M-25-32: Preventing Improper Payments and Protecting Privacy Through Do Not Pay (OMB, August 20, 2025)
Summary
Memorandum M-25-32, dated August 20, 2025, is addressed to heads of executive departments and agencies and is on the subject of Preventing Improper Payments and Protecting Privacy Through Do Not Pay. It provides guidance to help agencies implement Section 3(c) and (d) of EO 14249, which President Trump signed on March 25, 2025, and says Do Not Pay has been poorly managed over the last four years and has had limited impact on preventing improper payments. Appendix I, Routine Use for Do Not Pay, sets steps for each Senior Agency Official for Privacy by Friday, September 19, 2025, and requires notice in the Federal Register at least 30 days before the effective date of a new or modified routine use. Appendix II is titled Four-Year Waiver of Matching Agreement Requirement for Do Not Pay.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Cite this document
“M-25-32: Preventing Improper Payments and Protecting Privacy Through Do Not Pay (OMB, August 20, 2025).”
Original at www.whitehouse.gov. Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/omb-memo-m-25-32-preventing-improper-payments-do-not-pay-2025-08-20-026dfcad8c/
, SHA-256 e98fb587f34267273850357ed0955d5b1090831a5e2bb81754dbbfcfd39fabc5.Full text
EXECUTIVE OFFICE OF THE PRESIDENT
OFFICE OF MANAGEMENT AND BUDGET
WASHINGTON , D.C. 20503
THE D IRECTOR
August 20, 2025
M-25 -32
MEMORANDUM TO HEADS OF EXECUTIVE DEPARTMENTS AND AGENCIES
FROM: R~ssell T. Vought
Duector
G\'\l\ A ~
SUBJECT: Preventing Improper Payments and Protecting Privacy Through Do Not Pay
Overview
It is the policy of this Administration to promote financial integrity and ensure
accountability to American taxpayers. On March 25, 2025, President Trump signed Executive
Order (EO) 14249, Protecting America's Bank Account Against Fraud, Waste, and Abuse, 1
which requires Executive Branch agencies to take action to defend against financial fraud and
prevent improper payments in collaboration with the U.S. Department of the Treasury
(Treasury), the Federal Government's largest financial payment manager. The EO requires
effective use of Treasury's Do Not Pay Working System (Do Not Pay),2 which, to date, has
failed as a tool for comprehensive screening for improper payments to protect against waste,
fraud, and abuse. This Memorandum provides guidance to help agencies implement Section 3(c)
and (d) of EO 14249 to strengthen the Executive Branch' s capacity and flexibility to prevent
improper payments while preserving important safeguards under the Privacy Act of 1974
(Privacy Act).3
Background
The Payment Integrity Information Act of 2019 4 (PIIA) requires "[e]ach executive
agency ... [to] ensure that a thorough review of available databases with relevant information on
eligibility occurs to determine program or award eligibility and prevent improper payments
before the release of any Federal funds" and provides that "[f]or purposes of identifying and
preventing improper payments, each executive agency shall have access to, and use of, the Do
1 90 Fed. Reg. 14,011 (Mar. 28, 2025).
2 For purposes of this guidance, the Do Not Pay Working System is the same as the Initial Working System
identified in 31 U.S.C. § 3354(c). It includes Treasury ' s system ofrecords for Do Not Pay.
3 5 U.S .C. § 552a.
4 31 U.S.C. § 3351 et seq.
Not Pay Initiative to verify payment or award eligibility.” 5 In accordance with PIIA, Do Not Pay
contains a centralized portal that agencies can use to screen potential benefit recipients, vendors,
and other payees against databases that help determine their eligibility to receive the payment
and help agencies ensure the payment is made to the right recipient. To the detriment of the
American taxpayer, this tool has been poorly managed over the last four years and has had
limited impact on preventing improper payments. EO 14249 reaffirms this Administration’s
commitment to eliminating improper payments by enhancing the requirement for agencies to use
Do Not Pay as part of a pre-certification verification process for payment and award eligibility.6
The Director of the Office of Management and Budget (OMB) is responsible for issuing
guidance on Do Not Pay under PIIA, and is also required by the Privacy Act to provide guidance
and assistance to agencies implementing that statute’s requirements. 7 Consistent with the goals
of EO 14249, this Memorandum will enable agencies to access Do Not Pay more easily, while
protecting privacy, improving the ability to prevent waste and improper payments.
EO 14249 requires agency heads to “review and modify, as applicable, their relevant
system of records notices under the Privacy Act of 1974 to include a ‘routine use’ that allows for
the disclosure of records to the Department of the Treasury for the purposes of identifying,
preventing, or recouping fraud and improper payments, to the extent permissible by law,” within
90 days of that order. 8 Additionally, the EO emphasizes the need “to minimize administrative
barriers to accessing and using data to prevent fraud and improper payments by exercising the
authority in 31 U.S.C. 3351 et seq. to waive [the procedural requirements of the Privacy Act to
enter into matching agreements] . . . in any case or class of cases for computer matching
activities, to the extent permissible by law.” 9
As agencies take the actions required by EO 14249, they are responsible for following the
guidance provided in this Memorandum, consistent with law and policy, including the detailed
instructions provided in Appendix I, Routine Use for Do Not Pay, and Appendix II, Four-Year
Waiver of Matching Agreement Requirement for Do Not Pay. This guidance complements other
OMB guidance on Do Not Pay and the Privacy Act. 10 The term improper payment is defined at
31 U.S.C. § 3351(4); in this Memorandum, this term includes fraudulent transactions. Given the
focus of this Memorandum on Privacy Act requirements, the terms agency, individual, maintain,
record, system of records, routine use, matching program, Federal benefit program, and Federal
personnel have the meanings given those terms in the Privacy Act. 11
5
Id. § 3354(a)(1), (b)(3).
6
Executive Order 14249, § 3(b).
7
5 U.S.C. § 552a(v).
8
Executive Order 14249, § 3(d).
9
Id. § 3(c).
10
E.g., Appendix C to OMB Circular No. A-123, Requirements for Payment Integrity Improvement (March 5,
2021); OMB Circular No. A-108, Federal Agency Responsibilities for Review, Reporting, and Publication under the
Privacy Act (Dec. 2016).; Privacy Act Implementation: Guidelines and Responsibilities, 40 Fed. Reg. 28,948,
28,961 (July 9, 1975); Final Guidance Interpreting the Provisions of Public Law 100-503, the Computer Matching
and Privacy Protection Act of 1988, 54 Fed. Reg. 25,818, 25,826 (June 19, 1989).
11
See 5 U.S.C. § 552a(a)(1), (2), (3), (4), (5), (7), (8), (12), (13).
2
While the goal of this guidance is to increase the Federal Government’s efficiency in
preventing improper payments, it is also important to acknowledge that sharing personally
identifiable information can present risk to individuals without appropriate safeguards for
privacy. EO 14249 recognized this risk in directing the Secretary of the Treasury and agency
heads to “take all necessary steps to protect classified information and systems, as well as
personally identifiable information and tax return information, through the implementation of
this order.” 12
OMB Assistance
Agencies may submit questions about this Memorandum to OMB via the following email
address: privacy-oira@omb.eop.gov. For other questions about implementation of EO 14249,
agencies should email the following address: BankAccountEO@omb.eop.gov.
Appendix
12
Executive Order 14249, § 7(c).
3
APPENDIX I: Routine Use for Do Not Pay
The Privacy Act prohibits agencies from disclosing “any record which is contained in a
system of records by any means of communication to any person, or to another agency” without
the prior written consent of the individual to whom the record pertains, unless an exception
applies. 13 One exception is for a “routine use” published in an agency’s system of records notice
(SORN) 14 that allows for a disclosure that is compatible with the purpose for which the
information was collected. 15 EO 14249 requires agency heads to “review and modify, as
applicable, their relevant system of records notices under the Privacy Act of 1974 to include a
‘routine use’ that allows for the disclosure of records to the Department of the Treasury for the
purposes of identifying, preventing, or recouping fraud and improper payments, to the extent
permissible by law,” within 90 days of that order. 16
By that same deadline, EO 14249 required agency heads to submit a compliance plan to
the OMB Director detailing their implementation strategies. 17 In April 2025, OMB and Treasury
provided to agency Chief Financial Officers instructions on the development and submission of
such a compliance plan by June 23, 2025. Those instructions directed agencies to identify
actions they are taking to review and modify relevant SORNs for purposes of implementing the
routine use provision in Section 3(d) of EO 14249, which is a responsibility of Senior Agency
Officials for Privacy.
a. Routine Use and Compliance Timeline
In accordance with Section 3(d) of EO 14249, each Senior Agency Official for Privacy, 18
in consultation with the agency’s Chief Financial Officer and Chief Information Officer, is
required to take the following steps:
i. By Friday, September 19, 2025
1. Identify which of the agency’s systems of records maintain information about
applicants for, or recipients of, Federal funds that agencies use to make eligibility
determinations for payments to beneficiaries, award and loan recipients, vendors,
contractors, and other payees;
2. Determine which of the identified systems of records maintain information whose
disclosure to Treasury would be relevant and necessary for identifying, preventing, or
recouping improper payments by reviewing payment and award eligibility through
the Do Not Pay Working System; and
13
5 U.S.C. § 552a(b).
14
Id. § 552a(e)(4).
15
Id. § 552a(a)(7).
16
Executive Order 14249, § 3(d).
17
Id. § 7(a).
18
The Senior Agency Official for Privacy has agency-wide responsibility and accountability for the agency’s
privacy program, and is responsible for ensuring that “the agency complies with applicable privacy requirements in
law, regulation, and policy.” OMB Memorandum M-16-24, Role and Designation of Senior Agency Officials for
Privacy (Sept. 15, 2016).
Page 1 of 3
3. Report to OMB and Congress in accordance with OMB Circular No. A-108 19 any
proposal(s) to add the following routine use to the agency’s SORN(s) or to modify an
existing routine use in the agency’s SORN(s) so that it conforms to the following
routine use.
Routine Use
To the U.S. Department of the Treasury when disclosure of the information is relevant to
review payment and award eligibility through the Do Not Pay Working System for the
purposes of identifying, preventing, or recouping improper payments to an applicant for,
or recipient of, Federal funds, including funds disbursed by a state (meaning a state of
the United States, the District of Columbia, a territory or possession of the United States,
or a federally recognized Indian tribe) in a state-administered, federally funded program.
ii. Expeditiously (to the extent permissible by law, usually within two weeks of the date
on which OMB has concluded review of a proposal to modify a system of records),
address any comments from OMB and Congress 20 and submit the modified SORN(s) for
publication in the Federal Register. 21
iii. Subsequently, when establishing a new system of records that meets the criteria in
(a)(i), include the routine use provided in this Memorandum in the agency’s SORN.
b. Additional Guidance
The following guidance is intended to assist agencies in carrying out these requirements
in compliance with law and policy:
i. Customization of the Routine Use. Agencies are required to include the version of the
routine use provided in this Memorandum in relevant agency SORNs. This requirement
is intended to standardize agencies’ approach to disclosing records to Do Not Pay. An
agency, however, may add more specific language to its routine use to meet legal,
regulatory, or policy requirements. For example, an agency may need to include a
limitation on the categories of records disclosed.
ii. Modification of an Existing Routine Use. If a SORN already includes a routine use
with the same category of users and purpose of use, the agency must still update the
routine use to make it conform with the routine use provided in this Memorandum.
Generally, the modification of a routine use is considered a significant change that
requires reporting the proposal to OMB and Congress and publishing a notice in the
Federal Register. 22
19
OMB Circular No. A-108, § 7.
20
Id. § 7(b).
21
If OMB concludes review before its typical 30-day review period has ended, that does not waive the adequate
advance notice that is required to Congress.
22
See OMB Circular No. A-108, § 6(b)(8).
Page 2 of 3
iii. Other Modifications to the System of Records. When including a new or modified
routine use, agencies should consider whether other modifications to the system of
records and its SORN are necessary (e.g., updates to the purpose(s) of the system).
iv. Consolidation of the Report. Consistent with OMB Circular No. A-108, when adding
the routine use to multiple SORNs concurrently, agencies may submit a single,
consolidated report to OMB (and a single, consolidated report to Congress) describing
the changes. 23 However, the changes must be properly reflected in all of the published
SORNs that the agency has determined should include the routine use. 24
v. Publication in the Federal Register. As required by the Privacy Act, agencies must
publish an appropriate notice 25 in the Federal Register with any new or modified routine
use at least 30 days before the effective date of the routine use. 26 Once the notice is
published in the Federal Register, “[a]n agency shall not disclose any records pursuant to
a new or modified routine use until after the 30-day comment period has ended and the
agency has considered any comments from the public and determined that no further
modifications are necessary.” 27
vi. Relevant and Necessary Disclosure. When making a disclosure to Treasury pursuant to
the routine use, agencies must only disclose the specific information elements that are
directly relevant to identify, prevent, or recoup improper payments through Do Not
Pay. 28
23
Id. § 7(f).
24
Id.
25
As stated in OMB Circular No. A-108, § 6(k): “Agencies are strongly encouraged to publish all routine uses
applicable to a system of records in a single Federal Register notice for that system. However, some agencies
choose to publish a separate notice of routine uses that are applicable to many systems of records at the agency, and
then incorporate them by reference into the notices for specific systems to which they apply. When incorporating
such routine uses by reference, agencies shall ensure that the routine use section of the SORN clearly indicates
which of the separately published routine uses apply to the system of records and includes the Federal Register
citation where they have been published.”
26
See 5 U.S.C. § 552a(e)(11).
27
OMB Circular No. A-108, § 6(k).
28
Section 3(e) of EO 14249 highlights health records as an example of information that would not be necessary to
disclose for the purpose of verifying payment information or detecting and preventing improper payments.
Page 3 of 3
APPENDIX II: Four-Year Waiver of Matching Agreement Requirement for Do Not Pay
The Privacy Act includes a series of requirements that apply when agencies engage in a
matching program. 29 Generally, a matching program is a computerized comparison of records
from two or more automated systems of records maintained by Federal agencies, or an
automated system of records and automated records maintained by a non-Federal agency (or
agent thereof). One of the requirements for matching programs is for the participating agencies
to enter into a matching agreement, which is a written agreement specifying important details
about the matching program. This requirement helps to ensure that the matching program is
conducted in a manner that ensures accountability, due process, information quality, data
minimization, security, and transparency. 30 Congress, however, recognized a need for flexibility
in how agencies implement these safeguards for matching programs conducted under Do Not
Pay.
PIIA states that “[t]he head of the agency operating the [Do Not Pay] Working System
may, in consultation with the Office of Management and Budget, waive the requirements of
section 552a(o) of title 5 in any case or class of cases for computer matching activities conducted
under this section.” 31 EO 14249 emphasizes this flexibility in directing the Secretary of the
Treasury “to minimize administrative barriers to accessing and using data to prevent fraud and
improper payments by exercising the authority in 31 U.S.C. 3351 et seq. to waive the
requirements of 5 U.S.C. 552[a](o), in consultation with the OMB Director, in any case or class
of cases for computer matching activities, to the extent permissible by law.” 32
To facilitate matching activities for Do Not Pay, this Memorandum provides guidance to
establish requirements governing such waivers, in accordance with the OMB Director’s authority
in the PIIA. 33 A waiver is not required for any Do Not Pay activity that is not part of a matching
program because such activities are not subject to the requirement for a computer matching
agreement at 5 U.S.C. § 552a(o). Thus, although the eligibility criteria below define the scope of
the waiver to be granted by Treasury under PIIA, 34 the waiver criteria do not limit use of Do Not
Pay in circumstances in which the matching requirements of the Privacy Act do not apply.
29
A matching program pertains to either (1) Federal benefit programs or (2) Federal personnel or payroll records. A
Federal benefit program is defined at 5 U.S.C. § 552a(a)(12) to mean “any program administered or funded by the
Federal Government, or by any agent or State on behalf of the Federal Government, providing cash or in-kind
assistance in the form of payments, grants, loans, or loan guarantees to individuals.” A Federal benefit match is
performed for purposes of determining or verifying eligibility for payments under Federal benefit programs,
verifying compliance with the requirements of such programs, or recouping payments or delinquent debts under
such programs. A matching program involves not just the matching activity itself, but also the investigative follow-
up and ultimate action, if any. See U.S.C. § 552a(a)(8); see also Appendix C to OMB Circular No. A-123, § VIII.
30
See 5 U.S.C. § 552a(o).
31
31 U.S.C. § 3354(b)(3)(B)(i).
32
Executive Order 14249, § 3(c). Although the quoted text from Section 3(c) of the Federal Register version of EO
14249 refers to “5 U.S.C. 552(o),” 5 U.S.C. § 552a(o) is correctly cited in the version of the EO on the White House
website at https://www.whitehouse.gov/presidential-actions/2025/03/protecting-americas-bank-account-against-
fraud-waste-and-abuse/.
33
31 U.S.C. § 3354(b)(3)(B)(ii).
34
Id. § 3354(b)(3)(B).
Page 1 of 5
a. Eligibility Criteria for Waiver
Following appropriate evaluation and documentation of the benefits and risks, Treasury,
in consultation with OMB, will grant a forthcoming four-year waiver of the requirement for
entering into 35 a matching agreement under 5 U.S.C § 552a(o) for the class of matching
programs that meet all of the following criteria:
i. The only purposes of the matching program are identifying and preventing improper
payments and conducting any related recovery activities by verifying through Do Not Pay
prepayment or pre-award eligibility.
ii. The matching program involves one or more databases contained in Do Not Pay during
the period in which the waiver is in effect.
iii. The matching program involves either:
1. one payment-certifying agency’s 36 system(s) of records that maintain(s) information
relevant and necessary for verifying payment or award eligibility and related recovery
activities; or
2. a state, 37 or agency thereof, responsible for reducing improper payments of a state-
administered, federally funded program.
iv. The matching program involves verifying prepayment or pre-award eligibility in one or
more of the eligible object classes identified in the following table, as defined in OMB
Circular No. A-11, 38 or any other object classes specified by Treasury, in consultation
with OMB.
35
Agencies should continue to observe the requirements of existing matching agreements in place as of the issuance
of this waiver until their expiration. This waiver may apply to matching programs that are established or re-
established during the period in which this waiver is in effect.
36
The payment-certifying agency is a Federal agency in the Executive Branch that has the authority to issue a
payment or award and engages in a matching program for the purposes of determining or verifying eligibility for the
payment or award.
37
This Memorandum defines a state as a state of the United States, the District of Columbia, a territory or
possession of the United States, or a federally recognized Indian tribe, in alignment with 31 U.S.C. § 3351(8).
38
OMB Circular No. A-11, Preparation, Submission, and Execution of the Budget (July 25, 2024), § 83.
Page 2 of 5
Object Classes Eligible for Waiver Object Classes Not Eligible for Waiver
12.1 – Civilian personnel benefits 11.1 – Full-time permanent 39
12.2 – Military personnel benefits 11.3 – Other than full-time permanent
13.0 – Benefits for former personnel 11.5 – Other personnel compensation
25.1 – Advisory and assistance services 11.6 – Military personnel – basic allowance
25.2 – Other services from non-Federal for housing
sources 11.7 – Military personnel
25.3 – Other goods and services from Federal 11.8 – Special personnel services payments
sources 21.0 – Travel and transportation of persons
25.4 – Operation and maintenance of facilities 22.0 – Transportation of things
25.5 – Research and development contracts 23.1 – Rental payments to GSA
25.6 – Medical care 23.2 – Rental payments to others
25.7 – Operation and maintenance of 23.3 – Communications, utilities, and
equipment miscellaneous charges
25.8 – Subsistence and support of persons 24.0 – Printing and reproduction
26.0 – Supplies and materials 43.0 – Interest and dividends
31.0 – Equipment 91.0 – Unvouchered
32.0 – Land and structures 92.0 – Undistributed
33.0 – Investments and loans 94.0 – Financial transfers
41.0 – Grants, subsidies, and contributions
42.0 – Insurance claims and indemnities
44.0 – Refunds
The waiver will be in effect for four years from its issuance. During that period, Treasury
will report annually to OMB on the effectiveness of this approach to preventing improper
payments and safeguarding privacy, in accordance with reporting requirements to be set by
OMB. At least six months before the end of the four-year period, Treasury, in consultation with
OMB, will make a determination about the continuation of this waiver.
b. Requirements to Receive Waiver
No written request for a waiver is needed for matching programs that meet these
criteria, 40 provided that the payment-certifying agency (or state, or agency thereof) and Treasury
comply with the following requirements before conducting the matching program:
i. Data Sharing Agreement. Any payment-certifying agency or state (or agency thereof)
making use of this waiver must first establish a written data sharing agreement with
Treasury 41 that describes the terms of the matching program, including how both parties
will safeguard the records involved. At a minimum, the data sharing agreement must
specify:
39
Object classes 11.1 through 11.8 relate to personnel compensation.
40
This guidance replaces the following sentences from Appendix C to OMB Circular No. A-123, § IV(E)(5)(a):
“To request a CMA waiver for matching programs, agencies must send a CMA Waiver Request to Treasury. CMA
Waiver Requests will be handled and evaluated by Treasury based on procedures and criteria established by OMB.”
41
This data sharing agreement may be the same as the one Treasury establishes when onboarding Do Not Pay users.
Page 3 of 5
1. the categories of records that will be matched, including each data element;
2. procedures for verifying information produced in such matching program; 42
3. procedures for ensuring the administrative, technical, and physical security of the
records matched and the results of such program;
4. prohibitions on duplication and redisclosure of records provided by the payment-
certifying agency (or state, or agency thereof), except where required by law or
essential to the conduct of the matching program; and
5. procedures governing the use of records provided by the payment-certifying agency
(or state, or agency thereof), including return of the records to the payment-certifying
agency (or state, or agency thereof) or destruction of records used in the matching
program.
ii. Reporting to OMB and Congress. Any agency making use of this waiver must still
report to OMB and Congress any proposal to establish, re-establish, or significantly
modify a matching program. 43 The transmittal letter for the report to OMB and Congress
must include confirmation that the data sharing agreement required by this Memorandum
has been signed by the payment-certifying agency (or state, or agency thereof) and
Treasury. When concurrently establishing, re-establishing, or significantly modifying
multiple matching programs that involve the Do Not Pay Working System, agencies may
submit a single, consolidated report to OMB (and a single, consolidated report to
Congress) describing the changes.
iii. Matching Notice. Any agency making use of this waiver must still publish notice of the
matching program in the Federal Register. The agency may not conduct the new, re-
established, or significantly modified matching program until after the required 30-day
public comment period has ended. 44 The matching notice must comply with OMB
Circular No. A-108 requirements and must explain in the Supplementary Information
section that a waiver of the matching agreement requirement under 5 U.S.C § 552a(o) has
been granted.
iv. Compliance with Privacy Act Requirements. Any agency making use of this waiver
must still comply with all other applicable requirements of the Privacy Act. For example,
a waiver of the matching agreement requirement under 5 U.S.C. § 552a(o) does not affect
the requirement at 5 U.S.C. § 552a(p)(1)(A) for the agency to independently verify
information produced by the matching program, or the requirement at 5 U.S.C.
§ 552a(p)(1)(B) for the agency to provide an individual with notice containing a
statement of the agency’s findings and informing the individual of the opportunity to
42
5 U.S.C. § 552a(p).
43
See OMB Circular No. A-108, § 9(c).
44
5 U.S.C. § 552a(e)(12).
Page 4 of 5
contest such findings. Agencies should not adopt practices that deliberately avoid the
reach of the Privacy Act where compliance would otherwise be required. 45
v. Privacy Act Training. Agencies making use of this waiver must conduct annual,
mandatory role-based training on applicable Privacy Act requirements for agency
officials involved in conducting the matching program.
45
For example, the matching requirements of the Privacy Act apply to all matching activities that involve a subset of
records from a system of records when the subset of records itself would meet the definition of system of records in
the Privacy Act, so long as the other qualifications in the statute are met.
Page 5 of 5
File and source
- File
- omb-memo-m-25-32-preventing-improper-payments-do-not-pay-2025-08-20.pdf
- Size
- 1,376,852 bytes
- SHA-256
- e98fb587f34267273850357ed0955d5b1090831a5e2bb81754dbbfcfd39fabc5
- Original
- www.whitehouse.gov