1039-00005 · Torchlight Mining Corp · Diligence/Financial

books-and-records-analysis-memo.docx DOCUMENT Litigation

10 / 35 ← → ✕

Contract analysis Extract to table

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT

CALDERWOOD & HARKNESS LLP 825 Eighth Avenue, 42nd Floor New York, New York 10019

MEMORANDUM

TO: Conrad Ashby, Responsible Partner, White Collar & Investigations

FROM: Steven Hollander, Lead Associate, White Collar & Investigations

DATE: April 18, 2025

RE: FCPA Books and Records and Internal Controls Provisions — Potential Violations — Torchlight Mining Corp.

MATTER NO.: 1039-00005

CONFIDENTIALITY LEGEND: This memorandum is protected by the attorney-client privilege and the work product doctrine. It was prepared at the direction of counsel in connection with the internal investigation of Torchlight Mining Corp. and its subsidiaries. It is not to be disclosed to any third party without the prior written consent of Calderwood & Harkness LLP and Torchlight Mining Corp.

Right-click to update Table of Contents

I. Executive Summary

This memorandum analyzes potential violations of the accounting provisions of the Foreign Corrupt Practices Act ("FCPA") — specifically, Section 13(b)(2)(A) of the Securities Exchange Act of 1934 (the "books and records" provision) and Section 13(b)(2)(B) of the Securities Exchange Act of 1934 (the "internal controls" provision) — arising from the conduct identified during the course of the ongoing internal investigation of Torchlight Mining Corp. ("Torchlight" or "TMC"), its British Virgin Islands intermediate holding subsidiary Torchlight Ganara Holdings Ltd. ("TGH"), and its Ganaran operating subsidiary Torchlight Ganara Mining S.A. ("TGM"). This analysis is based on the investigation's findings as of the date hereof and should be updated as additional information becomes available through the ongoing forensic review and witness interviews.

Torchlight is a Canadian corporation whose common shares are listed on the Toronto Stock Exchange (ticker: TMC) and whose American Depositary Receipts ("ADRs") are listed on the New York Stock Exchange (ticker: TRCH). The listing of Torchlight's ADRs on the NYSE subjects the company to the reporting requirements of Section 12 of the Securities Exchange Act of 1934, thereby making Torchlight an "issuer" within the meaning of the FCPA's accounting provisions. As discussed in greater detail below, this issuer status brings Torchlight — and the books, records, and internal controls of its controlled subsidiaries TGH and TGM — within the reach of Sections 13(b)(2)(A) and 13(b)(2)(B).

The internal investigation, which was initiated following receipt of an anonymous whistleblower complaint on August 19, 2024, concerns approximately $4,730,000 in suspected improper payments made between April 2019 and October 2024. These payments were channeled through two primary mechanisms: (1) payments routed through Crestfield Advisory Partners Ltd. ("Crestfield"), a Mauritius-incorporated intermediary controlled by Jean-Philippe Renard, totaling approximately $3,210,000; and (2) direct cash disbursements from TGM and in-kind benefits provided to government officials in the Republic of Ganara, totaling approximately $1,520,000. The suspected payments were made in connection with obtaining or expediting mining permits and environmental approvals for Torchlight's Ganaran operations, principally in the Kousseri and Dembélé concession areas.

This memorandum focuses specifically on the FCPA's accounting provisions, which are civil and administrative in nature and are enforced by the U.S. Securities and Exchange Commission ("SEC"). It is essential to note at the outset that these provisions are independently actionable — they apply regardless of whether the underlying payments ultimately are proven to have constituted bribes in violation of the FCPA's anti-bribery provisions. The mischaracterization of payments in Torchlight's books and records, and the failures of Torchlight's internal accounting controls, are independently sufficient bases for SEC enforcement action. This distinction is critical to the company's exposure assessment, as the SEC can and frequently does bring standalone books-and-records and internal controls charges even in cases where the evidence of corrupt intent is inconclusive or where the Department of Justice ("DOJ") declines to bring anti-bribery charges.

Based on the evidence developed to date through document review, forensic accounting analysis, and witness interviews, we have reached the following key conclusions:

1. Books and Records (Section 13(b)(2)(A)): The evidence strongly supports potential violations based on the systematic mischaracterization of payments in TGH's and TGM's books and records. Payments to Crestfield that were diverted to Ganaran government officials were recorded as legitimate consulting expenses. Cash withdrawals directed to government officials were booked under a vague general ledger code as "Community Relations Expenses." In-kind benefits provided to officials were recorded without identifying the recipients as government officials or the true purpose of the expenditures. In aggregate, these mischaracterizations affected approximately $4,730,000 in transactions over a five-year period, all of which were consolidated into Torchlight's financial statements filed with the SEC and Canadian securities regulators.

2. Internal Controls (Section 13(b)(2)(B)): The evidence strongly supports potential violations based on multiple, overlapping failures of Torchlight's internal accounting controls. These failures include systematic overrides of the company's Delegation of Authority Policy, the complete absence of third-party due diligence on Crestfield, the failure to detect payments exceeding contractual limits by $1,170,000 (a 57% overage), inadequate controls over cash disbursements, failures of supervisory and monitoring controls, and the failure to reconcile recorded asset accountability with actual asset dispositions. The scheme operated for approximately five years — from April 2019 through at least October 2024 — without detection by the company's internal controls framework. The scheme was ultimately uncovered only through an anonymous whistleblower complaint, not through the functioning of any internal control mechanism.

3. Duration and Systemic Nature: The extended duration of the scheme and its penetration across multiple transaction categories and organizational levels strongly suggest that Torchlight's internal controls were not merely inadequate in isolated respects but were fundamentally insufficient to prevent or detect the conduct at issue. This systemic character is likely to be viewed as an aggravating factor by the SEC in any enforcement proceeding.

We note that the SEC has opened a formal order of investigation in this matter, designated File No. HO-14892, dated January 22, 2025. On February 3, 2025, the SEC served a document subpoena on Torchlight, and document production is ongoing. The existence of an active SEC investigation underscores the urgency of the analysis contained herein and its relevance to the company's voluntary self-disclosure ("VSD") decision, which is targeted for June 30, 2025.

The balance of this memorandum proceeds as follows: Section II sets forth the applicable legal framework. Sections III and IV present the factual bases for potential violations of the books and records and internal controls provisions, respectively. Section V addresses potential individual liability. Section VI quantifies the company's potential SEC exposure. Sections VII and VIII address the interaction with the VSD analysis and remediation implications, respectively. Section IX identifies open issues and next steps. Section X provides our overall conclusions and recommendations.

II. Legal Framework

A. FCPA Section 13(b)(2)(A) — Books and Records Provision

The books and records provision of the FCPA is codified at 15 U.S.C. § 78m(b)(2)(A). It provides, in relevant part, that every issuer which has a class of securities registered pursuant to Section 12 of the Securities Exchange Act of 1934, or which is required to file reports under Section 15(d) of that Act, shall:

"make and keep books, records, and accounts, which, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the issuer."

This provision imposes an affirmative obligation on issuers to maintain accurate books and records. Several features of the provision are particularly relevant to the present analysis:

Scope — Subsidiary Records. The books and records obligation extends beyond the issuer's own records to encompass the records of all subsidiaries that the issuer controls. Where, as here, the issuer maintains a controlling interest in subsidiaries (TGH and TGM are wholly owned), the issuer bears responsibility for the accuracy of those subsidiaries' books and records. Transactions recorded in the books of TGH and TGM are therefore subject to the requirements of Section 13(b)(2)(A) to the same extent as transactions recorded directly in Torchlight's own books.

No Materiality Threshold. Unlike certain other provisions of the federal securities laws, the books and records provision contains no materiality qualifier. Even immaterial inaccuracies in an issuer's books and records can constitute a violation. The SEC has consistently taken the position that the provision's mandate is absolute: if a transaction is not accurately and fairly reflected, a violation has occurred regardless of whether the inaccuracy would be material to an investor's decision-making. This is particularly significant here because the total suspected mischaracterized payments of $4,730,000, while substantial in absolute terms, represent a relatively modest percentage of Torchlight's consolidated revenue and total assets.

No Scienter Requirement. For purposes of civil enforcement by the SEC, the books and records provision is a strict liability standard. The SEC is not required to prove that the issuer or any individual acted with corrupt intent, knowledge of falsity, or even negligence. The sole question is whether the books and records "accurately and fairly reflect" the relevant transactions. This feature significantly lowers the evidentiary burden the SEC must satisfy and makes books-and-records charges among the most readily provable of all FCPA violations.

"Reasonable Detail" Standard. The statute qualifies its accuracy requirement with the phrase "in reasonable detail." The legislative history and SEC guidance interpret this standard to mean the level of detail and degree of assurance that would satisfy prudent officials in the conduct of their own affairs. This is an objective, reasonableness-based standard rather than an absolute requirement of perfection. Nevertheless, the standard is demanding: it requires that the description of each transaction in the company's books convey the essential nature, purpose, and characteristics of the transaction with sufficient particularity that a reasonable reader would not be misled.

Types of Violations. Books and records violations can arise from range recording failures, including but not limited to: (i) mischaracterizing the nature or purpose of a payment (e.g., describing a bribe as a "consulting fee"); (ii) creating false or misleading descriptions in general ledgers, sub-ledgers, or other accounting records; (iii) failing to record transactions altogether; (iv) recording transactions in incorrect amounts; and (v) failing to identify the true recipients or beneficiaries of payments. As discussed in Section III below, the present investigation has identified potential violations in the first, second, and fifth of these categories.

B. FCPA Section 13(b)(2)(B) — Internal Controls Provision

The internal controls provision of the FCPA is codified at 15 U.S.C. § 78m(b)(2)(B). It provides, in relevant part, that every issuer subject to the books and records requirement shall:

"devise and maintain a system of internal accounting controls sufficient to provide reasonable assurances that—

(i) transactions are executed in accordance with management's general or specific authorization;

(ii) transactions are recorded as necessary to permit preparation of financial statements in conformity with generally accepted accounting principles or any other criteria applicable to such statements, and to maintain accountability for assets;

(iii) access to assets is permitted only in accordance with management's general or specific authorization; and

(iv) the recorded accountability for assets is compared with the existing assets at reasonable intervals and appropriate action is taken with respect to any differences."

Several aspects of this provision warrant emphasis:

"Reasonable Assurances" Standard. The statute does not require that an issuer's internal controls achieve an absolute guarantee against error or wrongdoing. The standard is one of "reasonable assurances" — defined in the legislative history as the level of assurance that would satisfy prudent officials in the conduct of their own affairs. The standard recognizes that internal controls involve cost-benefit judgments and that no system of controls can prevent all misconduct. However, the "reasonable assurances" standard does require that an issuer make good-faith efforts to design and implement controls that are reasonably capable of preventing and detecting the types of inaccuracies and unauthorized transactions at issue.

Effective Implementation and Maintenance. The provision requires not merely that an issuer adopt policies or procedures on paper, but that it effectively implement and maintain those controls over time. A control that exists in written policy but is systematically overridden, ignored, or unenforced does not satisfy the statutory requirement. As the SEC has stated in numerous enforcement actions, the mere existence of a compliance program or policy manual is insufficient; the issuer must demonstrate that its controls are operationally effective. This distinction is critical in the present case, where Torchlight maintained certain written policies (e.g., the Delegation of Authority Policy) that were routinely circumvented in practice.

No Scienter Requirement for Entity-Level Liability. As with the books and records provision, the SEC need not prove scienter to establish a civil violation of the internal controls provision at the entity level. The SEC must demonstrate only that the issuer's system of internal accounting controls was insufficient to provide reasonable assurances as defined by the statute. This is an objective adequacy standard.

Subsidiary Controls. The obligation to devise and maintain adequate internal controls extends to subsidiaries that the issuer controls. Torchlight, as the ultimate parent of both TGH and TGM, bears responsibility for ensuring that adequate internal accounting controls are in place at each level of its corporate structure, including at the operating subsidiary level in Ganara.

Four Categories of Required Controls. The statute identifies four distinct categories of controls, each addressing a different aspect of asset accountability and transaction integrity. As discussed in detail in Section IV below, the investigation has identified potential failures across all four categories:

• Authorization controls (§ 13(b)(2)(B)(i)): ensuring that transactions are executed only with proper authorization;

• Recording controls (§ 13(b)(2)(B)(ii)): ensuring that transactions are recorded accurately and in conformity with GAAP;

• Access controls (§ 13(b)(2)(B)(iii)): ensuring that access to company assets is appropriately restricted; and

• Reconciliation controls (§ 13(b)(2)(B)(iv)): ensuring that recorded accountability is periodically compared to actual asset positions.

C. Applicability to Torchlight Mining Corp.

Torchlight qualifies as an "issuer" within the meaning of the FCPA because its ADRs are listed on the New York Stock Exchange under the ticker symbol TRCH. This listing subjects Torchlight to the registration and reporting requirements of Section 12 of the Securities Exchange Act of 1934, 15 U.S.C. § 78l, thereby bringing Torchlight within the scope of the FCPA's accounting provisions. Although Torchlight is a Canadian corporation with its primary listing on the TSX, the NYSE listing is independently sufficient to establish issuer status under the FCPA.

The corporate structure relevant to this analysis is as follows:

• Torchlight Mining Corp. ("Torchlight" or "TMC") — Canadian corporation; parent entity; listed on TSX (ticker: TMC) and NYSE via ADRs (ticker: TRCH).

• Torchlight Ganara Holdings Ltd. ("TGH") — Wholly owned subsidiary of Torchlight; incorporated in the British Virgin Islands on March 15, 2017; functions as the intermediate holding company for Torchlight's Ganaran operations.

• Torchlight Ganara Mining S.A. ("TGM") — Wholly owned subsidiary of TGH; organized under the laws of the Republic of Ganara; the operating entity responsible for Torchlight's mining operations in the Kousseri and Dembélé concession areas.

Because Torchlight owns 100% of TGH, which in turn owns 100% of TGM, Torchlight exercises unquestioned control over both subsidiaries. Accordingly, Torchlight bears responsibility under Sections 13(b)(2)(A) and 13(b)(2)(B) for the books, records, and internal accounting controls of both TGH and TGM. The financial results of TGH and TGM are fully consolidated into Torchlight's consolidated financial statements, which are filed with the SEC and Canadian securities regulators on an annual and quarterly basis.

For context, Torchlight's FY2024 consolidated revenue was approximately CAD $2.1 billion. The West African operations, centered in the Republic of Ganara and conducted through TGH and TGM, generated approximately CAD $387 million in revenue for FY2024, representing approximately 18.4% of Torchlight's total consolidated revenue. The Ganaran operations are thus a material component of Torchlight's overall business, and the books and records of TGH and TGM are integral to the accuracy of Torchlight's consolidated financial statements.

D. SEC Enforcement Trends and Precedent

The SEC has demonstrated a consistent and vigorous enforcement posture with respect to FCPA books-and-records and internal controls violations, particularly in the mining and extractive industries. Several enforcement trends are worth noting in connection with the present analysis.

First, the SEC frequently brings standalone books-and-records and internal controls charges, even in cases where the evidence of underlying bribery is contested, inconclusive, or where the DOJ has declined to bring anti-bribery charges. The accounting provisions provide the SEC with a powerful enforcement tool because they require no proof of corrupt intent and no showing of materiality. In a significant number of FCPA enforcement actions over the past decade, the SEC's charges have been limited to, or have principally rested upon, violations of Sections 13(b)(2)(A) and 13(b)(2)(B).

Second, the extractive industries — including mining, oil and gas, and natural resources — have been a particular focus of FCPA enforcement. The SEC has recognized that these industries present elevated corruption risks due to the necessity of obtaining government permits and approvals, the concentration of operations in jurisdictions with high perceived levels of corruption, the frequent use of third-party agents and intermediaries, and the substantial sums of money involved. Multiple SEC enforcement actions involving mining companies have resulted in significant monetary sanctions.

Third, the SEC has the authority to impose substantial financial remedies in books-and-records and internal controls cases. Under Section 21(d)(3) of the Exchange Act, the SEC may seek civil monetary penalties in three tiers. For Tier III violations — those involving fraud, deceit, manipulation, or deliberate or reckless disregard of a regulatory requirement — the SEC may seek penalties up to the greater of the gross pecuniary gain to the defendant or a specified statutory maximum per violation. In addition, the SEC routinely seeks disgorgement of ill-gotten gains, calculated as the economic benefit the issuer derived from the improperly obtained permits, contracts, or business advantages, together with prejudgment interest running from the date of the violation.

Fourth, the SEC has increasingly emphasized the importance of effective internal controls in high-risk jurisdictions and has brought enforcement actions targeting not only the absence of controls but also the failure to implement and enforce existing controls — precisely the type of failure identified in the present investigation.

III. Factual Basis for Potential Books and Records Violations — Section 13(b)(2)(A)

The investigation has identified three principal categories of transactions that were inaccurately recorded in TGH's and TGM's books and records, which were in turn consolidated into Torchlight's financial statements. Each category is discussed in turn below.

A. Mischaracterization of Payments to Crestfield Advisory Partners Ltd.

The most significant category of potential books and records violations involves the payments made by TGH to Crestfield Advisory Partners Ltd. ("Crestfield"), a Mauritius-incorporated intermediary entity.

Aggregate Payment Data. Between April 2019 and October 2024, TGH made total payments to Crestfield of $3,210,000, comprising 24 separate invoices across approximately five and one-half years. The payments were distributed across calendar years as follows:

All payments were routed through TGH's account at Meridian Commercial Bank (BVI), Account No. 7740-2281-0056. Wire transfer records obtained from Meridian confirm the amounts and dates of each payment.

Invoice Descriptions. The 24 Crestfield invoices uniformly described the services purportedly rendered using vague, generic terminology. The invoice descriptions included "permitting support services," "regulatory liaison," "stakeholder engagement," "government affairs advisory," and similar characterizations. None of the invoices identified any specific government official as a recipient of any portion of the invoiced amounts, nor did they describe the services in sufficient detail to reveal the true nature and purpose of the payments.

Forensic Findings — Diversion of Funds. The investigation, conducted in coordination with Pinnacle Forensic Advisory LLC (engagement partner Dr. Leonard Strauss), has determined through forensic tracing of bank records, wire transfer documentation, and analysis of Crestfield's Mauritius bank account (Harborline Commerce Bank, Port Louis) that approximately $2,410,000 — representing approximately 75% of total Crestfield payments — was diverted from Crestfield's accounts to Ganaran government officials. The identified recipients of diverted funds include:

• Hon. Boubacar Diallo, Former Minister of Mines and Natural Resources, Republic of Ganara: approximately $1,850,000 in aggregate payments, traced through multiple transfers to accounts in Ganara, Senegal, and the United Arab Emirates.

• Amadou Traoré, Director, Environmental Permitting, Ministry of Mines and Natural Resources, Republic of Ganara: approximately $620,000 in aggregate payments, traced through transfers to personal accounts at Regency International Bank (Ganara) and a Dubai-based account.

• Other and unidentified recipients: the balance of the diverted amounts, totaling approximately $140,000 in smaller transfers whose ultimate beneficiaries have not yet been definitively identified as of the date of this memorandum. The ongoing forensic review by Pinnacle may yield additional clarity on these transactions.

The remaining approximately $800,000 in Crestfield payments (roughly 25% of the total) appears to have been retained by Crestfield as its own fee or used for expenses that may have been legitimate, though further forensic review is required to confirm this allocation.

Books and Records Implications. The Crestfield invoices were recorded in TGH's general ledger as legitimate consulting expenses under various expense categories. This recording was inaccurate and unfair because it failed to reflect that the predominant purpose and effect of the payments was the funneling of funds to Ganaran government officials in exchange for favorable action on mining permits and environmental approvals. The descriptions in TGH's books bore no resemblance to the actual nature of the transactions. A prudent official reviewing TGH's books would have had no basis to understand that the payments classified as "permitting support services" or "stakeholder engagement" were in fact being channeled to government decision-makers with authority over Torchlight's permit applications.

Contractual Overpayment Analysis. The irregularity in the books and records is further demonstrated by the relationship between the actual payments and the contractual terms governing the Crestfield engagement. The Government Relations Advisory Agreement between TGH and Crestfield, executed on April 12, 2019, established the following fee structure:

• Monthly retainer: $15,000 per month × 66 months (April 2019 through September 2024) = $990,000

• Success fees: $100,000 per permit obtained × 5 permits = $500,000

• Quarterly expense reimbursement: capped at $25,000 per quarter × 22 quarters = $550,000 maximum

• Total contractual maximum: approximately $2,040,000

The actual payments of $3,210,000 exceeded this contractual maximum by $1,170,000 — a 57% overage. No contract amendment or addendum was executed to authorize the excess payments. The excess amounts therefore had no contractual basis whatsoever, yet they were recorded in TGH's books without any documentation of the basis for payment. This discrepancy is itself a books and records violation: the books reflect payments characterized as made pursuant to a consulting agreement, when in fact $1,170,000 in payments had no contractual authorization or support. A system of books and records that fails to reflect the absence of contractual authority for over $1 million in payments does not "accurately and fairly reflect the transactions and dispositions of the assets of the issuer."

B. Mischaracterization of TGM Cash Withdrawals Under GL 7450

The second category of potential books and records violations involves cash withdrawals made directly by TGM from its local banking account in Ganara.

Aggregate Cash Withdrawal Data. Between 2019 and 2024, TGM made cash withdrawals totaling $890,000 from its account at Regency International Bank (Ganara), Account No. GAN-4419-8837. These withdrawals were made in a series of smaller transactions, typically in amounts below the thresholds that would trigger enhanced internal review.

General Ledger Coding. The cash withdrawals were uniformly recorded in TGM's general ledger under code GL 7450, captioned "Community Relations Expenses." This general ledger code was, by its nature, vague and generic — it conveyed no information about the specific nature of the disbursements, the identity of the recipients, or the purpose for which the funds were expended. As discussed in Section IV.D below, GL 7450 was used by TGM as a "catch-all" code at the direction of Raymond Osei-Bonsu, the former Country Manager.

Forensic Findings — Payments to Government Officials. The investigation has identified that substantial portions of the GL 7450 cash withdrawals were directed to Ganaran government officials rather than to bona fide community relations activities. In particular:

• Col. Ibrahim Konaté, Former Regional Prefect, Kousseri Province: approximately $340,000 in cash payments and in-kind benefits were provided to Col. Konaté or his associates under the guise of "community development" expenditures. The investigation has determined that these payments were personal in nature and were not directed toward any identifiable community development project or initiative. Col. Konaté, as Regional Prefect, exercised significant administrative authority over the Kousseri concession area, including authority over local land-use approvals and security arrangements that were prerequisite to Torchlight's mining operations.

The remaining GL 7450 expenditures are still under review by Pinnacle Forensic Advisory. It is possible that some portion of these funds was used for legitimate community engagement purposes; however, the absence of supporting documentation (discussed in Section IV.D) makes it impossible to verify the legitimacy of any individual transaction recorded under this code.

Books and Records Implications. The recording of cash payments to government officials under the generic caption "Community Relations Expenses" constitutes a clear failure to "accurately and fairly reflect the transactions and dispositions of the assets" of the issuer. The description conceals rather than reveals the true nature of the transactions. A prudent official reviewing GL 7450 entries would have no indication that company funds were being paid to government officials with authority over Torchlight's operations. The coding does not identify the recipients, the purpose, or the connection to government permitting activities. This lack of transparency is precisely the type of record-keeping failure that Section 13(b)(2)(A) was designed to prevent.

C. Mischaracterization of In-Kind Benefits

The third category of potential books and records violations involves in-kind benefits provided to Ganaran government officials.

Aggregate In-Kind Benefits. The investigation has identified approximately $630,000 in in-kind benefits — principally vehicle purchases and travel expenses — that were provided to government officials between 2019 and 2024. These benefits were booked in TGM's and TGH's records across two general ledger codes:

• GL 7200 ("Vehicle and Transportation Expenses"): used to record vehicle purchases and related costs.

• GL 7310 ("Travel and Accommodation"): used to record travel arrangements and related expenses.

The descriptions associated with these entries did not identify the recipients as government officials, nor did they disclose the true purpose of the expenditures. The entries were recorded in a manner that suggested routine operational expenses rather than benefits conferred upon public officials.

Preliminary Examples. The forensic review by Pinnacle Forensic Advisory LLC is continuing to develop the full scope of in-kind benefits. Preliminary findings include the following:

• Multiple vehicle purchases for Col. Ibrahim Konaté and members of his family, recorded as general fleet acquisitions or community development vehicles under GL 7200, with no notation that the vehicles were delivered to a government official for personal use.

• Travel arrangements — including international airfare, hotel accommodations, and per diem expenses — for government officials attending conferences or events that were funded by TGM but recorded under GL 7310 as general travel expenses without identifying the recipients as government officials or disclosing the purpose of the travel.

Further details will be developed as Pinnacle completes its review of GL 7200 and GL 7310 entries and associated supporting documentation.

Books and Records Implications. As with the Crestfield payments and GL 7450 withdrawals, the in-kind benefits were recorded in a manner that obscured their true nature. The books and records reflected what appeared to be ordinary business expenses — vehicle acquisitions and travel costs — when in fact they represented benefits conferred upon government officials in connection with Torchlight's permitting and regulatory activities. The failure to accurately identify the recipients and purposes of these expenditures constitutes a failure to maintain books and records that "accurately and fairly reflect" the relevant transactions.

D. Impact on Consolidated Financial Statements

The mischaracterized transactions described above flowed directly into Torchlight's consolidated financial statements, which are filed with the SEC on Form 20-F (annual) and Form 6-K (current and interim reports) and with Canadian securities regulators on a corresponding basis.

Torchlight's external auditor, Clarendon Group LLP (engagement partner Alain Beaumont, Montreal), issued unqualified (clean) audit opinions on Torchlight's consolidated financial statements for each of fiscal years 2019 through 2023. Those audit opinions stated, among other things, that Torchlight's financial statements presented fairly, in all material respects, the financial position and results of operations of the company in conformity with International Financial Reporting Standards ("IFRS") as issued by the International Accounting Standards Board. The audit opinions did not identify any material misstatement or internal control deficiency related to the Ganaran operations.

The FY2024 audit is currently delayed pending the outcome of the internal investigation. Clarendon has been informed of the investigation and has indicated that the resolution of the investigation's findings will be a prerequisite to the completion of the FY2024 audit and the issuance of an audit opinion. The potential implications for the FY2024 audit, and the risk of restatement for prior-year financial statements, are addressed in Section IX below.

Total Suspected Mischaracterized Payments. In aggregate, the investigation has identified $4,730,000 in suspected mischaracterized payments across the three categories described above:

Each of these amounts was reflected in TGH's and TGM's books and records — and, by consolidation, in Torchlight's SEC filings — in a manner that inaccurately and unfairly described the true nature, purpose, and recipients of the transactions.

E. Summary of Books and Records Violations

Based on the foregoing, the evidence developed to date strongly supports potential violations of Section 13(b)(2)(A) of the Securities Exchange Act. The violations span three distinct categories of transactions — (1) Crestfield consulting payments, (2) GL 7450 cash withdrawals, and (3) in-kind benefits — all of which were described in TGH's and TGM's books and records in a manner that obscured their true character as payments to, or for the benefit of, Ganaran government officials. The mischaracterizations were not isolated or episodic; they were systematic, recurring across 24 invoices and numerous additional transactions over a period of approximately five years. The descriptions employed — "permitting support services," "regulatory liaison," "stakeholder engagement," "community relations expenses," and generic vehicle and travel expense codes — were uniformly designed to present the payments as legitimate business expenses rather than as benefits conferred upon government officials. This pattern of systematic mischaracterization is precisely the type of conduct that the books and records provision was enacted to address and that the SEC has consistently targeted in FCPA enforcement actions.

IV. Factual Basis for Potential Internal Controls Violations — Section 13(b)(2)(B)

The investigation has identified multiple, overlapping failures of Torchlight's internal accounting controls that are potentially actionable under Section 13(b)(2)(B). These failures are organized below according to the four statutory subsections, though in practice many of the identified failures implicate more than one subsection simultaneously.

A. Failure of Authorization Controls — Delegation of Authority Policy Violations

Torchlight's Delegation of Authority Policy. Torchlight maintains a corporate Delegation of Authority Policy (the "DAP"), which establishes approval thresholds for expenditures across the organization. As relevant here, the DAP requires dual approval — by the originating manager and a designated secondary approver — for any single expenditure exceeding $50,000. The DAP was adopted in 2016 and was in effect throughout the period relevant to this investigation. The policy was designed to serve as a key internal control over the authorization of significant expenditures, ensuring that no single individual could unilaterally commit the company to payments above the specified threshold.

Systematic Override. Of the 24 Crestfield invoices paid by TGH between April 2019 and October 2024, 14 invoices exceeded the $50,000 dual-approval threshold. These 14 invoices ranged in amount from $55,000 to $185,000. Each of these invoices was approved solely by Raymond Osei-Bonsu, the former Country Manager of TGM, without the required secondary authorization. In no instance was a secondary approver identified or documented. In no instance was the absence of secondary approval flagged by any automated system or manual review process.

This represents a systematic and sustained override of a fundamental internal control over a five-year period. The override was not a matter of occasional oversight or administrative error; it was a consistent pattern in which the dual-approval requirement was simply disregarded for every qualifying Crestfield invoice throughout the life of the engagement.

Failure of Supervisory Oversight. There is no evidence in the record that any supervisory personnel above Osei-Bonsu — including Marcus Delacroix, the former VP Africa Operations, who had direct supervisory authority over Osei-Bonsu — flagged the single-approval issue or took any steps to enforce compliance with the DAP. Delacroix, who personally introduced Jean-Philippe Renard to Torchlight and who is believed to have directed the payment scheme, appears to have acquiesced in or actively facilitated the circumvention of the DAP. The failure of supervisory personnel to enforce a key control that was being systematically overridden by their direct reports compounds the control failure and suggests that the DAP was, in practice, ineffective with respect to the Ganaran operations.

Section 13(b)(2)(B)(i) Analysis. The dual-approval requirement is a direct expression of "management's general or specific authorization" for the execution of transactions above the $50,000 threshold. The systematic circumvention of this requirement means that 14 of the 24 Crestfield invoices were not "executed in accordance with management's general or specific authorization" as required by Section 13(b)(2)(B)(i). This constitutes a clear failure of authorization controls.

B. Absence of Third-Party Due Diligence on Crestfield

Due Diligence Records. Torchlight's compliance records contain no due diligence file on Crestfield Advisory Partners Ltd. No due diligence questionnaire was completed. No background investigation was conducted. No public records search was performed. No references were checked. No assessment of Crestfield's qualifications, reputation, or capacity to perform the contracted services was documented.

Red Flags. The absence of due diligence is particularly significant in light of the numerous red flags associated with Crestfield and the engagement, including the following:

• Crestfield was incorporated in Mauritius, a jurisdiction commonly used as an offshore intermediary domicile, and maintained no physical office — its registered address was at a registered-agent office at 7th Floor, Nexus Tower, Ebène Cybercity, Port Louis, Mauritius.

• Crestfield had no website, no public profile, and no track record of performing government relations advisory services.

• Crestfield had no employees other than its sole owner, Jean-Philippe Renard, a French citizen, age 54, based in Dakar, Senegal — not in Ganara, where the services were purportedly being performed.

• The Crestfield engagement was not the product of a competitive selection process. Renard was personally introduced to Torchlight by Marcus Delacroix, the VP Africa Operations, with no documentation of how Delacroix came to know Renard or why Renard's firm was selected over other potential service providers.

• The engagement involved the provision of services in the Republic of Ganara, a jurisdiction recognized as presenting elevated corruption risks based on its Transparency International Corruption Perceptions Index ranking and the nature of the extractive industries regulatory environment.

Contractual Deficiencies. The Government Relations Advisory Agreement between TGH and Crestfield, executed on April 12, 2019, contained significant deficiencies from an anti-corruption compliance perspective:

• The agreement contained only a general anti-corruption representation in Clause 9.2, in which Crestfield warranted compliance with "all applicable anti-corruption laws." This generic warranty did not specifically reference the FCPA, the U.K. Bribery Act, or any other specific anti-corruption statute, and it did not impose any affirmative compliance obligations on Crestfield.

• The agreement contained no audit rights clause, thereby depriving Torchlight of the contractual ability to inspect Crestfield's books and records or to verify how Crestfield was using the funds it received from TGH. The absence of audit rights is a significant control deficiency in any third-party agent engagement, and it is particularly egregious in a high-risk jurisdiction engagement involving government-facing services.

• The agreement did not require Crestfield to provide detailed activity reports, to identify government officials with whom it interacted, or to maintain records sufficient to demonstrate that no improper payments were made.

Internal Controls Implications. The complete absence of third-party due diligence on an agent engaged to perform government-facing services in a high-risk jurisdiction represents a fundamental failure of internal controls. Robust third-party due diligence is universally recognized as one of the most critical elements of an effective anti-corruption compliance program, and the failure to conduct any due diligence on Crestfield — in the face of multiple red flags — represents a failure to maintain controls "sufficient to provide reasonable assurances" that transactions were properly authorized and recorded. This failure implicates multiple subsections of Section 13(b)(2)(B), including the authorization and recording requirements.

C. Failure to Detect Payments Exceeding Contractual Limits

As discussed in Section III.A above, actual payments to Crestfield of $3,210,000 exceeded the contractual maximum of approximately $2,040,000 by $1,170,000 — a 57% overage. This overage accumulated over the course of approximately five years without detection by any internal control mechanism.

Absence of Contract-to-Payment Reconciliation. The investigation has found no evidence that any department within Torchlight, TGH, or TGM performed a comparison of actual cumulative payments to Crestfield against the contractual limits established in the Government Relations Advisory Agreement. No automated system generated alerts when payments exceeded budgeted or contracted amounts. No manual review process compared invoices to contractual fee schedules or caps. The overage grew steadily from year to year without triggering any inquiry.

VP Finance Awareness. Diane Fournier, VP Finance of Torchlight, had oversight responsibility for the financial consolidation of TGH and TGM results into Torchlight's consolidated financial statements. In her interview on April 8, 2025, conducted by Calderwood & Harkness in Toronto, Fournier indicated that she was not aware of the absence of a contract amendment authorizing the excess payments and that she did not receive reports comparing actual payments to contractual limits for third-party consultant engagements in the West African operations. Fournier stated that she relied upon the regional management team — principally Delacroix and Osei-Bonsu — to ensure that expenditures were within authorized parameters.

Section 13(b)(2)(B)(ii) Analysis. The failure to detect a $1,170,000 overage on a consulting contract reflects a failure of controls designed to ensure that "transactions are recorded as necessary to permit preparation of financial statements in conformity with GAAP" and to "maintain accountability for assets." Payments that exceed contractual limits by 57% and that lack any contractual authorization cannot be properly recorded or categorized in the financial statements. The absence of controls to detect this overage is a significant internal controls deficiency.

D. Inadequate Controls Over Cash Disbursements (GL 7450)

GL 7450 as a "Catch-All" Code. As discussed in Section III.B above, TGM made cash withdrawals totaling $890,000 over five years, all booked under GL 7450 — "Community Relations Expenses." The investigation has revealed that this general ledger code was used as a catch-all category for a wide range of disbursements, many of which bore no relationship to community relations activities.

Absence of Supporting Documentation Requirements. No supporting documentation requirements appear to have been enforced for GL 7450 entries. The investigation has found no receipts, no beneficiary identification forms, no purpose statements, no photographs or other evidence of community projects, and no approvals beyond those of Osei-Bonsu for the vast majority of GL 7450 transactions. The absence of documentation makes it impossible to verify whether any individual GL 7450 transaction was legitimate.

Thomas Achebe Interview. Thomas Achebe, Finance Director of TGM, was interviewed on April 28, 2025, via video from Ganara. Achebe stated that he processed cash withdrawal requests upon direction from Raymond Osei-Bonsu and that GL 7450 was used as a "catch-all" code at Osei-Bonsu's instruction. Achebe stated that he did not question the coding or request supporting documentation because Osei-Bonsu was the Country Manager and the most senior Torchlight employee in Ganara. Achebe further stated that he was not aware of any written policy requiring specific documentation for GL 7450 entries and that no such policy had been communicated to him by Torchlight's headquarters finance team.

Section 13(b)(2)(B)(iii) Analysis. The use of a catch-all GL code with no documentation requirements for nearly $900,000 in cash disbursements over five years represents a clear failure of controls governing "access to assets" under Section 13(b)(2)(B)(iii). Cash is inherently the asset most susceptible to misappropriation and diversion, and the absence of basic documentation and approval controls over cash disbursements in a high-risk operating environment is a fundamental internal controls deficiency. The fact that a single individual — Osei-Bonsu — could direct cash withdrawals of this magnitude without oversight or documentation requirements demonstrates that access to company assets was not "permitted only in accordance with management's general or specific authorization."

E. Failure of Supervisory and Monitoring Controls

Beyond the specific control failures described above, the investigation has identified a pervasive failure of supervisory and monitoring controls that allowed the scheme to operate undetected for approximately five years.

Absence of Periodic Compliance Reviews. There is no evidence that Torchlight's Compliance and Ethics function — headed since 2021 by Nadia Berenson, VP Compliance and Ethics — conducted any periodic review of TGH's or TGM's third-party relationships, expenditure patterns, or compliance with anti-corruption policies prior to receiving the August 19, 2024 whistleblower complaint. The whistleblower complaint was received via Torchlight's ethics hotline, operated by Sentinel Compliance Solutions Inc., and was assigned Report ID: SCH-2024-08-4417. Prior to that complaint, no compliance review or audit had examined the Crestfield engagement, the GL 7450 cash disbursements, or the in-kind benefits identified in this memorandum.

Failure to Identify Timing Correlations. A significant indicator of potential corruption — the timing correlation between Crestfield invoice spikes and government permit issuances — was never identified by any internal monitoring or audit function. The forensic analysis by Pinnacle has established that Crestfield invoices consistently spiked in the 30 to 60 days preceding each of the five permit issuances associated with Torchlight's Ganaran operations:

This pattern — in which significant payments to a government-relations intermediary repeatedly precede the issuance of government permits — is a classic corruption red flag. The failure of any internal monitoring, audit, or compliance function to identify this pattern over a five-year period underscores the inadequacy of Torchlight's monitoring controls.

Use of Personal Email. The investigation has identified at least 37 communications between Marcus Delacroix and Jean-Philippe Renard that were conducted via personal email accounts (i.e., non-Torchlight email addresses). The use of personal email for company business constitutes a circumvention of Torchlight's communication controls and record-keeping requirements, as these communications were not captured in Torchlight's corporate email archive and were not available for compliance review or internal audit. The use of personal email was not detected by any internal control or monitoring system during the five-year period.

Duration Without Detection. Perhaps the most significant indicator of internal controls inadequacy is the sheer duration of the scheme without detection. The payment scheme operated for approximately five years — from April 2019 through at least October 2024 — during which time $4,730,000 in suspected improper payments was made without triggering any internal alarm. The scheme was ultimately detected not through the functioning of Torchlight's internal controls framework but through an anonymous whistleblower complaint submitted through the third-party ethics hotline. While the existence and accessibility of a whistleblower mechanism is itself a positive compliance feature, the fact that the company's internal controls failed to detect the scheme independently — and that detection required an external tip — demonstrates that the controls were insufficient to "provide reasonable assurances" as required by the statute.

F. Failure to Reconcile Asset Accountability

The investigation has also identified failures related to the fourth category of required controls under Section 13(b)(2)(B)(iv) — the requirement that the recorded accountability for assets be compared with existing assets at reasonable intervals.

Consultant Payment Reconciliation. No evidence has been found that TGH or TGM conducted periodic reconciliation of actual consultant payments against contractual terms. As noted above, such a reconciliation would have identified the $1,170,000 contractual overage on the Crestfield engagement, which grew steadily over five years. The absence of this basic reconciliation control allowed the excess payments to continue without detection.

Community Relations Expense Verification. No evidence has been found that TGM compared the recorded "community relations expenses" booked under GL 7450 with actual community development outcomes, projects, or beneficiaries. A basic reconciliation exercise — comparing the funds recorded as expended on community relations with tangible evidence of community benefit — would have revealed that substantial portions of the GL 7450 expenditures could not be linked to any identifiable community project or initiative. This type of reconciliation is a straightforward control that should have been in place for a category of expenditure that totaled $890,000 over five years.

Section 13(b)(2)(B)(iv) Analysis. These failures directly implicate the statutory requirement to compare "recorded accountability for assets" with "existing assets at reasonable intervals and [take] appropriate action with respect to any differences." The absence of periodic reconciliation allowed discrepancies to accumulate undetected and denied Torchlight the ability to identify and investigate the diversion of company assets.

G. Summary of Internal Controls Failures

In summary, the investigation has identified at least six distinct categories of internal controls failures, spanning all four subsections of Section 13(b)(2)(B):

1. Systematic override of dual-approval requirements (14 of 24 Crestfield invoices approved by a single individual in violation of the Delegation of Authority Policy) — implicating § 13(b)(2)(B)(i).

2. Complete absence of third-party due diligence on Crestfield Advisory Partners Ltd., a high-risk intermediary engaged to perform government-facing services in a high-risk jurisdiction — implicating § 13(b)(2)(B)(i) and (ii).

3. Failure to detect contractual overpayments of $1,170,000 (57% above the contractual maximum) over a five-year period — implicating § 13(b)(2)(B)(ii).

4. Inadequate controls over cash disbursements, including the use of a catch-all general ledger code with no documentation requirements for nearly $900,000 in cash payments — implicating § 13(b)(2)(B)(iii).

5. Failure of supervisory and monitoring controls, including the absence of periodic compliance reviews, the failure to identify timing correlations between intermediary payments and permit issuances, the failure to detect the use of personal email for company business, and the five-year duration of the scheme without detection — implicating § 13(b)(2)(B)(i) through (iv).

6. Failure to reconcile asset records with actual dispositions, including the absence of contract-to-payment reconciliation and the absence of verification of community relations expenditures against actual outcomes — implicating § 13(b)(2)(B)(iv).

These failures are not isolated or technical in nature. They are systemic, overlapping, and mutually reinforcing. Taken together, they demonstrate that Torchlight's system of internal accounting controls was fundamentally insufficient to prevent or detect the diversion of company assets to government officials over an extended period. The SEC is likely to view the breadth, depth, and duration of these failures as strong evidence of a violation of Section 13(b)(2)(B).

V. Potential Individual Liability

The books and records and internal controls provisions of the FCPA can give rise to individual liability in addition to entity-level liability. Two provisions are particularly relevant.

Section 13(b)(5) of the Exchange Act. Section 13(b)(5), codified at 15 U.S.C. § 78m(b)(5), provides that no person shall knowingly circumvent or knowingly fail to implement a system of internal accounting controls, or knowingly falsify any book, record, or account described in Section 13(b)(2). Unlike the entity-level provisions, Section 13(b)(5) requires proof of scienter — the SEC or DOJ must demonstrate that the individual acted "knowingly." However, the scienter requirement is satisfied by a showing that the individual was aware of the circumvention or falsification; proof of corrupt motive is not required.

SEC Rule 13b2-1. Rule 13b2-1, promulgated under the Exchange Act, provides that no person shall, directly or indirectly, falsify or cause to be falsified any book, record, or account subject to Section 13(b)(2)(A). Rule 13b2-1 does not require proof of scienter; negligent or even innocent falsification can give rise to liability. This rule significantly broadens the potential scope of individual liability for books and records violations.

The investigation has identified three individuals with potential individual exposure under these provisions:

Marcus Delacroix (former VP, Africa Operations). Delacroix resigned from Torchlight on November 15, 2024, approximately three months after the whistleblower complaint was received and shortly after being informed of the internal investigation. Delacroix personally introduced Jean-Philippe Renard to Torchlight and is believed, based on evidence developed to date, to have directed or at minimum facilitated the payment scheme. The 37 identified personal-email communications between Delacroix and Renard — which were not captured in Torchlight's corporate email system and which Delacroix did not disclose — suggest a deliberate effort to conceal the true nature of the Crestfield relationship. Delacroix is currently represented by Helen Whitmore of Whitmore & Sharpe LLP, Washington, D.C. Through counsel, Delacroix declined a voluntary interview request on April 2, 2025, with Whitmore citing Fifth Amendment concerns. The refusal to cooperate, while well within Delacroix's rights, limits our ability to assess the full scope of his involvement and knowledge.

Raymond Osei-Bonsu (former Country Manager, TGM). Osei-Bonsu was terminated by Torchlight on January 8, 2025, following preliminary findings of the internal investigation. As the sole approver of 14 Crestfield invoices exceeding the $50,000 dual-approval threshold, Osei-Bonsu systematically overrode the Delegation of Authority Policy. He also directed Thomas Achebe, the TGM Finance Director, to use GL 7450 as a catch-all code for cash disbursements, thereby facilitating the mischaracterization of those payments in TGM's books and records. Osei-Bonsu is currently represented by Barrister Emeka Okoro of Okoro Law Chambers in Ganara. The extent of Osei-Bonsu's knowledge of the ultimate disposition of the Crestfield payments and GL 7450 disbursements remains under investigation.

Jean-Philippe Renard (sole owner, Crestfield Advisory Partners Ltd.). Renard served as the conduit through which the majority of the suspected improper payments were funneled. As the sole owner and only identified principal of Crestfield, Renard had direct knowledge of, and exercised control over, the disposition of the $3,210,000 in payments received by Crestfield from TGH. The forensic evidence indicates that Renard directed or facilitated the transfer of approximately $2,410,000 from Crestfield's accounts to Ganaran government officials. Renard is a French citizen based in Dakar, Senegal, which may present practical challenges to enforcement depending on the available jurisdictional bases and treaty obligations.

Current Torchlight Officers. The potential exposure of current Torchlight officers, including Diane Fournier (VP Finance) and Nadia Berenson (VP Compliance and Ethics, appointed 2021), requires further assessment. Based on the evidence developed to date, the conduct of these individuals appears more consistent with supervisory failures — failures to detect, inquire, or escalate — than with knowing participation in the scheme. Fournier's April 8, 2025 interview statements, in which she indicated a lack of awareness of the contractual overage and a reliance on regional management for expenditure oversight, are broadly consistent with a negligence or supervisory-failure theory rather than a knowing-circumvention theory. However, this preliminary assessment may change as additional witness interviews and document review are completed. We recommend that the question of individual exposure for current officers be revisited upon completion of the second wave of witness interviews and Pinnacle's full forensic review.

VI. Quantification of Potential SEC Exposure on Books-and-Records/Internal Controls Charges

Based on the foregoing analysis, we set forth below a preliminary quantification of Torchlight's potential financial exposure in connection with SEC enforcement of the FCPA's accounting provisions. This quantification is necessarily approximate and is subject to revision as the investigation progresses and as additional information becomes available regarding the SEC's enforcement posture.

Disgorgement. The SEC may seek disgorgement of the full $4,730,000 in suspected improper payments, on the theory that these amounts constitute ill-gotten gains derived from the mining permits and environmental approvals that Torchlight improperly obtained or expedited through the payment scheme. The SEC's disgorgement theory i

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT
CALDERWOOD & HARKNESS LLP 825 Eighth Avenue, 42nd Floor New York, New York 10019
MEMORANDUM
TO: Conrad Ashby, Responsible Partner, White Collar & Investigations
FROM: Steven Hollander, Lead Associate, White Collar & Investigations
DATE: April 18, 2025
RE: FCPA Books and Records and Internal Controls Provisions — Potential Violations — Torchlight Mining Corp.
MATTER NO.: 1039-00005
CONFIDENTIALITY LEGEND: This memorandum is protected by the attorney-client privilege and the work product doctrine. It was prepared at the direction of counsel in connection with the internal investigation of Torchlight Mining Corp. and its subsidiaries. It is not to be disclosed to any third party without the prior written consent of Calderwood & Harkness LLP and Torchlight Mining Corp.
Right-click to update Table of Contents
I. Executive Summary
This memorandum analyzes potential violations of the accounting provisions of the Foreign Corrupt Practices Act ("FCPA") — specifically, Section 13(b)(2)(A) of the Securities Exchange Act of 1934 (the "books and records" provision) and Section 13(b)(2)(B) of the Securities Exchange Act of 1934 (the "internal controls" provision) — arising from the conduct identified during the course of the ongoing internal investigation of Torchlight Mining Corp. ("Torchlight" or "TMC"), its British Virgin Islands intermediate holding subsidiary Torchlight Ganara Holdings Ltd. ("TGH"), and its Ganaran operating subsidiary Torchlight Ganara Mining S.A. ("TGM"). This analysis is based on the investigation's findings as of the date hereof and should be updated as additional information becomes available through the ongoing forensic review and witness interviews.
Torchlight is a Canadian corporation whose common shares are listed on the Toronto Stock Exchange (ticker: TMC) and whose American Depositary Receipts ("ADRs") are listed on the New York Stock Exchange (ticker: TRCH). The listing of Torchlight's ADRs on the NYSE subjects the company to the reporting requirements of Section 12 of the Securities Exchange Act of 1934, thereby making Torchlight an "issuer" within the meaning of the FCPA's accounting provisions. As discussed in greater detail below, this issuer status brings Torchlight — and the books, records, and internal controls of its controlled subsidiaries TGH and TGM — within the reach of Sections 13(b)(2)(A) and 13(b)(2)(B).
The internal investigation, which was initiated following receipt of an anonymous whistleblower complaint on August 19, 2024, concerns approximately $4,730,000 in suspected improper payments made between April 2019 and October 2024. These payments were channeled through two primary mechanisms: (1) payments routed through Crestfield Advisory Partners Ltd. ("Crestfield"), a Mauritius-incorporated intermediary controlled by Jean-Philippe Renard, totaling approximately $3,210,000; and (2) direct cash disbursements from TGM and in-kind benefits provided to government officials in the Republic of Ganara, totaling approximately $1,520,000. The suspected payments were made in connection with obtaining or expediting mining permits and environmental approvals for Torchlight's Ganaran operations, principally in the Kousseri and Dembélé concession areas.
This memorandum focuses specifically on the FCPA's accounting provisions, which are civil and administrative in nature and are enforced by the U.S. Securities and Exchange Commission ("SEC"). It is essential to note at the outset that these provisions are independently actionable — they apply regardless of whether the underlying payments ultimately are proven to have constituted bribes in violation of the FCPA's anti-bribery provisions. The mischaracterization of payments in Torchlight's books and records, and the failures of Torchlight's internal accounting controls, are independently sufficient bases for SEC enforcement action. This distinction is critical to the company's exposure assessment, as the SEC can and frequently does bring standalone books-and-records and internal controls charges even in cases where the evidence of corrupt intent is inconclusive or where the Department of Justice ("DOJ") declines to bring anti-bribery charges.
Based on the evidence developed to date through document review, forensic accounting analysis, and witness interviews, we have reached the following key conclusions:
1. Books and Records (Section 13(b)(2)(A)): The evidence strongly supports potential violations based on the systematic mischaracterization of payments in TGH's and TGM's books and records. Payments to Crestfield that were diverted to Ganaran government officials were recorded as legitimate consulting expenses. Cash withdrawals directed to government officials were booked under a vague general ledger code as "Community Relations Expenses." In-kind benefits provided to officials were recorded without identifying the recipients as government officials or the true purpose of the expenditures. In aggregate, these mischaracterizations affected approximately $4,730,000 in transactions over a five-year period, all of which were consolidated into Torchlight's financial statements filed with the SEC and Canadian securities regulators.
2. Internal Controls (Section 13(b)(2)(B)): The evidence strongly supports potential violations based on multiple, overlapping failures of Torchlight's internal accounting controls. These failures include systematic overrides of the company's Delegation of Authority Policy, the complete absence of third-party due diligence on Crestfield, the failure to detect payments exceeding contractual limits by $1,170,000 (a 57% overage), inadequate controls over cash disbursements, failures of supervisory and monitoring controls, and the failure to reconcile recorded asset accountability with actual asset dispositions. The scheme operated for approximately five years — from April 2019 through at least October 2024 — without detection by the company's internal controls framework. The scheme was ultimately uncovered only through an anonymous whistleblower complaint, not through the functioning of any internal control mechanism.
3. Duration and Systemic Nature: The extended duration of the scheme and its penetration across multiple transaction categories and organizational levels strongly suggest that Torchlight's internal controls were not merely inadequate in isolated respects but were fundamentally insufficient to prevent or detect the conduct at issue. This systemic character is likely to be viewed as an aggravating factor by the SEC in any enforcement proceeding.
We note that the SEC has opened a formal order of investigation in this matter, designated File No. HO-14892, dated January 22, 2025. On February 3, 2025, the SEC served a document subpoena on Torchlight, and document production is ongoing. The existence of an active SEC investigation underscores the urgency of the analysis contained herein and its relevance to the company's voluntary self-disclosure ("VSD") decision, which is targeted for June 30, 2025.
The balance of this memorandum proceeds as follows: Section II sets forth the applicable legal framework. Sections III and IV present the factual bases for potential violations of the books and records and internal controls provisions, respectively. Section V addresses potential individual liability. Section VI quantifies the company's potential SEC exposure. Sections VII and VIII address the interaction with the VSD analysis and remediation implications, respectively. Section IX identifies open issues and next steps. Section X provides our overall conclusions and recommendations.
II. Legal Framework
A. FCPA Section 13(b)(2)(A) — Books and Records Provision
The books and records provision of the FCPA is codified at 15 U.S.C. § 78m(b)(2)(A). It provides, in relevant part, that every issuer which has a class of securities registered pursuant to Section 12 of the Securities Exchange Act of 1934, or which is required to file reports under Section 15(d) of that Act, shall:
"make and keep books, records, and accounts, which, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the issuer."
This provision imposes an affirmative obligation on issuers to maintain accurate books and records. Several features of the provision are particularly relevant to the present analysis:
Scope — Subsidiary Records. The books and records obligation extends beyond the issuer's own records to encompass the records of all subsidiaries that the issuer controls. Where, as here, the issuer maintains a controlling interest in subsidiaries (TGH and TGM are wholly owned), the issuer bears responsibility for the accuracy of those subsidiaries' books and records. Transactions recorded in the books of TGH and TGM are therefore subject to the requirements of Section 13(b)(2)(A) to the same extent as transactions recorded directly in Torchlight's own books.
No Materiality Threshold. Unlike certain other provisions of the federal securities laws, the books and records provision contains no materiality qualifier. Even immaterial inaccuracies in an issuer's books and records can constitute a violation. The SEC has consistently taken the position that the provision's mandate is absolute: if a transaction is not accurately and fairly reflected, a violation has occurred regardless of whether the inaccuracy would be material to an investor's decision-making. This is particularly significant here because the total suspected mischaracterized payments of $4,730,000, while substantial in absolute terms, represent a relatively modest percentage of Torchlight's consolidated revenue and total assets.
No Scienter Requirement. For purposes of civil enforcement by the SEC, the books and records provision is a strict liability standard. The SEC is not required to prove that the issuer or any individual acted with corrupt intent, knowledge of falsity, or even negligence. The sole question is whether the books and records "accurately and fairly reflect" the relevant transactions. This feature significantly lowers the evidentiary burden the SEC must satisfy and makes books-and-records charges among the most readily provable of all FCPA violations.
"Reasonable Detail" Standard. The statute qualifies its accuracy requirement with the phrase "in reasonable detail." The legislative history and SEC guidance interpret this standard to mean the level of detail and degree of assurance that would satisfy prudent officials in the conduct of their own affairs. This is an objective, reasonableness-based standard rather than an absolute requirement of perfection. Nevertheless, the standard is demanding: it requires that the description of each transaction in the company's books convey the essential nature, purpose, and characteristics of the transaction with sufficient particularity that a reasonable reader would not be misled.
Types of Violations. Books and records violations can arise from range recording failures, including but not limited to: (i) mischaracterizing the nature or purpose of a payment (e.g., describing a bribe as a "consulting fee"); (ii) creating false or misleading descriptions in general ledgers, sub-ledgers, or other accounting records; (iii) failing to record transactions altogether; (iv) recording transactions in incorrect amounts; and (v) failing to identify the true recipients or beneficiaries of payments. As discussed in Section III below, the present investigation has identified potential violations in the first, second, and fifth of these categories.
B. FCPA Section 13(b)(2)(B) — Internal Controls Provision
The internal controls provision of the FCPA is codified at 15 U.S.C. § 78m(b)(2)(B). It provides, in relevant part, that every issuer subject to the books and records requirement shall:
"devise and maintain a system of internal accounting controls sufficient to provide reasonable assurances that—
(i) transactions are executed in accordance with management's general or specific authorization;
(ii) transactions are recorded as necessary to permit preparation of financial statements in conformity with generally accepted accounting principles or any other criteria applicable to such statements, and to maintain accountability for assets;
(iii) access to assets is permitted only in accordance with management's general or specific authorization; and
(iv) the recorded accountability for assets is compared with the existing assets at reasonable intervals and appropriate action is taken with respect to any differences."
Several aspects of this provision warrant emphasis:
"Reasonable Assurances" Standard. The statute does not require that an issuer's internal controls achieve an absolute guarantee against error or wrongdoing. The standard is one of "reasonable assurances" — defined in the legislative history as the level of assurance that would satisfy prudent officials in the conduct of their own affairs. The standard recognizes that internal controls involve cost-benefit judgments and that no system of controls can prevent all misconduct. However, the "reasonable assurances" standard does require that an issuer make good-faith efforts to design and implement controls that are reasonably capable of preventing and detecting the types of inaccuracies and unauthorized transactions at issue.
Effective Implementation and Maintenance. The provision requires not merely that an issuer adopt policies or procedures on paper, but that it effectively implement and maintain those controls over time. A control that exists in written policy but is systematically overridden, ignored, or unenforced does not satisfy the statutory requirement. As the SEC has stated in numerous enforcement actions, the mere existence of a compliance program or policy manual is insufficient; the issuer must demonstrate that its controls are operationally effective. This distinction is critical in the present case, where Torchlight maintained certain written policies (e.g., the Delegation of Authority Policy) that were routinely circumvented in practice.
No Scienter Requirement for Entity-Level Liability. As with the books and records provision, the SEC need not prove scienter to establish a civil violation of the internal controls provision at the entity level. The SEC must demonstrate only that the issuer's system of internal accounting controls was insufficient to provide reasonable assurances as defined by the statute. This is an objective adequacy standard.
Subsidiary Controls. The obligation to devise and maintain adequate internal controls extends to subsidiaries that the issuer controls. Torchlight, as the ultimate parent of both TGH and TGM, bears responsibility for ensuring that adequate internal accounting controls are in place at each level of its corporate structure, including at the operating subsidiary level in Ganara.
Four Categories of Required Controls. The statute identifies four distinct categories of controls, each addressing a different aspect of asset accountability and transaction integrity. As discussed in detail in Section IV below, the investigation has identified potential failures across all four categories:
• Authorization controls (§ 13(b)(2)(B)(i)): ensuring that transactions are executed only with proper authorization;
• Recording controls (§ 13(b)(2)(B)(ii)): ensuring that transactions are recorded accurately and in conformity with GAAP;
• Access controls (§ 13(b)(2)(B)(iii)): ensuring that access to company assets is appropriately restricted; and
• Reconciliation controls (§ 13(b)(2)(B)(iv)): ensuring that recorded accountability is periodically compared to actual asset positions.
C. Applicability to Torchlight Mining Corp.
Torchlight qualifies as an "issuer" within the meaning of the FCPA because its ADRs are listed on the New York Stock Exchange under the ticker symbol TRCH. This listing subjects Torchlight to the registration and reporting requirements of Section 12 of the Securities Exchange Act of 1934, 15 U.S.C. § 78l, thereby bringing Torchlight within the scope of the FCPA's accounting provisions. Although Torchlight is a Canadian corporation with its primary listing on the TSX, the NYSE listing is independently sufficient to establish issuer status under the FCPA.
The corporate structure relevant to this analysis is as follows:
• Torchlight Mining Corp. ("Torchlight" or "TMC") — Canadian corporation; parent entity; listed on TSX (ticker: TMC) and NYSE via ADRs (ticker: TRCH).
• Torchlight Ganara Holdings Ltd. ("TGH") — Wholly owned subsidiary of Torchlight; incorporated in the British Virgin Islands on March 15, 2017; functions as the intermediate holding company for Torchlight's Ganaran operations.
• Torchlight Ganara Mining S.A. ("TGM") — Wholly owned subsidiary of TGH; organized under the laws of the Republic of Ganara; the operating entity responsible for Torchlight's mining operations in the Kousseri and Dembélé concession areas.
Because Torchlight owns 100% of TGH, which in turn owns 100% of TGM, Torchlight exercises unquestioned control over both subsidiaries. Accordingly, Torchlight bears responsibility under Sections 13(b)(2)(A) and 13(b)(2)(B) for the books, records, and internal accounting controls of both TGH and TGM. The financial results of TGH and TGM are fully consolidated into Torchlight's consolidated financial statements, which are filed with the SEC and Canadian securities regulators on an annual and quarterly basis.
For context, Torchlight's FY2024 consolidated revenue was approximately CAD $2.1 billion. The West African operations, centered in the Republic of Ganara and conducted through TGH and TGM, generated approximately CAD $387 million in revenue for FY2024, representing approximately 18.4% of Torchlight's total consolidated revenue. The Ganaran operations are thus a material component of Torchlight's overall business, and the books and records of TGH and TGM are integral to the accuracy of Torchlight's consolidated financial statements.
D. SEC Enforcement Trends and Precedent
The SEC has demonstrated a consistent and vigorous enforcement posture with respect to FCPA books-and-records and internal controls violations, particularly in the mining and extractive industries. Several enforcement trends are worth noting in connection with the present analysis.
First, the SEC frequently brings standalone books-and-records and internal controls charges, even in cases where the evidence of underlying bribery is contested, inconclusive, or where the DOJ has declined to bring anti-bribery charges. The accounting provisions provide the SEC with a powerful enforcement tool because they require no proof of corrupt intent and no showing of materiality. In a significant number of FCPA enforcement actions over the past decade, the SEC's charges have been limited to, or have principally rested upon, violations of Sections 13(b)(2)(A) and 13(b)(2)(B).
Second, the extractive industries — including mining, oil and gas, and natural resources — have been a particular focus of FCPA enforcement. The SEC has recognized that these industries present elevated corruption risks due to the necessity of obtaining government permits and approvals, the concentration of operations in jurisdictions with high perceived levels of corruption, the frequent use of third-party agents and intermediaries, and the substantial sums of money involved. Multiple SEC enforcement actions involving mining companies have resulted in significant monetary sanctions.
Third, the SEC has the authority to impose substantial financial remedies in books-and-records and internal controls cases. Under Section 21(d)(3) of the Exchange Act, the SEC may seek civil monetary penalties in three tiers. For Tier III violations — those involving fraud, deceit, manipulation, or deliberate or reckless disregard of a regulatory requirement — the SEC may seek penalties up to the greater of the gross pecuniary gain to the defendant or a specified statutory maximum per violation. In addition, the SEC routinely seeks disgorgement of ill-gotten gains, calculated as the economic benefit the issuer derived from the improperly obtained permits, contracts, or business advantages, together with prejudgment interest running from the date of the violation.
Fourth, the SEC has increasingly emphasized the importance of effective internal controls in high-risk jurisdictions and has brought enforcement actions targeting not only the absence of controls but also the failure to implement and enforce existing controls — precisely the type of failure identified in the present investigation.
III. Factual Basis for Potential Books and Records Violations — Section 13(b)(2)(A)
The investigation has identified three principal categories of transactions that were inaccurately recorded in TGH's and TGM's books and records, which were in turn consolidated into Torchlight's financial statements. Each category is discussed in turn below.
A. Mischaracterization of Payments to Crestfield Advisory Partners Ltd.
The most significant category of potential books and records violations involves the payments made by TGH to Crestfield Advisory Partners Ltd. ("Crestfield"), a Mauritius-incorporated intermediary entity.
Aggregate Payment Data. Between April 2019 and October 2024, TGH made total payments to Crestfield of $3,210,000, comprising 24 separate invoices across approximately five and one-half years. The payments were distributed across calendar years as follows:
All payments were routed through TGH's account at Meridian Commercial Bank (BVI), Account No. 7740-2281-0056. Wire transfer records obtained from Meridian confirm the amounts and dates of each payment.
Invoice Descriptions. The 24 Crestfield invoices uniformly described the services purportedly rendered using vague, generic terminology. The invoice descriptions included "permitting support services," "regulatory liaison," "stakeholder engagement," "government affairs advisory," and similar characterizations. None of the invoices identified any specific government official as a recipient of any portion of the invoiced amounts, nor did they describe the services in sufficient detail to reveal the true nature and purpose of the payments.
Forensic Findings — Diversion of Funds. The investigation, conducted in coordination with Pinnacle Forensic Advisory LLC (engagement partner Dr. Leonard Strauss), has determined through forensic tracing of bank records, wire transfer documentation, and analysis of Crestfield's Mauritius bank account (Harborline Commerce Bank, Port Louis) that approximately $2,410,000 — representing approximately 75% of total Crestfield payments — was diverted from Crestfield's accounts to Ganaran government officials. The identified recipients of diverted funds include:
• Hon. Boubacar Diallo, Former Minister of Mines and Natural Resources, Republic of Ganara: approximately $1,850,000 in aggregate payments, traced through multiple transfers to accounts in Ganara, Senegal, and the United Arab Emirates.
• Amadou Traoré, Director, Environmental Permitting, Ministry of Mines and Natural Resources, Republic of Ganara: approximately $620,000 in aggregate payments, traced through transfers to personal accounts at Regency International Bank (Ganara) and a Dubai-based account.
• Other and unidentified recipients: the balance of the diverted amounts, totaling approximately $140,000 in smaller transfers whose ultimate beneficiaries have not yet been definitively identified as of the date of this memorandum. The ongoing forensic review by Pinnacle may yield additional clarity on these transactions.
The remaining approximately $800,000 in Crestfield payments (roughly 25% of the total) appears to have been retained by Crestfield as its own fee or used for expenses that may have been legitimate, though further forensic review is required to confirm this allocation.
Books and Records Implications. The Crestfield invoices were recorded in TGH's general ledger as legitimate consulting expenses under various expense categories. This recording was inaccurate and unfair because it failed to reflect that the predominant purpose and effect of the payments was the funneling of funds to Ganaran government officials in exchange for favorable action on mining permits and environmental approvals. The descriptions in TGH's books bore no resemblance to the actual nature of the transactions. A prudent official reviewing TGH's books would have had no basis to understand that the payments classified as "permitting support services" or "stakeholder engagement" were in fact being channeled to government decision-makers with authority over Torchlight's permit applications.
Contractual Overpayment Analysis. The irregularity in the books and records is further demonstrated by the relationship between the actual payments and the contractual terms governing the Crestfield engagement. The Government Relations Advisory Agreement between TGH and Crestfield, executed on April 12, 2019, established the following fee structure:
• Monthly retainer: $15,000 per month × 66 months (April 2019 through September 2024) = $990,000
• Success fees: $100,000 per permit obtained × 5 permits = $500,000
• Quarterly expense reimbursement: capped at $25,000 per quarter × 22 quarters = $550,000 maximum
• Total contractual maximum: approximately $2,040,000
The actual payments of $3,210,000 exceeded this contractual maximum by $1,170,000 — a 57% overage. No contract amendment or addendum was executed to authorize the excess payments. The excess amounts therefore had no contractual basis whatsoever, yet they were recorded in TGH's books without any documentation of the basis for payment. This discrepancy is itself a books and records violation: the books reflect payments characterized as made pursuant to a consulting agreement, when in fact $1,170,000 in payments had no contractual authorization or support. A system of books and records that fails to reflect the absence of contractual authority for over $1 million in payments does not "accurately and fairly reflect the transactions and dispositions of the assets of the issuer."
B. Mischaracterization of TGM Cash Withdrawals Under GL 7450
The second category of potential books and records violations involves cash withdrawals made directly by TGM from its local banking account in Ganara.
Aggregate Cash Withdrawal Data. Between 2019 and 2024, TGM made cash withdrawals totaling $890,000 from its account at Regency International Bank (Ganara), Account No. GAN-4419-8837. These withdrawals were made in a series of smaller transactions, typically in amounts below the thresholds that would trigger enhanced internal review.
General Ledger Coding. The cash withdrawals were uniformly recorded in TGM's general ledger under code GL 7450, captioned "Community Relations Expenses." This general ledger code was, by its nature, vague and generic — it conveyed no information about the specific nature of the disbursements, the identity of the recipients, or the purpose for which the funds were expended. As discussed in Section IV.D below, GL 7450 was used by TGM as a "catch-all" code at the direction of Raymond Osei-Bonsu, the former Country Manager.
Forensic Findings — Payments to Government Officials. The investigation has identified that substantial portions of the GL 7450 cash withdrawals were directed to Ganaran government officials rather than to bona fide community relations activities. In particular:
• Col. Ibrahim Konaté, Former Regional Prefect, Kousseri Province: approximately $340,000 in cash payments and in-kind benefits were provided to Col. Konaté or his associates under the guise of "community development" expenditures. The investigation has determined that these payments were personal in nature and were not directed toward any identifiable community development project or initiative. Col. Konaté, as Regional Prefect, exercised significant administrative authority over the Kousseri concession area, including authority over local land-use approvals and security arrangements that were prerequisite to Torchlight's mining operations.
The remaining GL 7450 expenditures are still under review by Pinnacle Forensic Advisory. It is possible that some portion of these funds was used for legitimate community engagement purposes; however, the absence of supporting documentation (discussed in Section IV.D) makes it impossible to verify the legitimacy of any individual transaction recorded under this code.
Books and Records Implications. The recording of cash payments to government officials under the generic caption "Community Relations Expenses" constitutes a clear failure to "accurately and fairly reflect the transactions and dispositions of the assets" of the issuer. The description conceals rather than reveals the true nature of the transactions. A prudent official reviewing GL 7450 entries would have no indication that company funds were being paid to government officials with authority over Torchlight's operations. The coding does not identify the recipients, the purpose, or the connection to government permitting activities. This lack of transparency is precisely the type of record-keeping failure that Section 13(b)(2)(A) was designed to prevent.
C. Mischaracterization of In-Kind Benefits
The third category of potential books and records violations involves in-kind benefits provided to Ganaran government officials.
Aggregate In-Kind Benefits. The investigation has identified approximately $630,000 in in-kind benefits — principally vehicle purchases and travel expenses — that were provided to government officials between 2019 and 2024. These benefits were booked in TGM's and TGH's records across two general ledger codes:
• GL 7200 ("Vehicle and Transportation Expenses"): used to record vehicle purchases and related costs.
• GL 7310 ("Travel and Accommodation"): used to record travel arrangements and related expenses.
The descriptions associated with these entries did not identify the recipients as government officials, nor did they disclose the true purpose of the expenditures. The entries were recorded in a manner that suggested routine operational expenses rather than benefits conferred upon public officials.
Preliminary Examples. The forensic review by Pinnacle Forensic Advisory LLC is continuing to develop the full scope of in-kind benefits. Preliminary findings include the following:
• Multiple vehicle purchases for Col. Ibrahim Konaté and members of his family, recorded as general fleet acquisitions or community development vehicles under GL 7200, with no notation that the vehicles were delivered to a government official for personal use.
• Travel arrangements — including international airfare, hotel accommodations, and per diem expenses — for government officials attending conferences or events that were funded by TGM but recorded under GL 7310 as general travel expenses without identifying the recipients as government officials or disclosing the purpose of the travel.
Further details will be developed as Pinnacle completes its review of GL 7200 and GL 7310 entries and associated supporting documentation.
Books and Records Implications. As with the Crestfield payments and GL 7450 withdrawals, the in-kind benefits were recorded in a manner that obscured their true nature. The books and records reflected what appeared to be ordinary business expenses — vehicle acquisitions and travel costs — when in fact they represented benefits conferred upon government officials in connection with Torchlight's permitting and regulatory activities. The failure to accurately identify the recipients and purposes of these expenditures constitutes a failure to maintain books and records that "accurately and fairly reflect" the relevant transactions.
D. Impact on Consolidated Financial Statements
The mischaracterized transactions described above flowed directly into Torchlight's consolidated financial statements, which are filed with the SEC on Form 20-F (annual) and Form 6-K (current and interim reports) and with Canadian securities regulators on a corresponding basis.
Torchlight's external auditor, Clarendon Group LLP (engagement partner Alain Beaumont, Montreal), issued unqualified (clean) audit opinions on Torchlight's consolidated financial statements for each of fiscal years 2019 through 2023. Those audit opinions stated, among other things, that Torchlight's financial statements presented fairly, in all material respects, the financial position and results of operations of the company in conformity with International Financial Reporting Standards ("IFRS") as issued by the International Accounting Standards Board. The audit opinions did not identify any material misstatement or internal control deficiency related to the Ganaran operations.
The FY2024 audit is currently delayed pending the outcome of the internal investigation. Clarendon has been informed of the investigation and has indicated that the resolution of the investigation's findings will be a prerequisite to the completion of the FY2024 audit and the issuance of an audit opinion. The potential implications for the FY2024 audit, and the risk of restatement for prior-year financial statements, are addressed in Section IX below.
Total Suspected Mischaracterized Payments. In aggregate, the investigation has identified $4,730,000 in suspected mischaracterized payments across the three categories described above:
Each of these amounts was reflected in TGH's and TGM's books and records — and, by consolidation, in Torchlight's SEC filings — in a manner that inaccurately and unfairly described the true nature, purpose, and recipients of the transactions.
E. Summary of Books and Records Violations
Based on the foregoing, the evidence developed to date strongly supports potential violations of Section 13(b)(2)(A) of the Securities Exchange Act. The violations span three distinct categories of transactions — (1) Crestfield consulting payments, (2) GL 7450 cash withdrawals, and (3) in-kind benefits — all of which were described in TGH's and TGM's books and records in a manner that obscured their true character as payments to, or for the benefit of, Ganaran government officials. The mischaracterizations were not isolated or episodic; they were systematic, recurring across 24 invoices and numerous additional transactions over a period of approximately five years. The descriptions employed — "permitting support services," "regulatory liaison," "stakeholder engagement," "community relations expenses," and generic vehicle and travel expense codes — were uniformly designed to present the payments as legitimate business expenses rather than as benefits conferred upon government officials. This pattern of systematic mischaracterization is precisely the type of conduct that the books and records provision was enacted to address and that the SEC has consistently targeted in FCPA enforcement actions.
IV. Factual Basis for Potential Internal Controls Violations — Section 13(b)(2)(B)
The investigation has identified multiple, overlapping failures of Torchlight's internal accounting controls that are potentially actionable under Section 13(b)(2)(B). These failures are organized below according to the four statutory subsections, though in practice many of the identified failures implicate more than one subsection simultaneously.
A. Failure of Authorization Controls — Delegation of Authority Policy Violations
Torchlight's Delegation of Authority Policy. Torchlight maintains a corporate Delegation of Authority Policy (the "DAP"), which establishes approval thresholds for expenditures across the organization. As relevant here, the DAP requires dual approval — by the originating manager and a designated secondary approver — for any single expenditure exceeding $50,000. The DAP was adopted in 2016 and was in effect throughout the period relevant to this investigation. The policy was designed to serve as a key internal control over the authorization of significant expenditures, ensuring that no single individual could unilaterally commit the company to payments above the specified threshold.
Systematic Override. Of the 24 Crestfield invoices paid by TGH between April 2019 and October 2024, 14 invoices exceeded the $50,000 dual-approval threshold. These 14 invoices ranged in amount from $55,000 to $185,000. Each of these invoices was approved solely by Raymond Osei-Bonsu, the former Country Manager of TGM, without the required secondary authorization. In no instance was a secondary approver identified or documented. In no instance was the absence of secondary approval flagged by any automated system or manual review process.
This represents a systematic and sustained override of a fundamental internal control over a five-year period. The override was not a matter of occasional oversight or administrative error; it was a consistent pattern in which the dual-approval requirement was simply disregarded for every qualifying Crestfield invoice throughout the life of the engagement.
Failure of Supervisory Oversight. There is no evidence in the record that any supervisory personnel above Osei-Bonsu — including Marcus Delacroix, the former VP Africa Operations, who had direct supervisory authority over Osei-Bonsu — flagged the single-approval issue or took any steps to enforce compliance with the DAP. Delacroix, who personally introduced Jean-Philippe Renard to Torchlight and who is believed to have directed the payment scheme, appears to have acquiesced in or actively facilitated the circumvention of the DAP. The failure of supervisory personnel to enforce a key control that was being systematically overridden by their direct reports compounds the control failure and suggests that the DAP was, in practice, ineffective with respect to the Ganaran operations.
Section 13(b)(2)(B)(i) Analysis. The dual-approval requirement is a direct expression of "management's general or specific authorization" for the execution of transactions above the $50,000 threshold. The systematic circumvention of this requirement means that 14 of the 24 Crestfield invoices were not "executed in accordance with management's general or specific authorization" as required by Section 13(b)(2)(B)(i). This constitutes a clear failure of authorization controls.
B. Absence of Third-Party Due Diligence on Crestfield
Due Diligence Records. Torchlight's compliance records contain no due diligence file on Crestfield Advisory Partners Ltd. No due diligence questionnaire was completed. No background investigation was conducted. No public records search was performed. No references were checked. No assessment of Crestfield's qualifications, reputation, or capacity to perform the contracted services was documented.
Red Flags. The absence of due diligence is particularly significant in light of the numerous red flags associated with Crestfield and the engagement, including the following:
• Crestfield was incorporated in Mauritius, a jurisdiction commonly used as an offshore intermediary domicile, and maintained no physical office — its registered address was at a registered-agent office at 7th Floor, Nexus Tower, Ebène Cybercity, Port Louis, Mauritius.
• Crestfield had no website, no public profile, and no track record of performing government relations advisory services.
• Crestfield had no employees other than its sole owner, Jean-Philippe Renard, a French citizen, age 54, based in Dakar, Senegal — not in Ganara, where the services were purportedly being performed.
• The Crestfield engagement was not the product of a competitive selection process. Renard was personally introduced to Torchlight by Marcus Delacroix, the VP Africa Operations, with no documentation of how Delacroix came to know Renard or why Renard's firm was selected over other potential service providers.
• The engagement involved the provision of services in the Republic of Ganara, a jurisdiction recognized as presenting elevated corruption risks based on its Transparency International Corruption Perceptions Index ranking and the nature of the extractive industries regulatory environment.
Contractual Deficiencies. The Government Relations Advisory Agreement between TGH and Crestfield, executed on April 12, 2019, contained significant deficiencies from an anti-corruption compliance perspective:
• The agreement contained only a general anti-corruption representation in Clause 9.2, in which Crestfield warranted compliance with "all applicable anti-corruption laws." This generic warranty did not specifically reference the FCPA, the U.K. Bribery Act, or any other specific anti-corruption statute, and it did not impose any affirmative compliance obligations on Crestfield.
• The agreement contained no audit rights clause, thereby depriving Torchlight of the contractual ability to inspect Crestfield's books and records or to verify how Crestfield was using the funds it received from TGH. The absence of audit rights is a significant control deficiency in any third-party agent engagement, and it is particularly egregious in a high-risk jurisdiction engagement involving government-facing services.
• The agreement did not require Crestfield to provide detailed activity reports, to identify government officials with whom it interacted, or to maintain records sufficient to demonstrate that no improper payments were made.
Internal Controls Implications. The complete absence of third-party due diligence on an agent engaged to perform government-facing services in a high-risk jurisdiction represents a fundamental failure of internal controls. Robust third-party due diligence is universally recognized as one of the most critical elements of an effective anti-corruption compliance program, and the failure to conduct any due diligence on Crestfield — in the face of multiple red flags — represents a failure to maintain controls "sufficient to provide reasonable assurances" that transactions were properly authorized and recorded. This failure implicates multiple subsections of Section 13(b)(2)(B), including the authorization and recording requirements.
C. Failure to Detect Payments Exceeding Contractual Limits
As discussed in Section III.A above, actual payments to Crestfield of $3,210,000 exceeded the contractual maximum of approximately $2,040,000 by $1,170,000 — a 57% overage. This overage accumulated over the course of approximately five years without detection by any internal control mechanism.
Absence of Contract-to-Payment Reconciliation. The investigation has found no evidence that any department within Torchlight, TGH, or TGM performed a comparison of actual cumulative payments to Crestfield against the contractual limits established in the Government Relations Advisory Agreement. No automated system generated alerts when payments exceeded budgeted or contracted amounts. No manual review process compared invoices to contractual fee schedules or caps. The overage grew steadily from year to year without triggering any inquiry.
VP Finance Awareness. Diane Fournier, VP Finance of Torchlight, had oversight responsibility for the financial consolidation of TGH and TGM results into Torchlight's consolidated financial statements. In her interview on April 8, 2025, conducted by Calderwood & Harkness in Toronto, Fournier indicated that she was not aware of the absence of a contract amendment authorizing the excess payments and that she did not receive reports comparing actual payments to contractual limits for third-party consultant engagements in the West African operations. Fournier stated that she relied upon the regional management team — principally Delacroix and Osei-Bonsu — to ensure that expenditures were within authorized parameters.
Section 13(b)(2)(B)(ii) Analysis. The failure to detect a $1,170,000 overage on a consulting contract reflects a failure of controls designed to ensure that "transactions are recorded as necessary to permit preparation of financial statements in conformity with GAAP" and to "maintain accountability for assets." Payments that exceed contractual limits by 57% and that lack any contractual authorization cannot be properly recorded or categorized in the financial statements. The absence of controls to detect this overage is a significant internal controls deficiency.
D. Inadequate Controls Over Cash Disbursements (GL 7450)
GL 7450 as a "Catch-All" Code. As discussed in Section III.B above, TGM made cash withdrawals totaling $890,000 over five years, all booked under GL 7450 — "Community Relations Expenses." The investigation has revealed that this general ledger code was used as a catch-all category for a wide range of disbursements, many of which bore no relationship to community relations activities.
Absence of Supporting Documentation Requirements. No supporting documentation requirements appear to have been enforced for GL 7450 entries. The investigation has found no receipts, no beneficiary identification forms, no purpose statements, no photographs or other evidence of community projects, and no approvals beyond those of Osei-Bonsu for the vast majority of GL 7450 transactions. The absence of documentation makes it impossible to verify whether any individual GL 7450 transaction was legitimate.
Thomas Achebe Interview. Thomas Achebe, Finance Director of TGM, was interviewed on April 28, 2025, via video from Ganara. Achebe stated that he processed cash withdrawal requests upon direction from Raymond Osei-Bonsu and that GL 7450 was used as a "catch-all" code at Osei-Bonsu's instruction. Achebe stated that he did not question the coding or request supporting documentation because Osei-Bonsu was the Country Manager and the most senior Torchlight employee in Ganara. Achebe further stated that he was not aware of any written policy requiring specific documentation for GL 7450 entries and that no such policy had been communicated to him by Torchlight's headquarters finance team.
Section 13(b)(2)(B)(iii) Analysis. The use of a catch-all GL code with no documentation requirements for nearly $900,000 in cash disbursements over five years represents a clear failure of controls governing "access to assets" under Section 13(b)(2)(B)(iii). Cash is inherently the asset most susceptible to misappropriation and diversion, and the absence of basic documentation and approval controls over cash disbursements in a high-risk operating environment is a fundamental internal controls deficiency. The fact that a single individual — Osei-Bonsu — could direct cash withdrawals of this magnitude without oversight or documentation requirements demonstrates that access to company assets was not "permitted only in accordance with management's general or specific authorization."
E. Failure of Supervisory and Monitoring Controls
Beyond the specific control failures described above, the investigation has identified a pervasive failure of supervisory and monitoring controls that allowed the scheme to operate undetected for approximately five years.
Absence of Periodic Compliance Reviews. There is no evidence that Torchlight's Compliance and Ethics function — headed since 2021 by Nadia Berenson, VP Compliance and Ethics — conducted any periodic review of TGH's or TGM's third-party relationships, expenditure patterns, or compliance with anti-corruption policies prior to receiving the August 19, 2024 whistleblower complaint. The whistleblower complaint was received via Torchlight's ethics hotline, operated by Sentinel Compliance Solutions Inc., and was assigned Report ID: SCH-2024-08-4417. Prior to that complaint, no compliance review or audit had examined the Crestfield engagement, the GL 7450 cash disbursements, or the in-kind benefits identified in this memorandum.
Failure to Identify Timing Correlations. A significant indicator of potential corruption — the timing correlation between Crestfield invoice spikes and government permit issuances — was never identified by any internal monitoring or audit function. The forensic analysis by Pinnacle has established that Crestfield invoices consistently spiked in the 30 to 60 days preceding each of the five permit issuances associated with Torchlight's Ganaran operations:
This pattern — in which significant payments to a government-relations intermediary repeatedly precede the issuance of government permits — is a classic corruption red flag. The failure of any internal monitoring, audit, or compliance function to identify this pattern over a five-year period underscores the inadequacy of Torchlight's monitoring controls.
Use of Personal Email. The investigation has identified at least 37 communications between Marcus Delacroix and Jean-Philippe Renard that were conducted via personal email accounts (i.e., non-Torchlight email addresses). The use of personal email for company business constitutes a circumvention of Torchlight's communication controls and record-keeping requirements, as these communications were not captured in Torchlight's corporate email archive and were not available for compliance review or internal audit. The use of personal email was not detected by any internal control or monitoring system during the five-year period.
Duration Without Detection. Perhaps the most significant indicator of internal controls inadequacy is the sheer duration of the scheme without detection. The payment scheme operated for approximately five years — from April 2019 through at least October 2024 — during which time $4,730,000 in suspected improper payments was made without triggering any internal alarm. The scheme was ultimately detected not through the functioning of Torchlight's internal controls framework but through an anonymous whistleblower complaint submitted through the third-party ethics hotline. While the existence and accessibility of a whistleblower mechanism is itself a positive compliance feature, the fact that the company's internal controls failed to detect the scheme independently — and that detection required an external tip — demonstrates that the controls were insufficient to "provide reasonable assurances" as required by the statute.
F. Failure to Reconcile Asset Accountability
The investigation has also identified failures related to the fourth category of required controls under Section 13(b)(2)(B)(iv) — the requirement that the recorded accountability for assets be compared with existing assets at reasonable intervals.
Consultant Payment Reconciliation. No evidence has been found that TGH or TGM conducted periodic reconciliation of actual consultant payments against contractual terms. As noted above, such a reconciliation would have identified the $1,170,000 contractual overage on the Crestfield engagement, which grew steadily over five years. The absence of this basic reconciliation control allowed the excess payments to continue without detection.
Community Relations Expense Verification. No evidence has been found that TGM compared the recorded "community relations expenses" booked under GL 7450 with actual community development outcomes, projects, or beneficiaries. A basic reconciliation exercise — comparing the funds recorded as expended on community relations with tangible evidence of community benefit — would have revealed that substantial portions of the GL 7450 expenditures could not be linked to any identifiable community project or initiative. This type of reconciliation is a straightforward control that should have been in place for a category of expenditure that totaled $890,000 over five years.
Section 13(b)(2)(B)(iv) Analysis. These failures directly implicate the statutory requirement to compare "recorded accountability for assets" with "existing assets at reasonable intervals and [take] appropriate action with respect to any differences." The absence of periodic reconciliation allowed discrepancies to accumulate undetected and denied Torchlight the ability to identify and investigate the diversion of company assets.
G. Summary of Internal Controls Failures
In summary, the investigation has identified at least six distinct categories of internal controls failures, spanning all four subsections of Section 13(b)(2)(B):
1. Systematic override of dual-approval requirements (14 of 24 Crestfield invoices approved by a single individual in violation of the Delegation of Authority Policy) — implicating § 13(b)(2)(B)(i).
2. Complete absence of third-party due diligence on Crestfield Advisory Partners Ltd., a high-risk intermediary engaged to perform government-facing services in a high-risk jurisdiction — implicating § 13(b)(2)(B)(i) and (ii).
3. Failure to detect contractual overpayments of $1,170,000 (57% above the contractual maximum) over a five-year period — implicating § 13(b)(2)(B)(ii).
4. Inadequate controls over cash disbursements, including the use of a catch-all general ledger code with no documentation requirements for nearly $900,000 in cash payments — implicating § 13(b)(2)(B)(iii).
5. Failure of supervisory and monitoring controls, including the absence of periodic compliance reviews, the failure to identify timing correlations between intermediary payments and permit issuances, the failure to detect the use of personal email for company business, and the five-year duration of the scheme without detection — implicating § 13(b)(2)(B)(i) through (iv).
6. Failure to reconcile asset records with actual dispositions, including the absence of contract-to-payment reconciliation and the absence of verification of community relations expenditures against actual outcomes — implicating § 13(b)(2)(B)(iv).
These failures are not isolated or technical in nature. They are systemic, overlapping, and mutually reinforcing. Taken together, they demonstrate that Torchlight's system of internal accounting controls was fundamentally insufficient to prevent or detect the diversion of company assets to government officials over an extended period. The SEC is likely to view the breadth, depth, and duration of these failures as strong evidence of a violation of Section 13(b)(2)(B).
V. Potential Individual Liability
The books and records and internal controls provisions of the FCPA can give rise to individual liability in addition to entity-level liability. Two provisions are particularly relevant.
Section 13(b)(5) of the Exchange Act. Section 13(b)(5), codified at 15 U.S.C. § 78m(b)(5), provides that no person shall knowingly circumvent or knowingly fail to implement a system of internal accounting controls, or knowingly falsify any book, record, or account described in Section 13(b)(2). Unlike the entity-level provisions, Section 13(b)(5) requires proof of scienter — the SEC or DOJ must demonstrate that the individual acted "knowingly." However, the scienter requirement is satisfied by a showing that the individual was aware of the circumvention or falsification; proof of corrupt motive is not required.
SEC Rule 13b2-1. Rule 13b2-1, promulgated under the Exchange Act, provides that no person shall, directly or indirectly, falsify or cause to be falsified any book, record, or account subject to Section 13(b)(2)(A). Rule 13b2-1 does not require proof of scienter; negligent or even innocent falsification can give rise to liability. This rule significantly broadens the potential scope of individual liability for books and records violations.
The investigation has identified three individuals with potential individual exposure under these provisions:
Marcus Delacroix (former VP, Africa Operations). Delacroix resigned from Torchlight on November 15, 2024, approximately three months after the whistleblower complaint was received and shortly after being informed of the internal investigation. Delacroix personally introduced Jean-Philippe Renard to Torchlight and is believed, based on evidence developed to date, to have directed or at minimum facilitated the payment scheme. The 37 identified personal-email communications between Delacroix and Renard — which were not captured in Torchlight's corporate email system and which Delacroix did not disclose — suggest a deliberate effort to conceal the true nature of the Crestfield relationship. Delacroix is currently represented by Helen Whitmore of Whitmore & Sharpe LLP, Washington, D.C. Through counsel, Delacroix declined a voluntary interview request on April 2, 2025, with Whitmore citing Fifth Amendment concerns. The refusal to cooperate, while well within Delacroix's rights, limits our ability to assess the full scope of his involvement and knowledge.
Raymond Osei-Bonsu (former Country Manager, TGM). Osei-Bonsu was terminated by Torchlight on January 8, 2025, following preliminary findings of the internal investigation. As the sole approver of 14 Crestfield invoices exceeding the $50,000 dual-approval threshold, Osei-Bonsu systematically overrode the Delegation of Authority Policy. He also directed Thomas Achebe, the TGM Finance Director, to use GL 7450 as a catch-all code for cash disbursements, thereby facilitating the mischaracterization of those payments in TGM's books and records. Osei-Bonsu is currently represented by Barrister Emeka Okoro of Okoro Law Chambers in Ganara. The extent of Osei-Bonsu's knowledge of the ultimate disposition of the Crestfield payments and GL 7450 disbursements remains under investigation.
Jean-Philippe Renard (sole owner, Crestfield Advisory Partners Ltd.). Renard served as the conduit through which the majority of the suspected improper payments were funneled. As the sole owner and only identified principal of Crestfield, Renard had direct knowledge of, and exercised control over, the disposition of the $3,210,000 in payments received by Crestfield from TGH. The forensic evidence indicates that Renard directed or facilitated the transfer of approximately $2,410,000 from Crestfield's accounts to Ganaran government officials. Renard is a French citizen based in Dakar, Senegal, which may present practical challenges to enforcement depending on the available jurisdictional bases and treaty obligations.
Current Torchlight Officers. The potential exposure of current Torchlight officers, including Diane Fournier (VP Finance) and Nadia Berenson (VP Compliance and Ethics, appointed 2021), requires further assessment. Based on the evidence developed to date, the conduct of these individuals appears more consistent with supervisory failures — failures to detect, inquire, or escalate — than with knowing participation in the scheme. Fournier's April 8, 2025 interview statements, in which she indicated a lack of awareness of the contractual overage and a reliance on regional management for expenditure oversight, are broadly consistent with a negligence or supervisory-failure theory rather than a knowing-circumvention theory. However, this preliminary assessment may change as additional witness interviews and document review are completed. We recommend that the question of individual exposure for current officers be revisited upon completion of the second wave of witness interviews and Pinnacle's full forensic review.
VI. Quantification of Potential SEC Exposure on Books-and-Records/Internal Controls Charges
Based on the foregoing analysis, we set forth below a preliminary quantification of Torchlight's potential financial exposure in connection with SEC enforcement of the FCPA's accounting provisions. This quantification is necessarily approximate and is subject to revision as the investigation progresses and as additional information becomes available regarding the SEC's enforcement posture.
Disgorgement. The SEC may seek disgorgement of the full $4,730,000 in suspected improper payments, on the theory that these amounts constitute ill-gotten gains derived from the mining permits and environmental approvals that Torchlight improperly obtained or expedited through the payment scheme. The SEC's disgorgement theory i

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT

MEMORANDUM

MATTER NO.: 1039-00005

Record

Parties

Dates

Amounts