCY-PLANNING-FOR-HIGH-RISK-OR­
HIGH-VOLUME-COUNTERPARTIES .aspx
Financial Stability Oversight Council . (2020) . 2020 Annual Report https://home .treasury .gov/
system/files/261/FSOC2020AnnualReport .pdf
Office of the Comptroller of the Currency . (2013) . An International Review of OCC’s
Supervision of Large and Midsize Institutions https://www .occ .gov/news-issuances/news­
releases/2013/nr-occ-2013-184a .pdf
Office of the Special Inspector General for the Troubled Asset Relief Program . (2014) . What
Makes a Bank Systemically Important?, Written Testimony of Christy L . Romero before
the U .S . Senate Committee on Banking, Housing, and Urban Affairs Subcommittee on
Financial Institutions and Consumer Protection . https://www .sigtarp .gov/sites/sigtarp/files/
Testimony/SIGTARP testimony TBTF and SIFI regulation July 16 2014 .pdf
CRISIS READINESS PLAN ELEMENTS
Board of Governors of the Federal Reserve System (2020) .
(hereinafter “
”)
Board of Governors of the Federal Reserve System (2019) .
 .
(hereinafter “
”)
Board of Governors of the Federal Reserve System (2018) .

supra
FDIC, Managing FDIC’s Resources, supra
Federal Deposit Insurance Corporation . (2020) . FDIC Chairman Letter to Representative
Maxine Waters . (hereinafter “FDIC Chairman Letter”)
17

Council of Inspectors General on Financial Oversight • Guidance in Preparing for and Managing Crises

APPENDIX III
Federal Deposit Insurance Corporation . (2018) . Atlanta Region Critical Event Management Plan.
Federal Deposit Insurance Corporation Office of Inspector General . (2020) . The FDIC’s
Readiness for Crises [EVAL-20-004] https://www .fdicoig .gov/sites/default/files/
publications/EVAL-20-004 .pdf
Federal Housing Finance Agency . (2017) . AB 2017-02 Information Security Management
https://www .fhfa .gov/SupervisionRegulation/AdvisoryBulletins/Pages/Information­
Security-Management .aspx
Federal Housing Finance Agency . (2018) . AB 2018-06 Liquidity Risk Management https://
www .fhfa .gov/SupervisionRegulation/AdvisoryBulletins/Pages/Liquidity-Risk-Management .
aspx
National Credit Union Administration . (2020) .
. (hereinafter “
”)
U .S . Securities and Exchange Commission (2020) .
 . (hereinafter “
”)
U .S . Securities and Exchange Commission (2020) .
 .
U .S . Securities and Exchange Commission . (2020) SEC Coronavirus (COVID-19) Response
https://www .sec .gov/sec-coronavirus-covid-19-response (hereinafter “SEC COVID
Response”)
U .S . Securities and Exchange Commission . (2018) . U.S. Securities and Exchange Commission
Strategic Plan Fiscal Years 2018-2022 https://www .sec .gov/files/SEC Strategic Plan
FY18-FY22 FINAL .pdf
CRISIS MANAGEMENT
Consumer Financial Protection Bureau . (2020) .
 .
FDIC Chairman Letter, supra
FDIC, Managing FDIC’s Resources, supra
18

19
Council of Inspectors General on Financial Oversight • Guidance in Preparing for and Managing Crises

APPENDIX III
Federal Deposit Insurance Corporation . (2017) . Crisis and Response, An FDIC History, 2008­
2013 https://www .fdic .gov/bank/historical/crisis/
Federal Deposit Insurance Corporation . (2017) . Draft Debt Ceiling Contingency Planning
Summaries
Federal Housing Finance Agency . (2020) . (FNM-DER-2020-023) (FRE-DER-2020-027)
Operational Risks Associated with Coronavirus Disease 2019 (COVID-19)
FRB 2020
, supra
supra
NCUA
, supra
Office of the Special Inspector General for the Troubled Asset Relief Program . (2012) . Factors
Affecting Implementation of the Hardest Hit Fund Program [SIGTARP 12-002] https://
www .sigtarp .gov/sites/sigtarp/files/Audit Reports/SIGTARP HHF Audit .pdf
Office of the Special Inspector General for the Troubled Asset Relief Program . (2009) . Initial
Report to the Congress https://www .sigtarp .gov/sites/sigtarp/files/Quarterly Reports/
SIGTARP Initial Report to the Congress .pdf
Office of the Special Inspector General for the Troubled Asset Relief Program . (2011) . Legal
Fees Paid Under the Troubled Asset Relief Program: An Expanded Report [SIGTARP 11­
004] https://www .sigtarp .gov/sites/sigtarp/files/Audit Reports/G%2009%20OFS%20
Contracting%20Final%2011-004%2009-28-2011 .pdf
Office of the Special Inspector General for the Troubled Asset Relief Program . (2011) . Quarterly
Report to Congress https://www .sigtarp .gov/sites/sigtarp/files/Quarterly Reports/
October2011 Quarterly Reportto Congress .pdf
SEC COVID Response, supra
SEC
supra
U .S . Securities and Exchange Commission (2020) .
[
] .

APPENDIX IV
APPENDIX IV
CIGFO Working Group
Council of Inspectors General on Financial Oversight • Guidance in Preparing for and Managing Crises
Federal Deposit Insurance Corporation Office of Inspector General, Co-Lead
Jay Lerner, Inspector General, Federal Deposit Insurance Corporation
Terry Gibson
Cynthia Hogue
Stacey Luck
Rigene Mabry
Michael Reed
Special Inspector General for the Troubled Asset Relief Program, Co-Lead
Melissa Bruce, Acting Special Inspector General, Troubled Asset Relief Program
Jenniffer Wilson
Marc Geller
Jennifer Kim
James Lloyd
Gabriele Tonsil
Department of the Treasury Office of Inspector General
Richard Delmar, Deputy Inspector General, Department of the Treasury and Acting CIGFO Chair
Deborah Harker
Susan Barron
Jeffrey Hawkins
Andrew Morgan
Tayla Haughton
Kajuana Britt
Katherine Draper
Sheila Arguello
Timothy Cargill
Jackquelynne Foley
Department of Housing and Urban Development, Office of Inspector General
Rae Oliver Davis, Inspector General, Department of Housing and Urban Development
Lisa Sweeney
 Greg Soames
Board of Governors of the Federal Reserve System and the Consumer Financial Protection Bureau Office of
Inspector General
Mark Bialek, Inspector General, Board of Governors of the Federal Reserve System and Consumer Financial
Protection Bureau
Michael VanHuysen
Jason Derr
Laura Shakarji
Margaret An
Matt Gibbons
Federal Housing Finance Agency Office of Inspector General
Brian Tomney, Inspector General, Federal Housing Finance Agency
Marla Freedman
Robert Taylor
James Lisle
April Ellison
Michael Rivera
National Credit Union Administration Office of Inspector General
James Hagen, Inspector General, National Credit Union Administration
Marvin Stith
U.S. Securities and Exchange Commission Office of Inspector General
Carl Hoecker, Inspector General, U.S. Securities and Exchange Commission
Rebecca Sharek
Kelli Brown-Barnes
Douglas Carney
Lucia Fuentes Bermudez
U.S. Commodity Futures Trading Commission Office of Inspector General
A. Roy Lavik, Inspector General, U.S. Commodity Futures Trading Commission

21
Council of Inspectors General on Financial Oversight • Guidance in Preparing for and Managing Crises
This page is intentionally blank

File and source

File

2023-07-cigfo-annual-2023.pdf

Size

2,935,266 bytes

SHA-256

a4354a3afbccffe72b253b51a7f9bd2e36b56d878f4aead078a8b4fe02a77f34

Our copy

2023-07-cigfo-annual-2023.pdf

Original

oig.treasury.gov