Cease and Desist Order -- C&D
- Date
- 2025-10-17
Summary
A 27-page copy of a Consent Order issued by the Office of the Comptroller of the Currency in In the Matter of Bank of America, N.A., AA-ENF-2022-21, filed October 17, 2025 as Document 591-101 (marked DX 41) in Case 3:21-md-02992-GPC-MSB. The order is issued under 12 U.S.C. § 1818(b) and relates to the bank's prepaid cards for unemployment benefits and its enterprise-wide complaints risk management. The Comptroller's findings, which the bank neither admits nor denies, state that cards loaded rose from under one million in January 2020 to over six million in July 2020 and describe an automated fraud filter applied between September 28, 2020 and June 8, 2021. The order requires a Compliance Committee, an action plan, and a UI Prepaid Card Oversight and Risk Management Program. It closes with signatures of a Deputy Comptroller and the bank's Board of Directors.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Full text
Case 3:21-md-02992-GPC-MSB Document 591-101 Filed 10/17/25 PageID.42937
Page 1 of 27
DX 41
Case 3:21-md-02992-GPC-MSB Document 591-101 Filed 10/17/25 PageID.42938
Page 2 of 27
#2022-023
UNITED STATES OF AMERICA
DEPARTMENT OF THE TREASURY
OFFICE OF THE COMPTROLLER OF THE CURRENCY
In the Matter of: )
)
Bank of America, N.A. ) AA-ENF-2022-21
Charlotte, North Carolina )
)
CONSENT ORDER
WHEREAS, the Office of the Comptroller of the Currency (“OCC”) has supervisory
authority over Bank of America, N.A., Charlotte, North Carolina (“Bank”);
WHEREAS, the OCC intends to initiate cease and desist proceedings against the Bank
pursuant to 12 U.S.C. § 1818(b), through the issuance of a Notice of Charges, related to: (1) the
administration of the Bank’s prepaid cards for unemployment benefits, specifically engagement
in (i) unsafe or unsound practice(s), including deficiencies in its risk management, operational
processes and controls, internal audit, and investigation and resolution of consumer claims of
unauthorized transactions; and (ii) unfair and deceptive practices in violation(s) of Section 5 of
the Federal Trade Commission Act (“FTC Act”), 15 U.S.C. § 45(a)(1); and (2) engaging in
unsafe or unsound practices related to deficiencies in its enterprise-wide complaints risk
management framework;
WHEREAS, in the interest of cooperation and to avoid additional costs associated with
administrative and judicial proceedings with respect to the above matter, the Bank, by and
through its duly elected and acting Board of Directors (“Board”), consents to the issuance of this
Consent Order (“Order”), by the OCC through the duly authorized representative of the
Comptroller of the Currency (“Comptroller”); and
NOW, THEREFORE, pursuant to the authority vested in the OCC by Section 8(b) of
Case 3:21-md-02992-GPC-MSB Document 591-101 Filed 10/17/25 PageID.42939
Page 3 of 27
the Federal Deposit Insurance Act, as amended, 12 U.S.C. § 1818(b), the OCC hereby orders
that:
ARTICLE I
JURISDICTION
(1) The Bank is an “insured depository institution” as that term is defined in
12 U.S.C. § 1813(c)(2).
(2) The Bank is a national banking association within the meaning of 12 U.S.C.
§ 1813(q)(1)(A), and is chartered and examined by the OCC. See 12 U.S.C. § 1 et seq.
(3) The OCC is the “appropriate Federal banking agency” as that term is defined in
12 U.S.C. § 1813(q) and is therefore authorized to initiate and maintain this cease and desist
action against the Bank pursuant to 12 U.S.C. § 1818(b).
ARTICLE II
COMPTROLLER’S FINDINGS
The Comptroller finds, and the Bank neither admits nor denies, the following:
(1) For several years, the Bank issued and administered prepaid debit cards to
distribute unemployment insurance benefits (“UI Prepaid Cards”) to consumers that were
loaded with benefit funds issued by certain states, hereinafter referred to as the Unemployment
Benefits Prepaid Card Program (“Program”).
(2) In March 2020, millions became unemployed and Congress enacted the
Coronavirus Aid, Relief, and Economic Security Act (“CARES Act”), which created the new
Pandemic Unemployment Assistance (“PUA”) benefit. The CARES Act and PUA expanded
unemployment benefits eligibility and provided greater benefit amounts than previously
available. As a result, the size of the Program increased substantially (from under one million
2
Case 3:21-md-02992-GPC-MSB Document 591-101 Filed 10/17/25 PageID.42940
Page 4 of 27
unique cards loaded in January 2020 to over six million in July 2020), as did the volume of
benefits issued by the states and loaded onto UI Prepaid Cards (from approximately $1 billion
in January 2020 to over $27 billion in July 2020). Along with the increases in Program
participants and benefits, the Program experienced an increase in fraud, including with respect
to unauthorized transaction claims.
(3) The Bank failed to establish effective risk management over the Program, and,
beginning in 2020, denied or delayed many consumers’ access to unemployment benefits when
consumers filed or attempted to file UI Prepaid Card unauthorized transaction claims.
Specifically, the Bank:
(a) applied an automated fraud filter between September 28, 2020 and June 8,
2021 to decision UI Prepaid Card error claims that met certain criteria
(“Fraud Filter”) without conducting a sufficient investigation to: (i) deny
many consumers’ claims of unauthorized transactions on their UI Prepaid
Cards, and (ii) “freeze” or “block” the UI Prepaid Card accounts
associated with the claims. Consumers with frozen or blocked accounts
could not access the unemployment benefits in their UI Prepaid Card
accounts until the Bank removed the freeze or block.
(b) failed to provide timely and full provisional or final credit to many
consumers entitled to such credits who reported unauthorized transactions
on their UI Prepaid Card accounts.
(c) retroactively applied the Fraud Filter to many consumers’ claims of
unauthorized transactions on their UI Prepaid Card accounts without
conducting further investigation and providing advance notice, which
3
Case 3:21-md-02992-GPC-MSB Document 591-101 Filed 10/17/25 PageID.42941
Page 5 of 27
incorrectly resulted in the reversal of provisional and final credits that the
Bank previously provided to those consumers.
(d) impeded many consumers’ ability to regain access to their unemployment
benefits through the UI Prepaid Cards and to request reconsideration of
their unauthorized transaction claims as a result of operational
deficiencies.
(e) provided consumers deceptive disclosures and notices with respect to
liability for unauthorized transactions, processing of unauthorized
transaction claims, and account freezes and blocks.
(4) Overall, the Bank has the following deficiencies in its administration of the
Program:
(a) inadequate risk management practices in both the front-line units and
independent risk management, including ineffective oversight, risk
assessment, monitoring, and reporting;
(b) inadequate internal controls, including those relating to contract
management;
(c) inadequate oversight, risk management, and monitoring of UI Prepaid
Card unemployment benefits vendors (“Program Vendors”); and
(d) inadequate oversight and coverage by the Bank’s independent audit
function.
(5) In addition, the Bank failed to establish an effective enterprise-wide complaints
risk management framework that is commensurate with the Bank’s size, complexity, and risk
profile. Specifically, the complaint risk management framework lacks an effective:
4
Case 3:21-md-02992-GPC-MSB Document 591-101 Filed 10/17/25 PageID.42942
Page 6 of 27
(a) process to identify, measure, manage, and report complaints;
(b) complaint resolution process; and
(c) quality assurance process.
(6) By reason of the deficiencies and conduct described in Paragraphs (2) through (5)
of this Article, the Bank engaged in unsafe or unsound practices and engaged in unfair and
deceptive practices in violation of Section 5 of the FTC Act, 15 U.S.C. § 45(a). These violations
and practices support actions against the Bank under 12 US.C. § 1818(b) and (i)(2)(B).
(7) The Bank has begun taking corrective actions and has committed to taking
necessary and appropriate steps to remedy the deficiencies identified by the OCC and to assist
and remediate harmed consumers.
ARTICLE III
COMPLIANCE COMMITTEE
(1) Within thirty (30) days of the date of this Order, the Board shall maintain a
Compliance Committee of at least three (3) members of which a majority shall be directors who
are not employees or officers of the Bank or any of its subsidiaries or affiliates. The Board shall
submit in writing to the Examiner-in-Charge the names of the members of the Compliance
Committee within ten (10) days of their appointment. In the event of a change of the
membership, the Board shall submit in writing to the Examiner-in-Charge within ten (10) days
the name of any new or resigning committee member. The Compliance Committee shall monitor
and oversee the Bank’s compliance with the provisions of this Order. The Compliance
Committee shall meet at least quarterly and maintain minutes of its meetings at which
compliance with this Order is discussed.
5
Case 3:21-md-02992-GPC-MSB Document 591-101 Filed 10/17/25 PageID.42943
Page 7 of 27
(2) Within sixty (60) days after the effective date of this Order, and thereafter within
forty-five (45) days after the end of each subsequent quarter, the Bank shall prepare and submit
to the Compliance Committee a written progress report setting forth in detail:
(a) a description of the corrective actions needed to achieve compliance with
each Article of this Order,
(b) the specific corrective actions undertaken to comply with each Article of
this Order,
(c) the results and status of the corrective actions, and
(d) the person(s) responsible for the completion of outstanding corrective
actions.
(3) The Compliance Committee shall forward a copy of the report, with any
additional comments by the Committee, to the Board.
(4) The Compliance Committee shall forward a copy of the report, with any
additional comments by the Committee or Board, to the Examiner-in-Charge within fifteen (15)
days of the first Compliance Committee meeting following the Committee’s receipt of such
report.
ARTICLE IV
ACTION PLAN
(1) Pursuant to the timeframe for completion and other requirements set forth in
Article V of this Order, the Bank shall develop a UI Prepaid Card Oversight and Risk
Management Program (“ORMP”) containing a complete description of the actions necessary to
achieve compliance with Article V of this Order. Separately, the Bank shall develop a Consent
Order Action Plan (“COAP”) containing a complete description of the actions necessary to
6
Case 3:21-md-02992-GPC-MSB Document 591-101 Filed 10/17/25 PageID.42944
Page 8 of 27
achieve compliance with Articles VI through X of this Order. The components of the COAP
shall be completed within the timeframes set forth in Articles VI through X of this Order, if
specified. Collectively, the ORMP and COAP are referred to collectively in this Order as the
“Plans.” At the time the Bank is required to submit the ORMP pursuant to Article V, Paragraph
(4), the Bank shall submit the Board-approved COAP to the Examiner-in-Charge for review and
prior written determination of no supervisory objection.
(2) The Plans shall also specify the:
(a) reasonable and well-supported timelines for completion of the corrective
actions required by this Order, and
(b) the person(s) responsible for completion of the corrective actions required
by this Order.
(3) The timelines contained in the Plans shall be consistent with any deadlines set
forth in this Order, including any modifications to the Order made pursuant to Article XIV,
Paragraph (5).
(4) In the event the Examiner-in-Charge requires changes to the Plans, the Bank shall
incorporate the required changes into the Plan(s) and submit the revised Plan(s) to the Examiner-
in-Charge for review and prior written determination of no supervisory objection.
(5) Within thirty (30) days following receipt of the Examiner-in-Charge’s written
determination of no supervisory objection to the Plans, the Board shall adopt the Plans and
thereafter ensure that Bank management implements and adheres to the Plans, including the
timelines set forth within the Plans.
(6) The Bank shall not take any action that will cause a significant deviation from, or
7
Case 3:21-md-02992-GPC-MSB Document 591-101 Filed 10/17/25 PageID.42945
Page 9 of 27
material change to, the Plans. Where the Bank makes a determination to modify the Plans, the
Bank shall submit the revised Plan(s) containing the proposed modifications to the Examiner-in-
Charge for prior written determination of no supervisory objection. Upon receipt of a written
determination of no supervisory objection from the Examiner-in-Charge, the Board shall timely
adopt the revised Plan(s) and thereafter ensure that Bank management implements and adheres to
the revised Plan(s), including the timelines set forth within the revised Plan(s).
ARTICLE V
UI PREPAID CARD OVERSIGHT AND RISK MANAGEMENT PROGRAM
(1) Within sixty (60) days of the date of this Order, the Bank shall perform and
submit to the Examiner-in-Charge for review and prior written determination of no supervisory
objection, the Program Risk Assessment and Program Risk Assessment Report as defined in and
required by Paragraph (2) of this Article and the Program Gap Analysis Report as defined in and
required by Paragraph (3) of this Article. Within five (5) business days of receipt of the
Examiner-in-Charge’s written determination of no supervisory objection to each of the Program
Risk Assessment, the Program Risk Assessment Report, and the Program Gap Analysis Report,
the Bank shall submit the respective item to the Compliance Committee.
(2) The Bank shall perform a comprehensive and holistic risk assessment of the
Program (“Program Risk Assessment”) that shall address all significant risks to include at a
minimum transaction and card volumes and trends; operational risks, including capacity
limitations or obstacles with product service or delivery; requisite staffing skills and expertise;
compliance with applicable consumer protection and information security laws and regulations;
and fraud risk volume, fraud sources, and types of fraud. The Bank shall also prepare a report of
8
Case 3:21-md-02992-GPC-MSB Document 591-101 Filed 10/17/25 PageID.42946
Page 10 of 27
the Program Risk Assessment (“Program Risk Assessment Report”) that summarizes the
findings from the Program Risk Assessment.
(3) The Bank shall conduct an analysis of its current controls and risk management
processes over the Program to identify gaps (“Program Gap Analysis”). At a minimum, the
Program Gap Analysis shall address the adequacy of operational controls, fraud investigations,
fraud rules and/or strategies, claims intake and processing, accounting practices, complaints
management, claims and complaints quality assurance processes, systems and data management,
and Program Vendor risk management. The Bank shall also prepare a report of the Program Gap
Analysis (“Program Gap Analysis Report”) that summarizes the findings from the Program Gap
Analysis.
(4) Within thirty (30) days following receipt of the Examiner-in-Charge’s written
determination of no supervisory objection to the Program Risk Assessment, the Program Risk
Assessment Report, and the Gap Analysis Report, the Bank shall submit to the Examiner-in-
Charge for review and prior written determination of no supervisory objection, an acceptable
Board-approved UI Prepaid Card ORMP that at a minimum shall include:
(a) policies, procedures, systems, and controls to effectively identify,
measure, monitor, and control risks associated with the Bank’s
administration of the Program, including those risks identified in the
Program Risk Assessment required by Paragraph (2) of this Article.
(b) corrective actions to address the gaps identified in the Program Gap
Analysis required by Paragraph (3) of this Article.
(c) an effective oversight and risk management framework that establishes the
roles and responsibility for respective front-line units and independent risk
9
Case 3:21-md-02992-GPC-MSB Document 591-101 Filed 10/17/25 PageID.42947
Page 11 of 27
management for Program operations consistent with the Bank’s
Enterprise-Wide Risk Framework.
(d) policies and procedures to ensure effective and timely execution of
training to Bank employees and employees of Program Vendors and
comprehensive measures for assessing the effectiveness of such training.
(e) measures to ensure Program Vendors adhere to the Bank’s established
Enterprise-Wide Vendor Risk Management Policy and comply with all
applicable consumer protection laws and regulations and that at a
minimum shall:
(i) ensure comprehensive and timely quality assurance activities and
monitoring activities to identify, measure, monitor, and control
risks identified by the Program Risk Assessment required by
Paragraph (1) of this Article.
(ii) ensure business level Program Vendor scorecards and enterprise-
wide and business level reporting clearly escalate performance
issues, control lapses, or non-compliance with all applicable
consumer protection laws and regulations and Bank policies and
procedures.
(f) standard reporting for the Program, which, at a minimum, shall include
performance metrics, risk indicators, and complaints trends.
(g) effective independent risk management for the Program that adheres to the
Bank’s Enterprise-Wide Risk Management Framework and includes, at a
minimum:
10
Case 3:21-md-02992-GPC-MSB Document 591-101 Filed 10/17/25 PageID.42948
Page 12 of 27
(i) periodic comprehensive and holistic risk assessments of the
Program, to occur at least annually, that identify the risks specified
in Paragraph (1) of this Article and specify the actions taken to
identify, measure, monitor, and control the risks; and
(ii) independent coverage plans and testing sufficient to detect,
mitigate, and manage operational control lapses and non-
compliance with all applicable consumer protection laws and
regulations and Bank policies and procedures.
(5) Within thirty (30) days following receipt of the Examiner-in-Charge’s written
determination of no supervisory objection to the ORMP, the Board shall adopt, and Bank
management, subject to Board oversight consistent with Article XI, shall immediately implement
and thereafter ensure adherence to the ORMP. Any amendment to the ORMP must be submitted
to the Examiner-in-Charge for review and prior written determination of no supervisory
objection.
ARTICLE VI
ENTERPRISE-WIDE COMPLAINTS RISK MANAGEMENT FRAMEWORK
(1) Within sixty (60) days of the date of this Order, the Bank shall submit to the
Examiner-in-Charge for review and prior written determination of no supervisory objection a
Board-approved enterprise-wide complaints risk management framework (“Complaints
Framework”).
(2) The Complaints Framework shall at a minimum include an effective
enterprise complaints policy, inclusive of an expanded complaints definition, and the
identification and description of effective procedures for adequately and timely identifying,
11
Case 3:21-md-02992-GPC-MSB Document 591-101 Filed 10/17/25 PageID.42949
Page 13 of 27
tracking, documenting, analyzing, managing, monitoring, escalating, reporting, and resolving
consumer customer complaints. This Complaints Framework shall also include quality assurance
measures to ensure Bank adherence to the Complaints Framework.
(3) Within sixty (60) days following receipt of the Examiner-in-Charge’s written
determination of no supervisory objection to the Complaints Framework or to any subsequent
amendment to the Complaints Framework, the Board shall adopt the Complaints Framework and
shall ensure that Bank management, subject to Board oversight consistent with Article XI, shall
implement and thereafter ensure adherence to the Complaints Framework. Any amendment to
the Complaints Framework must be submitted to the Examiner-in-Charge for review and prior
written determination of no supervisory objection.
ARTICLE VII
CONTRACT APPROVAL AND REVIEW PROCESS
(1) Within thirty (30) days of the date of this Order, the Bank shall develop the
criteria it will use to determine if a contract, including nonstandard contracts, pursuant to which
the Bank is providing significant services and acting as a vendor of such services, poses
significant risks to the Bank in various scenarios, including adverse conditions.
(2) Within thirty (30) days of the date of this Order, the Bank shall create an
inventory of existing contracts and newly signed contracts executed more than thirty (30) days
prior to the date of submission of the inventory that meet the criteria developed pursuant to
Paragraph (1) of this Article and submit this inventory to the Examiner-in-Charge.
(3) The Bank shall update the inventory required by Paragraph (2) of this Article on
an annual basis and submit the updated inventory to the Examiner-in-Charge.
12
Case 3:21-md-02992-GPC-MSB Document 591-101 Filed 10/17/25 PageID.42950
Page 14 of 27
(4) Within one hundred fifty (150) days of the date of this Order, the Bank shall
conduct risk assessments of all existing contracts listed in the inventory required by Paragraph
(2) of this Article.
(5) Within one hundred fifty (150) days of the date of this Order, the Bank shall
review and revise, as appropriate, its enterprise-wide framework for contract review and
approval for contracts where the Bank is providing significant services and acting as a vendor of
such services, including nonstandard contracts, to ensure at a minimum that its contract approval
and review process includes:
(a) policies and procedures for assessing the risks of new contracts that meet
the criteria required by Paragraph (1) of this Article, which assessment
shall occur prior to entering the contract;
(b) policies and procedures for conducting periodic assessments of the risks,
of all existing contracts listed in the inventory required by Paragraph (2) of
this Article, which assessments should occur at least annually; and
(c) policies and procedures for developing and implementing plans that
adequately measure, monitor, and provide for controls that adapt
commensurate with changing risk levels for the risks identified pursuant to
the assessments required by Paragraphs (4), (5)(a) and (5)(b) of this
Article.
(6) Upon adoption of the revised enterprise-wide framework for contract approval
and review as described in Paragraph (5) of this Article, Bank management, subject to Board
oversight consistent with Article XI, shall implement and thereafter ensure adherence to the
revised enterprise-wide framework for contract review and approval and any amendments
13
Case 3:21-md-02992-GPC-MSB Document 591-101 Filed 10/17/25 PageID.42951
Page 15 of 27
thereto. The Board shall ensure that the Bank conducts the assessments, develops, implements,
and adheres to the requirements of this Article.
ARTICLE VIII
INTERNAL AUDIT
(1) Within sixty (60) days of the date of this Order, Internal Audit shall revise the
audit plan to ensure comprehensive end-to-end coverage of the Program’s operations and risk
management processes and that at a minimum includes the testing of controls over the Program’s
operations, claims and reconsiderations, and adherence to all applicable consumer protection
laws and regulations and Bank policies and procedures.
(2) Consistent with the Bank’s established Internal Audit policies and procedures,
Internal Audit shall report all Program control deficiencies; UI Prepaid Card claims-related and
other operational errors; Program internal misconduct; and Program violations of applicable
laws, including consumer protection laws and regulations, and of Bank policies and procedures
to the Board and management in a timeframe consistent with the Bank’s established Internal
Audit policies and procedures.
ARTICLE IX
REMEDIATION
(1) Within ninety (90) of days of the date of this Order, the Bank shall submit to the
Examiner-in-Charge for review and prior written determination of no supervisory objection a
Board-approved acceptable remediation plan (“Remediation Plan”).
(2) At a minimum, the Remediation Plan shall include:
(a) a description of a well-supported methodology to be used to identify
harmed consumers as a result of the practices described in Article II,
14
Case 3:21-md-02992-GPC-MSB Document 591-101 Filed 10/17/25 PageID.42952
Page 16 of 27
Paragraph (3), and a calculation of the time necessary to compile a list of
potential harmed consumers.
(b) a description of the procedures and process used to remediate each harmed
consumer meeting the methodology referred to in Paragraph 2(a) of this
Article, including for claim amounts wrongfully withheld or denied,
benefit amounts frozen or blocked, and any consequential financial harm.
At a minimum, these procedures shall include:
(i) a lump sum consequential harm payment to harmed consumers,
that is calculated pursuant to the methodology required by
Paragraph (2)(c) of this Article;
(ii) an individualized review process administered by an independent
third-party payment administrator that allows harmed consumers to
request an individualized review to establish consequential harm
not satisfied by the lump sum payment described in Paragraph
2(b)(i) of this Article (“Individualized Review Process”); and
(iii) a description of the plan for developing effective disclosures and
communications used to inform harmed consumers of
Individualized Review Process and the type of supporting
information that will be required, as well as the circumstances
under which such supporting information will be required.
(c) a description of the methodology used to calculate the amount of
remediation to be paid to each harmed consumer. This methodology shall
include compensation for the financial harm suffered due to loss of access
15
Case 3:21-md-02992-GPC-MSB Document 591-101 Filed 10/17/25 PageID.42953
Page 17 of 27
to unemployment funds, including but not limited to, the wrongly denied
unauthorized transaction claim amounts and the loss of access to the UI
Prepaid Card balances that were frozen or blocked as described in Article
II Paragraph 3(a).
(d) a description of the procedures for the issuance and tracking of
remediation and the disclosures and communications required by
Paragraph (2)(b)(iii) of this Article.
(e) a description of the procedure for monitoring compliance with the
Remediation Plan.
(3) The Bank shall remediate financial injury and make restitution to each harmed
consumer in accordance with the Remediation Plan required by Paragraph (1) of this Article. No
amount paid under the Remediation Plan is paid to reimburse the OCC or any other government
or governmental entity for investigation or litigation costs, or in lieu of a fine or penalty.
(4) Within thirty (30) days following receipt of the Examiner-in-Charge’s written
determination of no supervisory objection to the Remediation Plan or to any subsequent
amendment to the Remediation Plan, the Board shall adopt and Bank management, subject to
Board oversight consistent with Article XI, shall immediately implement and thereafter ensure
adherence to the Remediation Plan. Any amendment to the Remediation Plan must be submitted
to the Examiner-in-Charge for review and prior written determination of no supervisory
objection.
16
Case 3:21-md-02992-GPC-MSB Document 591-101 Filed 10/17/25 PageID.42954
Page 18 of 27
ARTICLE X
ASSESSMENT OF REMEDIATION
(1) There shall be a periodic independent review and assessment of compliance with
the terms of the Remediation Plan (“Remediation Review”) in accordance with Paragraph (2) of
this Article, which Review shall include an assessment of:
(a) the application of the methodology used to determine the population of
harmed consumers,
(b) the Claims Process and the adherence to procedures specified for the
Claims Process,
(c) the application of the methodology used to determine the amount of
remediation for each harmed consumer,
(d) the sufficiency of the disclosures and communications required by
Paragraph (2)(b)(iii) of Article IX,
(e) the effectiveness of the process used to issue and track remediation
payments to harmed consumers and the disclosures and communications
required by Paragraph (1)(b)(iii) of Article IX, and
(f) the process used for monitoring compliance with the Remediation Plan.
(2) The Remediation Reviews shall occur at least every six months, beginning from
the date of this Order, during the development and execution of the Remediation Plan and the
findings shall be memorialized in writing. Within thirty (30) days of completing the Remediation
Review, the Bank shall provide the written findings of the Remediation Review to the
Compliance Committee and the Examiner-in-Charge.
17
Case 3:21-md-02992-GPC-MSB Document 591-101 Filed 10/17/25 PageID.42955
Page 19 of 27
(3) Any communications, workpapers, or work product related to the Remediation
Reviews shall be made available to the OCC immediately upon request of the Examiner-in-
Charge.
ARTICLE XI
GENERAL BOARD RESPONSIBILITIES
(1) The Board shall ensure that the Bank has timely adopted and implemented all
corrective actions required by this Order, and shall verify that the Bank adheres to the corrective
actions and that the corrective actions are effective in addressing the Bank’s deficiencies that
resulted in this Order.
(2) In each instance in which this Order imposes responsibilities upon the Board, it is
intended to mean that the Board shall:
(a) authorize, direct, and adopt corrective actions on behalf of the Bank as
may be necessary to perform the obligations and undertakings imposed on
the Board by this Order;
(b) ensure the Bank has sufficient processes, management, personnel, control
systems, and corporate and risk governance to implement and adhere to all
provisions of this Order;
(c) require that Bank management and personnel have sufficient training and
authority to execute their duties and responsibilities pertaining to or
resulting from the Order;
(d) hold Bank management and personnel accountable for executing their
duties and responsibilities pertaining to or resulting from this Order;
18
Case 3:21-md-02992-GPC-MSB Document 591-101 Filed 10/17/25 PageID.42956
Page 20 of 27
(e) require appropriate, adequate, and timely reporting to the Board by Bank
management of corrective actions directed by the Board to be taken under
the terms of this Order; and
(f) address any noncompliance with corrective actions in a timely and
appropriate manner.
ARTICLE XII
WAIVERS
(1) The Bank, by executing and consenting to this Order, waives:
(a) any and all rights to the issuance of a Notice of Charges pursuant to
12 U.S.C. § 1818;
(b) any and all procedural rights available in connection with the issuance of
this Order;
(c) any and all rights to a hearing and a final agency decision pursuant to
12 U.S.C. § 1818 and 12 C.F.R. Part 19;
(d) any and all rights to seek any type of administrative or judicial review of
this Order;
(e) any and all claims for fees, costs, or expenses against the OCC, or any of
its officers, employees, or agents related in any way to this enforcement
matter or this Order, whether arising under common law or under the
terms of any statute, including, but not limited to, the Equal Access to
Justice Act, 5 U.S.C. § 504 and 28 U.S.C. § 2412;
(f) any and all rights to assert these proceedings, the consent to and/or the
issuance of this Order, as the basis for a claim of double jeopardy in any
19
Case 3:21-md-02992-GPC-MSB Document 591-101 Filed 10/17/25 PageID.42957
Page 21 of 27
pending or future proceedings brought by the United States Department of
Justice or any other governmental entity; and
(g) any and all rights to challenge or contest the validity of this Order.
ARTICLE XIII
OTHER PROVISIONS
(1) As a result of this Order, the Bank is not:
(a) precluded from being treated as an “eligible bank” for the purposes of
12 C.F.R. Part 5, unless the Bank fails to meet any of the requirements
contained in subparagraphs (1) – (4) of 12 C.F.R. § 5.3, Definitions,
Eligible bank or eligible savings association, or is otherwise informed in
writing by the OCC;
(b) subject to the restrictions in 12 C.F.R. § 5.51 requiring prior notice to the
OCC of changes in directors and senior executive officers or the
limitations on golden parachute payments set forth in 12 C.F.R. Part 359,
unless the Bank is otherwise subject to such requirements pursuant to
12 C.F.R. § 5.51(c)(7)(i) and (iii); and
(c) precluded from being treated as an “eligible bank” for the purposes of
12 C.F.R. Part 24, unless the Bank fails to meet any of the requirements
contained in 12 C.F.R. § 24.2(e)(1)-(3) or is otherwise informed in writing
by the OCC.
(2) This Order supersedes all prior OCC communications issued pursuant to 12
C.F.R. §§ 5.3, 5.51(c)(7)(ii), and 24.2(e)(4).
20
Case 3:21-md-02992-GPC-MSB Document 591-101 Filed 10/17/25 PageID.42958
Page 22 of 27
ARTICLE XIV
CLOSING
(1) This Order is a settlement of the cease and desist proceedings against the Bank
contemplated by the OCC, based on the unsafe or unsound practices and/or violations of law
described in the Comptroller’s Findings set forth in Article II of this Order. The OCC releases
and discharges the Bank from all potential liability for a cease and desist order that has been or
might have been asserted by the OCC based on the practices and/or violations described in
Article II of this Order, to the extent known to the OCC as of the effective date of this Order.
Nothing in this Order, however, shall prevent the OCC from:
(a) instituting enforcement actions other than a cease and desist order against
the Bank based on the Comptroller’s Findings set forth in Article II of this
Order;
(b) instituting enforcement actions against the Bank based on any other
findings;
(c) instituting enforcement actions against institution-affiliated parties (as
defined by 12 U.S.C. § 1813(u)) based on the Comptroller’s Findings set
forth in Article II of this Order, or any other findings; or
(d) utilizing the Comptroller’s Findings set forth in Article II of this Order in
future enforcement actions against the Bank or its institution-affiliated
parties to establish a pattern or the continuation of a pattern.
(2) Nothing in this Order is a release, discharge, compromise, settlement, dismissal,
or resolution of any actions, or in any way affects any actions that may be or have been brought
21
Case 3:21-md-02992-GPC-MSB Document 591-101 Filed 10/17/25 PageID.42959
Page 23 of 27
by any other representative of the United States or an agency thereof, including, without
limitation, the United States Department of Justice.
(3) This Order is:
(a) a “cease-and-desist order issued upon consent” within the meaning of
12 U.S.C. § 1818(b);
(b) a “cease-and-desist order which has become final” within the meaning of
12 U.S.C. § 1818(e);
(c) an “order issued with the consent of the depository institution” within the
meaning of 12 U.S.C. § 1818(h)(2);
(d) an “effective and outstanding . . . order” within the meaning of 12 U.S.C.
§ 1818(i)(1); and
(e) a “final order” within the meaning of 12 U.S.C. § 1818(i)(2) and (u).
(4) This Order is effective upon its issuance by the OCC, through the Comptroller’s
duly authorized representative. Except as otherwise expressly provided herein, all references to
“days” in this Order shall mean calendar days and the computation of any period of time
imposed by this Order shall not include the date of the act or event that commences the period of
time.
(5) The provisions of this Order shall remain effective except to the extent that, and
until such time as, such provisions are amended, suspended, waived, or terminated in writing by
the OCC, through the Comptroller’s duly authorized representative. If the Bank seeks an
extension, amendment, suspension, waiver, or termination of any provision of this Order, the
Board or a Board-designee shall submit a written request to the Deputy Comptroller asking for
the desired relief. Any request submitted pursuant to this paragraph shall include a statement
22
Case 3:21-md-02992-GPC-MSB Document 591-101 Filed 10/17/25 PageID.42960
Page 24 of 27
setting forth in detail the circumstances that warrant the desired relief or prevent the Bank from
complying with the relevant provision(s) of the Order, and shall be accompanied by relevant
supporting documentation. The OCC’s decision concerning a request submitted pursuant to this
paragraph, which will be communicated to the Board in writing, is final and not subject to further
review.
(6) The Bank will not be deemed to be in compliance with this Order until it has
adopted, implemented, and adhered to all of the corrective actions set forth in each Article of this
Order; the corrective actions are effective in addressing the Bank’s deficiencies; and the OCC
has verified and validated the corrective actions. An assessment of the effectiveness of the
corrective actions requires sufficient passage of time for the Bank to demonstrate the sustained
effectiveness of the corrective actions.
(7) This Order is not a contract binding on the United States, the United States
Treasury Department, the OCC, or any officer, employee, or agent of the OCC and neither the
Bank nor the OCC intends this Order to be a contract.
(8) Each citation, issuance, or guidance referenced in this Order includes any
subsequent citation, issuance, or guidance that replaces, supersedes, amends, or revises the
referenced cited citation, issuance, or guidance.
(9) This Order applies to the Bank and all its subsidiaries.
(10) No separate promise or inducement of any kind has been made by the OCC, or by
its officers, employees, or agents, to cause or induce the Bank to consent to the issuance of this
Order.
(11) All reports, plans, or programs submitted to the OCC pursuant to this Order shall
23
Case 3:21-md-02992-GPC-MSB Document 591-101 Filed 10/17/25 PageID.42961
Page 25 of 27
be forwarded, by overnight mail or via email, to the following:
Robert Barnes
Examiner-in-Charge
National Bank Examiners
Bank of America, N.A.
201 N. Tryon Street, NC1-022-19-01
Charlotte, NC 28255
or other such individuals or addresses as directed by the OCC.
(12) The terms of this Order, including this paragraph, are not subject to amendment or
modification by any extraneous expression, prior agreements, or prior arrangements between the
parties, whether oral or written.
IN TESTIMONY WHEREOF, the undersigned, authorized by the Comptroller as his duly
authorized representative, has hereunto set her signature on behalf of the Comptroller.
//s// Digitally Signed, Dated: 2022.07.14
Tanya K. Smith
Deputy Comptroller
Large Bank Supervision
24
Case 3:21-md-02992-GPC-MSB Document 591-101 Filed 10/17/25 PageID.42962
Page 26 of 27
IN TESTIMONY WHEREOF, the undersigned, as the duly elected and acting Board of
Directors of the Bank of America, N.A., Charlotte, North Carolina have hereunto set their
signatures on behalf of the Bank.
/s/ 07/12/2022
Brian T. Moynihan Date
/s/ 13 Jul, 2022
Sharon L. Allen Date
/s/ 13 Jul, 2022
Frank P. Bramble, Sr. Date
/s/ 13 Jul, 2022
Pierre J.P. de Weck Date
/s/ 07/13/2022
Arnold W. Donald Date
/s/ 13 Jul, 2022
Linda P. Hudson Date
/s/ 12 Jul, 2022
Monica C. Lozano Date
/s/ 12 Jul, 2022
Lionel L. Nowell, III Date
/s/ 12 Jul, 2022
Denise L. Ramos Date
/s/ 13 Jul, 2022
Clayton S. Rose Date
25
Case 3:21-md-02992-GPC-MSB Document 591-101 Filed 10/17/25 PageID.42963
Page 27 of 27
/s/ 12 Jul, 2022
Michael D. White Date
/s/ 13 Jul, 2022
Thomas D. Woods Date
/s/ 12 Jul, 2022
R. David Yost Date
/s/ 07/13/2022
Maria T. Zuber Date
26
File and source
- File
- gov.uscourts.casd.709615.591.101.pdf
- Size
- 350,869 bytes
- SHA-256
- 6a869a7b60a355b5a9160d77e19c17b78cf7654e1a8595f645d2886c7f645656
- Original
- PACER (login required)