Contract analysis

I. PURPOSE AND SCOPE OF THIS PROTOCOL This memorandum establishes the privilege review procedures and quality-control guidelines governing the document production by Belmont Ridge Bank National Association ("BRB" or the "Bank") to the United States Securities and Exchange Commission ("SEC"), Division of Enforcement, in connection with Investigation File No. HO-14287, pursuant to Formal Order of Investigation No. EN-2

II. PRODUCTION FORMAT AND BATES NUMBERING CONVENTION The production format for documents responsive to subpoena No. HO-14287-001 has been addressed in preliminary correspondence with the SEC Staff. As set forth in C&H's October 20, 2023 letter to SEC Staff Attorneys Andrea Felton and Christopher Yuen, documents will be produced in TIFF image format accompanied by extracted text files to ensure that all produced docum

III. CATEGORIES OF PRIVILEGE This section describes the privilege doctrines applicable to this review and provides guidance on how each privilege should be identified and applied during the document review process. Reviewers must be familiar with all four categories described below. A. Attorney-Client Privilege

1. Definition and Scope The attorney-client privilege protects confidential communications between BRB personnel (acting as the client or as authorized representatives of the client) and attorneys acting in a legal advisory capacity, where such communications are made for the purpose of obtaining or providing legal advice. The privilege belongs to the client — here, BRB — and may be asserted only by the client or its

2. Covered Attorneys and Firms The following attorneys and law firms have been identified as counsel whose communications with BRB personnel may be protected by the attorney-client privilege. Reviewers should be familiar with these names and should flag any communications involving individuals not listed below who appear to be acting in a legal advisory capacity. (a) Calderwood & Harkness LLP — Defense counsel in the

3. Key Considerations Reviewers should bear in mind the following important principles when applying the attorney-client privilege during this review: Confidentiality Requirement. The communication must have been confidential at the time it was made. A communication shared with third parties outside the scope of the privilege relationship is generally not privileged, unless the disclosure was made pursuant to a joint

1. Definition and Scope The attorney work-product doctrine, codified in Federal Rule of Civil Procedure 26(b)(3) and recognized by the Supreme Court in Hickman v. Taylor, 329 U.S. 495 (1947), protects documents and tangible things prepared in anticipation of litigation or for trial by or for a party or its representative, including the party's attorney, consultant, surety, indemnitor, insurer, or agent. The doctrine

2. Applicable Standard — Anticipation-of-Litigation Trigger Date A critical threshold question for work-product analysis is the identification of the date upon which BRB could reasonably have anticipated litigation or a government enforcement proceeding. For purposes of this review, the earliest trigger date for the anticipation of litigation is September 18, 2023 — the date on which BRB received the SEC voluntary re

3. Brindoval Analytic Partners LLC — Kovel Consultant Brindoval Analytic Partners LLC ("Brindoval") is a forensic accounting consulting firm retained by C&H under the United States v. Kovel, 296 F.2d 918 (2d Cir. 1961), doctrine, effective October 10, 2023. The engagement lead at Brindoval is Dr. Franklin Osei, CPA, CFF. Brindoval was engaged at the direction of C&H specifically to provide forensic accounting analysi

4. Whitfield Keane LLP — Independent Auditor Whitfield Keane LLP is BRB's independent auditor. The engagement partner is Lorraine Dupont, PCAOB Registration No. 2847. Materials prepared by Whitfield Keane in the ordinary course of its audit engagement — including audit work papers, engagement letters, management representation letters, and audit reports — are not attorney work product. They were prepared in the ordin

5. Fact Work Product vs. Opinion Work Product Reviewers should be aware of the distinction between fact work product and opinion work product, as it affects the level of protection afforded: (a) Opinion Work Product — Materials reflecting the mental impressions, conclusions, opinions, or legal theories of an attorney receive near-absolute protection. Opinion work product is discoverable only in the rarest of circumst

1. Definition and Scope The bank-examination privilege protects confidential communications between BRB and its federal banking regulators — specifically, the Office of the Comptroller of the Currency ("OCC") — related to the supervisory and examination process. BRB is a nationally chartered bank operating under OCC Charter No. 24891. As a national bank, BRB is subject to periodic examinations by the OCC, and the con

2. Applicable Authority The bank-examination privilege and the protections afforded to confidential supervisory information ("CSI") are grounded in the following authorities: • 12 C.F.R. § 4.32 et seq. (OCC regulations governing the release of non-public OCC information) • 12 U.S.C. § 1828(x) (restrictions on disclosure of examination reports) • Inter-agency guidance on the treatment of confidential supervisory infor

3. Scope of Protected Materials The following categories of documents constitute or may constitute CSI and must be withheld from production to the SEC on the basis of the bank-examination privilege: (a) OCC examination reports, Reports of Examination ("ROEs"), supervisory letters, Matters Requiring Attention ("MRAs"), and any BRB responses thereto. (b) Internal BRB documents prepared specifically for, or in direct re

4. Special Handling Procedures No CSI may be produced to the SEC without prior written authorization from the OCC. This rule is absolute. If a document contains CSI, it must be withheld regardless of whether it is also responsive to the subpoena. If the SEC Staff specifically requests CSI or materials containing CSI, the request must be immediately escalated to Victoria Chambers and Derek Sung. The SEC may seek such

1. Status. As of the date of this protocol, no formal joint-defense agreement or common-interest agreement has been executed between BRB and any other party. If BRB enters into a common-interest arrangement with any other party — for example, individual officers or directors of the Bank who retain separate counsel in connection with the SEC investigation — this protocol will be amended to address the scope and implic

2. Preliminary Note Regarding Hargrove & Millstein LLP Communications with Hargrove & Millstein LLP (counsel to Whitfield Keane LLP, the Bank's independent auditor; lead partner Samuel Hargrove) are not covered by any common-interest agreement and should be treated as third-party communications unless and until a formal agreement is executed and approved by Victoria Chambers. Because Hargrove & Millstein represents t

IV. CUSTODIANS AND DATA SOURCES A. Identified Custodians The following individuals have been identified as custodians whose files have been collected for review in this matter. Reviewers will be assigned custodian-based batches (as described in Section V.A) and should familiarize themselves with the role and communication patterns of each custodian to whom they are assigned. Reviewers should note that testimony subpo

V. FIRST-PASS REVIEW PROCEDURES A. Staffing and Assignment First-pass privilege review will be conducted by C&H associates and contract attorneys under the direct supervision of Liam Donahue, Working Associate. All reviewers must read this protocol in its entirety and execute a written acknowledgment of receipt and understanding before commencing review. The acknowledgment form will be distributed by Liam Donahue and

1. PRODUCE — The document is not privileged, is responsive to the subpoena, and is cleared for production to the SEC Staff. No privilege applies, and no redaction is required.

2. PRIVILEGE — ATTORNEY-CLIENT — The document is withheld in full on the basis of the attorney-client privilege. The entire document is protected by the privilege and no portion of it may be produced.

3. PRIVILEGE — WORK PRODUCT — The document is withheld in full on the basis of the attorney work-product doctrine. The entire document is protected and no portion of it may be produced.

4. PRIVILEGE — BANK EXAMINATION — The document is withheld in full on the basis of the bank-examination privilege. The document constitutes or contains confidential supervisory information and may not be produced to the SEC without OCC authorization.

5. PRIVILEGE — MULTIPLE BASES — The document is withheld on more than one privilege ground. The reviewer must specify all applicable privilege bases in the notes field (e.g., "AC + WP" for attorney-client and work product; "AC + BE" for attorney-client and bank examination).

6. REDACT — The document is partially privileged. Specific passages within the document are privileged, but the remainder of the document is responsive and may be produced in redacted form. The reviewer must identify the specific passages to be redacted (by highlighting, annotation, or precise description in the notes field) and must specify the privilege basis for each proposed redaction. Documents coded as REDACT w

7. SECOND-PASS ESCALATION — The document presents a privilege question that the first-pass reviewer is unable to resolve with confidence by reference to this protocol. The reviewer must include a detailed note in the review platform explaining the specific privilege issue, the reviewer's preliminary analysis, and the reason for escalation. This code should be used for close calls, ambiguous situations, and documents

8. NON-RESPONSIVE — The document falls outside the scope of the subpoena and is not responsive to any document request. Non-responsiveness determinations should be made by reference to the subpoena specifications as described in the October 20, 2023 production protocol letter to the SEC Staff. Documents coded as NON-RESPONSIVE will not be produced and will not appear on the privilege log, but will be retained in the

1. Emails Between BRB Personnel and Caldwell Pratt & Stein LLP (Martin Caldwell) Regarding SEC Filing Preparation Communications in which BRB personnel seek legal advice from CPS regarding the Bank's disclosure obligations under the federal securities laws, or in which CPS provides such advice, are privileged (attorney-client). This includes, for example, emails in which BRB's CFO or CAO asks Martin Caldwell whether

2. Emails Forwarding Non-Privileged Business Documents to Counsel When a BRB employee forwards a pre-existing business document (e.g., a financial spreadsheet, a loan modification report, or a credit quality dashboard) to counsel, the underlying business document is generally not privileged. It was not created for the purpose of seeking or providing legal advice; it is a pre-existing business record. However, the tra

3. BridgeFin Credit Metrics Spreadsheets and Data Analyses BridgeFin credit metrics spreadsheets and data analyses are generally pre-existing business records and are not privileged. They were created in the ordinary course of the Bank's business operations, not in anticipation of litigation or for the purpose of seeking legal advice. Code such documents as PRODUCE (if responsive). However, if a spreadsheet or data a

4. Communications with Whitfield Keane LLP (Lorraine Dupont) Communications between BRB and its independent auditor, Whitfield Keane LLP, are generally not privileged. The auditor is not BRB's attorney, and the audit engagement is a business relationship, not a legal representation. Routine audit communications — including audit inquiry letters, management representation letters, and discussions regarding accounting

5. Communications With or About Brindoval Analytic Partners LLC (Dr. Franklin Osei) All communications involving Brindoval that are routed through or directed by C&H are work product. Code such documents as PRIVILEGE — WORK PRODUCT. This includes emails between C&H attorneys and Brindoval personnel, Brindoval reports and analyses prepared for C&H, and BRB-to-Brindoval communications that were directed by C&H (e.g., w

6. Board and Audit Committee Materials Board and Audit Committee minutes, presentations, and communications that reflect legal advice from C&H, CPS, or Derek Sung regarding the SEC investigation are privileged (attorney-client). For example, a board presentation in which Victoria Chambers provides an update on the status of the SEC investigation and recommends a course of action is privileged. Routine governance mate

7. OCC-Related Materials Any document bearing OCC letterhead, referencing OCC examination findings, referencing the Bank's CAMELS rating, referencing Matters Requiring Attention, or otherwise constituting or containing confidential supervisory information must be coded PRIVILEGE — BANK EXAMINATION. This includes OCC Reports of Examination, supervisory letters, and any BRB responses to such materials. BRB internal doc

8. Communications Among BRB Officers Discussing Business Operations (No Attorney Involvement, No Legal Advice) Communications among BRB business personnel that do not involve any attorney (whether in-house or outside counsel) and do not seek or reflect legal advice are not privileged. The fact that a communication discusses a topic that is also the subject of the SEC investigation does not make the communication priv

VI. SECOND-PASS REVIEW PROCEDURES A. Staffing Second-pass review will be conducted by Jasmine Thornton, Lead Associate. Documents presenting particularly complex or close-call privilege determinations will be escalated to Victoria Chambers, Partner, for final resolution. All documents coded as SECOND-PASS ESCALATION during first-pass review will be routed to a dedicated second-pass review queue within the review plat

1. Mixed Business-and-Legal-Advice Communications Where a communication contains a mixture of business advice and legal advice, the second-pass reviewer should apply the dominant-purpose test. Under this test, if the primary purpose of the communication, viewed as a whole, was to seek or render legal advice, the communication is privileged even if it also addresses business matters. Conversely, if the dominant purpos

2. Draft SEC Filings with CPS Mark-Ups Draft versions of BRB's SEC filings (Forms 10-K and 10-Q) that contain mark-ups, comments, or annotations by CPS attorneys are privileged to the extent that the mark-ups reflect legal advice or legal judgment about the Bank's disclosure obligations. For example, a draft 10-K in which Martin Caldwell has inserted comments questioning whether a particular risk factor disclosure is

3. Inadvertent Disclosure During Prior Regulatory Interactions During second-pass review, the reviewer should verify whether any documents at issue in the privilege determination were previously produced to the OCC or other banking regulators. This inquiry is relevant for two reasons: (a) If a document was produced to the OCC under compulsion during the bank examination process, the production does not constitute a w

VII. PRIVILEGE LOG — CUMULATIVE LOG REQUIREMENTS A cumulative privilege log will be maintained and updated with each rolling production. The privilege log will serve as the master record of all documents withheld from production or redacted on privilege grounds throughout the course of the SEC investigation. Based on preliminary estimates derived from the initial data assessment and search-term analysis, the review t

VIII. CLAWBACK PROTECTIONS — FRE 502(d) AND NON-WAIVER AGREEMENT A. FRE 502(d) Order Federal Rule of Evidence 502(d) provides that a federal court may order that the privilege or work-product protection is not waived by disclosure connected with the litigation pending before the court, and that the court's order is binding on all persons or entities whether or not they were parties to the litigation. An FRE 502(d) pr

IX. QUALITY-CONTROL SAMPLING METHODOLOGY Quality control is an essential component of the privilege review process. The procedures described in this section are designed to identify and correct privilege coding errors before documents are produced to the SEC Staff, and to maintain an auditable record of quality-control measures taken throughout the review. A. Random Sampling of "PRODUCE" Coded Documents After first-p