Contract analysis

I. Executive Summary On October 12, 2023, the Division of Enforcement of the United States Securities and Exchange Commission ("SEC" or the "Commission") issued Formal Order of Investigation No. EN-2023-0947 in connection with File No. HO-14287 (the "Formal Order"), thereby escalating the preliminary inquiry that began with the September 18, 2023 voluntary request letter directed to Belmont Ridge Bank National Associ

1. To analyze the scope and language of the Formal Order in detail, including the statutory provisions referenced and the breadth of the authorization granted;

2. To identify the categories of documents and the custodians likely to be implicated by the investigation and the accompanying document subpoena;

3. To identify potential witnesses — both internal to BRB and external — whom the Staff may seek to compel to testify;

4. To assess whether the Formal Order signals a broader inquiry beyond the allowance for credit losses ("ACL") disclosure issues that were identified during the voluntary request phase; and

5. To recommend immediate and near-term next steps for the investigation defense team. Key Conclusion. The Formal Order's language is broad in certain respects but remains fundamentally consistent with a focused investigation into BRB's ACL disclosures related to the BridgeFin digital lending portfolio. The statutory provisions cited are limited to periodic-reporting and books-and-records requirements; critically, no

II. Background A. BRB and the BridgeFin Division Belmont Ridge Bank National Association is a publicly traded national banking association organized under the laws of the United States and headquartered at 200 Park Avenue South, 38th Floor, New York, New York 10003. The Bank's common stock is listed on the Nasdaq Global Select Market under the ticker symbol "BRDG." BRB holds OCC Charter No. 24891 and is subject to pr

III. Analysis of the Formal Order's Scope A. Text and Structure of the Order The Formal Order of Investigation No. EN-2023-0947 follows the standard format prescribed by the Commission's Rules of Practice and the Division of Enforcement's internal procedures. It identifies BRB by its full legal name — Belmont Ridge Bank National Association — and references BRB's Nasdaq-listed common stock (ticker symbol: BRDG). The

Section 13(a) of the Exchange Act (15 U.S.C. § 78m(a)). This provision requires issuers of securities registered under Section 12 of the Exchange Act to file with the Commission such annual, quarterly, and other periodic reports as the Commission may prescribe. The reports must be accurate and complete in all material respects. Section 13(a) is the foundational statutory authority for the Commission's periodic report

Section 13(b)(2)(A) of the Exchange Act (15 U.S.C. § 78m(b)(2)(A)). This is the "books and records" provision, which requires every issuer of securities registered under Section 12 to make and keep books, records, and accounts which, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the issuer. The "reasonable detail" standard is defined in the statute as the level

IV. Identification of Document Categories A. Categories Expected to Be Sought Under the Subpoena Based on our analysis of the Formal Order's scope and a preliminary review of the document subpoena (SEC Subpoena No. HO-14287-001) issued on October 15, 2023, we anticipate that the following categories of documents will be sought by the Staff. While the subpoena itself contains its own specific language and definitions,

1. SEC Filings and Drafts. All drafts, comments, tracked-change versions, and final versions of the FY 2022 Form 10-K, Q1 2023 Form 10-Q, and Q2 2023 Form 10-Q, together with any related correspondence, memoranda, or communications reflecting the review and preparation process for these filings. This category will necessarily implicate documents in the possession of Caldwell Pratt & Stein LLP ("CPS"), BRB's securitie

2. CECL Model Documentation. BRB's CECL methodology documentation, including the Bank's model governance policies and procedures, model validation reports (whether prepared internally or by third-party model validation vendors), vintage-cohort loss-rate assumptions and supporting data, qualitative overlay analyses and the documentation supporting management's qualitative adjustments to model-derived estimates, quarte

3. BridgeFin Loan-Level Data. Loan-level data for the BridgeFin portfolio, including origination records, borrower-level underwriting data, modification and re-aging records for the 12,847 modified loans (aggregate outstanding balance: $236.4 million), delinquency tracking records and status histories, charge-off records and recovery data, and any loan-level data feeds or extracts used as inputs to the CECL model. Th

4. ACL Committee and Credit Risk Committee Materials. Minutes, agendas, presentations, supporting analyses, and related correspondence from BRB's internal ACL estimation committee (or equivalent body) and any credit-risk governance committees or bodies that reviewed or approved the ACL estimate for the BridgeFin portfolio. These materials will likely reflect the participation of Chief Risk Officer Annette Kowalski an

5. Communications with External Auditor. Correspondence and communications between BRB management and Whitfield Keane LLP regarding the ACL estimate, any proposed audit adjustments (whether recorded or unrecorded), management representation letters, and the auditor's assessment of BRB's CECL methodology and the re-aging treatment. The primary BRB contacts in these communications are expected to be Patricia Navarrete

6. Board and Audit Committee Materials. Minutes and materials from meetings of the BRB Board of Directors and the Audit Committee of the Board at which ACL methodology, BridgeFin credit quality, or SEC filing disclosures were discussed. The Audit Committee is chaired by Gwendolyn Prescott, who is an independent director and is expected to be designated as a custodian for purposes of board-level document collection. B

7. Internal Audit Reports. Any internal audit reports, findings, workpapers, or follow-up memoranda relating to BridgeFin credit quality, ACL methodology, loan-modification practices, or the re-aging of delinquent loans. Internal audit reports can be particularly significant in SEC investigations because they may identify control deficiencies, process weaknesses, or departures from policy that management was aware of

8. Regulatory Correspondence. Communications with the OCC regarding BRB's ACL methodology, credit-quality examinations, supervisory findings, matters requiring attention ("MRAs"), or any other supervisory matters related to the BridgeFin portfolio. This category presents a sensitive privilege issue, as such communications and examination materials are protected by the bank-examination privilege (discussed in detail i

9. Analyst and Investor Communications. Earnings call transcripts, investor day presentations, analyst question-and-answer sessions, and other communications in which BRB management discussed BridgeFin credit quality, the ACL, or related metrics with investors, analysts, or the financial markets. These materials are typically public or semi-public, but the Staff may also seek internal preparatory materials, talking p

10. Personal Communications of Key Custodians. Emails, text messages, instant messages (including through platforms such as Vireo Software, Northgate Data Systems, or Meridian Solutions, if used), and other electronic communications of identified custodians that reference or relate to the ACL, BridgeFin credit quality, re-aging, loan modifications, charge-offs, delinquency metrics, or the SEC inquiry itself. The prod

1. Patricia "Trish" Navarrete, Chief Financial Officer. As CFO, Navarrete has ultimate oversight responsibility for BRB's financial reporting, including the ACL disclosures at issue. She is a co-signatory to the CEO/CFO certifications under Sections 302 and 906 of the Sarbanes-Oxley Act. Her files, emails, and communications are expected to contain critical documents bearing on the ACL estimation process and the prep

2. Raymond Hu, Chief Accounting Officer. Hu is the officer primarily responsible for the mechanics of the CECL model, the quarterly ACL true-up process, qualitative overlay analyses, and the preparation of the journal entries recording the ACL. He is also a primary contact for communications with Whitfield Keane LLP regarding audit-related matters.

3. Naveen Chakravarti, SVP & Division Head, BridgeFin. Chakravarti is the operational leader of the BridgeFin division and has direct knowledge of the loan-modification and re-aging policies, credit-quality trends, the AI-driven underwriting model, and the vintage-cohort data underlying the BridgeFin portfolio.

4. Annette Kowalski, Chief Risk Officer. Kowalski oversees the credit-risk governance framework, including the ACL estimation committee and the risk-appetite framework for BridgeFin. Her files are expected to contain risk reports, credit-quality analyses, and committee materials bearing on the ACL.

5. Derek Sung, General Counsel / Chief Legal Officer. Sung's files may contain relevant documents regarding the legal review of SEC filings, disclosure controls and procedures, and communications with the OCC. However, a significant portion of Sung's files will be subject to attorney-client privilege, and the inclusion of Sung as a custodian will require particularly careful privilege review.

6. Marcus R. Ellingham, Chief Executive Officer. As CEO, Ellingham is a co-signatory to the Sarbanes-Oxley certifications and has general oversight responsibility for BRB's operations and reporting. However, we anticipate that the volume of relevant documents in Ellingham's files will be limited compared to the other primary custodians, and we recommend proposing Ellingham as a limited custodian — subject to collecti

7. Gwendolyn Prescott, Audit Committee Chair. As Chair of the Audit Committee, Prescott's files will contain Board-level and committee-level materials relating to the ACL, financial reporting, and oversight of the external audit. We recommend proposing Prescott as a custodian limited to Board and committee materials, rather than a full email collection. Possible Additional Custodians: In addition to the seven primary

V. Identification of Potential Witnesses A. Current BRB Officers and Employees The following current BRB officers and employees are likely to be sought as witnesses by the SEC Staff, either through investigative testimony subpoenas (formal testimony under oath before Staff attorneys) or through informal interviews: B. External Witnesses The following external individuals and their associated entities are likely to be

1. Naveen Chakravarti — as the individual with the most direct operational knowledge of the BridgeFin re-aging practices and the underlying credit-quality trends;

2. Raymond Hu — as the individual primarily responsible for the CECL model mechanics and the accounting treatment of the re-aged loans; and

3. Patricia Navarrete — as the senior financial officer with oversight responsibility for the ACL estimate and signatory to the Sarbanes-Oxley certifications. We anticipate that testimony subpoenas could be issued within four to eight weeks of the commencement of document production, consistent with the Staff's standard practice of reviewing a threshold set of key documents before scheduling testimony. In some cases,

VI. Privilege and Protective Considerations A. Attorney-Client Privilege The attorney-client privilege protects confidential communications between BRB and its attorneys made for the purpose of obtaining or providing legal advice. In the context of this investigation, the privilege protects the following categories of communications: • Communications between BRB personnel and attorneys at Caldwell Pratt & Stein LLP r

VII. Assessment: Broader Inquiry Risk A. Factors Suggesting a Focused Investigation Several features of the Formal Order and the investigation as a whole suggest that the Staff's inquiry is focused on the specific ACL disclosure issue and is not, at present, a wide-ranging fraud investigation: • Specificity of the Order's recitals. The Formal Order's recitals are specific to ACL disclosures and periodic reporting for

VIII. Recommended Next Steps Based on the foregoing analysis, we recommend that the investigation defense team take the following actions, listed in order of priority:

1. Document Subpoena Response. Immediately commence planning for the response to SEC Subpoena No. HO-14287-001 (issued October 15, 2023). We will prepare and circulate a separate Document Production Protocol letter to the SEC Staff, which we propose to deliver no later than October 20, 2023. The protocol letter will: (a) propose a search methodology, including the identification of custodians, date ranges, and keywor

2. Privilege Review. Implement the privilege review protocol (fir