Overview
In a recent client alert, Steptoe discussed a $17.1 million settlement between the Department of Justice (DOJ) and International Business Machines Corporation (IBM) over alleged False Claims Act violations related to IBM's Diversity, Equity, and Inclusion (DEI) practices. Since then, investigations of DEI practices in companies with government contracts have picked up at both the state and federal levels.
First, in May 2026, the Texas Attorney General issued a letter to CVS Health (CVS) warning it that the use of race- and/or sex-based quotas, including within its Supplier Diversity Program, may violate federal and state anti-discrimination laws and demanding a response within 14 days to avoid a potential Medicaid fraud investigation.[1] Second, also in May, the DOJ reached a $30 million settlement with PayPal, Inc. (PayPal) that resolved allegations that PayPal's diversity-focused investment program unlawfully considered race and national origin in violation of the Equal Credit Opportunity Act (ECOA).
We discuss each of these developments below and offer guidance for clients.
I. Texas Warns CVS Health of Potential DEI Liability
On May 11, 2026, the Texas Office of the Attorney General (OAG) sent a letter to CVS requesting that CVS detail the steps it has taken to comply with its anti-discrimination obligations under both state and federal laws (Letter).[2] While the Letter mentions implications for racially discriminatory employee quotas, it primarily focuses on the implications of CVS's Supplier Diversity Program.[3]
The OAG asserts that CVS's Supplier Diversity Program directed millions of dollars of CVS's purchases and contracts "to suppliers who are owned and operated by 'Minority-and-Women-Owned Enterprises' and 'Lesbian, Gay, Bisexual, and/or Transgender Business Enterprises.'"[4] The Letter further explains that "more than half of the jobs supported by CVS Health" in Texas has gone to diverse suppliers.[5]
Supplier Diversity Programs are procurement initiatives designed by corporations to allocate some of their supply-chain purchases to businesses owned and operated by historically marginalized or underrepresented groups.[6] These programs are not unique to CVS and have become common in modern supply-chain management.[7] Indeed, some states have laws requiring contractors to make a "good faith effort" to utilize certified minority- and women-owned business enterprises.[8] See, e.g., 5 NY ADC 142.8.
However, the risks associated with some of the practices underlying Supplier Diversity Programs shifted after the U.S. Supreme Court's decision in Students for Fair Admissions Inc v. President and Fellows of Harvard College, 600 U.S. 181 (2023) (SFFA).[9] That decision led to an increase in investigations and litigation challenging corporate DEI programs, alleging that they involve racially discriminatory contracting decisions in violation of 42 U.S.C. § 1981.[10]
In the Letter, the OAG warns CVS that both federal and state law prohibit discrimination "through advancing race- and sex-based employee and/or supplier quotas,"[11] including:
- Title VII of the Civil Rights Act of 1964 ("Title VII"). Title VII prohibits "discriminat[ion] against any individual with respect to his compensation, terms, conditions, or privileges of employment, because of such individual's race, color, religion, sex, or national origin." 42 U.S.C. § 2000e-2(a)(1). Title VII claims only apply to employees, not independent contractors, like suppliers.[12] OAG further warns of liability under the state's comprehensive employment discrimination law, Chapter 21 of the Texas Labor Code, which prevents similar conduct as Title VII. See Tex. Labor Code Ann. § 21.001 et seq.
- Section 1981 of the Civil Rights Act of 1866 ("Section 1981"), which prohibits racial discrimination in the making and enforcement of contracts. See 42 U.S.C. § 1981. Unlike Title VII, lawsuits under Section 1981 may only be brought by private litigants, and the statute protects not only individual employees but also independent contractors, extending to both existing and proposed contractual relationships.[13] Reference to this statute, in this context, suggests that a non-diverse supplier alleging it lost business or was excluded from an opportunity because preferential treatment was provided to a diverse supplier, may fit under this cause of action.
The Letter also contends that if CVS was advancing race- and sex-based employee and/or supplier quotas, it may be violating medical-provider related statutes including Title VI of the Civil Rights Act of 1964, which prohibits discrimination in programs receiving federal financial assistance,[14] and Section 1557 of the Affordable Care Act, which prohibits discrimination in federally funded health programs. It also mentions a Texas statute prohibiting "discrimination in the administration and operation of [a Health and Human Services]."[15]
The Letter conjures several underlying implications that it leaves unanswered, including the risks associated with procurement efforts by companies. In fact, this Letter does not mean that having a Supplier Diversity Program is per se violative of state and federal laws. Companies can develop a wide array of initiatives to meet their supplier goals and there is nothing that says that one Program's non-compliance translates to another Program. Assessments must be made on a case-by-case basis. Notably, companies in states that still enforce supplier diversity goals may have to navigate both ensuring compliance with state contractual requirements and ensuring it does not run afoul of recent federal guidance on the topic some states.
II. DOJ Reaches Settlement with PayPal Over DEI-Related Investment Program
Another development came the very next day, on May 12, 2026, when the DOJ announced a "$30 million" settlement with PayPal resolving allegations that the company's prior diversity-focused investment program violated federal fair lending laws.[16]
The DOJ's investigation focused on PayPal's "Economic Opportunity Fund," launched in 2020, which provided funding to Black and minority-owned businesses through capital investments and grants.[17] The government alleged that the program unlawfully considered race, color, and national origin in determining eligibility, in violation of the ECOA, which prohibits creditors from discriminating against credit applicants on certain bases.[18] PayPal denied any liability to the Economic Opportunity Fund and does not admit to guilt or any finding of liability in the settlement agreement.[19]
The terms of the settlement are extensive and detailed.[20] PayPal will not pay $30 million, but agrees to implement programming, reporting, and training efforts with an estimated aggregate value of $30 million. The agreement states that PayPal must:
- Launch a Small Business Initiative (SBI) that "will infuse American small businesses with economic opportunity and expand access to capital to these businesses," and it must coordinate with the United States Small Business Administration to accomplish this;
- Allow the SBI to "waive processing fees for $1 billion of transactions offered to eligible American small business" that are certified veterans or involved in manufacturing, farming, or technology. This waiver has an estimated aggregate value of approximately $30 million;
- Designate a Director of the SBI who will report to PayPal's Executive Vice President responsible for small business customers;
- Submit to the United States an assessment of the needs of American small businesses to suggest ways for it to support these businesses;
- Submit to the United States a proposed structure for the SBI (SBI Proposal) which may include plans for advertising and engaging in outreach to small businesses, etc. The SBI Proposal must agree to comply with Executive Order 14151, January 20, 2025, "Ending Radical and Wasteful Government DEI Programs And Preferencing;"[21]
- Ensure all employees of the SBI have annual training on ECOA (and PayPal is required to provide a copy of such training to the Unites States upon request and a list of employees who completed the training); and
- Ensure the SBI Director make SBI Annual Reports to the United States sufficient to evidence compliance with the settlement agreement.[22]
The agreement allows the United States to review PayPal's compliance at any time, and the agreement will remain in effect "until the United States provides its non-objection to PayPal's third Annual Report.[23] Notably, the agreement does not affect PayPal's existing contractual obligations to entities that received funding as part of the Economic Opportunity Fund.[24]
In its press release, the DOJ emphasized that it would continue to pursue enforcement actions against programs that it views as discriminatory, even where such programs are designed to promote economic opportunity.[25] It specifically stated that PayPal's Economic Opportunity Fund "was not implemented to remediate any specific instances of past discrimination."[26] This is key because in his concurring opinion in SFFA, Justice Brett Kavanaugh stated that "governments and universities still 'can, of course, act to undo the effects of past discrimination in many permissible ways that do not involve classification by race.'"[27]
Conclusion
Companies, particularly those that contract with the government or operate in highly regulated sectors like healthcare and banking/fintech, should not assume that well-intentioned initiatives are insulated from review at either the federal or state level. Instead, organizations should proactively assess their DEI programs through the lens of applicable anti-discrimination laws, ensure that any selection criteria are carefully tailored and defensible, and consider implementing enhanced compliance, documentation, and training measures.
As the legal landscape continues to evolve, close coordination with counsel will be critical to balancing business objectives with emerging enforcement priorities. Steptoe continues to monitor developments in this area across practice industries and remains ready to advise how these developments may affect your organization. Please see Steptoe's DEI-focused news alerts from our DEI Enforcement Response Team, to be found here.
[1] The 14-day deadline for CVS to respond to the Letter passed in May 2026. There is no reporting of any public response from CVS.
[2] Letter from Amy S. Hilton, Chief, Healthcare Program Enforcement, Office of the Tex. Att'y Gen., to Sam Khichi, Exec. Vice President & Gen. Counsel, CVS Health (May 11, 2026), https://www.texasattorneygeneral.gov/sites/default/files/images/press/Letter_12.pdf.
[3] See id.
[4] Id.
[5] Id.
[6] Julie Kratz, Supplier Diversity Is the Key to Better Business Outcomes, Forbes (Feb. 25, 2024), https://www.forbes.com/sites/juliekratz/2024/02/25/supplier-diversity-is-the-key-to-better-business-outcomes.
[7] Id.
[8] Even Texas maintains a Historically Underutilized Businesses ("HUB") Program, codified at Tex. Gov't Code ch. 2161, which sets statewide goals for contracting with minority- and women-owned businesses. But in October 2025, Texas's Acting Comptroller announced a freeze on new and renewed HUB certifications pending a review of the program's constitutionality. See Texas Comptroller of Public Accounts – Press Release, Historically Underutilized Business Certification Process Suspended by Acting Texas Comptroller (Oct. 28, 2025), https://comptroller.texas.gov/about/media-center/news/20251028-historically-underutilized-business-certification-process-under-review-by-acting-texas-comptroller-1761686774358.
[9] In SFFA, the Supreme Court held that race-conscious admissions policies of Harvard and the University of North Carolina violated the Equal Protection Clause of the U.S. Constitution and Title VI of the Civil Rights Act of 1964. Part of the Supreme Court's rationale was based on its determination that "[a] benefit provided to some applicants but not to others necessarily advantages the former group at the expense of the latter." Id. at 218–29.
[10] See, e.g., Am. All. for Equal Rts. v. American Airlines, Inc, 4:25-cv-00125, (N.D. Tex. Feb 11, 2025) (challenging American Airlines' supplier diversity program, claiming that it unfairly excludes white business owners from participating and securing supplier contracts with the airline).
[11] Letter from Amy S. Hilton, Chief, Healthcare Program Enforcement, Office of the Tex. Att'y Gen., to Sam Khichi, Exec. Vice President & Gen. Counsel, CVS Health (May 11, 2026), https://www.texasattorneygeneral.gov/sites/default/files/images/press/Letter_12.pdf.
[12] See Eisenberg v. Advance Relocation & Storage, Inc., 237 F.3d 111, 113 (2d Cir. 2000).
[13] See Domino's Pizza, Inc. v. McDonald, 546 U.S. 470, 476 (2006); Comcast Corp. v. Nat'l Ass'n of African Am.-Owned Media, 589 U.S. 327, 334 (2020).
[14] 42 U.S.C. § 2000d et seq.
[15] 1 Tex. Admin. Code § 395.11(a)(1).
[16] U.S. Dep't of Justice, Justice Department Secures $30M Settlement with PayPal Over Unlawful DEI Investment Program (May 12, 2026), https://www.justice.gov/opa/pr/justice-department-secures-30m-settlement-paypal-over-unlawful-dei-investment-program.
[17] Id.
[18] See 15 U.S.C. § 1691 et seq.
[19] Resolution Agreement Between the United States of America and PayPal, Inc. (May 12, 2026), https://www.justice.gov/crt/media/1440286/dl.
[20] Id.
[21] Executive Order 14151, Ending Radical and Wasteful Government DEI Programs And Preferencing, (Jan. 20, 2025) https://www.whitehouse.gov/presidential-actions/2025/01/ending-radical-and-wasteful-government-dei-programs-and-preferencing/.
[22] Resolution Agreement Between the United States of America and PayPal, Inc. (May 12, 2026), https://www.justice.gov/crt/media/1440286/dl.
[23] Id.
[24] Id.
[25] U.S. Dep't of Justice, Justice Department Secures $30M Settlement with PayPal Over Unlawful DEI Investment Program (May 12, 2026), https://www.justice.gov/opa/pr/justice-department-secures-30m-settlement-paypal-over-unlawful-dei-investment-program.
[26] Id.
[27] SFFA, 600 U.S. at 317 (quotation omitted) (Kavanaugh, J., concurring).
