Miller v. U.S. ex rel. Miller

110 F.4th 533

Tamika MILLER, individually, Plaintiff-Appellant, v. UNITED STATES of America EX REL. Tamika MILLER, Plaintiff-Appellee Citibank, N.A., Defendant-Appellee.^*

Docket No. 22-1615-cv

August Term 2023

United States Court of Appeals, Second Circuit

Argued: September 18, 2023

Decided: August 6, 2024

ON APPEAL FROM THE UNITED STATES DISTRICT COURT FOR THE SOUTHERN DISTRICT OF NEW YORK, (Cote, J.)

Cleveland Lawrence III (Richard E. Condit, C. Ezra Bronstein), Mehri & Skalet, PLLC, Washington, D.C., and Robert J. Valli, Jr., Valli Kane & Vagnini LLP, Garden City, NY, for Plaintiff-Appellant.

Nicole A. Saharsky (Lucia Nale, Debra Bogo-Ernst, Hans J. Germann), Mayer Brown LLP, Washington, D.C., and Chicago, IL, for Defendant-Appellee.

Rebecca S. Tinio, Assistant United States Attorney (Benjamin H. Torrance, Assistant United States Attorney, on the brief), for Damian Williams, United States Attorney for the Southern District of New York, New York, NY, for the United States.

Before: Chin, Nardini, and Nathan, Circuit Judges.

Chin, Circuit Judge:

In 2019, plaintiff-appellant Tamika Miller filed this qui tam action under the False Claims Act (the "FCA"), 31 U.S.C. § 3729 et seq., against defendant-appellee Citibank, N.A.¹ Miller contends that Citibank violated consent orders it had entered into in 2015 by hiding failures in its management of third-party risks. Citibank did so, she asserts, to avoid paying regulatory fines and penalties, thereby depriving the United States of monies it otherwise would have been paid — a "reverse false claim." In June 2020, after investigating the matter, the United States declined to intervene. In October 2020, Citibank entered into a different consent order with the Office of the Comptroller of the Currency (the "OCC") and was required to pay a $400 million civil penalty. In January 2022, Miller moved for an order awarding her a share of that penalty. While that motion was pending, Citibank moved to dismiss Miller's complaint.

On June 22, 2022, the district court (Cote, J.) addressed both motions. As to Miller's motion for a share of the $400 million civil penalty, the court noted that "the $400 million award of which the Relator seeks a share does not appear to be an 'alternate remedy' for the qui tam claim asserted in the complaint." United States ex rel. Miller v. Citigroup Inc., No. 19-cv-10970 (DLC), 2022 WL 2237619, at *2 (S.D.N.Y. June 22, 2022) (quoting 31 U.S.C. § 3730(c)(5)), recons. denied, No. 19-cv-10970 (DLC), 2022 WL 3030707 (S.D.N.Y. Aug. 1, 2022). It further observed that the order accompanying the OCC's 2020 penalty did "not appear to relate to any of the misconduct alleged in the complaint." Id. The district court then held, however, that Miller's request had to be denied "regardless" because she had failed to sufficiently plead a reverse false claim. Id. The district court therefore granted Citibank's motion to dismiss and denied Miller's motion for a share of the $400 million penalty.

Miller appeals from both rulings, as well as from the district court's denial of her request for leave to amend her complaint. For the reasons set forth below, we affirm.

BACKGROUND

As we must when reviewing a district court's grant of a motion to dismiss, "we accept the material facts alleged in the complaint as true and draw all reasonable inferences in favor of the plaintiff" — here, Miller. In re: Nine W. LBO Sec. Litig., 87 F.4th 130, 140 (2d Cir. 2023).

I. The Facts

The following facts are drawn primarily from Miller's complaint, with the addition of certain undisputed facts.

A. The Parties

Citibank is a global bank that is the world's largest issuer of credit cards. It uses third-party vendors to provide services to its credit card customers. To monitor these third-party vendors and ensure compliance with applicable laws, regulations, and consent orders, Citibank created a third-party risk management department. Citibank's operations are subject to regulation by various federal agencies, including the OCC and the Consumer Financial Protection Bureau (the "CFPB").

Miller is a vice president at Citibank who has worked in the bank's third-party risk management department since 2014. She audits third-party vendors and suppliers that service Citibank's credit card division. Miller conveys the results of her audits — as well as her observations and findings — to senior managers through a type of report called an external executive summary report.

B. The 2015 Consent Orders

In July 2015, Citibank entered into one consent order with the CFPB and one consent order with the OCC. Citibank's consent order with the CFPB (the "2015 CFPB Order") addressed the bank's alleged deceptive acts or practices related to its credit-card business, including marketing, membership retention, and debt collection. Citibank's consent order with the OCC (the "2015 OCC Order" and, together with the CFPB Order, the "2015 Consent Orders") addressed the bank's billing practices tied to its identity protection products and marketing and sales practices linked to its debt cancellation products. The OCC terminated the 2015 OCC Order in 2018 after concluding it was no longer necessary.²

C. The Purported Violations

In January 2016, Citibank created an auditing procedure for third-party vendors and suppliers called TPORT — housed within its third-party risk management department — to comply with federal regulations and consent orders. Miller and her colleagues implemented TPORT. During the course of her work, however, Miller noticed that TPORT's questions and scoring criteria had been altered to downplay compliance violations — permitting the violations to evade mandatory reporting to the government. Her superiors discovered how to bypass TPORT's internal controls and hide issues that should have resulted in failed audits of third-party suppliers and vendors.

In 2018, Miller "witnessed, firsthand, her audit reports regarding violations with the [2015 Consent Orders] and agency guidelines, being altered" to show more favorable results. J.A. at 26. She observed "senior Citibank management suppressing [a]udit findings, altering reviews and minimizing audit observations." Id. at 27. She also observed a conflict of interest in the structure of her department that incentivized her managers to suppress failed audits. In December 2018, Miller reported these violations to Citibank's ethics department, which informed her on February 19, 2019, that it did not find any violations.

In July 2019, Miller reported her concerns about Citibank to the OCC, using its whistleblower website, and discussed her concerns with OCC representatives.

D. The 2020 Consent Order

On October 2, 2020, some two years after the termination of the 2015 OCC Consent Order, Citibank entered into a new consent order with the OCC (the "2020 OCC Consent Order") "for deficiencies in its data governance, risk management, and internal controls that constitute unsafe or unsound practices" and was required to pay a $400 million fine (the "2020 OCC Penalty"). J.A. at 171. The factual findings underpinning the consent order did not mention risk management for third parties or refer to third-party suppliers or vendors — the subject of Miller's complaint in this case.³

II. Procedural History

On November 26, 2019, Miller filed this qui tam action alleging violations of the 2015 Consent Orders and applicable laws. The qui tam complaint asserted three claims under the FCA and one claim under the Financial Institutions Recovery, Reform and Enforcement Act. Miller alleges that Citibank hid third-party compliance failures that violated the 2015 Consent Orders and the "Government's guidance" by altering her reports, implementing a reporting structure rife with conflicts of interest, and tampering with TPORT, the internal audit procedure. J.A. at 25-27. Citibank's actions, she claims, permitted the bank to avoid paying the government at least $150 million in fines or penalties.

In June 2020, the government declined to intervene in the instant action, and the complaint was unsealed and served on Citibank.

On January 31, 2022, Miller moved in this case for an order directing the United States to award her a share of the 2020 OCC Penalty under the FCA's alternate remedy provision on the theory that the information she provided to the OCC was "instrumental" to securing the 2020 OCC Penalty. J.A. at 78. The government opposed the motion.

On March 25, 2022, before responding to Miller's motion for a share of the 2020 OCC Penalty, Citibank moved to dismiss the qui tam complaint. On May 13, 2022, in her memorandum of law in opposition to Citibank's motion to dismiss, Miller voluntarily dismissed three of the four claims in her complaint, leaving only her reverse false claim under 31 U.S.C. § 3729(a)(1)(G).

On June 22, 2022, the district court granted Citibank's motion to dismiss and denied Miller's motion for a portion of the penalty. The district court observed that, "[a]s an initial matter," the $400 million of which Miller sought a share did "not appear to be an 'alternate remedy' for the qui tam claim asserted in the complaint." Citigroup, 2022 WL 2237619, at *2 (quoting 31 U.S.C. § 3730(c)(5)). The district court concluded that while Miller's complaint alleged that Citibank suppressed audits showing third-party compliance failures, in violation of the 2015 Consent Orders and federal law, the OCC obtained the $400 million penalty from a different consent order — the 2020 OCC Consent Order — for conduct unrelated to oversight of third parties. Id. Accordingly, the district court was of the view that the 2020 OCC Penalty was not related to the reverse false claim asserted in the complaint. Id.

The district court determined, however, that Miller's request for a share of 2020 OCC Penalty "must be denied regardless,... because she has failed to state a claim." Id. Specifically, the district court concluded Miller's complaint failed to state a reverse false claim because (1...