Confidential Investigations of Bank Activities

by Manatt, Phelps & Phillips, LLP

Scenario:  In the course of a safety and soundness examination, the bank examiners identify certain unusual transactions and bring the issue to the attention of management. Management, in turn, recognizing the potential severity of the issue presented, decides that the matter should be referred to the Audit Committee of the Board of Directors of the bank for appropriate action. Now what?

Not every issue with the potential for substantial risk of financial or reputational loss warrants a special investigation conducted by outside, independent counsel. However, if the circumstances suggest the possibility of significant employee or customer negligence or misconduct or violations of law or regulations, the prompt authorization of a full, independent and confidential investigation may be the best approach, particularly since it demonstrates to regulatory authorities that the Board and bank management acted with both dispatch and a desire to correct any identified deficiencies. Of course, authorizing and conducting a confidential investigation is separate from, and does not supplant, the requirement that the bank file any necessary suspicious activity reports. Here are some of the key issues to be considered for the confidential investigation.

Who Is the Client?
While the bank management could authorize the investigation and hire independent counsel, it is more common for the Board of Directors to authorize formally the investigation and to delegate to the Board's Audit Committee the responsibility of hiring independent counsel and overseeing the investigation. In this case, the client is the Audit Committee, and the engagement of counsel and other third-party specialists is done through the Committee.

Preserving Privilege and Confidentiality
It is extremely important that the final report of independent counsel and all work product produced in the course of the investigation be protected from mandatory disclosure to third parties, particularly what otherwise might be required in litigation that might arise as a consequence of the investigation or otherwise. Unless otherwise waived by the client's disclosure, the attorney-client privilege and the attorney work product doctrine should protect both the contents of the final report and the work product produced in the course of the investigation from discovery by third parties. See, for example, Rule 26(b)(3) of the Federal Rules of Civil Procedure; section 2018.30 of the California Code of Civil Procedure. Disclosure to bank regulatory agencies under circumstances where privilege is protected is discussed below.

Initial Focus of the Investigation
It is extremely important that upon being retained, counsel understand the nature and potential breadth of the investigation. This requires that counsel be fully conversant with both banking law and regulation as well as banking practice and the regulatory interaction between a bank and its regulators. To this end, there should be an early meeting with the client to enable counsel to fully appreciate the relevant facts and circumstances as well as those facts which will need to be determined in the course of the investigation and which will form the basis of the conclusions the report will reach. This may include any relevant communications with the bank regulatory agencies and recent Reports of Examination issued to the bank to determine if the issues previously were brought to the attention of the bank.

Managing the Investigation Environment
In any organization, banks included, word of an outside investigation often triggers rumors and "water cooler" speculation. This is especially true if the discussions and actions taken at a Board meeting authorizing a confidential investigation become known. It is important to keep the gossips at bay by a carefully planned and monitored program initiated by senior management of keeping a tight lid on the confidential investigation while making sure that all who have need to know of the ongoing investigation are aware that the investigation process was authorized by the Board. Once the plan of the investigation has been established, managers must be alerted to the need for complete cooperation and confidentiality in the ranks.

At the same time, management should manage the reputation risk that might arise during and at the conclusion of the investigations by utilizing public relations consultants in order to be ready to address any public notoriety that might arise.

Forensic Assistance
Counsel should consider retaining investigators, forensic accountants, e-discovery vendors, and other consultants as appropriate given the nature and scope of the investigation. It is of course important that these consultants be retained by counsel to preserve the attorney-client and work product privileges. In turn, the plan for the confidential investigation should include the views of those consultants. Ordinarily, the use of the bank's internal forensic skills (such as the internal audit department) should be minimized or discouraged, notwithstanding any potential cost savings, so as to protect the work product from disclosure to third parties. The cost of this forensic assistance is borne by the bank.

Establishing the Plan of Investigation
What is Being Investigated? - Unless the client and counsel have a clear understanding of the precise nature of the investigation, with a laser-like focus, a confidential investigation at a bank can easily veer off into areas that may have only a tangential connection to the matter under inquiry. This is especially true because policies and procedures are an integral part of banking operations and something that bank regulatory authorities examine regularly as part of a safety and soundness examination. The tendency is to want to cover every possible angle that might assist in the final analysis of the facts and circumstances at issue. The risk is that time and resources are spent on ultimately unnecessary tasks. In this connection, the judgment of counsel of what is material to the investigation must be followed or the entire investigation runs the risk of being deemed a "whitewash."

Establishment of Investigation Team Leadership - In a confidential investigation, experience is the key. Counsel must have a clear understanding of the issues and of the methodology that needs to be followed. Often, this leadership is best exemplified by counsel with law enforcement experience, such as is provided by service with a U.S. Attorney's Office, jointly operating with counsel thoroughly familiar with banking law and regulation and bank operations.

Document Preservation and Collection - In today's business environment, electronic records are prevalent but not necessarily the only means of communication. This means that the client has to take instructions from counsel in causing the safeguarding and production of all relevant records, which would include business records, e-mail communications to and from relevant bank employees, video recordings of bank activities and records provided by third-party vendors, if relevant. Counsel has to have access to all these records in an efficient manner. In order to preserve the evidentiary value of these materials, it is often necessary for counsel to retain an independent third-party e-discovery vendor to collect and process this information. The failure to adequately preserve relevant documents and electronic materials can result in regulatory criticism, imposition of monetary, evidentiary or issue sanctions in subsequent civil litigation, and, in egregious situations, obstruction of justice prosecutions.

Scheduling Interviews - While the review of records and other documents provides counsel with invaluable insight into the activities being investigated, nevertheless, interviewing witnesses, particularly employees of the bank, generally provides critical information for the investigation. Employees risk their jobs by failing to cooperate. However, third parties cannot be compelled to be subject to an interview and often this requires the intervention of the client to arrange.

Employee interviews should be conducted in the presence of counsel and any relevant forensic assisting parties. It is particularly important that the retained investigator be present to ask questions but also to document the interview for later use by counsel.

Investigative Analysis - Since the results of the investigation will normally be documented in a written report, the analysis of documents, investigatory material and interview notes forms the basis for the ultimate report. The input of all parties is essential to this process. Thus, any estimate of the time necessary to complete a confidential investigation must take into account the considerable time normally devoted to the investigative analysis and the writing of the report. Often the need for another round of follow-up interviews or further document reviews becomes apparent as the primary actions and results are reviewed and analyzed.

Conducting Interviews
As noted above, employee interviews are critical once the other elements of the investigation are in place. Generally, interviews are most productive when they are not conducted as adversarial interrogations but rather as mere fact-finding activities. However, to protect the bank, certain procedural requirements are necessary. These are often referred to as the Upjohn warnings, so called because of a U.S. Supreme Court case in which they were first elucidated. They can be summarized as follows:

  • Counsel has been retained at the direction of the Board of Directors of the Bank to conduct a confidential investigation into certain bank-related issues.
  • Counsel represents the Board and does not represent any individual employee of the Bank or the interviewee.
  • The substance of the interview is covered by the attorney-client privilege since the interviewee is an employee of the Bank and is being interviewed in that capacity. This means that the interview must be kept confidential and may not be discussed with anyone.
  • The interview may not discuss the substance of the interview with any other employee, officer or other person at the Bank, or indeed any person outside the Bank.
  • The attorney-client privilege belongs to the Board of Directors of the Bank and the Bank Board may decide to waive the privilege and share the substance of the interview with third parties outside the Bank, including regulatory authorities and law enforcement agencies.

Human Resources Considerations
If the employee to be interviewed requests that she/he be represented by separate counsel during the interview, that request should be considered in light of all of the facts and circumstances of the investigation and that particular individual's role. The bank may be obligated to pay the cost of such counsel - or may have the discretion to do so - under applicable state corporate and employment laws. Also, it is possible that in the course of the investigation counsel may become aware of employee conduct that may warrant that personnel action be taken by the bank. For that reason, employment counsel for the bank should be consulted before the bank initiates any personnel action, both as to the process to be undertaken and the appropriate timing of it.

Often, interviews of bank employees reveal incidents or lapses that suggest the interviewed employee should be disciplined. This runs the risk of the employee claiming that she/he is a whistle-blower and that the discipline is retaliatory because of the information revealed in the course of the investigation. No personnel action of this kind should be taken without consultation with the bank's employment counsel, since it could end up creating potential exposure for the bank.

Periodic Reporting to Client
Prior to the rendition of the final report, it is normal for counsel to brief client's representative as to the progress of the investigation. This often will include keeping the client abreast of costs and expenses being incurred.

Written Report
At the conclusion of the investigation, it is customary to deliver to the Board of Directors (or a designated committee of the Board) a written report containing the findings of the investigation together with observations concerning matters made apparent to the investigating team and any recommendations for correcting deficient or improper behavior based on the conclusions reached in the investigation.

The final report should be transmitted with a clear statement that it is subject to the attorney-client privilege and the attorney work product privilege. In addition, the report should contain an admonition that the report is confidential and that dissemination of the report to third parties will constitute a waiver of the privilege that could subject the report to discovery by third parties if private litigation or regulatory or criminal proceedings were to be commenced thereafter.

Bank Regulators
It is not uncommon for the applicable banking regulators to ask for a copy of the final report, particularly if the matter that is the subject of the confidential investigation was identified by the regulators in the course of a bank examination. In this connection, absent other considerations, the bank should be comfortable in delivering the report because the submission of any information to any federal, state or foreign banking authority in the course of a supervisory or regulatory process concerning the bank will not waive, destroy or otherwise affect any applicable privileges. See Section 18(x) of the Federal Deposit Insurance Act, 12 U.S.C. Section 1828(x).

There has been a recent trend for bank regulators to want to review not only any written report of a confidential investigation but also to review the materials used by counsel in formulating its conclusions and to interview counsel as to the process and procedures that were undertaken in conducting the investigation. Counsel should be prepared for these additional requests, and to defend the objectivity and independence of the investigation.

Other Disclosures
It is important to note that the statute noted above does not protect disclosure to other parties, such as the bank's outside auditors, law enforcement agencies and, if the bank's shares (or that of its holding company) are publicly traded, the Securities and Exchange Commission. Thus any desired or requested disclosure to these parties must be considered only in the light of other privileges that may apply and thus protect against third-party disclosure. The bank also should be aware that the bank regulatory agencies could make formal criminal referrals to federal or state prosecutors if the investigation identifies any apparent criminal activity by employees or bank customers. Also, a criminal investigation could result from the filing of any suspicious activity reports relating to conduct identified as part of the confidential investigation.

Public Disclosure
If the bank or its holding company is a public company, consideration will have to be given to the need for timely public disclosure of the material facts and circumstances set forth in the report. The bank's securities counsel should be consulted in this regard.

Follow-On Action by the Board
The delivery and presentation of the report of the confidential investigation is not the end of the process but, rather, the beginning. The identification of lapses, deficiencies, failures to follow bank policies and procedures and failure to comply with applicable law and regulation will require that corrective steps be taken. It is the Board's responsibility as part of its oversight function to assure that management takes the appropriate remedial actions.

Banks operate today under a regulatory microscope. If the regulatory agencies deem the identified conduct as pervasive and egregious, formal regulatory action may be taken against the bank such as a cease and desist order. The Board will play a major role in the negotiation and implementation of such an order.

Given the headlines in the financial press about wrongdoing at a number of large institutions and the continued pressure on directors and officers of failed banks to be charged with liability for losses incurred by the Deposit Insurance Fund, it is safe to assume that there will be increasing calls for confidential investigations, whether initiated by regulatory inquiry or by attentive boards of directors.


DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Manatt, Phelps & Phillips, LLP | Attorney Advertising

Written by:

Manatt, Phelps & Phillips, LLP

Manatt, Phelps & Phillips, LLP on:

Readers' Choice 2017
Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
Sign up using*

Already signed up? Log in here

*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
Privacy Policy (Updated: October 8, 2015):

JD Supra provides users with access to its legal industry publishing services (the "Service") through its website (the "Website") as well as through other sources. Our policies with regard to data collection and use of personal information of users of the Service, regardless of the manner in which users access the Service, and visitors to the Website are set forth in this statement ("Policy"). By using the Service, you signify your acceptance of this Policy.

Information Collection and Use by JD Supra

JD Supra collects users' names, companies, titles, e-mail address and industry. JD Supra also tracks the pages that users visit, logs IP addresses and aggregates non-personally identifiable user data and browser type. This data is gathered using cookies and other technologies.

The information and data collected is used to authenticate users and to send notifications relating to the Service, including email alerts to which users have subscribed; to manage the Service and Website, to improve the Service and to customize the user's experience. This information is also provided to the authors of the content to give them insight into their readership and help them to improve their content, so that it is most useful for our users.

JD Supra does not sell, rent or otherwise provide your details to third parties, other than to the authors of the content on JD Supra.

If you prefer not to enable cookies, you may change your browser settings to disable cookies; however, please note that rejecting cookies while visiting the Website may result in certain parts of the Website not operating correctly or as efficiently as if cookies were allowed.

Email Choice/Opt-out

Users who opt in to receive emails may choose to no longer receive e-mail updates and newsletters by selecting the "opt-out of future email" option in the email they receive from JD Supra or in their JD Supra account management screen.


JD Supra takes reasonable precautions to insure that user information is kept private. We restrict access to user information to those individuals who reasonably need access to perform their job functions, such as our third party email service, customer service personnel and technical staff. However, please note that no method of transmitting or storing data is completely secure and we cannot guarantee the security of user information. Unauthorized entry or use, hardware or software failure, and other factors may compromise the security of user information at any time.

If you have reason to believe that your interaction with us is no longer secure, you must immediately notify us of the problem by contacting us at In the unlikely event that we believe that the security of your user information in our possession or control may have been compromised, we may seek to notify you of that development and, if so, will endeavor to do so as promptly as practicable under the circumstances.

Sharing and Disclosure of Information JD Supra Collects

Except as otherwise described in this privacy statement, JD Supra will not disclose personal information to any third party unless we believe that disclosure is necessary to: (1) comply with applicable laws; (2) respond to governmental inquiries or requests; (3) comply with valid legal process; (4) protect the rights, privacy, safety or property of JD Supra, users of the Service, Website visitors or the public; (5) permit us to pursue available remedies or limit the damages that we may sustain; and (6) enforce our Terms & Conditions of Use.

In the event there is a change in the corporate structure of JD Supra such as, but not limited to, merger, consolidation, sale, liquidation or transfer of substantial assets, JD Supra may, in its sole discretion, transfer, sell or assign information collected on and through the Service to one or more affiliated or unaffiliated third parties.

Links to Other Websites

This Website and the Service may contain links to other websites. The operator of such other websites may collect information about you, including through cookies or other technologies. If you are using the Service through the Website and link to another site, you will leave the Website and this Policy will not apply to your use of and activity on those other sites. We encourage you to read the legal notices posted on those sites, including their privacy policies. We shall have no responsibility or liability for your visitation to, and the data collection and use practices of, such other sites. This Policy applies solely to the information collected in connection with your use of this Website and does not apply to any practices conducted offline or in connection with any other websites.

Changes in Our Privacy Policy

We reserve the right to change this Policy at any time. Please refer to the date at the top of this page to determine when this Policy was last revised. Any changes to our privacy policy will become effective upon posting of the revised policy on the Website. By continuing to use the Service or Website following such changes, you will be deemed to have agreed to such changes. If you do not agree with the terms of this Policy, as it may be amended from time to time, in whole or part, please do not continue using the Service or the Website.

Contacting JD Supra

If you have any questions about this privacy statement, the practices of this site, your dealings with this Web site, or if you would like to change any of the information you have provided to us, please contact us at:

- hide
*With LinkedIn, you don't need to create a separate login to manage your free JD Supra account, and we can make suggestions based on your needs and interests. We will not post anything on LinkedIn in your name. Or, sign up using your email address.