OCC’s New and Revised Sections of Policies and Procedures Manual Relating to Enforcement Actions Suggest Continued Heightened Interest in Actions Against Individuals
Summary
Historically, the Office of the Comptroller of the Currency (the “OCC”) has applied a single set of internal policies and procedures to enforcement actions brought against individuals (institution-affiliated parties (“IAPs”)) and institutions (national banks, federal savings associations, and federal branches and agencies of foreign banks (collectively, “banks”)). On November 13, the OCC issued a new section to its Policies and Procedures Manual (“PPM”) specific to enforcement actions against IAPs (the “IAP PPM”)[1] and simultaneously updated the existing sections for Bank Enforcement Actions and Related Matters (the “Bank PPM”)[2] and for Civil Money Penalties (“CMPs”) (the “CMP PPM”).[3] The new IAP PPM generally breaks no new ground, and most changes to the Bank PPM and CMP PPM align those two sections with, and reflect the issuance of, the IAP PPM. There are, however, several notable additions and modifications to the new and revised sections that serve to improve the clarity and transparency of the OCC’s enforcement action process.
Beyond those distinctions, the issuance of a standalone IAP PPM suggests a continued, if not increased, focus by the OCC on actions against IAPs going forward, and is consistent with the broader theme, evidenced over the last several years, of regulatory and law enforcement focus on holding individuals accountable in cases of financial institution wrongdoing.[4] The new OCC IAP PPM suggests a continual focus on holding individuals accountable for corporate misconduct in the financial industry.
Discussion
Several notable additions and modifications are unique to the new IAP PPM, while others apply to multiple sections of the PPM, and still others are unique to the CMP PPM. We discuss each in turn below.
1. IAP PPM
As noted above, the new IAP PPM does not significantly depart from previous policies and procedures and remains generally consistent with the Bank PPM and CMP PPM, particularly with respect to the internal OCC processes for preparing, reviewing, decision-making and recordkeeping for enforcement actions. The new IAP PPM, however, provides additional detail and tailors certain elements of the policies and procedures to provide greater clarity as to how the process applies to individuals. Of note are the following:
- Views on Statute of Limitations. The IAP PPM details the OCC’s views on applicable statutes of limitations—at least in the context of IAP actions. The Bank PPM and CMP PPM do not address this point. According to the IAP PPM, most IAP enforcement actions are subject to the general five-year federal statute of limitations found in 28 U.S.C. 2462. According to the IAP PPM, a claim will generally accrue either upon the IAP’s engaging in unlawful misconduct or upon the realization of the effect of such misconduct (g., loss to the bank).[5] Although the latter is not a novel position, IAPs should be cognizant that the contours of what qualifies as an “effect” is not well-defined, and that effects may be realized years after the relevant misconduct occurred. Along similar lines, the IAP PPM notes that, in certain situations, a claim may continue beyond five years from the initial occurrence of misconduct when, for example, there are multiple or continuing instances of misconduct.[6]
- Tailored 15-Day Letter Process. The IAP PPM provides for 15-day letters in all IAP enforcement actions, not just CMP It also provides that the OCC may proceed without issuing a 15-day letter “if appropriate,”[7] without detailing the circumstances in which it might be appropriate to proceed that way. In addition, the IAP PPM tailors the contents of a 15-day letter to an IAP by noting that, “In cases in which a CMP is also under consideration, the 15-day letter should solicit certain other information, including the IAP’s personal financial information [a factor the OCC is required by statute to consider].”[8] Although the IAP PPM cross-references the CMP PPM for any situation in which a CMP is under consideration,[9] the relationship between the IAP PPM and CMP PPM is somewhat unclear.
- Lack of Specificity With Respect to Timing. The IAP PPM affords the OCC broad leeway to “take IAP enforcement actions as soon as practical.” In so doing, the IAP PPM does little to encourage the timely resolution of IAP enforcement actions. The Bank PPM, in contrast, provides that, absent deputy comptroller approval, the OCC should present a proposed enforcement action within 180 days of the start of a supervisory activity that results in a formal written communication to the bank identifying certain issues.[10]
2. Multiple Sections of the PPM
Certain notable additions and modifications appear both in the revised CMP PPM and Bank PPM and in the new IAP PPM. These changes generally serve to improve the clarity and transparency of the enforcement action process, but also raise questions as to how they will work in practice.
- Acknowledgement that Enforcement Action May not Always be Warranted. The revised CMP PPM explicitly acknowledges that, even after the OCC has sent a 15-day letter, there may be circumstances in which the OCC determines that action is not warranted. The IAP PPM contains a similar acknowledgement.[11] Although neither the CMP PPM nor the IAP PPM describes the circumstances in which such a determination may be made, it is notable that the OCC has now acknowledged in formal guidance that it may be appropriate for the agency’s official position on the need for an enforcement action to change.[12] In the past, the OCC has been very unlikely to change its position after issuing a 15-day letter, so this guidance may indicate that the OCC may be more open to re-evaluation going forward.
- OCC Approval Required for Legally Required Disclosures. At times, the subject of a non-public or anticipated public enforcement action or the recipient of a subpoena may have independent legal or regulatory disclosure obligations (g., under securities law or foreign law). Notably, notwithstanding any such independent obligation, both the Bank PPM and the IAP PPM require a subject in these circumstances to submit a formal request to the OCC before making a disclosure. As disclosures at times must be made according to a timeline that may not align with the OCC’s timeline in acting on a formal disclosure request, this requirement may present challenges to institutions and IAPs.
- Discussion of Actions Meriting Specific News Releases. All three of the sections of the PPM discuss the public disclosure of enforcement actions,[13] while also noting, without elaboration, that, in addition to including an enforcement action in its routine monthly public disclosure of enforcement actions, the OCC may, “in certain cases,” issue a separate news release.[14] In the absence of detail as to the factors the OCC considers in determining the appropriateness of a news release, there will be continued uncertainty as to whether the OCC will issue a news release in any particular situation.
- Additional Detail Regarding Formal Investigation Process. The Bank PPM and IAP PPM provide guidelines as to when a formal investigation is appropriate and how a formal investigation is to be conducted.[15] The guidance notes that, upon commencing formal investigations through the issuance of an order of investigation, the supervisory office and OCC legal staff should prepare investigative plans that “focus on specific issues, describe investigatory steps, include time frames for completion, and be updated periodically as necessary.”[16] This requirement that OCC staff plan and narrowly scope formal investigations may provide banks and IAPs with greater certainty and predictability in the enforcement action process; however, this internal requirement will not itself provide banks or IAPs with a legal basis for challenging information requests or the overall scope or direction of an investigation.
3. CMP PPM
As part of the CMP PPM, the OCC includes matrices for the OCC to use when considering the appropriate amount of a CMP and related guidance. The matrices quantify the degree of severity of misconduct, with higher numbers generally reflecting progressive levels of severity, and the guidance provides explanatory detail. Aside from the additions and modifications to the CMP PPM noted above, other notable changes relate to these CMP matrices and related guidance:
- Adjustment to the “History of Violations” Factor in the Bank CMP Matrix. Interestingly, the CMP matrix applicable to banks substantially “swaps” the severity of two of the descriptions used to determine the weight to be afforded to an institution’s history of violations. Now, “prior unrelated repeat or recurring violations” is viewed as less severe than “at least one prior related violation.”[17] In addition, the most severe factor is now “prior related or recurring violations,” whereas historically “similar” such violations sufficed.[18] The OCC did not otherwise update the matrix guidance to conform to these changes, nor did it make similar changes to the corresponding factor in the IAP CMP matrix (which previously mirrored the bank CMP matrix). Accordingly, it is unclear whether these changes were inadvertent or instead intended to have practical significance.
- Limiting the Consideration of Previous Misconduct Outside the Statute of Limitations. Historically, in determining the weights to be afforded to previous concerns for similar violations and history of violations, the guidance accompanying both matrices permitted the OCC to consider evidence of misconduct without regard to its relation to the misconduct at issue and even if outside the statute of limitations. Now, the OCC may only consider evidence of related misconduct outside the statute of limitations.[19]
- Updates to Definition of “Unsafe or Unsound Practice.” In the guidance accompanying both matrices, the OCC adjusted the definition of “unsafe or unsound practice” to refer to “any action, or lack of action, which is contrary to generally accepted standards of prudent operation, the possible consequences of which, if continued, would be abnormal risk or loss or damage to an institution, its shareholders, or the Deposit Insurance Fund.” This aligns the definition with that typically used by the courts and federal banking agencies.
Footnotes
[1] Office of the Comptroller of the Currency, Institution-Affiliated Party Enforcement Actions and Related Matters, PPM 5310-13 (Nov. 13, 2018) (PDF: 193 KB), (hereinafter “IAP PPM”).
[2] Office of the Comptroller of the Currency, Bank Enforcement Actions and Related Matters, PPM 5310-3 (Nov. 13, 2018) (PDF: 249 KB), (hereinafter “Bank PPM”).
[3] Office of the Comptroller of the Currency, Civil Money Penalties, PPM 5000-7 (Nov. 13, 2018) (PDF: 201 KB), (hereinafter “CMP PPM”).
[4] For example, in 2015, then-acting Deputy Attorney General of the United States, Salley Quillian Yates, issued a memo listing six “key steps” Department of Justice attorneys are to take in order to determine whether and to what extent individuals should be held accountable for corporate misconduct. See “Individual Accountability for Corporate Wrongdoing” (Sept. 9, 2015) (PDF: 448 KB). In his confirmation hearing, the Chairman of the Securities and Exchange Commission, Jay Clayton, stated that “individual liability is the greatest deterrent” in preventing unlawful conduct. Brad Bennett, Alex Bourelly, and Bridget M. Moore, The 2017 SEC Enforcement Shift: Transition Lull or the New Normal? (Aug. 18, 2017).
[5] IAP PPM at 4.
[6] Id.
[7] Id. at 9.
[8] Id.; 12 U.S.C. 1818(i)(2)(G) (providing that “size of financial resources” is a factor agency must take into account in determining the size of a CMP).
[9] See id. at 5, 8.
[10] Bank PPM at 11.
[11] IAP PPM at 10.
[12] CMP PPM at 8.
[13] CMP PPM at 10; IAP PPM at 14; Bank PPM at 16.
[14] CMP PPM at 10; IAP PPM at 14; Bank PPM at 16.
[15] Bank PPM at 9; IAP PPM at 11.
[16] Bank PPM at 10; IAP PPM at 11.
[17] CMP PPM at 12.
[18] Id.
[19] Id. at 16, 17, 24.
Sullivan & Cromwell LLP comprises more than 875 lawyers who serve clients around the world through a network of 13 offices, located in leading financial centers in Asia, Australia, Europe and the United States. The Firm is headquartered in New York.
Disclaimer
The views, opinions and positions expressed within all posts are those of the author alone and do not represent those of the Program on Corporate Compliance and Enforcement (PCCE) or of New York University School of Law. PCCE makes no representations as to the accuracy, completeness and validity of any statements made on this site and will not be liable for any errors, omissions or representations. The copyright of this content belongs to the author and any liability with regards to infringement of intellectual property rights remains with the author.