PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT PREPARED AT THE DIRECTION OF COUNSEL — DO NOT DISTRIBUTE WITHOUT AUTHORIZATION
CALDERWOOD & HARKNESS LLP 825 Eighth Avenue, 42nd Floor New York, New York 10019
MEMORANDUM
May 12, 2025
TO:
Patricia Sung, General Counsel & Corporate Secretary, Torchlight Mining Corp. Dr. Eleanor Fiske, Chair, Audit Committee, Torchlight Mining Corp. Warren Ogilvy, Member, Audit Committee, Torchlight Mining Corp. Marguerite Chen, Member, Audit Committee, Torchlight Mining Corp.
FROM:
Conrad Ashby, Responsible Partner, White Collar & Investigations Practice, Calderwood & Harkness LLP Steven Hollander, Lead Associate, White Collar & Investigations Practice, Calderwood & Harkness LLP
RE:
Remediation Recommendations — Anti-Corruption Compliance Program Enhancements
MATTER NO.: 1039-00005
Right-click to update Table of Contents
I. Executive Summary
The purpose of this memorandum is to set forth Calderwood & Harkness LLP's specific remediation recommendations arising from the ongoing internal investigation into potential violations of the Foreign Corrupt Practices Act of 1977, as amended (the "FCPA"), in connection with Torchlight Mining Corp.'s ("Torchlight" or the "Company") operations in the Republic of Ganara. These recommendations are intended to address the compliance program deficiencies identified during the course of the investigation and to position the Company for the most favorable outcome in any resolution with the United States Department of Justice ("DOJ") Fraud Section (FCPA Unit) and the United States Securities and Exchange Commission ("SEC") Division of Enforcement.
The internal investigation was opened on March 5, 2025, following the Audit Committee's authorization of a full-scope investigation by outside counsel. Calderwood & Harkness's engagement was formalized on the same date pursuant to an engagement letter executed by Dr. Eleanor Fiske on behalf of the Audit Committee. Forensic accounting support is being provided by Pinnacle Forensic Advisory LLC, under the direction of Dr. Leonard Strauss, engagement partner. To date, forensic accounting work has included the tracing of wire transfers, analysis of general ledger entries, and reconstruction of cash withdrawal records from Torchlight Ganara Mining S.A. ("TGM") local bank accounts.
Two waves of witness interviews have been completed. The first wave took place from April 7 through April 11, 2025, in Toronto, Ontario, and included interviews of seven current and former Torchlight headquarters personnel. The second wave was conducted via secure video conference from April 28 through May 2, 2025, with eight current and former TGM personnel based in the Republic of Ganara. Additional interviews are planned for the coming weeks and will be addressed in our interim investigation report to the Audit Committee, which is targeted for delivery on May 15, 2025.
This memorandum provides advance remediation recommendations in order to facilitate timely implementation. The Audit Committee and the General Counsel should not delay the commencement of remediation activities pending completion of the full investigation. Both the DOJ and the SEC evaluate the timeliness and comprehensiveness of remedial measures as a critical factor in resolution negotiations, and early action will inure to the Company's benefit.
The core findings driving the recommendations set forth herein can be summarized as follows: Calderwood & Harkness's investigation has identified approximately $4,730,000 in suspected improper payments made between 2019 and 2024 through the Company's wholly owned subsidiaries, Torchlight Ganara Holdings Ltd. ("TGH"), a British Virgin Islands holding company, and TGM, a Ganaran operating subsidiary. These payments were directed to government officials and intermediaries in the Republic of Ganara in connection with the procurement and maintenance of mining permits and environmental approvals. The payments were routed primarily through a Mauritius-incorporated consulting firm, Crestfield Advisory Partners Ltd. ("Crestfield"), and supplemented by direct cash withdrawals and in-kind benefits from TGM local accounts.
We note at the outset that robust remediation is a critical factor under the DOJ's revised Corporate Enforcement Policy ("CEP") for voluntary self-disclosure credit, and it will be closely scrutinized in any eventual resolution with the DOJ Fraud Section (FCPA Unit) and the SEC Division of Enforcement (File No. HO-14892). The DOJ's CEP expressly provides that, in evaluating whether to grant the full benefits of voluntary self-disclosure, prosecutors should assess whether a company has taken "timely and appropriate remediation." The SEC's Division of Enforcement applies similar principles in assessing cooperation credit under the Seaboard Report framework. The total government exposure range of $14.19 million to $19.63 million — encompassing potential criminal fines, civil penalties, disgorgement, and prejudgment interest — underscores the importance of demonstrating genuine, comprehensive remediation to both agencies.
The recommendations contained in this memorandum are organized into eight categories, as follows:
1. Enhanced Third-Party Due Diligence Procedures
2. Revised Delegation of Authority Policy
3. Mandatory FCPA and Anti-Corruption Training
4. Audit Rights in All Agent and Consultant Agreements
5. Enhanced Financial Controls and Monitoring
6. Strengthened Whistleblower and Reporting Mechanisms
7. Personnel Accountability and Disciplinary Framework
8. Engagement of an Independent Compliance Monitor
Each recommendation is discussed in detail below, including an assessment of the current state, specific remediation measures, and a proposed implementation timeline. A summary table of all recommendations, including priority levels, responsible parties, and estimated timelines and costs, is provided in Section XII of this memorandum.
II. Background and Investigation Findings Relevant to Remediation
Before setting forth the specific recommendations, it is necessary to summarize the investigation findings that inform and drive the remediation measures proposed herein. A detailed recitation of the evidence and its analysis will be provided in the interim investigation report to the Audit Committee dated May 15, 2025. The following summary is intended only to provide context for the remediation recommendations.
A. Overview of the Alleged Scheme
The suspected improper payments at issue in this investigation were made through two principal channels: (1) payments to Crestfield Advisory Partners Ltd., a Mauritius-incorporated consulting firm, and (2) direct payments and in-kind benefits from TGM local accounts.
Crestfield Advisory Partners Ltd. Crestfield was retained by TGH under a Government Relations Advisory Agreement dated April 12, 2019 (the "Crestfield Agreement"). Crestfield is a Mauritius-incorporated entity whose sole owner and sole employee is Jean-Philippe Renard, a French-Mauritanian national and former diplomatic attaché with longstanding connections to senior officials in the Republic of Ganara. The Crestfield Agreement was introduced and facilitated by Marcus Delacroix, then Vice President of Africa Operations for Torchlight, who had a pre-existing personal relationship with Renard.
Between 2019 and 2024, TGH made total payments to Crestfield of $3,210,000 across twenty-four (24) invoices. Based on forensic accounting analysis by Pinnacle Forensic Advisory LLC, including the tracing of wire transfers from TGH's account at Meridian Commercial Bank (BVI), Account No. 7740-2281-0056, to Crestfield's accounts and subsequently to accounts associated with Ganaran officials and their family members, Calderwood & Harkness estimates that approximately $2,410,000 — or approximately 75% of the total payments — was ultimately diverted to Ganaran government officials. The remaining funds appear to have been retained by Renard as his fee or were used for expenses whose legitimacy has not been established.
Direct Payments from TGM Local Accounts. In addition to the Crestfield payments, the investigation has identified $890,000 in cash withdrawals from TGM's account at Regency International Bank (Ganara), Account No. GAN-4419-8837, booked under general ledger code 7450 ("Community Relations Expenses") over the period 2019–2024. These cash withdrawals were directed by Raymond Osei-Bonsu, then Country Manager of TGM, and were supported by minimal documentation. Forensic analysis of available records, together with witness testimony from TGM finance and accounting staff, indicates that a significant portion of these funds was disbursed to government officials in connection with permitting activities.
Furthermore, the investigation has identified approximately $630,000 in in-kind benefits provided to government officials, including the purchase of vehicles and the provision of international travel, booked under general ledger codes 7200 ("Transportation and Logistics") and 7310 ("Travel and Accommodation"). These in-kind benefits were procured through TGM's procurement function and were arranged by Kwame Mensah, TGM's Procurement Manager, at the direction of Osei-Bonsu.
Total Suspected Improper Payments. The total value of suspected improper payments is approximately $4,730,000, comprising $2,410,000 in diverted Crestfield payments, $890,000 in cash withdrawals, and $630,000 in in-kind benefits, plus approximately $800,000 in Crestfield payments whose ultimate disposition remains under investigation.
Mining Permits at Issue. The suspected improper payments were made in connection with the procurement, renewal, or expansion of five mining permits and environmental approvals in the Republic of Ganara:
(a) Kousseri Mining License (Permit No. KCC-2019-0047), issued July 15, 2019;
(b) Kousseri Environmental Impact Approval (Permit No. ENV-KCC-2020-113), issued March 22, 2020;
(c) Dembélé Exploration License (Permit No. DRE-2021-0092), issued September 8, 2021;
(d) Dembélé Mining License Upgrade (Permit No. DRE-M-2023-0018), issued February 14, 2023; and
(e) Kousseri Expansion Permit (Permit No. KCC-2019-0047-A1), issued November 3, 2023.
Alleged Recipients. Based on the forensic evidence gathered to date, the alleged recipients of the improper payments include the following individuals:
(a) The Honorable Boubacar Diallo, Minister of Mines and Natural Resources, Republic of Ganara — approximately $1,850,000;
(b) Amadou Traoré, Director of Licensing and Permits, Ministry of Mines and Natural Resources — approximately $620,000;
(c) Colonel Ibrahim Konaté, Commandant, Kousseri Regional Gendarmerie — approximately $340,000; and
(d) Other and unidentified government officials and intermediaries — approximately $1,920,000.
The amounts attributed to individual recipients are preliminary estimates based on forensic analysis and witness testimony and are subject to revision as the investigation continues.
B. Key Subjects and Personnel Actions Taken
Two individuals have been identified as primary subjects of the investigation, and personnel actions have been taken with respect to each.
Marcus Delacroix, Former Vice President, Africa Operations. Delacroix resigned from Torchlight effective November 15, 2024, following the commencement of the Audit Committee's preliminary internal review of the whistleblower complaint. Delacroix personally introduced Renard to TGH and played a central role in the negotiation and execution of the Crestfield Agreement. Notably, Delacroix used his personal (non-company) email account in at least thirty-seven (37) identified communications with Renard, in apparent violation of Torchlight's Information Security and Communications Policy. This use of personal email effectively circumvented the Company's email monitoring and document retention systems. Delacroix is currently residing in Lyon, France, at 47 Rue de la République, 69002 Lyon. He is represented by Whitmore & Sharpe LLP, London (Helen Whitmore, lead partner). Through his counsel, Delacroix has declined a voluntary interview, citing potential criminal exposure in the United States, Canada, and France.
Raymond Osei-Bonsu, Former Country Manager, TGM. Osei-Bonsu's employment with TGM was terminated effective January 8, 2025, following an initial review of invoice approval records. Osei-Bonsu personally approved fourteen (14) of the twenty-four (24) Crestfield invoices that exceeded the $50,000 single-approval threshold under Torchlight's Delegation of Authority Policy, without obtaining required secondary authorization. Osei-Bonsu also directed the general ledger coding for cash withdrawals under GL 7450 and approved the procurement of vehicles and travel subsequently provided to government officials. Osei-Bonsu is represented by Okoro Law Chambers, Accra, Ghana (Barrister Emeka Okoro, lead counsel).
C. Summary of Compliance Program Deficiencies Identified
Calderwood & Harkness's April 15, 2025 memorandum assessed Torchlight's anti-corruption compliance program against the framework set forth in the DOJ Criminal Division's "Evaluation of Corporate Compliance Programs" guidance (last updated September 2024) and the SEC's related enforcement guidance. That assessment identified significant structural and operational deficiencies in the Company's compliance program, many of which directly enabled or failed to detect the misconduct at issue.
In addition, Calderwood & Harkness's March 28, 2025 red-flag summary memorandum identified nine discrete red flags that should have been detected by a reasonably effective compliance program. Upon further analysis, we have identified an additional deficiency, bringing the total to ten key deficiencies that serve as the foundation for the remediation recommendations in this memorandum. These deficiencies are summarized as follows:
1. No Due Diligence on Crestfield. There was no due diligence file on Crestfield anywhere in Torchlight's compliance records. There was no competitive selection process for Crestfield's engagement. No background check, adverse media screening, beneficial ownership verification, or assessment of business legitimacy was conducted prior to or at any time during the engagement.
2. Contractual Overages. Crestfield invoices exceeded the contractual maximum of $2,040,000 under the Crestfield Agreement by $1,170,000 without any contract amendment, addendum, or formal authorization for the overage.
3. Approval Threshold Violations. Fourteen of twenty-four Crestfield invoices exceeded the $50,000 single-approval threshold under Torchlight's Delegation of Authority Policy, yet each was approved solely by Osei-Bonsu without the required secondary authorization.
4. Vague General Ledger Coding. Cash withdrawals totaling $890,000 were booked under the vague and generic GL code 7450 — "Community Relations Expenses" — which did not require specification of recipients, purposes, or business justifications.
5. No Audit Rights Clause. The Crestfield Agreement contained no audit rights clause, depriving Torchlight of the contractual ability to audit Crestfield's books, records, or use of funds.
6. Generic Anti-Corruption Representations. The anti-corruption representations in the Crestfield Agreement (Clause 9.2) referenced "all applicable anti-corruption laws" in generic terms but contained no specific reference to the FCPA, the Canadian Corruption of Foreign Public Officials Act ("CFPOA"), or the UK Bribery Act 2010, and imposed no affirmative compliance obligations on Crestfield.
7. Timing Correlation Undetected. Forensic analysis revealed a significant temporal correlation between Crestfield invoices and the issuance of mining permits: in each instance, Crestfield invoices spiked within thirty to sixty days preceding or immediately following permit issuances. This pattern was not detected by Torchlight's finance or compliance functions at any point during the five-year engagement.
8. Use of Personal Email Not Flagged. Delacroix's use of personal (non-company) email for thirty-seven identified business communications with Renard was not flagged by Torchlight's information security or compliance monitoring systems.
9. Training Gaps. Anti-corruption training records for West African operations personnel were incomplete. Key personnel in government-facing roles had not received specialized FCPA or anti-corruption training beyond initial onboarding modules.
10. Inadequate Gift and Hospitality Tracking. Torchlight lacked a centralized gift and hospitality tracking system capable of aggregating and monitoring the value of benefits provided to government officials across its subsidiaries.
These ten deficiencies form the basis for the eight categories of remediation recommendations that follow.
III. Remediation Recommendation 1: Enhanced Third-Party Due Diligence Procedures
A. Current State Assessment
Torchlight does not currently maintain a formal, standalone third-party due diligence policy applicable to agents, consultants, or intermediaries engaged in government-facing roles. While the Company's Code of Business Conduct and Ethics contains a general provision requiring that "all business relationships be conducted in compliance with applicable laws and Company policies," this general statement does not translate into any operationalized procedure for conducting due diligence on third parties prior to engagement or on a recurring basis.
The engagement of Crestfield Advisory Partners Ltd. exemplifies the consequences of this deficiency. Crestfield was engaged in April 2019 without any background check, adverse media screening, or verification of business legitimacy. No due diligence file on Crestfield exists in Torchlight's compliance records, and no competitive selection process was conducted. The engagement was initiated through Delacroix's personal introduction of Renard to TGH, and the Crestfield Agreement was executed without any compliance department review or input.
Crestfield presented numerous characteristics that, under any reasonably designed due diligence process, should have raised significant red flags: the entity had no website, no employees other than Renard, and was registered at a registered-agent office address in Port Louis, Mauritius. Renard, the sole beneficial owner, was a former diplomatic attaché with personal connections to senior government officials in the Republic of Ganara. These characteristics are precisely the type of indicators that third-party due diligence processes are designed to identify and escalate.
B. Recommended Enhancements
Calderwood & Harkness recommends that Torchlight adopt a formal Third-Party Due Diligence Policy (the "TDD Policy") applicable to all agents, consultants, intermediaries, and joint venture partners engaged globally. The TDD Policy should incorporate the following elements:
Tiered Risk Assessment Framework. The TDD Policy should establish a tiered risk assessment framework with three levels of due diligence — standard, enhanced, and heightened — calibrated to the corruption risk profile of the engagement. Risk indicators to be considered in the tier assignment include, but should not be limited to: the country risk rating of the jurisdiction in which the third party will operate (as measured by the Transparency International Corruption Perceptions Index ("CPI") and other recognized indices); the nature of the services to be provided; the extent of government touchpoints involved in the engagement; the compensation structure (e.g., success fees, retainers, commissions); and the third party's corporate structure, ownership, and history.
Required Due Diligence Elements for All Tiers. At a minimum, all third-party engagements, regardless of tier, should be subject to the following due diligence procedures:
(a) Identity verification of the entity and its principals;
(b) Beneficial ownership disclosure and verification;
(c) Adverse media screening using a recognized third-party screening provider;
(d) Sanctions screening against all applicable lists, including OFAC, EU, UN, and BIS;
(e) Reference checks with at least two independent business references; and
(f) Completion of a standardized due diligence questionnaire, to be signed under penalty of perjury or local equivalent by an authorized representative of the third party.
For engagements classified as enhanced or heightened risk, additional due diligence elements should include in-person or virtual site visits to the third party's offices, interviews with the third party's principals, review of the third party's financial statements and tax filings (where available), and engagement of a specialist investigative firm for background reports.
Heightened Due Diligence Triggers. The following categories of engagements should automatically trigger the heightened due diligence tier:
(a) Any intermediary providing government relations, permitting, licensing, or regulatory advocacy services;
(b) Any intermediary operating in, or providing services in connection with, a country with a Transparency International CPI score below 40 (the Republic of Ganara's current CPI score is 29);
(c) Any intermediary whose principals, beneficial owners, or key personnel are current or former government officials or have familial or close personal relationships with government officials; and
(d) Any intermediary proposed or introduced by a single individual within the Company without independent sourcing.
Centralized Repository and Compliance Oversight. All due diligence files are to be maintained by the VP Compliance and Ethics (currently Nadia Berenson) in a centralized, searchable repository. No third-party engagement agreement may be executed without a completed and approved due diligence file. The VP Compliance and Ethics, or her designee, must provide written sign-off on the due diligence file before the engagement proceeds.
Annual Re-Certification. All active third-party engagements must be subject to annual re-certification, including refreshed due diligence screening (at minimum, updated adverse media and sanctions screening, and updated beneficial ownership disclosure). Any material changes in the third party's ownership, personnel, or risk profile identified during re-certification must trigger a full enhanced or heightened due diligence review.
Mandatory Compliance Sign-Off Before Payment. No payment to any third party may be processed by the finance function without confirmation that the third party has a current, approved due diligence file on record with the VP Compliance and Ethics. This control should be implemented both as a policy requirement and as a system-level control in Torchlight's enterprise resource planning ("ERP") and accounting systems.
Prohibition on Unvetted Introductions. No third party may be engaged solely on the basis of an introduction by individual business-unit personnel without independent compliance vetting. This provision is specifically designed to address the engagement pathway that led to the Crestfield relationship, in which Delacroix personally introduced Renard to TGH without any compliance department involvement or oversight.
C. Implementation Timeline
Calderwood & Harkness recommends the following implementation timeline for the enhanced third-party due diligence procedures:
• Policy drafting: Within 30 days of Audit Committee approval of these recommendations. Calderwood & Harkness will prepare an initial draft of the TDD Policy in coordination with the General Counsel's office and VP Compliance and Ethics.
• Rollout and training: Within 60 days of formal policy adoption. Training should be provided to all personnel involved in the sourcing, selection, approval, and management of third-party relationships, including procurement, business development, operations, finance, and legal personnel.
• Retroactive due diligence on all existing third parties: Within 120 days of policy adoption. All currently active third-party agents, consultants, and intermediaries globally must be subjected to due diligence under the new TDD Policy. Any third party that fails to cooperate with the due diligence process or whose due diligence review identifies unresolved red flags should be placed on a watch list for potential termination.
IV. Remediation Recommendation 2: Revised Delegation of Authority Policy
A. Current State Assessment
Torchlight's existing Delegation of Authority Policy (the "DOA Policy"), last revised in March 2018, sets a single-approval threshold of $50,000 for payments to third-party consultants. Under this policy, any invoice from a consultant or agent in an amount equal to or less than $50,000 may be approved by a single authorized manager, while invoices exceeding $50,000 require dual authorization — one from the relevant business-unit manager and one from a finance officer at the regional or headquarters level.
Despite this requirement, fourteen of the twenty-four Crestfield invoices — ranging in amount from $55,000 to $185,000 — were approved solely by Osei-Bonsu, the TGM Country Manager, without obtaining the required secondary authorization from regional or headquarters finance. These approvals were in direct violation of the DOA Policy.
Critically, there was no systematic compliance review mechanism in place to flag or escalate DOA Policy breaches in the invoice approval chain. The Torchlight finance function processed invoices based on the approval signatures presented, without an independent verification layer to confirm that the required number and level of approvals had been obtained. Thomas Achebe, TGM's Finance Director, processed the invoices on Osei-Bonsu's sole authority without escalation to the VP Finance at headquarters (Diane Fournier) or to the compliance function. When interviewed, Achebe stated that he relied on Osei-Bonsu's representation that the invoices had been "reviewed at the regional level," a claim that our investigation has found to be false.
B. Recommended Revisions
Calderwood & Harkness recommends the following revisions to the DOA Policy:
Lowered Single-Approval Threshold. The single-approval threshold for all payments to government-relations agents, consultants, intermediaries, and any third party providing services that involve interaction with government officials should be reduced from $50,000 to $25,000. This lower threshold reflects the heightened corruption risk associated with these categories of payments and is consistent with best practices observed in the extractive industries.
Dual Approval Requirement. All payments to agents, consultants, and intermediaries exceeding $25,000 should require dual approval: one approval from the relevant local or business-unit manager, and one approval from a regional or headquarters-level finance officer. The secondary approval authority should be vested in the VP Finance (currently Diane Fournier) or a formally designated delegate who reports directly to the VP Finance. The secondary approver must be independent of the business unit requesting the payment.
Mandatory Compliance Review. All payments to intermediaries exceeding $50,000, regardless of the number and level of management approvals obtained, must be submitted to the VP Compliance and Ethics for review prior to processing. This compliance review serves as an additional safeguard independent of the business-unit and finance approval chain.
Quarterly Reconciliation. The finance function at headquarters must perform a quarterly reconciliation of all consultant and agent payments against the terms of the applicable contracts, with an automatic flag for any payments that, individually or in the aggregate, exceed contractual maximums. This reconciliation would have identified the $1,170,000 overage on the Crestfield Agreement had it been in place during the relevant period.
System-Level Controls. Torchlight's ERP and accounting software must be configured to prevent the processing of payments that lack the required number and level of approvals. The system should reject any payment request for which the required dual approval is not documented in the system, and should generate an automatic alert to the VP Compliance and Ethics when a payment request is submitted that exceeds applicable thresholds without the requisite approvals.
Anti-Splitting Provision. The revised DOA Policy must include an express prohibition on the splitting of invoices or payment requests to circumvent approval thresholds. Any pattern of invoice amounts designed to remain just below the applicable threshold should be treated as a compliance violation and escalated accordingly.
Communication to Subsidiary-Level Finance Personnel. All revisions to the DOA Policy must be documented in writing and communicated to subsidiary-level finance personnel, including the TGM Finance Director and all subsidiary-level accounting staff. Acknowledgment of receipt and understanding should be required from all personnel with payment approval or processing responsibilities.
C. Implementation Timeline
• Policy revision: Within 30 days of Audit Committee approval.
• ERP system configuration: Within 60 days of policy revision. Calderwood & Harkness recommends that Torchlight's IT department, in coordination with the VP Finance and VP Compliance and Ethics, implement the system-level controls described above within this timeframe. If third-party ERP consultants are required, engagement should be initiated immediately.
• Training and rollout: Within 90 days of policy revision. All personnel with invoice approval or payment processing responsibilities should receive training on the revised DOA Policy, including the specific circumstances that led to the current investigation.
V. Remediation Recommendation 3: Mandatory FCPA and Anti-Corruption Training
A. Current State Assessment
Torchlight's current anti-corruption training program for its West African operations has been found to contain significant gaps. Training records for TGM personnel are incomplete, and there is no evidence that in-person or tailored anti-corruption training was ever delivered to Ganaran-based employees in government-facing roles. The Company's primary training vehicle is a generic annual online anti-corruption module deployed company-wide through Torchlight's learning management system. While this module provides a general overview of anti-corruption principles, it is not adapted to the local risk environment in the Republic of Ganara and does not address the specific scenarios, red flags, and compliance challenges that employees in high-risk jurisdictions are likely to encounter.
With respect to the individuals at the center of the current investigation, the training record is particularly deficient. Delacroix and Osei-Bonsu received only initial onboarding compliance training at the time of their respective hirings; there is no documentation of any refresher or specialized FCPA training for either individual during the period 2019–2024. Kwame Mensah, the TGM Procurement Manager who facilitated the procurement of vehicles and travel arrangements provided as in-kind benefits to government officials, including Colonel Ibrahim Konaté, had no documented training whatsoever on gifts, hospitality, or anti-bribery protocols.
The DOJ's "Evaluation of Corporate Compliance Programs" guidance emphasizes that an effective compliance program includes "risk-based training" that is "tailored to the audience" and "updated to account for new and changing risks." Torchlight's training program, as currently constituted, falls materially short of this standard.
B. Recommended Training Program
Calderwood & Harkness recommends that Torchlight implement a comprehensive, risk-based FCPA and anti-corruption training program incorporating the following elements:
Annual Mandatory Training — Global. All Torchlight employees globally, regardless of function or location, should receive annual anti-corruption training. The training content should cover, at a minimum, the FCPA's anti-bribery and books-and-records provisions, the Company's anti-corruption policies and Code of Business Conduct and Ethics, and the consequences of non-compliance, including individual criminal liability.
Enhanced Modules for High-Risk Jurisdictions. Employees located in or responsible for operations in high-risk jurisdictions — including, without limitation, the Republic of Ganara — should receive enhanced training modules specifically tailored to the local risk environment. These modules should address jurisdiction-specific corruption risks, common corruption schemes in the extractive industries, and the specific lessons learned from the current investigation (to the extent appropriate and consistent with privilege considerations).
Targeted, Role-Specific Training. In addition to the general annual training, the following categories of personnel should receive targeted, role-specific training on an annual basis:
(a) All personnel involved in government-facing roles, including those responsible for permitting, regulatory compliance, community relations, and government advocacy;
(b) All finance and accounting personnel at subsidiaries, with particular emphasis on invoice approval procedures, GL coding standards, and the identification of suspicious transaction patterns;
(c) All procurement personnel, with emphasis on gifts, hospitality, and the provision of anything of value to government officials; and
(d) All senior management with oversight responsibility for high-risk jurisdictions, including regional vice presidents, country managers, and their direct reports.
Training Content. The training curriculum should include, at a minimum, the following substantive topics:
(a) The FCPA's anti-bribery provisions (15 U.S.C. §§ 78dd-1 et seq.), including the elements of a violation, the definition of "foreign official," and the scope of prohibited payments;
(b) The FCPA's books-and-records and internal-controls provisions (15 U.S.C. § 78m(b)(2));
(c) Red flags for intermediary corruption, including the specific red flags identified in this investigation (e.g., shell company intermediaries, sole-proprietor consultants with government connections, vague invoicing, temporal correlation between payments and government actions);
(d) Proper protocols for gifts, hospitality, entertainment, and travel involving government officials;
(e) Whistleblower reporting procedures and the Company's non-retaliation policy;
(f) The consequences of non-compliance, including individual criminal and civil liability, disciplinary action, and harm to the Company; and
(g) The Canadian Corruption of Foreign Public Officials Act (CFPOA), to the extent applicable to Torchlight's Canadian-headquartered operations and personnel.
In-Person or Live-Virtual Delivery. Training for the enhanced categories described above must be delivered in person or via live virtual sessions (not pre-recorded webinars or self-paced online modules). Live delivery allows for interactive discussion, scenario-based exercises, and real-time Q&A, all of which significantly enhance training effectiveness and are viewed favorably by the DOJ and SEC.
Local-Language Delivery. Training for Ganaran-based personnel must be delivered in French, the official language of the Republic of Ganara, to ensure comprehension and engagement. Training materials should be professionally translated and reviewed by counsel familiar with the local legal and regulatory environment.
Certification Requirement. All training participants must certify in writing (or electronically) that they have completed the training and understand the Company's anti-corruption policies and their individual compliance obligations. Certifications must be maintained centrally by the VP Compliance and Ethics in a searchable, auditable format.
New-Hire Training. All new employees assigned to high-risk functions or high-risk jurisdictions must receive anti-corruption training within thirty (30) days of their start date. New-hire training should cover the same substantive topics as the annual training and should be followed by the applicable role-specific enhanced module.
Board and Audit Committee Briefing. Members of the Board of Directors and the Audit Committee should receive an annual FCPA and anti-corruption governance briefing, covering the Company's compliance program, investigation trends, enforcement developments, and any compliance incidents or near-misses during the preceding year.
C. Implementation Timeline
• Curriculum development: Within 45 days of Audit Committee approval. Calderwood & Harkness recommends that Torchlight engage a specialized compliance training provider with FCPA and extractive-industry expertise to develop the curriculum, in coordination with the VP Compliance and Ethics and outside counsel.
• Initial rollout to high-risk personnel: Within 90 days of curriculum completion. Priority should be given to all TGM personnel, all personnel in government-facing roles in the Republic of Ganara and other high-risk jurisdictions, and all finance, accounting, and procurement personnel at subsidiaries.
• Full global rollout: Within 120 days of curriculum completion.
• Ongoing: Annual training cycle for all employees. Quarterly training sessions for new hires in high-risk functions. Annual Board and Audit Committee briefing.
VI. Remediation Recommendation 4: Audit Rights in All Agent and Consultant Agreements
A. Current State Assessment
The Government Relations Advisory Agreement between TGH and Crestfield, dated April 12, 2019, contained no audit rights clause. This omission deprived Torchlight of the contractual right to audit Crestfield's books, records, or accounts, and prevented the Company from independently verifying whether payments made to Crestfield were used for legitimate advisory services or were diverted, in whole or in part, to government officials.
The absence of an audit rights clause is a significant deficiency from both a compliance and an enforcement perspective. The DOJ's "Evaluation of Corporate Compliance Programs" guidance specifically identifies the existence of audit rights in third-party agreements as a hallmark of an effective compliance program. The inability to audit Crestfield's use of funds was a direct impediment to the detection and prevention of the suspected improper payments and has complicated the investigation's ability to trace the disposition of all funds paid to Crestfield.
In addition to the absence of audit rights, the anti-corruption representations in the Crestfield Agreement were deficient. Clause 9.2 of the Crestfield Agreement contained a generic representation that Crestfield would comply with "all applicable anti-corruption laws," but did not specifically reference the FCPA, the Canadian CFPOA, or the UK Bribery Act 2010. The clause imposed no affirmative compliance obligations on Crestfield, such as the maintenance of accurate books and records, cooperation with investigations, or certification of compliance upon invoice submission.
Furthermore, the Crestfield Agreement did not provide Torchlight with the right to terminate the agreement immediately upon a breach of anti-corruption representations. Under the agreement's general termination provisions, termination for cause required a thirty-day cure period, which would have been wholly inadequate in the context of a suspected bribery scheme.
B. Recommended Contractual Provisions
Calderwood & Harkness recommends that Torchlight implement the following contractual requirements for all new and renewed agent, consultant, and intermediary agreements:
Unlimited Audit Rights. All agreements must include a clause granting Torchlight the right, at its sole discretion and upon reasonable notice, to audit the books, records, accounts, and financial documentation of the third party, including bank statements, invoices, receipts, and any other records relevant to the engagement. The audit right should extend for a period of not less than three years following the termination or expiration of the agreement.
Specific Anti-Corruption Compliance Representations and Warranties. The agreement must include specific representations and warranties by the third party that it will comply with the FCPA, the CFPOA, and all other applicable anti-corruption laws and regulations. These representations should be detailed, not generic, and should include express acknowledgment by the third party that it understands the prohibitions on payments to foreign government officials and the consequences of violations.
Affirmative Books-and-Records Covenant. The third party must covenant that it will maintain accurate books and records reflecting all transactions, expenditures, and disbursements in connection with the engagement, and that such records will be available for inspection by Torchlight or its designees at all times during the engagement and for three years thereafter.
Immediate Termination Right. Torchlight must have the right to terminate the agreement immediately, without cure period and without liability, upon any breach or suspected breach of the anti-corruption representations and warranties or upon the initiation of any government investigation involving the third party.
Investigation Cooperation Obligation. The third party must agree to cooperate fully with any internal investigation or government inquiry related to the engagement, including by making its personnel, records, and documents available to Torchlight or its counsel upon request.
Invoice-Level Anti-Corruption Certification. Upon submission of each invoice, the third party must certify that all amounts invoiced represent legitimate services rendered, that no portion of the payment has been or will be used to make improper payments to government officials, and that the third party remains in compliance with all anti-corruption representations and warranties in the agreement.
Prohibition on Subcontracting or Assignment. The third party must be prohibited from subcontracting or assigning any portion of the engagement, or engaging any sub-agent or sub-consultant, without the prior written consent of Torchlight and completion of compliance due diligence on the proposed subcontractor or assignee by the VP Compliance and Ethics.
Clawback Provisions. The agreement must include provisions entitling Torchlight to recover (clawback) any payments made to the third party in connection with any conduct that is subsequently determined to constitute a violation of applicable anti-corruption laws or a breach of the agreement's anti-corruption representations and warranties.
Amendment of Existing Agreements. All existing agent, consultant, and intermediary agreements that do not contain these provisions must be amended within ninety (90) days to incorporate them. Any third party that declines to accept the amended terms should be flagged for potential termination of the engagement, and the VP Compliance and Ethics should conduct an immediate risk assessment of the engagement.
Template Agreement. Calderwood & Harkness will prepare a template agent and consultant agreement incorporating all of the provisions described above, in coordination with Patricia Sung's office and the VP Compliance and Ethics (Nadia Berenson). The template will be designed for use across all Torchlight entities globally and will be adaptable to local law requirements in consultation with local counsel.
C. Implementation Timeline
• Template development: Within 30 days of Audit Committee approval. Calderwood & Harkness will deliver a draft template to the General Counsel's office for review and comment.
• Amendment of existing agreements: Within 90 days of template finalization. The VP Compliance and Ethics, in coordination with the General Counsel's office, should conduct an inventory of all active agent, consultant, and intermediary agreements globally and initiate the amendment process.
• Ongoing: All new agreements executed after the adoption of the template must include the standard anti-corruption and audit rights provisions. No exceptions may be approved without the written consent of the General Counsel and the VP Compliance and Ethics.
VII. Remediation Recommendation 5: Enhanced Financial Controls and Monitoring
A. Current State Assessment
The financial controls deficiencies identified in the investigation are among the most significant compliance failures and are directly relevant to potential FCPA books-and-records and internal-controls violations under Section 13(b)(2)(A) and Section 13(b)(2)(B) of the Securities Exchange Act of 1934, as amended.
Vague General Ledger Coding. TGM cash withdrawals totaling $890,000 over the period 2019–2024 were booked under the vague and generic GL code 7450, designated as "Community Relations Expenses." This GL code did not require specification of the identity of the recipient, the purpose of the payment, or the business justification for the expenditure. The use of this code effectively obscured the true nature and destination of the cash withdrawals and prevented both the internal finance function and external auditors from identifying the payments as suspicious.
Inadequate Documentation of In-Kind Benefits. In-kind benefits of $630,000, including the purchase of vehicles and the provision of international travel for government officials, were dispersed across GL codes 7200 ("Transportation and Logistics") and 7310 ("Travel and Accommodation") without adequate documentation of the identity of the beneficiaries, the business purpose of the expenditures, or the relationship between the expenditures and legitimate Company activities.
External Audit Failures. Torchlight's external auditors, Clarendon Group LLP (Alain Beaumont, engagement partner), issued unqualified ("clean") audit opinions on Torchlight's consolidated financial statements for fiscal years 2019 through 2023 without detecting the irregularities described above. While the scope and adequacy of the external audit are beyond the scope of this remediation memorandum, the failure to detect $4.73 million in suspected improper payments over a five-year period raises serious questions about the sufficiency of the audit procedures applied to the West African subsidiary transactions.
FCPA Books-and-Records and Internal-Controls Violations. As discussed in Calderwood & Harkness's April 18, 2025 memorandum, the financial controls deficiencies described above give rise to potential violations of the FCPA's books-and-records provision (Section 13(b)(2)(A)), which requires issuers to make and keep books, records, and accounts which, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the issuer, and the internal-controls provision (Section 13(b)(2)(B)), which requires issuers to devise and maintain a system of internal accounting controls sufficient to provide reasonable assurances that transactions are executed and recorded in conformity with generally accepted accounting principles.
Bank Account Oversight. Payments to Crestfield were made by wire transfer from TGH's account at Meridian Commercial Bank (BVI), Account No. 7740-2281-0056. Cash withdrawals for "community relations expenses" were made from TGM's account at Regency International Bank (Ganara), Account No. GAN-4419-8837. Neither account was subject to secondary review of transactions by headquarters finance personnel. Local management had sole control over transaction activity on both accounts.
B. Recommended Enhancements
Calderwood & Harkness recommends the following enhancements to Torchlight's financial controls and monitoring systems:
GL Code Restructuring. GL code 7450 ("Community Relations Expenses") should be retired or restricted to eliminate its use as a catch-all category for unspecified payments. In its place, Torchlight should implement granular GL codes that require specification of the recipient, the purpose of the expenditure, and the name and title of the approver. Any expenditure classified as a community relations expense should be supported by documentation identifying the specific community, project, or initiative to which the expenditure relates.
Mandatory Supporting Documentation. All payments exceeding $5,000, regardless of GL code, must be supported by the following documentation: original receipts or invoices, identification of the beneficiary (including name, title, and organizational affiliation), a written statement of business purpose signed by the requesting individual, and, where applicable, photographic or other evidence of the goods or services provided. Payments without adequate supporting documentation must not be processed and must be escalated to the VP Compliance and Ethics.
Monthly Bank Account Reconciliation. All subsidiary bank accounts — including, without limitation, the Meridian Commercial Bank (BVI) and Regency International Bank (Ganara) accounts identified above — must be reconciled monthly by the headquarters finance team under the direction of the VP Finance (Diane Fournier). Reconciliation should include comparison of bank statements to GL entries, identification of any unreconciled items, and investigation of any unexplained or undocumented transactions.
Quarterly Forensic Sampling. On a quarterly basis, an independent internal audit function should conduct forensic sampling of subsidiary transactions. The sampling methodology should be risk-based, with a focus on high-risk transaction categories (payments to agents and intermediaries, government-relations expenditures, cash withdrawals, procurement transactions in excess of specified thresholds, and payments to entities in high-risk jurisdictions). The results of each quarterly forensic sampling should be reported to the VP Compliance and Ethics and the Audit Committee.
Automated Transaction Monitoring. Torchlight should implement automated transaction monitoring within its ERP and accounting systems to identify anomalous patterns, including but not limited to: payments made within thirty to sixty days preceding or following permit applications or government approvals; payments to entities in high-risk jurisdictions that exceed specified thresholds; payments that exceed contractual limits; and sequential payments to the same entity in amounts just below approval thresholds (suggestive of invoice splitting).
Cash Withdrawal Controls. All cash withdrawals from subsidiary accounts exceeding $10,000 must require dual authorization — one from local management and one from headquarters finance — and must be accompanied by a compliance notification to the VP Compliance and Ethics. The purpose of this dual authorization requirement is to prevent the type of unilateral cash withdrawals that characterized the TGM "community relations expenses" pattern.
Gift, Hospitality, and Entertainment Log. Torchlight should implement a centralized gift, hospitality, and entertainment ("GHE") log, maintained by the VP Compliance and Ethics, that captures all gifts, meals, entertainment, travel, or other things of value provided to or received from government officials globally. The GHE log should be subject to quarterly review by the VP Compliance and Ethics, with reporting to the Audit Committee on an annual basis or more frequently as circumstances warrant.
Annual GL Code Taxonomy Review. The finance function, in coordination with the VP Compliance and Ethics, should conduct an annual review of the GL code taxonomy to assess its adequacy and clarity and to identify any GL codes that are being used in a manner inconsistent with their intended purpose or that lack sufficient specificity.
C. Coordination with External Auditors
Calderwood & Harkness recommends that the Audit Committee engage directly with Clarendon Group LLP regarding the FY2024 audit, which is currently delayed pending the outcome of the internal investigation. In particular:
(a) The Audit Committee should communicate to Clarendon the enhanced internal controls being implemented as a result of the investigation and should provide Clarendon with sufficient information (consistent with privilege considerations) to enable Clarendon to adjust its audit procedures accordingly.
(b) The Audit Committee should request that Clarendon perform expanded substantive testing of West African subsidiary transactions for FY2024 and on a going-forward basis. This testing should include, at a minimum, testing of a statistically significant sample of payments to agents and intermediaries, testing of cash withdrawal documentation and authorization, and testing of GHE expenditures.
The scope of engagement with Clarendon should be coordinated with Calderwood & Harkness to ensure that privilege and work-product protections are maintained and that disclosures to Clarendon are consistent with the Company's broader investigation and disclosure strategy.
D. Implementation Timeline
• GL code restructuring: Within 45 days of Audit Committee approval.
• ERP system modifications: Within 90 days of Audit Committee approval. This includes the implementation of system-level controls for mandatory documentation, automated transaction monitoring, and dual authorization for cash withdrawals.
• Ongoing monitoring: Continuous from date of implementation. Monthly bank reconciliations, quarterly forensic sampling, and quarterly GHE log reviews should commence immediately upon implementation of the underlying systems and processes.
VIII. Remediation Recommendation 6: Strengthened Whistleblower and Reporting Mechanisms
A. Current State Assessment
Torchlight's third-party ethics hotline, operated by Sentinel Compliance Solutions Inc. ("Sentinel"), received an anonymous whistleblower complaint on August 19, 2024 (Report ID: SCH-2024-08-4417). The complaint alleged that payments were being made to government ministers in the Republic of Ganara through a "fake consulting company in Mauritius." This complaint ultimately served as the catalyst for the preliminary internal review and, subsequently, the formal investigation that is now underway.