PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT
CALDERWOOD & HARKNESS LLP 825 Eighth Avenue, 42nd Floor New York, New York 10019
MEMORANDUM
TO: Conrad Ashby, Responsible Partner; Steven Hollander, Lead Associate
FROM: Jasmine Thornton, Working Associate
DATE: April 15, 2025
RE: Assessment of Torchlight Mining Corp. Anti-Corruption Compliance Program
MATTER NO.: 1039-00005
PRIVILEGE DESIGNATION: This memorandum constitutes privileged and confidential attorney work product prepared at the direction of counsel in connection with Calderwood & Harkness LLP's internal investigation on behalf of Torchlight Mining Corp. ("Torchlight" or the "Company"). It is protected by the attorney-client privilege and the work product doctrine. This memorandum contains the mental impressions, conclusions, opinions, and legal theories of counsel. Do not distribute, copy, or disclose without the express authorization of the Responsible Partner.
Right-click to update Table of Contents
I. Executive Summary
The purpose of this memorandum is to evaluate Torchlight Mining Corp.'s existing anti-corruption compliance program against the framework set forth in the U.S. Department of Justice Criminal Division's Evaluation of Corporate Compliance Programs (most recently updated March 2023) (the "DOJ Guidance") and the U.S. Securities and Exchange Commission's enforcement guidance, in order to identify gaps and deficiencies relevant to the ongoing FCPA investigation (SEC File No. HO-14892; related DOJ inquiry). This assessment is a critical component of Calderwood & Harkness's broader representation of Torchlight in connection with the investigation and will inform both the remediation strategy and the Audit Committee's evaluation of voluntary self-disclosure options.
The scope of this assessment encompasses a review of Torchlight's global compliance policies, procedures, training records, third-party management framework, internal controls, financial oversight mechanisms, and monitoring and testing activities. Particular focus has been directed to the Company's West African operations, which are conducted through two subsidiary entities: Torchlight Ganara Holdings Ltd. ("TGH"), a British Virgin Islands holding company, and Torchlight Ganara Mining S.A. ("TGM"), the Ganaran operating subsidiary. These entities are at the center of the alleged improper payment scheme that is the subject of the government investigation.
Based on our review to date, it is our overall assessment that Torchlight's compliance program, as administered by Vice President of Compliance and Ethics Nadia Berenson (appointed to that role in September 2021), contains foundational elements consistent with a basic compliance framework. The Company has adopted a Global Anti-Corruption Policy, a Code of Conduct, a Delegation of Authority Policy, and an ethics hotline operated by a third-party vendor. However, the compliance program exhibits material deficiencies in implementation, monitoring, and enforcement, particularly with respect to operations in high-risk jurisdictions. These deficiencies are most pronounced in the following areas: (1) third-party due diligence and ongoing monitoring; (2) enforcement of the Delegation of Authority Policy, especially with respect to payments processed through offshore subsidiaries; (3) training penetration in high-risk jurisdictions; and (4) tracking of gifts, hospitality, and in-kind benefits provided to government officials.
These deficiencies are directly relevant to the alleged scheme at the center of the investigation, which involves approximately $4.73 million in suspected improper payments to Ganaran government officials. The payments are alleged to have been made through two primary channels: (a) $3,210,000 paid to Crestfield Advisory Partners Ltd. ("Crestfield"), a Mauritius-incorporated shell entity controlled by Jean-Philippe Renard, which the investigation has identified as a conduit for corrupt payments; and (b) approximately $1,520,000 in direct disbursements from TGM, including $890,000 in cash withdrawals booked under vague general-ledger codes and approximately $630,000 in in-kind benefits (vehicle purchases, travel expenses, and other items) provided to Ganaran government officials.
The methodology employed in preparing this assessment includes: (a) review of Company policies and procedures, including the Global Anti-Corruption Policy, Code of Conduct, Delegation of Authority Policy, gift and hospitality guidelines, and third-party engagement procedures; (b) interviews conducted during the first wave of the investigation (April 7–11, 2025, at Torchlight's corporate headquarters in Toronto, Ontario, Canada), including interviews of Nadia Berenson, VP Compliance and Ethics (April 7, 2025), Diane Fournier, VP Finance (April 8, 2025), and Patricia Sung, General Counsel (April 9, 2025); (c) review of training records, compliance files, and the Sentinel Compliance Solutions Inc. hotline report database; (d) coordination with Pinnacle Forensic Advisory LLC (engagement lead: Dr. Leonard Strauss, CPA, CFF, CFE) on the financial controls review and forensic accounting analysis; and (e) consultation of publicly available DOJ and SEC enforcement guidance, declination letters, deferred prosecution agreements, and consent orders.
This memorandum sets forth our findings in detail below, organized by the principal topic areas identified in the DOJ Guidance. A consolidated summary of key deficiencies is provided in Section XIII. Remediation recommendations are previewed in Section XV and will be developed fully in a separate memorandum to be submitted by May 12, 2025.
II. Analytical Framework — DOJ/SEC Evaluation of Corporate Compliance Programs
The DOJ Criminal Division's Evaluation of Corporate Compliance Programs provides the principal framework against which prosecutors and regulators assess the adequacy of a company's compliance program in FCPA and other corporate criminal matters. The most recent revision of this guidance, issued in March 2023, builds upon earlier iterations (including the 2017 and 2020 versions) and reflects the DOJ's accumulated experience evaluating compliance programs in connection with charging decisions, plea agreements, deferred prosecution agreements, and declinations.
The DOJ Guidance is organized around three fundamental questions, which prosecutors are directed to consider in evaluating a company's compliance program:
1. Is the corporation's compliance program well designed? This inquiry examines whether the company has adopted policies, procedures, and structural safeguards that are reasonably tailored to the company's risk profile and that reflect an understanding of the specific corruption risks confronting the organization.
2. Is the program being applied earnestly and in good faith — that is, is it effectively implemented? This inquiry goes beyond paper policies to examine whether the compliance program is resourced, supported by management, and operationalized across the organization, including in high-risk subsidiaries and business units.
3. Does the compliance program work in practice? This inquiry focuses on outcomes — whether the program has mechanisms for detecting and remediating misconduct, whether it evolves in response to lessons learned and changes in risk, and whether the company has a track record of identifying issues and taking appropriate corrective action.
Under each of these overarching questions, the DOJ Guidance identifies specific topic areas that prosecutors should evaluate. The following key topics are relevant to Torchlight's compliance program and are addressed in this memorandum, mapped to the specific sections in which each is discussed:
• Commitment by senior and middle management (Section III) — The DOJ examines whether senior leadership has set an appropriate "tone at the top" and whether middle management has reinforced compliance expectations through their conduct and oversight. The DOJ specifically looks for evidence that senior leaders have devoted adequate resources to the compliance function and have communicated the importance of compliance in concrete, measurable terms.
• Policies and procedures (Section IV) — The DOJ evaluates whether the company has adopted policies and procedures that are reasonably designed to address the company's corruption risks, whether those policies are accessible and comprehensible to relevant personnel, and whether they provide clear guidance on the company's specific risk areas (including, in extractive-industry cases, interactions with government officials in connection with permitting, licensing, and regulatory approvals).
• Risk assessment (Section V) — The DOJ assesses whether the company has conducted a risk assessment that is tailored to its specific business activities, geographic footprint, and regulatory environment, and whether the risk assessment informs resource allocation and the design of compliance controls. A risk assessment that identifies a jurisdiction as "high risk" without triggering enhanced compliance measures is of limited value.
• Third-party management (Section VI) — This is frequently the most heavily scrutinized area in FCPA cases, given that the majority of FCPA enforcement actions involve payments made through third-party intermediaries, agents, or consultants. The DOJ examines whether the company has implemented risk-based due diligence procedures for third parties, whether the company has incorporated appropriate contractual protections (including anti-corruption representations, audit rights, and termination provisions), and whether the company conducts ongoing monitoring of third-party relationships.
• Training and communications (Section VII) — The DOJ evaluates whether the company's anti-corruption training is risk-based, whether it reaches all relevant personnel (including employees in high-risk jurisdictions and third-party agents), whether it is delivered in accessible languages, and whether the company tracks training completion and follows up on non-completion.
• Confidential reporting structure and investigation resources (Section VIII) — The DOJ examines whether the company has established effective mechanisms for employees and third parties to report suspected misconduct anonymously and without fear of retaliation, and whether the company has adequate investigation resources to respond to reports and escalate significant matters appropriately.
• Internal controls and financial oversight (Section IX) — Of particular importance in FCPA cases, the DOJ (and, independently, the SEC under the FCPA's books-and-records and internal-controls provisions) evaluates whether the company has implemented financial controls sufficient to ensure accurate recording of transactions and to prevent unauthorized payments. The DOJ Guidance specifically references the importance of delegation of authority controls, payment approval workflows, and the integration of compliance considerations into financial processes.
• Incentives and disciplinary measures (Section XI) — The DOJ examines whether the company's incentive structures align with compliance objectives and whether the company has a track record of imposing meaningful disciplinary consequences for compliance violations.
• Continuous improvement, periodic testing, and review (Section XII) — The DOJ evaluates whether the compliance program is static or dynamic — that is, whether the company regularly tests the effectiveness of its compliance controls, incorporates lessons from enforcement trends and internal experiences, and makes adjustments based on the results of testing and review.
• Mergers and acquisitions due diligence — While not a primary focus of this memorandum (Torchlight did not acquire TGH or TGM through an M&A transaction; both were established as greenfield subsidiaries), the DOJ's emphasis on pre- and post-acquisition compliance integration is relevant to the extent it underscores the importance of extending compliance controls to all entities within a corporate group.
This memorandum addresses each of these topic areas in turn, identifies our findings with respect to Torchlight's compliance program, and flags specific gaps that are relevant to the investigation and to the government's assessment of the Company's compliance posture. Each section concludes with a summary finding or identification of material deficiencies.
III. Commitment by Senior and Middle Management
III.A. Tone at the Top
Torchlight's Board of Directors adopted the Company's Global Anti-Corruption Policy in November 2018, approximately five months after Gerald R. Vandermeer was appointed Chief Executive Officer on June 22, 2018. The adoption of the policy was accompanied by a communication from Mr. Vandermeer to global staff, distributed via internal email and posted on the corporate intranet, in which he stated that Torchlight is "committed to conducting business with the highest standards of integrity" and that "compliance with anti-corruption laws is a core value of this company." This type of leadership communication is consistent with the "tone at the top" that the DOJ Guidance identifies as a foundational element of an effective compliance program.
At the Board level, the Audit Committee of Torchlight's Board of Directors has standing oversight authority over compliance matters, including the anti-corruption compliance program. The Audit Committee is chaired by Dr. Eleanor Fiske, an independent director with a background in corporate governance, and includes members Warren Ogilvy and Marguerite Chen, both independent directors. On September 5, 2024, following escalation of the whistleblower complaint by VP Compliance and Ethics Nadia Berenson and General Counsel Patricia Sung, the Audit Committee authorized the preliminary internal review that ultimately led to the engagement of Calderwood & Harkness LLP as outside counsel.
Finding: Board-level commitment to anti-corruption compliance appears documented in the adoption of the Global Anti-Corruption Policy and in the Audit Committee's prompt authorization of the internal review following receipt of the whistleblower complaint. However, our review has identified a significant gap in the depth of Board and Audit Committee engagement with compliance matters during the period prior to the whistleblower complaint. Specifically, there is no evidence of regular Board or Audit Committee reporting on anti-corruption compliance metrics at a level of granularity sufficient to provide meaningful oversight.
Berenson's interview on April 7, 2025, confirmed that she provided compliance program updates to the Audit Committee on an annual basis. However, she described these as "summary presentations" that covered the compliance program at a high level — typically a 10-to-15-minute agenda item during the December Audit Committee meeting — without granular risk metrics for specific jurisdictions, specific data on third-party engagements in high-risk countries, or information on the status of compliance monitoring activities at the subsidiary level. Berenson indicated that she had not been asked by the Audit Committee to provide more detailed reporting and that the annual summary format was established before her appointment.
This level of Board engagement falls short of the DOJ's expectation that senior leadership actively engage with the compliance function and receive sufficient information to exercise meaningful oversight. In recent enforcement actions — including the DOJ's 2023 resolution with Albemarle Corporation and the SEC's 2022 enforcement action against Glencore plc — the DOJ and SEC have emphasized the importance of regular, detailed compliance reporting to the Board as an indicator of genuine organizational commitment to compliance. The absence of granular compliance metrics in Audit Committee reporting is a gap that should be addressed in the remediation plan.
III.B. Middle Management Engagement
The DOJ Guidance places significant emphasis on the role of middle management in implementing and reinforcing compliance expectations. In the extractive-industry context, middle management — particularly regional operational leaders with authority over interactions with government officials — plays a critical role in translating corporate compliance policies into day-to-day practice. The DOJ evaluates whether middle management is incentivized and held accountable for compliance, and whether the compliance function has sufficient independence and access to oversee middle management's conduct.
Two individuals are of particular relevance to this assessment:
Marcus Delacroix (Former VP, Africa Operations): Delacroix was appointed VP, Africa Operations on November 3, 2018, shortly after Mr. Vandermeer's appointment as CEO. In this role, Delacroix had direct operational authority over all of Torchlight's West African operations, including oversight of TGH and TGM. Delacroix reported to the Chief Operating Officer and had budgetary authority over the Africa Operations division. Delacroix resigned from Torchlight on November 15, 2024, after being informed that the Company was conducting an internal review related to the Ganaran operations. He resigned prior to the commencement of formal disciplinary proceedings. Our review has identified a significant gap: there is no evidence that Delacroix was required to certify compliance with anti-corruption policies on a periodic basis. While the Company's Code of Conduct requires all employees to acknowledge receipt and understanding of the Code upon hire, no annual or periodic re-certification process existed for senior management with operational authority over high-risk regions. The absence of such a certification mechanism deprived the compliance function of a tool for establishing accountability and creating a documented record of management's compliance commitments.
Raymond Osei-Bonsu (Former Country Manager, TGM): Osei-Bonsu was hired as Country Manager of TGM on February 7, 2019, approximately four months before the execution of the Crestfield Advisory Agreement. In his capacity as Country Manager, Osei-Bonsu had day-to-day operational responsibility for TGM's activities in Ganara, including authority over payments, vendor relationships, and interactions with local government officials. Osei-Bonsu reported to Delacroix in the business chain of command. His employment was terminated on January 8, 2025, following the preliminary internal review.
Finding: A structural gap in middle management accountability has been identified with respect to the compliance function's visibility into TGM's operations. Berenson confirmed in her April 7 interview that she had "limited visibility" into TGM's compliance activities during the period under investigation. She stated that she relied on Delacroix as the "primary conduit" for information about compliance matters in the Ganaran operations, and that she did not have an independent reporting line to TGM personnel in Ganara. This arrangement is problematic for several reasons. First, it placed the compliance function in a position of dependence on the very individual who is alleged to have orchestrated or facilitated the improper payment scheme. Second, it created an information bottleneck that allowed compliance-relevant information — including information about the Crestfield engagement, the nature of TGM's interactions with government officials, and the classification of TGM's expenditures — to be filtered through the business chain of command before reaching the compliance function. Third, it is inconsistent with the DOJ Guidance's emphasis on compliance function independence and the importance of providing the compliance function with "direct access to relevant sources of data" and an "ability to measure the compliance culture" across the organization.
The reliance on the business chain of command as the sole information channel for compliance oversight of the highest-risk subsidiary in the Company's portfolio represents a material structural deficiency that is directly relevant to the failure of the compliance program to detect the alleged scheme.
IV. Policies and Procedures
IV.A. Global Anti-Corruption Policy
Torchlight's Global Anti-Corruption Policy was initially adopted in November 2018 and was revised in September 2021 under Berenson's direction. The policy is a 22-page document that covers the following subject areas: (i) prohibition of bribery of foreign officials; (ii) prohibition of commercial bribery; (iii) guidance on gifts, hospitality, and entertainment; (iv) facilitation payments; (v) use of agents, intermediaries, and consultants; (vi) charitable contributions and political donations; (vii) books-and-records requirements; and (viii) reporting obligations for known or suspected violations.
The policy states that it applies to "all directors, officers, employees, and agents of Torchlight Mining Corp. and its subsidiaries, wherever located," and requires compliance with "all applicable anti-corruption laws." The policy specifically references the Canadian Corruption of Foreign Public Officials Act (S.C. 1998, c. 34) (the "CFPOA") and contains a general reference to "applicable U.S. laws" in the introductory section. However, the policy does not specifically name the Foreign Corrupt Practices Act of 1977 (15 U.S.C. §§ 78dd-1 et seq.) (the "FCPA").
Gap: The failure to specifically reference the FCPA in the Global Anti-Corruption Policy is a notable omission given Torchlight's jurisdictional exposure under that statute. Torchlight is a Canadian-incorporated company headquartered in Toronto, Ontario, but its American Depositary Receipts (ADRs) are listed on the New York Stock Exchange under the ticker symbol "TRCH." As an issuer with securities registered under Section 12 of the Securities Exchange Act of 1934, Torchlight is subject to the FCPA's anti-bribery provisions (Section 78dd-1) and is also subject to the FCPA's books-and-records provision (Section 13(b)(2)(A)) and internal-controls provision (Section 13(b)(2)(B)). The failure to specifically reference the FCPA in the Company's anti-corruption policy, and the absence of specific guidance on the FCPA's books-and-records and internal-controls requirements, represents a design deficiency that is relevant to the government's assessment of whether the compliance program was reasonably tailored to the Company's legal and regulatory risk profile.
The 2021 revision of the policy, while incorporating improvements in several areas (including more detailed guidance on facilitation payments and the addition of a section on charitable contributions), did not address this gap. Berenson stated in her interview that the FCPA omission was an oversight and that she had intended to address it in a future revision. Patricia Sung, General Counsel, stated in her April 9 interview that she was aware of Torchlight's FCPA jurisdictional exposure but had not flagged the policy gap because she "assumed the general reference to 'applicable U.S. laws' was sufficient."
IV.B. Code of Conduct
Torchlight's Code of Conduct is a 34-page document available on the Company's corporate intranet. The Code is available in English and French, the two official languages of Canada. The Code includes a general anti-corruption section that prohibits bribery and corruption and directs employees to the Global Anti-Corruption Policy for detailed guidance. The Code also includes sections on conflicts of interest, confidentiality, insider trading, workplace health and safety, environmental compliance, and human rights.
Finding: The Code of Conduct was not translated into any Ganaran local languages. While French is an official language in Ganara, the lingua franca in the Kousseri and Dembélé regions where TGM operates is primarily Pulaar and Mandinka. TGM employs approximately 2,400 local workers, the majority of whom work in mining operations, site services, and community relations functions. While many of these workers may have working proficiency in French, the absence of local-language translations potentially limits comprehension of the Code's requirements among a significant portion of TGM's workforce. The DOJ Guidance specifically evaluates whether a company's policies and procedures are "accessible and applicable to all employees" and whether they are available in "local languages." The absence of local-language translations of the Code of Conduct is a design gap that should be addressed in the remediation plan.
IV.C. Delegation of Authority Policy
Torchlight maintains a Delegation of Authority Policy (the "DAP"), which establishes approval thresholds and authorization requirements for expenditures across the Company and its subsidiaries. The DAP is organized by expenditure type and specifies the level of management authorization required for various categories of payments. Of particular relevance to this investigation, the DAP provides that any single payment exceeding $50,000 requires dual authorization — that is, approval by both the initiating manager and a second authorized signatory at or above the Vice President level.
Critical Gap: The investigation has identified a systematic pattern of violations of the DAP's dual-approval requirement with respect to payments made to Crestfield Advisory Partners Ltd. Of the 24 invoices submitted by Crestfield to TGH over the period April 2019 through October 2024, 14 invoices exceeded the $50,000 dual-approval threshold. The amounts of these 14 invoices ranged from $55,000 to $185,000. Each of these 14 invoices was approved solely by Raymond Osei-Bonsu, the TGM Country Manager, without secondary authorization from a Vice President-level or higher signatory. No exception request, escalation, or override documentation exists for any of these payments. The payments were processed without triggering any automated control or manual review that would have flagged the single-approval violation.
Diane Fournier, VP Finance, provided critical context for this deficiency in her April 8, 2025 interview. Fournier confirmed that she was unaware of the single-approval violations because TGM's financial systems did not enforce automated dual-approval controls for payments processed through the BVI entity, TGH. Specifically, the Crestfield invoices were paid from TGH's account at Meridian Commercial Bank in the British Virgin Islands (Account No. 7740-2281-0056). Payments processed through Meridian Commercial Bank were not integrated into Torchlight's centralized enterprise resource planning ("ERP") system (Harborline Software), which is hosted at Torchlight's Toronto headquarters and enforces automated approval workflows for payments processed through the Company's primary treasury operations. Instead, the DAP relied on manual enforcement for BVI-processed payments — that is, Osei-Bonsu was responsible for manually ensuring that payments exceeding $50,000 received a second approval signature before being submitted to Meridian Commercial Bank for processing.
Fournier stated that TGH's banking arrangement with Meridian Commercial Bank was established in 2018, prior to her appointment as VP Finance in 2020, and that the decision to maintain a separate banking relationship outside the centralized ERP system was made for "operational efficiency" reasons related to currency conversion and local payment processing. She acknowledged that the absence of automated controls for BVI-processed payments was a "known limitation" but stated that she had relied on "manual compliance by the field team" and had not received any reports of DAP violations.
The failure to extend automated dual-approval controls to the BVI subsidiary is a material internal controls deficiency. It is directly relevant to the FCPA's internal-controls provision (Section 13(b)(2)(B)), which requires issuers to "devise and maintain a system of internal accounting controls sufficient to provide reasonable assurances" that transactions are executed in accordance with management's general or specific authorization. The DAP violations identified in connection with the Crestfield payments are precisely the type of control failure that the FCPA's internal-controls provision is designed to prevent.
IV.D. Facilitation Payment Policy
Torchlight's Global Anti-Corruption Policy includes a section addressing facilitation payments. The policy prohibits facilitation payments "except where required to protect the health or safety of personnel," and provides that any such payment must be "reported to the compliance department within 48 hours and accurately recorded in the Company's books and records."
Gap: The investigation has identified $890,000 in cash withdrawals from TGM's account at Regency International Bank (Account No. GAN-4419-8837) over the period 2019 through 2024. These cash withdrawals were booked under General Ledger Code 7450, which is designated as "Community Relations Expenses" in Torchlight's chart of accounts. GL 7450 is a broadly defined category that encompasses a range of expenditures related to community engagement, local stakeholder relations, and social impact programs. The vague and expansive nature of this GL code allowed significant cash withdrawals to be recorded without detailed supporting documentation, specific payee identification, or business purpose narratives.
No evaluation of the $890,000 in GL 7450 cash withdrawals was conducted against the facilitation payment policy at any time during the period under investigation. No monitoring mechanism existed to review or audit cash withdrawals classified under this or similar vague general-ledger codes. The forensic review being conducted by Pinnacle Forensic Advisory LLC is analyzing these withdrawals in detail; preliminary findings suggest that a substantial portion of the cash withdrawals may have been used to make direct payments to Ganaran government officials in connection with permitting and regulatory matters. These findings are being developed in the separate forensic accounting report.
V. Risk Assessment
V.A. Enterprise Risk Assessment
Torchlight conducted a global compliance risk assessment in 2021, shortly after Berenson's appointment as VP Compliance and Ethics. The risk assessment was conducted by Berenson's compliance team in consultation with Patricia Sung (General Counsel) and was presented to the Audit Committee as part of Berenson's initial compliance program review. The 2021 risk assessment identified the following key risk factors relevant to the Company's anti-corruption exposure:
• Geographic risk: Torchlight's operations in West Africa, and specifically in Ganara, were designated as presenting "high risk" for corruption based on Transparency International's Corruption Perceptions Index scores (Ganara scored 28/100 in the 2021 CPI, ranking 149th out of 180 countries) and the well-documented corruption risks associated with the extractive industries in the region.
• Industry risk: The extractive industries sector is identified by the DOJ, the SEC, the World Bank, and other international organizations as a sector with elevated corruption risk, particularly in connection with government permitting, licensing, regulatory approvals, customs clearance, and interactions with state-owned enterprises. Torchlight's operations in Ganara require the Company to obtain mining licenses, environmental approvals, and exploration permits from Ganaran government agencies, creating frequent and high-value interactions with government officials.
• Third-party risk: The risk assessment acknowledged that the use of agents, consultants, and intermediaries in connection with government permits and regulatory approvals presents elevated corruption risk. This acknowledgment is consistent with the DOJ's and SEC's findings in the vast majority of FCPA enforcement actions, which involve payments made through third-party intermediaries.
Finding: While the 2021 risk assessment correctly identified the Ganaran operations as high-risk, the risk assessment did not translate into enhanced compliance measures for the Ganaran operations. Despite the high-risk designation, no enhanced compliance procedures — such as increased monitoring, more frequent compliance reporting, dedicated compliance personnel in Ganara, or heightened due diligence requirements for third parties engaged in the region — were implemented beyond general policy distribution. The risk assessment functioned as an identification exercise rather than a driver of risk-based resource allocation and control design.
The DOJ Guidance specifically evaluates whether a company's risk assessment informs the allocation of compliance resources and the design of compliance controls. A risk assessment that identifies elevated risk in a particular jurisdiction but does not result in commensurate enhancements to the compliance program is of limited probative value in demonstrating that the company has an effective compliance program. This gap is particularly significant given that the alleged corrupt payment scheme originated in the very jurisdiction that the risk assessment identified as high-risk.
V.B. Third-Party Risk Assessment
As a component of the 2021 enterprise risk assessment, Berenson's team acknowledged that the use of agents, consultants, and intermediaries in connection with government permits presents elevated corruption risk. However, no risk-based tiering of third parties was documented as a result of this assessment.
Gap: Third-party risk tiering is a fundamental element of an effective anti-corruption compliance program, particularly in the extractive-industry context. A risk-tiered approach categorizes third parties based on factors such as the nature of their services, their proximity to government officials, the jurisdiction in which they operate, their ownership structure, and their payment terms, and calibrates the level of due diligence and monitoring to the risk tier. Torchlight did not implement any such tiering system.
As a result, Crestfield Advisory Partners Ltd. — a Mauritius-incorporated firm engaged to provide "government relations advisory services" in Ganara, with a single principal (Jean-Philippe Renard), no employees, no website, and an address matching a registered-agent office in Port Louis (7th Floor, Nexus Tower, Ebène Cybercity, Port Louis, Mauritius) — was not subjected to any documented risk assessment or due diligence prior to the engagement or at any time during the 5.5-year period of the relationship. Had a risk-tiered approach been in place, Crestfield would almost certainly have been classified as a high-risk or critical-risk third party based on its characteristics, and would have been subject to enhanced due diligence, including beneficial ownership verification, background checks on the principal, reference checks, assessment of the entity's reputation and track record, and ongoing monitoring.
VI. Third-Party Management — Due Diligence and Ongoing Monitoring
Third-party management is the area of Torchlight's compliance program that exhibits the most significant and consequential deficiencies. As noted above, the DOJ and SEC have identified third-party intermediaries as the primary channel through which corrupt payments are made in the vast majority of FCPA enforcement actions. The DOJ Guidance devotes substantial attention to the adequacy of a company's procedures for vetting, contracting with, and monitoring third parties who interact with government officials on the company's behalf. The deficiencies identified in this section are directly relevant to the alleged scheme involving Crestfield Advisory Partners Ltd.
VI.A. Third-Party Due Diligence Procedures
Torchlight's Global Anti-Corruption Policy includes a section titled "Use of Agents, Intermediaries, and Consultants" that requires "appropriate due diligence" on third parties engaged to interact with government officials on behalf of the Company. The policy states that "prior to engaging any agent, intermediary, or consultant who will interact with government officials in connection with the Company's business," the responsible business unit must "conduct appropriate due diligence to assess the integrity, qualifications, and reputation of the proposed third party."
While this policy language reflects an awareness of the need for third-party due diligence, the policy provides only general guidance. It does not specify the required due diligence steps, the documentation standards that must be satisfied, the approval workflow that must be followed, or the risk-based tiering criteria that should determine the scope and depth of due diligence. The policy does not identify a specific individual or department responsible for reviewing and approving the results of third-party due diligence, nor does it specify what categories of information must be collected and evaluated (e.g., beneficial ownership, sanctions screening, adverse media, references, financial information). This lack of specificity rendered the due diligence requirement aspirational rather than operational.
Critical Gap: No due diligence file exists in Torchlight's compliance records for Crestfield Advisory Partners Ltd. Our review of the Company's compliance files, the records maintained by Berenson's team, and the files of the legal department has confirmed that no documentation of any due diligence activity relating to Crestfield or its principal, Jean-Philippe Renard, was created or retained at any time during the 5.5-year engagement. The investigation has determined the following:
(a) No competitive selection process. Jean-Philippe Renard was personally introduced to Torchlight by Marcus Delacroix. Berenson's interview confirmed that Delacroix represented Renard as a "trusted local advisor with excellent government relationships" in Ganara. No competitive selection process was conducted for the Crestfield engagement. No alternative candidates were evaluated. No assessment of Renard's qualifications, background, or reputation was performed.
(b) No background check or reference check. Neither Torchlight's compliance department nor any other function conducted a background check, reference check, or reputational due diligence on Renard or on Crestfield. No sanctions screening (e.g., against OFAC, EU, UN, or other sanctions lists) was performed. No adverse media search was conducted. No verification of Crestfield's corporate registration, beneficial ownership, or financial standing was performed.
(c) No compliance department or legal department review. The Government Relations Advisory Agreement dated April 12, 2019, between TGH and Crestfield was executed without review by the compliance department or by the legal department at headquarters. The agreement was negotiated and signed by Delacroix on behalf of TGH and by Renard on behalf of Crestfield. Berenson stated in her interview that she was not aware of the Crestfield engagement until she assumed the VP Compliance and Ethics role in September 2021, and that even after becoming aware of it, she did not conduct a retroactive due diligence review because she "did not have the resources to go back and review all existing third-party relationships."
(d) Shell-company characteristics not identified. Crestfield presents multiple indicia of a shell entity: it is incorporated in Mauritius, a jurisdiction frequently used for offshore corporate structures; its registered address (7th Floor, Nexus Tower, Ebène Cybercity, Port Louis, Mauritius) matches a well-known registered-agent office; it has no website, no publicly available contact information, and no employees other than Renard; and its sole principal, Renard, has no documented professional history or qualifications in "government relations advisory" services. These characteristics are consistent with the types of red flags that the DOJ and SEC have identified in enforcement actions as indicators of potential corruption risk. None of these red flags were identified or flagged by any function within Torchlight.
The absence of any due diligence on Crestfield is a foundational deficiency that is directly relevant to the government's assessment of Torchlight's compliance program. The DOJ has consistently emphasized in enforcement actions and guidance documents that the failure to conduct adequate due diligence on third-party intermediaries is one of the most significant compliance failures in FCPA cases. In the DOJ's 2020 declination involving Jardine Lloyd Thompson Group plc, the Department specifically noted that "robust third-party due diligence procedures" were a factor supporting the declination. Conversely, in enforcement actions such as the DOJ's 2023 resolution with Sundial Corporation and the SEC's 2023 enforcement action against Alight Solutions LLC, the failure to conduct adequate third-party due diligence was cited as evidence of compliance program inadequacy.
VI.B. Contractual Protections
The Government Relations Advisory Agreement between TGH and Crestfield Advisory Partners Ltd., dated April 12, 2019, is a 14-page agreement that sets forth the terms of Crestfield's engagement. The agreement includes a general anti-corruption representation clause at Clause 9.2, in which Crestfield warranted that it "shall comply with all applicable anti-corruption laws" and that it "has not and will not, directly or indirectly, offer, promise, give, or authorize the giving of anything of value to any government official for the purpose of influencing any official act or decision."
While this representation reflects a basic contractual acknowledgment of anti-corruption obligations, the agreement contains several significant omissions:
(a) No FCPA-specific reference. The anti-corruption representation clause references "all applicable anti-corruption laws" but does not specifically reference the FCPA. Given Torchlight's FCPA jurisdictional exposure as a NYSE-listed issuer, the inclusion of FCPA-specific representations and warranties — including specific references to the anti-bribery provisions and the books-and-records and internal-controls provisions — is a standard contractual protection in agreements with government-facing third parties.
(b) No audit rights clause. The agreement does not include an audit rights clause permitting Torchlight (or its agents, including external auditors and outside counsel) to examine Crestfield's books, records, accounts, or use of funds. The absence of audit rights is a fundamental contractual deficiency. Audit rights clauses are a standard feature of well-designed third-party agreements in the anti-corruption context, and the DOJ and SEC have repeatedly identified the presence or absence of audit rights as a factor in evaluating the adequacy of a company's third-party management program. In the DOJ's 2016 FCPA Pilot Program guidance (now incorporated into the DOJ's Corporate Enforcement Policy), the Department specifically identified audit rights as a component of an effective compliance program.
(c) No termination-for-cause provision tied to anti-corruption violations. The agreement does not include a termination provision specifically triggered by anti-corruption violations, a refusal to certify compliance, or the discovery of red flags during ongoing monitoring. While the agreement includes a general termination-for-convenience provision (Clause 12.1), the absence of a specific anti-corruption termination provision deprived Torchlight of a contractual mechanism for promptly terminating the relationship upon the emergence of compliance concerns.
(d) No record-keeping requirement. The agreement does not require Crestfield to maintain records demonstrating the legitimate use of funds received from TGH, nor does it require Crestfield to provide Torchlight with periodic reports on the activities undertaken with the funds. This absence is particularly significant given the nature of Crestfield's engagement, which involved the provision of "government relations advisory services" — a category of services that, by its nature, involves expenditures that are difficult to verify independently and that present a heightened risk of being used as a conduit for corrupt payments.
Gap: The absence of audit rights, in particular, is a fundamental deficiency that has been identified in DOJ and SEC enforcement actions as a key indicator of an ineffective third-party management program. In the SEC's 2023 consent order with Koninklijke Philips N.V., the Commission specifically cited the absence of audit rights in third-party agreements as evidence of internal controls deficiencies. The Crestfield Advisory Agreement's contractual protections are materially deficient by the standards articulated in the DOJ Guidance and in enforcement precedent.
VI.C. Ongoing Monitoring of Third Parties
Effective third-party management requires not only pre-engagement due diligence but also ongoing monitoring of the third-party relationship for the duration of the engagement. The DOJ Guidance specifically evaluates whether a company has mechanisms for monitoring third-party payment patterns, assessing ongoing compliance, and detecting red flags that may emerge after the engagement commences. No ongoing monitoring or periodic recertification of Crestfield Advisory Partners Ltd. was conducted at any time during the 5.5-year engagement.
The absence of ongoing monitoring allowed the following anomalies and red flags to go undetected:
Payment volume exceeding contractual maximum. Over the course of the engagement, Crestfield invoiced TGH a total of $3,210,000 across 24 invoices. The Government Relations Advisory Agreement established a contractual payment structure consisting of: (i) monthly retainer fees totaling $990,000 over the expected term of the agreement; (ii) success fees of up to $500,000 tied to the successful issuance of specified permits; and (iii) reimbursable expenses of up to $550,000. The total contractual maximum under the agreement was therefore $2,040,000. The actual payments of $3,210,000 exceeded the contractual maximum by $1,170,000 — a 57% overpayment. No contract amendment, addendum, or side letter was executed to authorize this excess. No review or inquiry was triggered by the systematic overpayment.
The $1,170,000 overage is particularly concerning because it suggests that invoices were being submitted and paid without reference to the contractual terms, and that no function within Torchlight — not the finance team, not the compliance department, not the legal department — was tracking actual payments against the contractual budget. This is precisely the type of anomaly that an effective ongoing monitoring program would be designed to detect.
Timing correlation between invoices and permit issuances. The investigation has identified a striking temporal correlation between spikes in Crestfield invoicing and the issuance of government permits to Torchlight's Ganaran operations. Specifically, Crestfield invoices increased significantly in the 30-to-60-day window preceding each of the five major permit issuances during the period under investigation:
This pattern — in which payments to a government-facing intermediary spike immediately before the issuance of the government action that the intermediary was engaged to facilitate — is a classic red flag for corruption. It is the type of pattern that an effective compliance monitoring program, or a periodic review of third-party payment data, would be designed to identify. The pattern was not detected by any monitoring, audit, or review function within Torchlight.
Gap: No periodic review, compliance certification, annual recertification, or audit of the Crestfield relationship was conducted at any point during the 5.5-year engagement. The compliance program lacked any mechanism for: (a) flagging unusual payment patterns or deviations from contractual terms; (b) requiring periodic certifications from third-party agents regarding their ongoing compliance with anti-corruption laws; (c) conducting periodic updated due diligence (e.g., refreshed sanctions screening, adverse media checks) on existing third parties; or (d) requiring periodic reporting from third-party agents on the activities they have undertaken and the expenditures they have made with funds received from the Company. The complete absence of ongoing monitoring is a material deficiency in the compliance program and is directly relevant to the government's assessment of the program's effectiveness.
VII. Training and Communications
VII.A. Global Anti-Corruption Training Program
Torchlight implemented an online anti-corruption training module in 2021, concurrent with Berenson's broader compliance program review. The training program is administered through the Company's learning management system (the "LMS"), which is hosted on Torchlight's corporate IT infrastructure and accessible to employees with Torchlight corporate email accounts and network credentials. The training program includes modules addressing the following topics: (i) the definition and prohibition of bribery of foreign officials; (ii) the Company's facilitation payment policy; (iii) the use of third-party intermediaries and the obligation to conduct due diligence; (iv) the Company's gift, hospitality, and entertainment policy; and (v) the obligation to report suspected violations through the ethics hotline or other reporting channels.
The training is delivered annually to corporate-level employees based at Torchlight's headquarters in Toronto, Ontario. Completion is tracked through the LMS, and Berenson's compliance team monitors completion rates for the Toronto-based workforce. Berenson reported in her interview that completion rates for the Toronto-based corporate population have generally exceeded 90% in each year since the program's implementation.
VII.B. Training Penetration in West African Operations
Critical Gap: Review of training records reveals that anti-corruption training was not delivered to the majority of TGM personnel in Ganara during the period under investigation (2019–2024). The gap between the Toronto-based training program and the reality of training delivery at TGM is substantial and represents one of the most significant compliance program deficiencies identified in this assessment.
The following specific findings are relevant:
(a) LMS accessibility. The online LMS through which anti-corruption training is administered was accessible only to employees with Torchlight corporate email accounts and network credentials. Of TGM's approximately 2,400 local workers and 85 expatriate staff members, only the 85 expatriates and approximately 30 senior local managers had been assigned Torchlight corporate email accounts. The remaining approximately 2,285 TGM employees — representing approximately 95% of the TGM workforce — had no means of accessing the online training platform. No alternative training delivery mechanism (e.g., in-person training sessions, printed training materials, video training modules accessible without corporate credentials) was established to fill this gap until November 2022, more than three years after the commencement of the Crestfield engagement.
(b) Single in-person training event. In-person anti-corruption training was conducted in Ganara on one occasion — in November 2022. The training session was facilitated by a member of Berenson's compliance team who traveled to Ganara for a five-day visit. Attendance records show that 42 individuals participated in the in-person training session. This represents fewer than 2% of TGM's total workforce of approximately 2,485 employees. No follow-up sessions were scheduled or conducted.
(c) No local-language training. No anti-corruption training materials were made available in Ganaran local languages (Pulaar, Mandinka). The in-person training conducted in November 2022 was delivered in English and French. While French is an official language in Ganara, the predominant languages spoken by TGM's local workforce in the Kousseri and Dembélé operational areas are Pulaar and Mandinka. The absence of local-language training materials is inconsistent with the DOJ Guidance's emphasis on ensuring that compliance training reaches "all relevant employees" in a manner that is "accessible" and "comprehensible."
(d) Key subjects not trained. Of particular concern to the investigation, neither of the two primary subjects — Marcus Delacroix and Raymond Osei-Bonsu — has a documented record of completing the Company's anti-corruption training modules. The LMS records reviewed by our team do not contain completion records for either individual. Berenson stated in her April 7 interview that she "believed" Delacroix had completed the training at some point but could not locate a completion record in the LMS and acknowledged that she could not confirm whether he had, in fact, completed the training. No training completion record exists for Osei-Bonsu.
(e) Delayed training for key TGM personnel. Thomas Achebe, Finance Director of TGM, confirmed in his interview on April 28, 2025, that he did not receive any formal anti-corruption training prior to the November 2022 in-person session — meaning he had been in his role for approximately three years without anti-corruption training. Similarly, Kwame Mensah, Procurement Manager of TGM, confirmed in his interview on April 29, 2025, that he received no formal anti-corruption training prior to the November 2022 session. Mensah is the individual who, as discussed in Section X below, facilitated vehicle purchases for government officials under Osei-Bonsu's direction.
The pervasive training gap at TGM is directly relevant to the government's assessment of the compliance program's effectiveness. The DOJ has consistently identified training deficiencies — particularly the failure to deliver anti-corruption training to personnel in high-risk jurisdictions — as evidence of a compliance program that is not effectively implemented. In the DOJ's 2020 resolution with Bramwell National Bank (relating to the 1MDB matter), the Department cited inadequate training of personnel involved in the underlying misconduct as a factor in its assessment of the compliance program. The training gaps identified here are of a similar nature and severity.
VII.C. Communications to Third Parties
Crestfield Advisory Partners Ltd. received no anti-corruption training, compliance certification, or compliance communication from Torchlight at any time during the 5.5-year engagement. No onboarding compliance briefing was provided to Renard or to Crestfield at the commencement of the engagement. No annual compliance certification was required. No compliance-related correspondence was sent to Crestfield.
Gap: Torchlight's compliance program does not include any requirement for anti-corruption training, compliance certifications, or compliance communications to be provided to high-risk third-party agents and consultants. This gap is significant because, as noted in Section VI above, the Crestfield engagement involved a government-facing intermediary in a high-risk jurisdiction — precisely the type of third-party relationship for which the DOJ expects enhanced compliance controls, including training and periodic compliance certifications. The failure to provide any compliance communication to Crestfield over the entire duration of the engagement is a material deficiency.
VIII. Confidential Reporting Structure and Investigation Resources
VIII.A. Ethics Hotline
Torchlight operates a third-party ethics hotline managed by Sentinel Compliance Solutions Inc., a U.S.-based provider of ethics and compliance reporting services. The hotline accepts anonymous submissions through both an online reporting portal and a telephone hotline. The hotline is available 24 hours a day, seven days a week, and supports submissions in multiple languages, including English and French. The hotline is referenced in the Company's Code of Conduct and is promoted through periodic internal communications.
The whistleblower complaint that initiated the internal investigation was received through the Sentinel hotline on August 19, 2024. The complaint was assigned Report ID: SCH-2024-08-4417. The complaint was submitted anonymously through the online portal and alleged, in substance: "Payments being made to government ministers through a fake consulting company in Mauritius to get mining permits approved faster. The country manager and VP from Toronto both know about it."
Upon receipt of the hotline report, Sentinel transmitted the complaint to Nadia Berenson in accordance with the hotline's standard routing protocol. Berenson reviewed the complaint and escalated it to Audit Committee Chair Dr. Eleanor Fiske on August 26, 2024 — seven calendar days after the complaint was received by Sentinel. Berenson also informed General Counsel Patricia Sung of the complaint on the same date.
On September 5, 2024, the Audit Committee convened a special session to consider the complaint. The Audit Committee authorized a preliminary internal review to be conducted by the compliance team and the General Counsel's office, with authority to engage outside counsel if warranted by the preliminary findings. The Audit Committee also directed that the investigation be conducted under the supervision of outside counsel to preserve privilege.
Finding: The ethics hotline functioned as intended in receiving the whistleblower complaint and transmitting it to the appropriate internal recipient. The existence of a functioning hotline is a positive element of Torchlight's compliance program. The seven-day lag between receipt of the complaint by Sentinel and escalation to the Audit Committee Chair, while within a generally acceptable range, could be shortened through the implementation of clearer triage protocols for high-priority matters. Specifically, complaints alleging potential corrupt payments to government officials should be classified as "critical" and should trigger an expedited escalation timeline (e.g., within 48 hours of receipt) to senior management and the Audit Committee. The current hotline protocol does not include priority classification or expedited escalation mechanisms.
VIII.B. Investigation Resources
Prior to the engagement of Calderwood & Harkness LLP (formally retained on March 5, 2025, pursuant to an engagement letter authorized by the Audit Committee), the preliminary internal review was conducted by Berenson's compliance team and General Counsel Patricia Sung. The preliminary review involved an initial assessment of the allegations, a high-level review of available financial records, and preliminary interviews of selected personnel.
Gap: The compliance department's staffing levels were insufficient to conduct a thorough cross-border investigation of the type necessitated by the whistleblower complaint. Berenson's compliance team consists of herself plus two compliance analysts, all based in Toronto. The team does not include personnel with investigation experience, forensic accounting expertise, or familiarity with the legal and regulatory frameworks of the British Virgin Islands, Mauritius, or Ganara. Conducting an investigation involving the analysis of offshore payment flows, the review of contracts and invoices in multiple jurisdictions, the identification and interview of witnesses in West Africa, and the coordination with potential government inquiries exceeded the capacity of this three-person team.
This resource gap was ultimately addressed through the retention of Calderwood & Harkness LLP as outside counsel and the subsequent engagement of Pinnacle Forensic Advisory LLC (retained March 12, 2025, engagement lead: Dr. Leonard Strauss, CPA, CFF, CFE) to conduct the forensic accounting analysis. However, the six-month period between the receipt of the whistle