Use caution retaining vendors to investigate Matters Requiring Attention

At least every 12-18 months, federal and state banking regulators conduct an examination of the financial institutions under their jurisdiction to ensure that they are operating in a safe and sound manner and providing fair access to credit. If an examination reveals that practices deviate from sound risk management principles and corrective action is needed, such matters are formally summarized in writing as Matters Requiring Attention (MRAs), Matters Requiring Immediate Attention (MRIAs) and Matters Requiring Board Attention (MRBAs). Depending on the response and corrective actions taken, issues identified in a MRA, MRIA or MRBA can lead to full-blown enforcement action by regulators. For this reason, financial institutions often seek help from third-party consultants, accountants or other vendors to assist with internal investigations and responses to MRAs, MRIAs, or MRBAs.

If you use a third-party vendor, however, you must be particularly cautious. Banks with a MRA, MRIA or MRBA may be vulnerable to future litigation or enforcement action brought by a regulator.

Banking organizations are generally prohibited from disclosing confidential supervisory information without prior written consent from the regulator. To ensure you are able to have open disclosure with the examiner, the bank examination privilege exists, offering a degree of protection for confidential disclosures to regulators. If asserted by a regulator, it generally protects internal discussion of what’s needed to address a MRA, MRIA, or MRBA from disclosure – but the privilege doesn’t necessarily extend to cover third-party factual analysis.[1]

You can avoid this dilemma by using outside counsel to retain third-party vendors. If outside counsel serves as a shepherd for communications between you and the vendor that provides technical expertise necessary to answer a legal question, attorney-client privilege may apply that would protect the analysis from public disclosure and from disclosure to regulators.

Federal courts have long held that the attorney-client privilege and work-product doctrine can, in certain circumstances, protect information gathered by third parties hired to assist attorneys in providing legal advice to their clients.[2] Moreover, the Office of the Comptroller of the Currency’s handbook counsels bank examiners to avoid review of privileged materials if at all possible.[3]

Factual investigations have repeatedly been protected from discovery pursuant to the attorney-client privilege and work-product doctrine. The presumption of privilege is strengthened when outside counsel, rather than in-house counsel, directs and manages the third-party relationship and the flow of information between you and the outside vendor.[4]

The distinguishing feature between outside counsel and in-house counsel retaining the expert is that communications between you and your outside counsel are made for the purposes of obtaining legal advice. Corporate communications involving in-house counsel frequently involve operational or strategic matters. Because the attorney-client privilege does not extend to business advice, courts often require additional and stronger evidence before they will agree that the privilege extends to communications between an in-house attorney and other corporate decision makers.

In the face of ongoing regulatory compliance audits and examinations, the attorney-client privilege and work-product doctrine remain important tools to ensure that your investigations into MRAs, MRIAs, or MRBAs remain out of the hands of regulators unless and until disclosure is warranted. You should carefully consider engaging external counsel to direct third-party assessments, regulatory compliance audits, and investigations to preserve privilege and work-product protection over potentially damaging documents. Their management of these investigations carries with it the presumption of privilege, which both mitigates the risk of future disclosure and allows you to receive and interpret the information provided in the most efficient manner possible to manage your MRA, MRIA, or MRBA and its potential consequences.

Given the nuances involved in establishing the attorney-client privilege, before hiring a third party consultant or responding to requests for privileged documents by government regulators, banking organizations are encouraged to contact the attorney listed below.

---