Now that the Department of Justice has taken the dramatic step of indicting New York Attorney General Letitia “Tish” James, plenty of ink and pixels have been spent assessing the procedural missteps of the prosecution and the strength of the evidence. An important question was lost in the shuffle: was the investigation of James legal in the first place?

For background, the Acting U.S. Attorney for the Eastern District of Virginia Lindsey Halligan obtained a grand jury indictment alleging that James committed bank fraud by misrepresenting to her mortgage lender that she intended to use a home in Norfolk, Virginia as a secondary residence when her true intent was to use it as an investment rental property. James vociferously denies the claims and her attorney, Abbe Lowell, provided copies of emails to the Justice Department in which James expressly disclaims to her mortgage lender any intention of living in the property.

The investigation into James began not with the Justice Department or the FBI, but in a typically sleepier corner of the executive branch, the Federal Home Finance Agency (FHFA). The FHFA, headed by Acting Director Bill Pulte, has made several high-profile criminal referrals of the President’s political antagonists based on alleged mortgage fraud, including (besides James) against U.S. Senator Adam Schiff and Federal Reserve Governor Lisa Cook.  Although Pulte’s allegations against Cook served as a basis for the President’s decision to remove her from office—an action now being reviewed by the Supreme Court—Pulte’s allegations against James are the first to result in a criminal prosecution.

All of which raises the question of what authority Pulte had to launch his “investigations” in the first place. On the Credit Slips blog, Professor Adam Levitin hypothesized that Pulte “handed Fannie and Freddie a list of political enemies and asked for their loan files for review.”  FHFA declined to answer when specifically asked by Fortune how it is researching mortgage fraud, including whether it used government resources to do so. Pulte mentioned receiving a “tip” about Cook’s mortgage in an interview with CNBC, but did not provide any details.

The FHFA has no generalized crime-fighting or anti-fraud authority.  It does not even have an express authority to make criminal referrals besides those granted to the FHFA’s Inspector General under the Inspector General Act of 1978.  By contrast, the FHFA’s Financial Crisis cousin, the Consumer Financial Protection Bureau, has an express authority under the Dodd-Frank Act to refer potential criminal activity to the DOJ.  According to Pulte’s criminal referral letter, the FHFA made the referral pursuant to the Federal Housing Enterprises Financial Safety and Soundness Act of 1992, which established the Office of Federal Housing Enterprise Oversight (OFHEO) and empowered it as a safety-and-soundness regulator for Fannie Mae and Freddie Mac (collectively referred to as the Government-Sponsored Enterprises or “GSEs”).  That law permits the Director of OFHEO (later abolished and rolled into the FHFA) to require “reports of financial condition and operations” from Fannie Mae and Freddie Mac, as well as to conduct periodic examinations of the financial condition of the GSEs.  A single loan file, or even a handful, among millions would tell you exactly nothing about the financial condition or operations of the GSEs, making it difficult to call FHFA’s review either a “report” or an “exam” under the Act.  Nor is there any authority to make criminal referrals.  The search for authority appears just as fruitless under the Housing and Economic Recovery Act of 2008 (“HERA”), which abolished the OFHEO and transferred its powers to the FHFA.  HERA provided the FHFA Director specific authority to require “timely reports” from the GSEs upon the discovery of the sale or purchase of fraudulent loans, and to require the GSEs to maintain procedures designed for discovering fraudulent transactions.  Again, the authority here is hard to square with Pulte’s actions, which could explain why he didn’t purport to rely on them in his criminal referral letter.  Moreover, the inclusion of specific authorities related to fraud militates against finding similar ones implied elsewhere. 

One possible avenue remains for these criminal referrals, which is that Pulte could access the information and make criminal referrals by virtue of his chairmanship of the boards of both Fannie Mae and Freddie Mac.  In March, Pulte removed a slate of board members from both GSEs and named himself chair of both of them.  The chair of a private, or at least quasi-private, entity may have the freest hand to inspect its records and refer suspicious activity to the proper authorities.  But here lies another problem: HERA expressly prohibited the Director from holding any “office, position, or employment” in a regulated entity.  In any case, Pulte put his referral on FHFA letterhead and signed it as the Director of FHFA (or rather, as “U.S. Federal Housing FHFA,” as Pulte has restyled the agency name), so we can assume this referral is an official agency action requiring some legal authority.

Of course, there is nothing wrong with FHFA taking mortgage fraud seriously and taking steps to address it. Last year, Fannie Mae reported that it experienced financial losses due to mortgage fraud and was particularly concerned with multifamily lending transactions. Fannie Mae explained in SEC filings that it does not independently verify most borrower information provided to it and it is reportedly in talks with Palantir to use artificial intelligence to more efficiently detect mortgage fraud. But even taking as granted that the FHFA has some role to play in nudging the GSEs to combat fraud as part of its safety-and-soundness mission, it is not at all clear that the FHFA is doing anything within its specified authorities—like imposing tougher anti-fraud procedures on the GSEs, conducting targeted examinations, or requiring informative reports—to understand and address the problem.

This apparent lack of authority for its investigations creates a tangled web of legal problems for the FHFA and the GSEs. First, could someone on Pulte’s “enemies list” sue to enjoin these apparently ultra vires investigations? The entities best situated to object to Pulte’s demands for mortgage records are the GSEs holding them; however, Pulte’s position as both regulator and board chair allows him to place intense pressure on the GSEs to comply. Second, HERA provides the GSEs protection from liability for “good faith” reports of fraud—has Pulte’s dual role destroyed that protection? If so, the subjects of the FHFA’s criminal referrals could sue the GSEs for any potential violations of federal or state law resulting from Pulte’s actions. Third, do Pulte’s disclosures of individual records to other agencies or on social media violate the Privacy Act? The Privacy Act protects individuals from the abuse and disclosure of records maintained on them by the federal government and provides a private right of action for failures to protect, maintain the accuracy of, or inform the person about whom the records are kept. In addition to violations of the act itself, Pulte may have failed to comply with the FHFA’s own Privacy Act regulations, which require the agency to “ensure” that records containing personally identifiable information are “protected from public view”—in other words, not posted by the agency head on X. It may be too early to speculate about the impacts of Pulte’s actions on the criminal prosecution of Attorney General James, but as the ersatz law enforcement agency that conducted the investigation, one wonders if FHFA staff or Pulte himself will be asked to testify about the documents obtained by them.

The trial of Attorney General James in Virginia may provide us some answers about the origins of Pulte’s investigations. Most likely, however, the FHFA will need to be taken to court directly to get clear answers about why the agency can do what it has.

Domenic Powell is a staff attorney with Antimonopoly Counsel working on competition and regulatory matters.  He was a counsel with the Consumer Financial Protection Bureau for five years and a recent fellow of the ABA Section of Administrative Law & Regulatory Practice.  His views are his own.