Report Reveals ActBlue Internal Memos Flagged Gaps in Foreign Donation Vetting

In early 2025, attorneys at the white-shoe law firm Covington & Burling delivered a blunt assessment to the leadership of ActBlue, the dominant Democratic small-dollar fundraising platform: the organization faced "substantial risk" that it had facilitated the acceptance of foreign-national contributions into American elections, and its prior representations to Congress about its vetting procedures may have been misleading [1]. The warning, contained in a pair of internal memos first reported by the New York Times in April 2026, set off a chain of senior resignations, a joint congressional investigation, and a Justice Department inquiry that now threatens the platform that processed $3.8 billion in political contributions during the 2024 election cycle alone [2][3].

The story is not simply about one organization's compliance failures. It is about the structural vulnerability of the entire digital fundraising apparatus — left and right — to foreign money, and about an enforcement regime that lacks the resources to keep pace.

What the Memos Said

The Covington & Burling memos focused on a 2023 letter that ActBlue CEO Regina Wallace-Jones sent to Rep. Bryan Steil, chairman of the House Administration Committee. In that letter, Wallace-Jones described "multilayered" screening procedures designed to identify and block donations from foreign nationals, including requiring donors with international addresses to provide U.S. passport numbers before their contributions were processed [1][4].

Covington's attorneys concluded that several of those safeguards were not consistently applied. The most significant gap: ActBlue did not verify passport information from donors who contributed through third-party payment services such as Apple Pay, PayPal, or Venmo [1][5]. One memo stated that "it can be alleged that ActBlue accepted and/or facilitated the acceptance of foreign-national contributions into American elections" and warned that because "ActBlue's staff was aware that its system was not as robust as necessary, it could be alleged that these violations were 'knowing and willful'" — a legal standard that both increases potential FEC penalties and opens the door to criminal prosecution by the Department of Justice [4][6].

The Scale of the Problem

ActBlue's board chairwoman, Kimberly Peeler-Allen, stated that "less than 1 percent" of contributions processed during the 2024 cycle showed indicators of foreign origin [2]. On a $3.8 billion fundraising haul, even one percent represents approximately $38 million — a figure large enough to influence competitive House and Senate races [2][7].

Source: ActBlue / OpenSecrets

Data as of Jan 15, 2025CSV

During a 30-day window in September and October 2024, ActBlue's own systems detected 237 separate donations made from foreign IP addresses using domestic prepaid cards [8][9]. The joint congressional staff report released by the House Administration, Judiciary, and Oversight committees detailed additional concerns: ActBlue's training guide for new fraud-prevention employees instructed them to "look for reasons to accept contributions" rather than err on the side of flagging suspicious ones [8]. The report also found that ActBlue made its fraud-prevention rules "more lenient" twice during 2024 — once in April and again in September — and later "attempted to hide the changes" [8].

Internal Fallout

The Covington memos triggered an exodus of senior staff. At least seven senior employees, including ActBlue's highest-ranking legal officer, resigned beginning in February 2025 [1][10]. Among them was Aaron Ting, ActBlue's former in-house attorney and director, who told investigators he left because of concerns about the platform's representations to Congress in its 2023 letter [5][10]. The House Judiciary Committee subpoenaed Ting in September 2025 as part of its expanding investigation [11].

Three House committees — Judiciary, Oversight and Government Reform, and House Administration — are now jointly investigating ActBlue, and the committees shared their findings with the Department of Justice in May 2025 [12]. Acting Attorney General Todd Blanche described investigating ActBlue as "a top priority" [13]. The FBI has also opened an inquiry [6].

Specific Vetting Deficiencies

The compliance gaps documented internally and by congressional investigators fall into several categories:

Passport verification bypass. Donors contributing through Apple Pay, Venmo, or PayPal were not required to provide U.S. passport numbers, undermining the "multilayered" safeguard ActBlue described to Congress [1][5].

Prepaid and gift card acceptance. Until September 2024, ActBlue did not automatically reject donations from foreign prepaid or gift cards, domestic gift cards, or cards from high-risk or sanctioned countries. Updated policies were implemented only after congressional scrutiny intensified [9][14].

IP geolocation gaps. The 237 foreign-IP donations detected in a single month suggest that real-time IP screening was either not applied consistently or was insufficient to block transactions before processing [8][9].

Fraud threshold philosophy. Internal communications obtained by congressional investigators revealed that ActBlue's chief fraud-prevention official expressed willingness to accept a higher rate of fraud rather than risk blocking legitimate donors, with one exchange referencing tolerance for "10 percent more fraud" [8].

ActBlue's Defense

ActBlue has pushed back on the characterization of its practices. In a post on its website, the organization stated it uses a fraud-prevention tool that evaluates "over 140 behavioral signals" including card age, card type, issuer country, recent address changes, and proprietary cardholder-level signals [14]. The platform also noted that it informed Congress of updated screening measures in a June 2025 letter [1].

Peeler-Allen emphasized that the vast majority of ActBlue's transactions are legitimate small-dollar donations from verified U.S. citizens [2]. Democratic allies have argued that the investigations are politically motivated, noting that the Trump administration's presidential memorandum directing Attorney General Pam Bondi to investigate online fundraising platforms was issued alongside rhetoric targeting Democratic fundraising infrastructure specifically [15].

WinRed and the Bipartisan Problem

The foreign-donation vulnerability is not unique to ActBlue. Congressional Democrats have countered Republican-led investigations by pointing to comparable issues at WinRed, the GOP's primary small-dollar fundraising platform [15][16].

Top Democrats on the House Oversight Committee requested documents from the Federal Trade Commission in June 2025 regarding any investigations into WinRed dating back to 2019 [16]. The FTC received more than 800 complaints against WinRed between January 2022 and June 2024 — seven times as many as ActBlue during the same period — though many of those complaints centered on deceptive recurring-donation practices rather than foreign-money concerns specifically [16]. A May 2025 Washington Post investigation found that Trump's own campaign had received "scores of donations from problematic donors," including individuals with ties to foreign interests [15].

Neither WinRed nor ActBlue has published a detailed, independent audit of its foreign-donation screening procedures. The FEC requires intermediary platforms to disclose donor data, but disclosure is not the same as verification, and the commission largely relies on campaigns and PACs to self-certify that they confirmed the citizenship of donors with foreign addresses [17].

Legal Liability: Platform vs. Candidate Committee

Under the Federal Election Campaign Act (FECA), it is illegal for any person to knowingly solicit, accept, or receive a contribution from a foreign national [18]. The law applies to candidates, political committees, and any person who "knowingly" facilitates such contributions. The FEC has exclusive civil enforcement jurisdiction, while the DOJ can criminally prosecute "knowing and willful" violations above certain monetary thresholds [19].

The critical legal question for ActBlue is whether it can be held liable as a conduit — a platform that processes and passes through donations — or whether liability rests primarily with the receiving candidate committees and PACs. Federal prosecutors have successfully pursued cases against individuals who funneled foreign money into campaigns: Imaad Zuberi pleaded guilty to channeling foreign funds into hundreds of thousands of dollars in illegal campaign contributions, and Lev Parnas and Igor Fruman were prosecuted for similar conduct [19]. But no federal prosecutor has successfully brought charges against a bundling platform itself for systemic vetting failures. The Covington memo's warning about the "knowing and willful" standard suggests the firm believed ActBlue's internal awareness of its gaps could meet that threshold [4][6].

The FEC's Enforcement Gap

The agency tasked with policing foreign donations has been chronically underfunded and understaffed relative to the scale of digital fundraising it oversees.

Source: FEC / Campaign Legal Center

Data as of Dec 31, 2024CSV

The FEC's enforcement division shrank from 309 employees at the end of FY 2023 to 293 at the end of FY 2024, a reduction of more than five percent in a single year [20]. The agency has initiated roughly a dozen investigations into allegations of foreign spending in the past decade, and when it does act, penalties are modest and delayed. In one case, the FEC fined a pro-Trump super PAC $25,000 for soliciting a $2 million donation from a fictitious Chinese businessman in late 2016 — the fine was not imposed until nearly six years later [17].

The commission was unable to function for extended periods due to lack of a quorum — from late August 2019 to December 2020, with only a brief window of operations — and a backlog of over 350 outstanding enforcement matters accumulated, some exceeding the five-year statute of limitations [20]. The Campaign Legal Center has described this pattern as the FEC "allowing foreign money to influence our elections" through inaction [17].

Which Committees Received Flagged Funds?

The congressional staff reports and news accounts have not yet identified specific candidate committees or PACs that received funds ActBlue's compliance team flagged as high-risk. The 237 foreign-IP prepaid-card donations detected in the September–October 2024 window were flagged internally, but it remains unclear how many were blocked before reaching recipient committees and how many were processed and forwarded [8][9]. Under current law, candidate committees that receive contributions through ActBlue are expected to conduct their own independent verification, but in practice most rely on ActBlue's screening as a de facto first and only line of defense [17].

This is a significant open question. If recipient committees are identified and it can be shown they took no independent verification steps, they could face their own FEC complaints — though enforcement history suggests penalties would be minor.

Proposed Reforms and Their Tradeoffs

Several legislative and regulatory proposals have emerged to address the foreign-donation screening gap across both platforms:

Mandatory CVV verification. The SHIELD Act (Secure Handling of Internet Electronic Donations Act), championed by Rep. Steil and Sen. Marco Rubio, would require all online political contributions to include the card verification value (CVV) — the three- or four-digit code on the back of credit and debit cards [21][22]. CVV checks are standard in e-commerce and would eliminate many anonymous prepaid-card transactions. The tradeoff: some legitimate donors using digital wallets (Apple Pay, Google Pay) may face additional friction, and CVV alone does not verify citizenship.

Prepaid card prohibition. The SHIELD Act would also ban the use of gift cards and prepaid debit cards for federal campaign contributions entirely [21]. This would close one avenue for anonymous foreign donations but would also block legitimate donors who lack traditional bank accounts — a concern for lower-income and younger contributors.

Address verification against government databases. Some proposals call for real-time verification of donor addresses against passport or Treasury Department databases [22]. This would be more robust than self-certification but raises significant privacy concerns, would require new federal data-sharing agreements, and could create a chilling effect on political speech if donors believe the government is tracking their contributions in real time.

Real-time Treasury/OFAC screening. Matching donor names against the Office of Foreign Assets Control (OFAC) sanctions list is already standard in the financial sector [23]. Requiring political platforms to implement the same screening would add a layer of protection but carries costs — OFAC-compliance software requires ongoing licensing and generates false positives that would need manual review, increasing operational expenses for smaller campaigns.

IP geolocation requirements. Mandating that platforms flag or block donations from foreign IP addresses is technically straightforward but easily circumvented by VPNs. It is best understood as one signal among many rather than a standalone fix [9].

None of these measures is a silver bullet. Each involves a tradeoff between security and accessibility, between fraud prevention and donor privacy, between the desire to keep small-dollar giving frictionless and the legal obligation to keep foreign money out.

Sloppy Compliance vs. Deliberate Wrongdoing

The strongest version of ActBlue's defense is this: internal memos documenting compliance gaps are evidence that the organization's lawyers were doing their jobs — identifying problems so they could be fixed. The Covington memos themselves were a corrective mechanism, not proof of wrongdoing. Less than one percent of transactions showing foreign indicators, in a system processing billions, may reflect an error rate that no screening regime could eliminate entirely [2].

Critics of the narrative around the memos, including some election-law scholars, have cautioned against conflating incomplete compliance paperwork with deliberate facilitation of illegal foreign contributions [24]. The memos do not document specific instances of confirmed foreign money reaching candidates. They document a risk — a gap between what ActBlue told Congress its systems did and what those systems actually did in certain payment scenarios.

The counterargument is equally straightforward: ActBlue knew its systems had holes, described those systems to Congress as more robust than they were, and continued processing donations through unverified channels for months after being warned. Whether that constitutes negligence, recklessness, or willful misconduct is a question for investigators and, potentially, prosecutors to resolve. The standard of proof matters: an internal memo identifying risk is not the same as evidence that the risk materialized into actual illegal contributions. But it may be enough to sustain an FEC enforcement action or a referral for criminal investigation under the "knowing and willful" standard.

What Happens Next

The investigations are proceeding on multiple fronts. Three House committees continue to issue subpoenas [11][12]. The DOJ and FBI are conducting their own inquiries [6][13]. Texas Attorney General Ken Paxton has transmitted findings from a separate state investigation to the FEC through a petition for rulemaking [25].

ActBlue, for its part, says it has strengthened its screening measures and communicated updates to Congress [1][14]. But the organization remains without several senior legal and compliance staff members who departed in early 2025, raising questions about its capacity to implement reforms at the pace investigators expect [10].

The broader implication extends beyond ActBlue. If the dominant Democratic fundraising platform had significant gaps in its foreign-donation screening, there is no reason to assume the Republican infrastructure is airtight either — and the FEC's track record suggests the agency is not equipped to find out. The digital small-dollar fundraising system that both parties depend on was built for speed and accessibility. It was not built for the kind of verification that the law technically requires. Closing that gap will require either new legislation, new FEC rulemaking, or both — and a willingness to accept that making online giving safer will also make it slower and more expensive.