Contract analysis

I. Executive Summary The purpose of this memorandum is to set forth Calderwood & Harkness LLP's specific remediation recommendations arising from the ongoing internal investigation into potential violations of the Foreign Corrupt Practices Act of 1977, as amended (the "FCPA"), in connection with Torchlight Mining Corp.'s ("Torchlight" or the "Company") operations in the Republic of Ganara. These recommendations are i

1. Enhanced Third-Party Due Diligence Procedures

2. Revised Delegation of Authority Policy

3. Mandatory FCPA and Anti-Corruption Training

4. Audit Rights in All Agent and Consultant Agreements

5. Enhanced Financial Controls and Monitoring

6. Strengthened Whistleblower and Reporting Mechanisms

7. Personnel Accountability and Disciplinary Framework

8. Engagement of an Independent Compliance Monitor Each recommendation is discussed in detail below, including an assessment of the current state, specific remediation measures, and a proposed implementation timeline. A summary table of all recommendations, including priority levels, responsible parties, and estimated timelines and costs, is provided in Section XII of this memorandum.

II. Background and Investigation Findings Relevant to Remediation Before setting forth the specific recommendations, it is necessary to summarize the investigation findings that inform and drive the remediation measures proposed herein. A detailed recitation of the evidence and its analysis will be provided in the interim investigation report to the Audit Committee dated May 15, 2025. The following summary is intende

1. No Due Diligence on Crestfield. There was no due diligence file on Crestfield anywhere in Torchlight's compliance records. There was no competitive selection process for Crestfield's engagement. No background check, adverse media screening, beneficial ownership verification, or assessment of business legitimacy was conducted prior to or at any time during the engagement.

2. Contractual Overages. Crestfield invoices exceeded the contractual maximum of $2,040,000 under the Crestfield Agreement by $1,170,000 without any contract amendment, addendum, or formal authorization for the overage.

3. Approval Threshold Violations. Fourteen of twenty-four Crestfield invoices exceeded the $50,000 single-approval threshold under Torchlight's Delegation of Authority Policy, yet each was approved solely by Osei-Bonsu without the required secondary authorization.

4. Vague General Ledger Coding. Cash withdrawals totaling $890,000 were booked under the vague and generic GL code 7450 — "Community Relations Expenses" — which did not require specification of recipients, purposes, or business justifications.

5. No Audit Rights Clause. The Crestfield Agreement contained no audit rights clause, depriving Torchlight of the contractual ability to audit Crestfield's books, records, or use of funds.

6. Generic Anti-Corruption Representations. The anti-corruption representations in the Crestfield Agreement (Clause 9.2) referenced "all applicable anti-corruption laws" in generic terms but contained no specific reference to the FCPA, the Canadian Corruption of Foreign Public Officials Act ("CFPOA"), or the UK Bribery Act 2010, and imposed no affirmative compliance obligations on Crestfield.

7. Timing Correlation Undetected. Forensic analysis revealed a significant temporal correlation between Crestfield invoices and the issuance of mining permits: in each instance, Crestfield invoices spiked within thirty to sixty days preceding or immediately following permit issuances. This pattern was not detected by Torchlight's finance or compliance functions at any point during the five-year engagement.

8. Use of Personal Email Not Flagged. Delacroix's use of personal (non-company) email for thirty-seven identified business communications with Renard was not flagged by Torchlight's information security or compliance monitoring systems.

9. Training Gaps. Anti-corruption training records for West African operations personnel were incomplete. Key personnel in government-facing roles had not received specialized FCPA or anti-corruption training beyond initial onboarding modules.

10. Inadequate Gift and Hospitality Tracking. Torchlight lacked a centralized gift and hospitality tracking system capable of aggregating and monitoring the value of benefits provided to government officials across its subsidiaries. These ten deficiencies form the basis for the eight categories of remediation recommendations that follow.

III. Remediation Recommendation 1: Enhanced Third-Party Due Diligence Procedures A. Current State Assessment Torchlight does not currently maintain a formal, standalone third-party due diligence policy applicable to agents, consultants, or intermediaries engaged in government-facing roles. While the Company's Code of Business Conduct and Ethics contains a general provision requiring that "all business relationships b

IV. Remediation Recommendation 2: Revised Delegation of Authority Policy A. Current State Assessment Torchlight's existing Delegation of Authority Policy (the "DOA Policy"), last revised in March 2018, sets a single-approval threshold of $50,000 for payments to third-party consultants. Under this policy, any invoice from a consultant or agent in an amount equal to or less than $50,000 may be approved by a single auth

V. Remediation Recommendation 3: Mandatory FCPA and Anti-Corruption Training A. Current State Assessment Torchlight's current anti-corruption training program for its West African operations has been found to contain significant gaps. Training records for TGM personnel are incomplete, and there is no evidence that in-person or tailored anti-corruption training was ever delivered to Ganaran-based employees in governme

VI. Remediation Recommendation 4: Audit Rights in All Agent and Consultant Agreements A. Current State Assessment The Government Relations Advisory Agreement between TGH and Crestfield, dated April 12, 2019, contained no audit rights clause. This omission deprived Torchlight of the contractual right to audit Crestfield's books, records, or accounts, and prevented the Company from independently verifying whether payme

VII. Remediation Recommendation 5: Enhanced Financial Controls and Monitoring A. Current State Assessment The financial controls deficiencies identified in the investigation are among the most significant compliance failures and are directly relevant to potential FCPA books-and-records and internal-controls violations under Section 13(b)(2)(A) and Section 13(b)(2)(B) of the Securities Exchange Act of 1934, as amended

VIII. Remediation Recommendation 6: Strengthened Whistleblower and Reporting Mechanisms A. Current State Assessment Torchlight's third-party ethics hotline, operated by Sentinel Compliance Solutions Inc. ("Sentinel"), received an anonymous whistleblower complaint on August 19, 2024 (Report ID: SCH-2024-08-4417). The complaint alleged that payments were being made to government ministers in the Republic of Ganara thro