Whither Reputation Risk Regulation Post NRA v. Vullo?
The Supreme Court didn't have to opine in detail on reputation risk regulation, but the issue isn't going away.
As mentioned earlier, last week the Supreme Court reaffirmed that a government regulator may not pressure regulated entities to suppress the free speech rights of a person when it reversed the Second Circuit’s decision that the NRA’s claims against Maria Vullo, the former head of the New York Department of Financial Services, for violating their right to free speech via financial regulation must be dismissed. The result of this decision is that the case is remanded back to the Second Circuit for reevaluation and most likely will be sent back to the district court for trial.
Remember that the case reached the Supreme Court at an early stage, before we technically know what happened. This means that the Court did not need to opine on specifics; it only needed to find that if true the NRA allegations could present a constitutional violation. As such, there are dangling questions and issues that will need to be cleared up, and we are going to discuss one of them now: Whither Reputation Risk?
Reputation Risk in This Case
Financial regulators claim a legitimate interest in monitoring the reputation risk of a bank, insurance company, or other regulated party. Their position is that the regulated firm could suffer financial loss if it does business with a customer that some important constituency (e.g. other customers, employees, investors, or even the regulators themselves) disfavors.
Reputation risk came up in the Vullo case. Recall that the NYDFS published guidance documents warning banks and insurance companies about the potential risk to their reputation of doing business with Second Amendment advocacy groups like (but not limited to) the NRA. The documents then reminded banks and insurers that they had a legal obligation to manage such risks. As of now the documents are still up on the NYDFS website and presumably still in effect.
Are they going to stay up there? Is such guidance, focused as it is on a group’s First Amendment protected activity, constitutionally permissible? The Second Circuit thought so, but the Second Circuit also was reversed unanimously. However, the Supreme Court didn’t specifically discuss whether this guidance was always permissible, always impermissible, or if it depended on other factors, such as intent.
Is the NYDFS currently infringing on the rights of Second Amendment advocacy groups? Would it matter if the new head of the NYDFS argued that the letters remain in effect not because she or the NYDFS has any animus towards gun-rights groups but because they earnestly believe that affiliating with such groups may lead to economic harm to banks and insurers? Should a public (or bank customers, or employees, or some other constituency) that wants to suppress the speech of gun rights groups (or any other group) be allowed to “work the refs” and get even a neutral regulator to publish such guidance?
These are all questions that do not need to wait for further proceedings in NRA v. Vullo. Another pro-Second Amendment group could sue the NYDFS today to have the letters taken down. Such a case would provide a cleaner vehicle to assess the constitutionality of this type of reputation risk guidance without the complications regarding insurance law violations and enforcement that exist in NRA v. Vullo.
Reputation Risk Generally
Ok, but what about reputation risk generally? Here I think people hoping that the Supreme Court will say reputation risk is inherently invalid will be disappointed. The simple reason is that it is probably constitutional (if stupid) for a legislature to empower a regulator to use reputation risk as part of their tool kit. Like searches or the use of force, the tool’s legitimacy will depend on how and why it is used.
That said, there are many ways a court could limit reputation risk. The first would be to find that the regulator’s use of the power violated some sort of constitutional limitation. That is the argument in Vullo, that the regulator was using reputation risk as a pretext to attack groups whose advocacy she disliked. But what if it wasn’t just a pretext?
It would still seem constitutionally problematic for a regulator to say something to the effect of “Religious group X, or racial group Y, or advocacy group Z are really controversial, and you should be careful to manage the risk that comes with doing business with them.” This would seem suspect even if the regulator is making an honest and neutral appraisal. Of course, different constitutional rights are protected differently, so the nature of the right being infringed, and the nature and extent of the infringement could be relevant.
Another option would be to find that the legislature did not give the regulator that power, either generally or in specific cases. One of the most important cases placing limits on the use of reputation risk is Gulf Federal Loan Association v. Federal Home Loan Bank Board. In that case the Fifth Circuit limited the scope of the regulators power to use reputation risk on the grounds that Congress gave the regulator power to prevent unsafe and unsound practices. The regulator using reputation risk as a justification to bring an enforcement action against activities that did not threaten the stability of the bank, and were therefore not unsafe or unsound, exceeded that authority. The court did however leave open the possibility that reputation risk could be used if there was a legitimate threat to the stability of the bank.
Gulf Federal dealt with a bank regulator using reputation risk aimed at the bank’s own conduct, but what about cases where the bank regulator is allegedly trying to affect someone other than the bank? What if the regulator is trying to affect climate policy, or the availability of access to abortions, or something else that doesn’t necessarily pose a constitutional question? Could a court limit the regulator on the grounds that the relevant legislature did not empower it to regulate that downstream market? Would the regulator’s intent need to be to regulate the market or is effect enough to find that the regulator is exceeding their authority?
One could even ask if, given the huge importance of financial services, there is a “major questions doctrine” issue with bank regulators asserting the ability to use reputation risk without an explicit statutory grant from the legislature. Can Congress or state legislatures give such wide discretion to regulators implicitly, or must they be explicit about it?
Finally, there is the question of arbitrariness, which dovetails into the authority question. What if a regulator just asserts that the threat to banks’ reputations from doing business with a certain group or industry poses a risk to banks without evidence, or with flimsy or poor-quality evidence? What if the regulator is inconsistent on what groups it will do risk analysis for? How much deference are regulators entitled to in making these choices and how strong does their analysis need to be?
Reputation risk is a tool, if not a particularly good one, that legislatures can give to regulators. But that tool is not without limits, in fact far from it. Where courts will draw those limits will be an important question going forward. NRA v. Vullo is unlikely to provide the vehicle for answering all these questions, but it does open space for subsequent case law to develop.