ATTORNEY-CLIENT PRIVILEGED AND CONFIDENTIAL ATTORNEY WORK PRODUCT — DO NOT DISTRIBUTE

ATTORNEY-CLIENT PRIVILEGED AND CONFIDENTIAL ATTORNEY WORK PRODUCT — DO NOT DISTRIBUTE
MEMORANDUM
February 10, 2025
FROM: Philip Hartmann, Partner, Calderwood & Harkness LLP
TO: Gregory Nardone, General Counsel & Corporate Secretary, Belmont Ridge Bank National Association Patricia Langston, Chief Compliance Officer, Belmont Ridge Bank National Association
CC: Yuki Nakamura, Associate, Calderwood & Harkness LLP Carlos Espinoza, Associate, Calderwood & Harkness LLP Thomas Ikeda, BSA Officer / AML Program Director, Belmont Ridge Bank National Association
RE: Oversight & Communication Protocol for Independent Consultant Engagement — Thornfield Consulting Group LLC (Engagement Reference: TCG-BRB-2025-001)
MATTER NO.: 1045-00002
PRIVILEGE DESIGNATION: This memorandum was prepared by Calderwood & Harkness LLP in connection with the provision of legal advice to Belmont Ridge Bank National Association and is protected by attorney-client privilege and the work-product doctrine. This memorandum contains confidential attorney work product reflecting the mental impressions, conclusions, opinions, and legal theories of Calderwood & Harkness LLP attorneys. This document should not be disclosed, disseminated, distributed, or copied, in whole or in part, to any person or entity without the prior written authorization of Calderwood & Harkness LLP. Inadvertent disclosure does not constitute a waiver of any applicable privilege or protection.
Right-click to update Table of Contents
I. PURPOSE AND BACKGROUND
A. Purpose of This Memorandum
This memorandum establishes the comprehensive framework for managing the tripartite relationship among Calderwood & Harkness LLP ("C&H"), Belmont Ridge Bank National Association ("BRB" or "Belmont Ridge"), and Thornfield Consulting Group LLC ("Thornfield" or the "Independent Consultant") during the course of the independent consultant engagement mandated by Article VII of Consent Order No. OCC-2025-003 issued by the Office of the Comptroller of the Currency (the "OCC" or the "Comptroller").
The effective coordination of this engagement is critical to the successful resolution of the Consent Order and to the protection of BRB's legal interests throughout the remediation process. To that end, this memorandum is designed to accomplish the following objectives:
1.  Define Communication Channels. This protocol delineates the authorized channels of communication among C&H, BRB, Thornfield, and the OCC, ensuring that all substantive communications related to the engagement are conducted through appropriate pathways and with proper privilege protections in place.
2.  Establish Reporting cadences. This protocol sets forth the schedule and format for regular status reporting by Thornfield, internal strategy discussions between C&H and BRB, and tripartite coordination meetings involving all three parties.
3.  Set Forth Document-Sharing Procedures. This protocol prescribes the method by which Thornfield will request, receive, and handle BRB documents and data, and the process by which Thornfield's deliverables will be reviewed, commented upon, and ultimately submitted to the OCC.
4.  Create Issue Escalation Pathways. This protocol establishes a tiered escalation framework to ensure that issues arising during the engagement—ranging from routine logistical matters to critical findings requiring immediate regulatory notification—are addressed promptly, appropriately, and with due regard for their legal and regulatory significance.
5.  Govern Interactions with the OCC. This protocol coordinates the respective OCC reporting obligations of Thornfield (as independent consultant) and BRB (as the subject institution), ensuring consistency, accuracy, and privilege preservation in all regulatory communications.
This memorandum is intended to ensure the coordinated, privilege-preserving oversight of the Independent Consultant's work throughout the full 12-month engagement period, which is anticipated to run from February 2025 through February 2026. All parties are expected to adhere to the protocols set forth herein, subject to modification only through the amendment procedures described in Section XI.B below.
B. Engagement Context
The Thornfield engagement arises from a significant set of regulatory actions and compliance findings that necessitate a thorough, independent assessment of BRB's Bank Secrecy Act/Anti-Money Laundering ("BSA/AML") and Office of Foreign Assets Control ("OFAC") compliance programs. The following background is essential to understanding the scope and urgency of this engagement.
The Consent Order. On January 15, 2025, the OCC issued Consent Order No. OCC-2025-003 against Belmont Ridge Bank National Association, citing significant deficiencies in BRB's BSA/AML compliance program. The Consent Order identified the following principal areas of concern:
•  Inadequate OFAC Sanctions Screening. The OCC found that BRB's OFAC sanctions screening program was materially deficient, particularly with respect to transactions processed through BRB's Banking-as-a-Service ("BaaS") channel. The Consent Order specifically noted screening gaps in transactions associated with BRB's fintech partners, with an emphasis on the volume of unscreened or inadequately screened transactions.
•  SAR Filing Deficiencies. The OCC identified a significant backlog of unreviewed transaction monitoring alerts, totaling approximately 2,400 alerts as of the examination date. Additionally, the OCC found that BRB's average Suspicious Activity Report ("SAR") filing time had deteriorated to approximately 78 days from the date of initial alert generation, far exceeding both regulatory expectations and BRB's own internal policy targets.
•  CDD/EDD Failures. The OCC determined that BRB had failed to perform adequate Customer Due Diligence ("CDD") and Enhanced Due Diligence ("EDD") on a substantial population of high-risk accounts. Approximately 47,000 accounts were identified as requiring remediation of their CDD/EDD profiles, many of which were associated with customers onboarded through BRB's fintech partnership channels.
•  Transaction Monitoring Model Validation Gaps. The OCC found that BRB's primary transaction monitoring system—Veridian Transaction Monitoring System ("TMS") version 8.3—had not been independently validated since March 2021, a gap of nearly four years. The OCC cited this deficiency as a significant weakness in BRB's ability to detect and report suspicious activity effectively.
•  Board-Level Oversight Deficiencies. The OCC found that BRB's Board of Directors had not maintained adequate oversight of the BSA/AML compliance program, including insufficient reporting to the Board on compliance program performance metrics, inadequate challenge of management representations, and the absence of a dedicated Board-level compliance committee.
The Independent Consultant Requirement. Article VII of the Consent Order requires BRB to engage an independent consultant, acceptable to the OCC, to conduct a comprehensive BSA/AML and OFAC program assessment and to validate BRB's remediation efforts across all deficiency categories identified in the Order. The independent consultant is required to deliver a final validation report to the OCC, and the OCC retains the authority to approve or reject the consultant selected by BRB.
OCC Non-Objection and Engagement Execution. BRB proposed Thornfield Consulting Group LLC as the independent consultant, and the OCC communicated its non-objection to the selection of Thornfield on February 5, 2025. The Independent Consultant Engagement Agreement between BRB and Thornfield was executed on February 10, 2025, under the engagement reference TCG-BRB-2025-001. The financial terms of the engagement are as follows:
•  Fixed engagement fee: $6,500,000, payable in twelve (12) equal monthly installments of $541,666.67 each;
•  Expenses: reimbursable up to a cap of $400,000 for the engagement term;
•  Total engagement cost: $6,900,000.
C&H Engagement. Calderwood & Harkness LLP was engaged by Belmont Ridge Bank National Association on February 10, 2025 as outside regulatory counsel to advise BRB on the BSA/AML and sanctions compliance-program uplift, including the oversight and coordination of the independent consultant relationship with Thornfield, the preparation and submission of OCC-mandated deliverables, and the provision of legal advice on all matters arising from the Consent Order.
Related Documents. This protocol should be read in conjunction with the following documents, each of which governs a distinct but related aspect of the engagement:
•  The Privilege & Confidentiality Side Letter among BRB, C&H, and Thornfield, which establishes the detailed privilege framework, common-interest protections, and confidentiality obligations applicable to information shared during the engagement;
•  The Access & Cooperation Protocol, which governs Thornfield's access to BRB systems, personnel, and records, including the scope of permissible access, scheduling procedures, and information security requirements; and
•  The Independent Consultant Engagement Agreement (TCG-BRB-2025-001), which sets forth the contractual terms of Thornfield's engagement, including scope of work, deliverables, fees, indemnification, and termination provisions.
II. KEY PERSONNEL AND DESIGNATED CONTACTS
The effectiveness of this protocol depends upon clear designation of responsible individuals within each organization. The following individuals are the designated contacts for purposes of this engagement. Unless otherwise specified herein, all communications should be directed to the designated contacts identified below. Changes to designated contacts must be communicated in writing to all parties.
A. Calderwood & Harkness LLP
Primary Contact / Responsible Partner:
Philip Hartmann, Partner Banking & Finance Practice Group Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, NY 10019 Direct: (212) 555-4100
Email: phartmann@calderwoodharkness.com
Mr. Hartmann serves as the lead engagement partner and the primary point of contact for all strategic, legal, and regulatory matters arising from the Thornfield engagement. He chairs the bi-weekly tripartite status calls, approves all OCC-facing correspondence related to Thornfield deliverables, and coordinates with BRB General Counsel on privilege and engagement strategy matters. All Tier 3 escalation issues (as defined in Section V below) are directed to Mr. Hartmann in the first instance.
Lead Associate:
Yuki Nakamura, Associate Litigation (General) Practice Group Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, NY 10019 Direct: (212) 555-4137
Email: ynakamura@calderwoodharkness.com
Ms. Nakamura serves as the day-to-day C&H coordinator for the Thornfield engagement, managing communications with both Thornfield and BRB compliance teams. She is responsible for preparing and circulating agendas for the bi-weekly tripartite calls, serving as the primary drafter of OCC-facing correspondence related to Thornfield deliverables, conducting initial privilege review of documents to be produced to Thornfield, and tracking open items and action items arising from status calls and communications.
Working Associate:
Carlos Espinoza, Associate Litigation (General) Practice Group Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, NY 10019 Direct: (212) 555-4152
Email: cespinoza@calderwoodharkness.com
Mr. Espinoza supports the engagement through document review, workstream tracking, and substantive analysis of Thornfield deliverables. He is also responsible for preparing minutes of the bi-weekly tripartite status calls and maintaining the Document Request Log and Escalation Log described in this protocol.
Billing Partner (Cross-Staffed):
Marcus Delgado, Partner Intellectual Property Practice Group Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, NY 10019 Direct: (212) 555-4089
Email: mdelgado@calderwoodharkness.com
Mr. Delgado is cross-staffed on this matter in a limited advisory capacity. He is involved in BaaS-related aspects of the engagement where fintech patent and licensing compliance issues overlap with the regulatory deficiencies identified in the Consent Order. Mr. Delgado is consulted on an as-needed basis and does not participate in routine engagement communications unless specifically requested.
B. Belmont Ridge Bank National Association
General Counsel (Executive Sponsor):
Gregory Nardone, General Counsel & Corporate Secretary Belmont Ridge Bank National Association 400 Belmont Ridge Parkway, Suite 1200 King of Prussia, PA 19406 Direct: (610) 555-7200
Email: gnardone@belmontridgebank.com
Mr. Nardone serves as the ultimate BRB authority on all privilege matters, OCC engagement strategy, and Consent Order compliance. He is the executive sponsor of the remediation program and approves all external-facing submissions to the OCC and other regulatory bodies. Mr. Nardone's approval is required prior to the transmission of any document to the OCC, the production of any privilege-sensitive document to Thornfield, and the disclosure of any information subject to attorney-client privilege or work-product protection.
Chief Compliance Officer (Day-to-Day BRB Lead):
Patricia Langston, Chief Compliance Officer Belmont Ridge Bank National Association 400 Belmont Ridge Parkway, Suite 1200 King of Prussia, PA 19406 Direct: (610) 555-7235
Email: plangston@belmontridgebank.com
Ms. Langston serves as the primary BRB operational contact for Thornfield and is responsible for coordinating internal data gathering, interview scheduling, and compliance team responses to Thornfield requests. Ms. Langston was appointed to her current position in January 2024 and has led BRB's initial remediation efforts since the OCC's examination findings were communicated. She participates in all bi-weekly tripartite status calls and weekly C&H-BRB internal calls.
BSA Officer / AML Program Director:
Thomas Ikeda, BSA Officer / AML Program Director Belmont Ridge Bank National Association 400 Belmont Ridge Parkway, Suite 1200 King of Prussia, PA 19406 Direct: (610) 555-7248
Email: tikeda@belmontridgebank.com
Mr. Ikeda serves as the primary subject-matter contact for Thornfield on all BSA/AML operational matters, including transaction monitoring, SAR filing, CDD/EDD processes, and OFAC screening. He was appointed to his current position in March 2023. Mr. Ikeda participates in all bi-weekly tripartite status calls and weekly C&H-BRB internal calls and is responsible for coordinating Thornfield's access to BSA/AML operational data and personnel.
Chief Risk Officer:
Melissa Chu, Chief Risk Officer Belmont Ridge Bank National Association 400 Belmont Ridge Parkway, Suite 1200 King of Prussia, PA 19406 Direct: (610) 555-7260
Email: mchu@belmontridgebank.com
Ms. Chu is consulted on risk assessment, model validation, and enterprise risk management aspects of Thornfield's assessment. She participates in tripartite calls on an as-needed basis when agenda items relate to her areas of responsibility.
Head of Fintech Partnerships / BaaS Division:
Warren Ashby, Head of Fintech Partnerships / BaaS Division Belmont Ridge Bank National Association 400 Belmont Ridge Parkway, Suite 1200 King of Prussia, PA 19406 Direct: (610) 555-7275
Email: washby@belmontridgebank.com
Mr. Ashby is the designated contact for all BaaS-channel-related inquiries from Thornfield, including issues related to NovaPay Technologies Inc., FairLend Digital LLC, VaultEdge Inc., and the remaining eleven BaaS partners currently under contract with BRB. Mr. Ashby coordinates with the fintech partners to facilitate Thornfield's access to relevant data and documentation regarding partner oversight, transaction flows, and compliance controls within the BaaS channel.
CIO / CTO:
Linda Petrosian, Chief Information Officer / Chief Technology Officer Belmont Ridge Bank National Association 400 Belmont Ridge Parkway, Suite 1200 King of Prussia, PA 19406 Direct: (610) 555-7290
Email: lpetrosian@belmontridgebank.com
Ms. Petrosian is the designated contact for all technology-related inquiries from Thornfield, including matters related to the Veridian TMS v.8.3 platform, the planned upgrade to Veridian TMS v.10.0, OFAC screening systems, data extraction requests, system architecture documentation, and information security protocols applicable to Thornfield's access to BRB systems and data environments.
Head of Internal Audit:
Derek Ballard, Head of Internal Audit Belmont Ridge Bank National Association 400 Belmont Ridge Parkway, Suite 1200 King of Prussia, PA 19406 Direct: (610) 555-7305
Email: dballard@belmontridgebank.com
Mr. Ballard serves as the liaison for Thornfield's review of prior internal audit findings relevant to the BSA/AML compliance program. He is responsible for providing access to internal audit workpapers and the BSA/AML independent testing reports prepared by Caldera & Pope LLP, the most recent of which was completed in September 2024.
C. Thornfield Consulting Group LLC
Engagement Lead / Managing Director:
Dr. Vivian Castellano, Managing Director Financial Crimes Advisory Practice Thornfield Consulting Group LLC 200 Park Avenue South, 15th Floor New York, NY 10003 Direct: (212) 555-8400
Email: vcastellano@thornfieldconsulting.com
Dr. Castellano serves as the primary Thornfield contact for all strategic matters, OCC reporting, and final deliverable sign-off. She leads the overall Thornfield engagement team and is responsible for the quality and integrity of Thornfield's assessment. Dr. Castellano participates in all bi-weekly tripartite status calls and is the designated Thornfield signatory on the final validation report to be submitted to the OCC.
Senior Director, AML Transaction Monitoring:
Robert Eastman, Senior Director AML Transaction Monitoring Practice Thornfield Consulting Group LLC 200 Park Avenue South, 15th Floor New York, NY 10003 Direct: (212) 555-8425
Email: reastman@thornfieldconsulting.com
Mr. Eastman leads Thornfield's assessment of BRB's transaction monitoring system, including the current Veridian TMS v.8.3 platform and the planned upgrade to v.10.0. His scope encompasses alert management processes, SAR filing procedures and backlog clearance, and the independent model validation component of the assessment.
Director, Sanctions & OFAC Compliance:
Jennifer Hwang, Director Sanctions & OFAC Compliance Practice Thornfield Consulting Group LLC 200 Park Avenue South, 15th Floor New York, NY 10003 Direct: (212) 555-8440
Email: jhwang@thornfieldconsulting.com
Ms. Hwang leads Thornfield's assessment of BRB's OFAC sanctions screening program, with particular focus on the BaaS channel screening gaps identified in the Consent Order. The OCC examination found that approximately 3,800,000 NovaPay Technologies transactions in calendar year 2023 were either unscreened or inadequately screened for OFAC sanctions compliance, out of a total NovaPay transaction volume of approximately 31.7 million transactions during that period. Ms. Hwang's assessment encompasses the screening methodology, technology platform, list management processes, and escalation procedures for potential sanctions hits.
Director, Fintech & Payments Compliance:
Nathaniel Burgess, Director Fintech & Payments Compliance Practice Thornfield Consulting Group LLC 200 Park Avenue South, 15th Floor New York, NY 10003 Direct: (212) 555-8455
Email: nburgess@thornfieldconsulting.com
Mr. Burgess leads Thornfield's assessment of BRB's BaaS partner oversight program, CDD/EDD processes for fintech-onboarded customers, and the third-party risk management framework applicable to fintech partnerships. His assessment covers the full portfolio of BRB's fourteen BaaS partners and the adequacy of BRB's controls over customer onboarding, ongoing monitoring, and suspicious activity reporting within these channels.
D. OCC Personnel
Examiner-in-Charge:
Jonathan Frey, National Bank Examiner OCC Northeastern District Office 340 Madison Avenue New York, NY 10017
Mr. Frey is the OCC Examiner-in-Charge assigned to BRB's Consent Order compliance and the Thornfield independent consultant engagement. All communications with the OCC related to Thornfield's engagement, deliverables, and findings must be coordinated through C&H (Philip Hartmann) and approved by BRB General Counsel (Gregory Nardone) prior to transmission. The protocols governing Thornfield's separate and independent reporting obligations to the OCC are addressed in Section VII below. Under no circumstances should BRB personnel communicate directly with Mr. Frey or other OCC personnel regarding the Thornfield engagement without C&H's involvement, except as required by law or regulatory directive.
III. COMMUNICATION STRUCTURE AND cadence
Effective communication among the parties is essential to the orderly progress of Thornfield's assessment, the timely identification and resolution of issues, and the maintenance of privilege protections. This Section establishes the required communication channels, frequencies, and procedures. All parties are expected to adhere to these protocols throughout the engagement term.
A. Bi-Weekly Status Calls — Tripartite (C&H / BRB / Thornfield)
Frequency and Commencement. Tripartite status calls shall be held on every other Tuesday, commencing with the first full week after Thornfield's on-site assessment begins on March 1, 2025. The anticipated date of the first tripartite call is during the week of March 3, 2025. The specific time for each call will be established by mutual agreement of the parties and communicated by C&H. In the event that a scheduled call falls on a federal holiday or other date on which one or more parties are unavailable, C&H will reschedule the call to the nearest practicable date, with notice to all participants.
Participants. The following individuals are expected to participate in each tripartite call, unless excused in advance:
•  Philip Hartmann, C&H (chair)
•  Yuki Nakamura, C&H
•  Patricia Langston, BRB CCO
•  Thomas Ikeda, BRB BSA Officer
•  Dr. Vivian Castellano, Thornfield Engagement Lead
•  Additional Thornfield team members (Robert Eastman, Jennifer Hwang, and/or Nathaniel Burgess) as warranted by the agenda for a given call
Other BRB personnel (e.g., Melissa Chu, Warren Ashby, Linda Petrosian, Derek Ballard) and C&H attorneys (e.g., Carlos Espinoza, Marcus Delgado) may be invited to participate in specific calls when agenda items fall within their areas of responsibility, at the discretion of C&H and BRB General Counsel.
Purpose. The tripartite calls serve as the primary forum for coordinated oversight of the Thornfield engagement. The purpose of each call is to:
•  Review Thornfield's assessment progress across all workstreams;
•  Discuss emerging findings, observations, and areas of concern identified by Thornfield;
•  Address outstanding data requests and access issues;
•  Identify potential risks to the remediation timeline and Consent Order deadlines;
•  Coordinate on upcoming milestones and deliverables;
•  Discuss any OCC communications or inquiries related to the engagement; and
•  Review and confirm action items from the prior call.
Agenda Preparation and Distribution. The agenda for each tripartite call shall be prepared by C&H (Yuki Nakamura) and circulated to all expected participants at least twenty-four (24) hours in advance of the scheduled call. The agenda shall include the following standing items:
(i) Workstream status update by Thornfield (organized by Workstreams 1 through 5 as described in Section VI.A below);
(ii) Review of open data requests and access issues;
(iii) Discussion of emerging issues and findings;
(iv) Upcoming milestone dates and preparation requirements;
(v) OCC communication update;
(vi) Review and confirmation of action items from the prior call; and
(vii) Other business as appropriate.
Any party may request the addition of items to the agenda by submitting requests to Yuki Nakamura no later than forty-eight (48) hours before the scheduled call.
Minutes. Minutes of each tripartite call shall be prepared by Carlos Espinoza (C&H) within forty-eight (48) hours of the conclusion of each call. Minutes shall be circulated to all participants and marked "ATTORNEY-CLIENT PRIVILEGED AND CONFIDENTIAL." Minutes shall capture key discussion points, decisions reached, action items assigned (with responsible party and target date), and any matters identified for escalation under Section V below. All minutes are maintained in C&H's matter file under Matter No. 1045-00002 and constitute privileged attorney work product.
B. Weekly Internal Calls — C&H and BRB Only
Frequency and Commencement. Internal calls between C&H and BRB shall be held every Monday at a time to be mutually agreed upon, commencing the week of February 17, 2025. These calls will continue throughout the engagement term and are not subject to modification without the agreement of C&H and BRB General Counsel.
Participants. The following individuals are expected to participate in each internal call:
•  Philip Hartmann, C&H (or Yuki Nakamura as delegate)
•  Gregory Nardone, BRB General Counsel (or designee)
•  Patricia Langston, BRB CCO
•  Thomas Ikeda, BRB BSA Officer
Additional BRB or C&H personnel may be invited as needed.
Purpose. The weekly internal calls serve as the forum for privileged, attorney-client communications between C&H and BRB regarding the Thornfield engagement and the broader remediation program. These calls are specifically intended to facilitate:
•  Internal strategy discussion regarding Thornfield's activities and the trajectory of the assessment;
•  Assessment of emerging findings and their potential legal and regulatory implications;
•  Preparation for upcoming bi-weekly tripartite status calls, including identification of sensitive topics requiring advance discussion;
•  Discussion of privilege-sensitive matters, including the handling of potentially adverse findings;
•  Development and refinement of OCC engagement strategy, including preparation of OCC submissions;
•  Discussion of matters that should not be shared with Thornfield, including BRB's internal assessment of remediation risks, litigation exposure, and regulatory enforcement considerations.
Confidentiality of Internal Call Materials. Notes from the weekly internal calls are maintained by C&H in privileged work-product files only. No minutes, notes, or summaries from these calls are shared with Thornfield or any party outside of C&H and the BRB participants listed above. The content of these discussions is protected by attorney-client privilege and the work-product doctrine.
C. Monthly Written Status Reports — Thornfield to BRB (via C&H)
Frequency. Thornfield shall deliver a written status report on a monthly basis, within ten (10) business days of the end of each calendar month. The first such report is due by March 14, 2025 (covering the period from the commencement of the on-site assessment through March 31, 2025, to the extent activities occur in that period; alternatively, covering the initial set-up and planning period through the end of February 2025).
Content Requirements. Each monthly written status report shall contain a detailed narrative covering the following topics:
(i) Activities Completed: A description of all assessment activities completed during the reporting period, including site visits, interviews conducted, documents reviewed, and analyses performed;
(ii) Key Findings and Observations: A summary of key findings and observations arising from the reporting period's activities, including both positive findings and deficiencies identified;
(iii) Workstream Status: A status update for each of the five assessment workstreams (OFAC Sanctions Screening; SAR Backlog Clearance & Process Improvement; CDD/EDD Remediation; Transaction Monitoring Model Validation & Tuning; and BSA/AML Program Governance & Training), including progress against milestones, percentage completion, and any changes to the assessment timeline;
(iv) Open Issues and Impediments: Identification and description of any open issues, impediments, or obstacles encountered during the reporting period, including unresolved data requests, access limitations, personnel availability constraints, or cooperation concerns;
(v) Anticipated Activities: A description of activities planned for the following month, including scheduled interviews, document reviews, testing procedures, and deliverable preparation;
(vi) Updated Risk Assessment: An updated assessment of risks to the engagement timeline, the quality of BRB's remediation efforts, and any matters that may require heightened attention from BRB management or the OCC.
Routing and Review. Thornfield delivers its monthly reports to C&H (Philip Hartmann and Yuki Nakamura). Upon receipt, C&H reviews each report for privilege implications, accuracy of characterizations, and consistency with information in C&H's possession. C&H transmits the report to BRB (Gregory Nardone and Patricia Langston) within five (5) business days of receipt, together with any C&H commentary or observations that C&H deems appropriate to share. If C&H identifies privilege concerns or factual inaccuracies in a Thornfield monthly report, C&H will communicate those concerns to Thornfield and work to resolve them before transmitting the report to BRB.
Use in OCC Reporting. Thornfield's monthly status reports inform, but are not directly submitted to, the OCC. C&H synthesizes information from the monthly reports, together with other relevant data and analysis, in preparing the OCC quarterly progress reports (due September 15, 2025 and December 15, 2025) and other OCC submissions on BRB's behalf. Thornfield's monthly reports are not incorporated by reference into OCC submissions and remain subject to the privilege and confidentiality protections described in Section VIII below.
D. Ad Hoc Communications
Urgent Issues. Notwithstanding the regular communication schedule set forth above, any party may initiate an unscheduled call or communication at any time for urgent matters that cannot reasonably await the next regularly scheduled call. Circumstances warranting urgent ad hoc communication include, but are not limited to:
•  discovery of a significant, previously unidentified compliance gap;
•  Identification of a potential OFAC sanctions violation or match;
•  discovery of potential criminal activity in the course of Thornfield's assessment;
•  A data breach or cybersecurity incident affecting the confidentiality of engagement materials;
•  Evidence of obstruction, non-cooperation, or interference with Thornfield's assessment by BRB personnel;
•  Receipt of an unexpected communication from the OCC, FinCEN, or another regulatory or law enforcement agency; or
•  Any other circumstance that, in the reasonable judgment of the initiating party, requires immediate attention.
In the event of an urgent matter, the initiating party shall contact the C&H primary contact (Philip Hartmann) and the BRB CCO (Patricia Langston) immediately by telephone, followed by written confirmation via email. If the matter involves a Tier 3 escalation issue (as defined in Section V.A below), the BRB General Counsel (Gregory Nardone) must also be notified immediately.
Email Protocol. All email communications among C&H, BRB, and Thornfield related to this engagement must comply with the following requirements:
•  Each email must include the legend "ATTORNEY-CLIENT PRIVILEGED AND CONFIDENTIAL" in the subject line or body of the email;
•  Each substantive email must copy at least one C&H attorney (Philip Hartmann or Yuki Nakamura);
•  Reference to C&H Matter No. 1045-00002 in the subject line is strongly encouraged to facilitate matter management and privilege tracking;
•  Email chains that begin as operational or logistical communications but evolve into substantive discussions of findings, legal conclusions, or OCC-reportable matters must be redirected to include C&H participation before the substantive discussion continues.
Prohibition on Direct BRB-Thornfield Substantive Communications Without C&H. While operational coordination—including scheduling of interviews, logistical arrangements for site visits, data request fulfillment, and similar administrative matters—may proceed directly between BRB personnel and Thornfield team members without the active participation of C&H on each communication, all substantive discussions must include C&H participation or prior C&H approval. For purposes of this protocol, "substantive discussions" include any communication regarding:
•  Thornfield's findings, observations, or conclusions regarding BRB's compliance program;
•  The legal implications of any finding or observation;
•  Matters that may require reporting to the OCC or other regulatory agency;
•  Disputes regarding the scope of Thornfield's assessment or access rights;
•  Any matter that could affect BRB's legal position or regulatory standing.
If any BRB or Thornfield personnel are uncertain whether a particular communication rises to the level of a "substantive discussion," they should err on the side of including C&H and seek guidance from Yuki Nakamura.
IV. DOCUMENT SHARING PROCEDURES
The Thornfield engagement will require the production and review of a substantial volume of documents, data, and information. This Section establishes the procedures for managing the flow of documents from BRB to Thornfield, from Thornfield to BRB and C&H, and among the parties generally. These procedures are designed to facilitate efficient information exchange while preserving applicable privilege protections and ensuring compliance with the confidentiality obligations set forth in the Engagement Agreement and the Privilege & Confidentiality Side Letter.
A. Document Requests from Thornfield
Centralized Request Process. Thornfield shall submit all document and data requests through a centralized request log maintained by C&H. The request log will be established as a shared secure platform or tracked spreadsheet (the specific platform to be agreed upon among the parties) accessible to designated personnel at C&H, BRB, and Thornfield. The request log serves as the single authoritative record of all outstanding and completed document requests.
Request Logging Requirements. Each document or data request submitted by Thornfield shall be assigned a unique tracking number and logged with the following information:
•  Unique request tracking number (format: TCG-REQ-XXXX);
•  Date the request was submitted;
•  Name of the Thornfield team member submitting the request;
•  Detailed description of the requested materials;
•  Targeted BRB department or designated contact responsible for the responsive materials;
•  Priority level (High, Medium, or Low, as designated by Thornfield);
•  Target response date (per the timeframes established in the Access & Cooperation Protocol);
•  C&H privilege review status (Pending Review, Cleared, Partially Cleared with Redactions, or Withheld);
•  Actual production date; and
•  Notes regarding any issues, objections, or negotiations related to the request.
The template for the Document Request Log is attached as Appendix C to this memorandum.
BRB Response Obligations. The BRB designated contacts identified in Section II.B above—specifically, Patricia Langston, Thomas Ikeda, Warren Ashby, Linda Petrosian, and Derek Ballard, as applicable—are responsible for marshaling responsive documents within the timeframes established in the Access & Cooperation Protocol. Each designated contact is expected to coordinate with his or her respective department to identify, collect, and prepare responsive documents for review. Where a request crosses departmental lines, Patricia Langston (as BRB's day-to-day lead) is responsible for coordinating the multi-departmental response.
C&H Privilege Review. C&H (Yuki Nakamura) shall review all documents assembled by BRB in response to a Thornfield request prior to production to Thornfield. The purpose of this review is to identify documents that are protected by attorney-client privilege, the work-product doctrine, or other applicable protections, and to determine whether such documents should be withheld, redacted, or produced subject to appropriate protections. No documents are produced to Thornfield until C&H has cleared them for production. C&H will use commercially reasonable efforts to complete its privilege review promptly so as not to impede the progress of Thornfield's assessment.
B. Production Format
Secure File-Sharing Platform. Documents shared among the parties shall be transmitted via an agreed secure file-sharing platform. BRB shall make available its secure virtual data room (or an equivalent platform meeting the information security requirements specified in the Access & Cooperation Protocol) for this purpose. The platform must provide access logging, user authentication, and encryption capabilities sufficient to protect the confidentiality of the materials shared.
Privilege Markings and Withholdings. Documents bearing attorney-client privilege markings or containing attorney work product are flagged during C&H's privilege review. Where appropriate, such documents are withheld in their entirety or produced in redacted form, with a corresponding entry on the privilege log maintained by C&H. The production of privilege-sensitive materials follows the detailed procedures set forth in the Privilege & Confidentiality Side Letter, including the common-interest framework described in Section VIII.B below.
Return and Destruction Obligations. Thornfield may not retain copies of BRB documents beyond the engagement term. Upon the conclusion of the engagement (or earlier termination), Thornfield is obligated to return or destroy all BRB documents and data in its possession, custody, or control, in accordance with the return and destruction provisions of the Independent Consultant Engagement Agreement (TCG-BRB-2025-001). C&H will coordinate with Thornfield at the conclusion of the engagement to confirm compliance with these obligations.
C. Thornfield Deliverables to BRB/C&H
Submission of Draft Deliverables. All Thornfield draft deliverables—including the preliminary gap assessment (due April 15, 2025), interim reports, and the final validation report (due February 15, 2026)—shall be submitted first to C&H (Philip Hartmann and Yuki Nakamura) for legal review. Thornfield shall not transmit any draft deliverable directly to BRB without first routing it through C&H.
C&H Review Period. C&H shall provide comments on Thornfield deliverables within an agreed turnaround period. The standard turnaround periods are as follows:
•  Interim deliverables (including the preliminary gap assessment and monthly status reports): five (5) business days from receipt;
•  Final validation report: ten (10) business days from receipt.
C&H's review encompasses privilege and confidentiality concerns, legal sufficiency of the analysis and conclusions, factual accuracy based on C&H's knowledge of the engagement, and consistency with prior communications and representations to the OCC. C&H's comments are advisory in nature and are not intended to direct or constrain Thornfield's independent conclusions, consistent with the requirements of the Consent Order.
Transmission to BRB Management. Following C&H's initial privilege and legal-sufficiency review, BRB management (Gregory Nardone and Patricia Langston) receives Thornfield deliverables together with C&H's commentary. BRB management may provide its own factual comments and observations to Thornfield through C&H. Thornfield is expected to consider all comments received but retains sole authority over the content of its deliverables.
Final Validation Report — OCC Submission. Thornfield's final validation report, due February 15, 2026, will be submitted directly to the OCC (Examiner-in-Charge Jonathan Frey) following the review process described above. As noted in Section VII below, C&H and BRB have the right to review the draft final report prior to OCC submission but may not alter Thornfield's independent conclusions. The final submission to the OCC is Thornfield's own act, not a joint submission by BRB and Thornfield.
V. ISSUE ESCALATION FRAMEWORK
The parties recognize that issues of varying severity and urgency may arise during the course of the engagement. This Section establishes a structured escalation framework to ensure that each issue is addressed at the appropriate level, with the appropriate participants, and within an appropriate timeframe. The escalation framework is designed to promote early identification and resolution of issues before they become impediments to the engagement or risks to BRB's Consent Order compliance.
A. Tiered Escalation Structure
Tier 1 — Operational Issues. Tier 1 issues are day-to-day operational matters that do not implicate significant legal, regulatory, or strategic concerns. Examples include scheduling conflicts for interviews or site visits, logistical arrangements for Thornfield's on-site work, routine data access requests, technical difficulties with the secure file-sharing platform, and similar administrative matters.
•  Resolution Level: Resolved between BRB designated contacts (Patricia Langston or Thomas Ikeda) and the relevant Thornfield team members (Robert Eastman, Jennifer Hwang, or Nathaniel Burgess), with C&H (Yuki Nakamura or Carlos Espinoza) copied on all communications for tracking purposes.
•  Target Resolution: Two (2) business days from the date the issue is identified.
•  Documentation: Tier 1 issues are tracked in the Document Request Log or a separate operational issues tracker maintained by C&H and BRB, as appropriate.
Tier 2 — Assessment Findings Requiring Management Attention. Tier 2 issues are matters of greater significance that require the attention and judgment of senior personnel from each organization. Examples include significant deficiency findings by Thornfield, disputes regarding the interpretation of Thornfield's scope of work, resource constraints or personnel availability issues that impede Thornfield's ability to complete its assessment within the planned timeline, disagreements regarding the characterization or severity of a finding, and concerns regarding the adequacy of BRB's remediation efforts.
•  Resolution Level: Escalated to the next bi-weekly tripartite call, or, if the issue cannot wait, to a dedicated call among Philip Hartmann (C&H), Gregory Nardone or Patricia Langston (BRB), and Dr. Vivian Castellano (Thornfield).
•  Target Resolution: Five (5) business days from the date the issue is escalated.
•  Documentation: Tier 2 issues are documented in the Escalation Log maintained by C&H, with entries reflecting the date of escalation, the nature of the issue, the parties involved, the resolution (if achieved), and any follow-up actions required.
Tier 3 — Critical Issues Requiring Immediate Escalation. Tier 3 issues are matters of the highest severity that require immediate attention and may have significant legal, regulatory, or enforcement implications. Examples include:
•  discovery of potential criminal activity (e.g., evidence of money laundering, terrorist financing, or fraud) in the course of Thornfield's assessment;
•  Identification of previously unidentified OFAC violations, including potential matches to the Specially Designated Nationals and blocked Persons List ("SDN List") or other sanctions lists;
•  Material non-cooperation by BRB personnel, including refusal to provide requested documents, obstruction of Thornfield's interviews or testing, or interference with the independence of Thornfield's assessment;
•  Circumstances that may require immediate notification to the OCC, FinCEN, or law enforcement; or
•  Any other matter that, in the reasonable judgment of the party identifying it, presents an imminent risk to BRB's regulatory standing, legal position, or the integrity of the independent consultant engagement.
•  Resolution Level: Escalated immediately to Philip Hartmann (C&H) and Gregory Nardone (BRB General Counsel). C&H assesses the legal implications of the issue, evaluates any regulatory notification obligations, and provides BRB with a recommendation regarding next steps within twenty-four (24) hours of notification. Dr. Vivian Castellano (Thornfield) is involved in the discussion to the extent that the issue arises from Thornfield's assessment activities, subject to appropriate privilege considerations.
•  Target Resolution: Initial assessment and recommendation within twenty-four (24) hours; resolution timeline thereafter is determined on a case-by-case basis.
•  Documentation: Tier 3 issues are documented in the Escalation Log with heightened detail, including a record of all communications, the legal analysis performed by C&H, the recommendation provided, and any OCC notification made or contemplated.
B. Disagreements Between BRB and Thornfield
In the event of a disagreement between BRB and Thornfield regarding assessment findings, methodology, scope interpretation, or conclusions, the following procedures shall apply:
1.  C&H as Initial Mediator. C&H acts as mediator in the first instance, facilitating discussion between BRB and Thornfield to identify the source of the disagreement and explore potential resolutions. C&H may request additional information from either party to facilitate its understanding of the issues.
2.  Written Documentation. If the disagreement is not resolved through initial mediation, each party shall prepare a written statement of its position, including the factual basis for its position, the methodology or analysis supporting its conclusion, and any supporting documentation. These written statements are submitted to C&H (Philip Hartmann) for legal analysis and recommendation.
3.  C&H Legal Analysis and Recommendation. C&H reviews the positions of both parties and provides a legal analysis and recommendation to BRB General Counsel. C&H's recommendation may address the relative merits of each party's position, the potential implications of the disagreement for BRB's Consent Order compliance and regulatory standing, and the advisability of any particular course of action.
4.  Independence of Thornfield's Conclusions. It is a fundamental principle of the Consent Order that the independent consultant's conclusions and assessments must be independent. BRB may not direct or constrain Thornfield's findings. BRB may, however, present its perspective, factual information, and supporting documentation for Thornfield's consideration. Thornfield is expected to give due consideration to BRB's input but retains sole authority over its assessment conclusions.
5.  OCC Notification. Persistent disagreements that cannot be resolved through the processes described above may require notification to the OCC. C&H advises BRB on the applicable obligation to notify the OCC of any unresolved dispute that could affect the integrity or completeness of Thornfield's assessment.
C. Escalation Log
C&H maintains a comprehensive log of all Tier 2 and Tier 3 escalation events. The log includes the following information for each event:
•  Date the issue was identified and escalated;
•  Nature and description of the issue;
•  Tier classification (Tier 2 or Tier 3);
•  Parties involved in the escalation and resolution process;
•  Steps taken to resolve the issue;
•  Resolution achieved (if any) and date of resolution;
•  Any OCC notification required or made; and
•  Follow-up actions and responsible parties.
The Escalation Log is maintained in C&H's privileged work-product files under Matter No. 1045-00002 and constitutes attorney work product. The log is not shared with Thornfield or the OCC, except to the extent that information from the log is incorporated into OCC submissions prepared by C&H on BRB's behalf with BRB's approval.
VI. WORKSTREAM COORDINATION AND MILESTONE TRACKING
A. Alignment of Thornfield Assessment with BRB Remediation Workstreams
Thornfield's scope of work, as set forth in Appendix A to the Independent Consultant Engagement Agreement (TCG-BRB-2025-001), encompasses all five deficiency categories identified in the Consent Order. These five deficiency categories correspond to BRB's five internal remediation workstreams. Effective coordination between Thornfield's assessment activities and BRB's remediation efforts is essential to ensuring that Thornfield's work informs and validates BRB's progress, and that BRB's remediation activities are conducted with awareness of Thornfield's assessment findings and recommendations.
The following table sets forth the alignment of Thornfield's assessment scope with BRB's remediation workstreams, together with the designated leads from each organization:
Each workstream is managed on a day-to-day basis through the coordination of the designated leads identified above. The bi-weekly tripartite status calls (Section III.A) serve as the primary forum for cross-workstream coordination and for identifying dependencies, conflicts, or resource constraints that affect multiple workstreams. The designated C&H support attorneys maintain awareness of progress across their assigned workstreams and report to Philip Hartmann on a regular basis.
B. Key Thornfield Milestones
The following milestones mark the principal stages of Thornfield's assessment:
•  March 1, 2025: Thornfield's on-site assessment commences. Thornfield personnel begin conducting site visits, interviews, document reviews, and testing at BRB's facilities and through remote access to BRB systems.
•  April 15, 2025: Thornfield delivers the preliminary gap assessment to C&H and BRB. This deliverable is expected to identify the most significant compliance gaps observed during the initial phase of the assessment and to inform the preparation of BRB's Comprehensive Remediation Action Plan (due to the OCC on May 15, 2025).
•  Monthly (Ongoing): Thornfield delivers written status reports in accordance with the procedures described in Section III.C above, providing regular updates on assessment progress, findings, and issues.
•  February 15, 2026: Thornfield delivers the final validation report to BRB and C&H, and subsequently to the OCC. The final validation report constitutes Thornfield's independent assessment of the adequacy of BRB's remediation efforts across all five deficiency categories and is the principal deliverable under the Consent Order's independent consultant requirement.
C. Integration with Consent Order Deadline Calendar
C&H maintains the master Remediation Milestone Tracker (a separate document, updated on a rolling basis) incorporating all Consent Order deadlines, Thornfield assessment milestones, BRB internal remediation milestones, and OCC reporting obligations. The Remediation Milestone Tracker serves as the authoritative source for all parties regarding upcoming deadlines and the interrelationships among them.
The bi-weekly tripartite calls include a standing agenda item reviewing all milestones falling within the next thirty (30) calendar day window. This review encompasses not only the milestone date itself but also the preparatory steps required to meet the milestone, the current status of those preparatory steps, and any identified risks to timely achievement.
Any identified risk to milestone achievement is escalated in accordance with the Issue Escalation Framework set forth in Section V above. In general, risks to Consent Order deadlines are treated as Tier 2 issues at minimum, and risks that could result in BRB's inability to meet a Consent Order deadline or an OCC submission date are treated as Tier 3 issues requiring immediate escalation.
VII. OCC REPORTING AND COMMUNICATION PROTOCOLS
This Section addresses the interplay between Thornfield's independent reporting obligation to the OCC and BRB's own OCC reporting obligations, and establishes the coordination protocols necessary to ensure consistency, accuracy, and privilege preservation in all regulatory communications.
A. Thornfield's Independent Reporting Obligation to the OCC
Under Article VII of Consent Order No. OCC-2025-003 and the terms of the Independent Consultant Engagement Agreement (TCG-BRB-2025-001), Thornfield has an independent obligation to report its assessment findings to the OCC. This obligation is a core element of the Consent Order's independent consultant requirement and reflects the OCC's expectation that the consultant's assessment will be conducted free from undue influence or interference by BRB.
Thornfield's primary OCC deliverable is the final validation report, due February 15, 2026. This report will be submitted directly to the OCC Examiner-in-Charge, Jonathan Frey, at the OCC Northeastern District Office, 340 Madison Avenue, New York, NY 10017. The final validation report constitutes Thornfield's independent, professional assessment of the adequacy and effectiveness of BRB's BSA/AML and OFAC compliance program remediation efforts.
C&H and BRB have the right to review Thornfield's draft final validation report prior to its submission to the OCC, in accordance with the review process described in Section IV.C above. This review right is intended to enable BRB to provide factual input and to enable C&H to identify privilege concerns. However, neither C&H nor BRB may alter, direct, or constrain Thornfield's independent conclusions. Thornfield retains sole authority over the content of the final validation report, and its submission to the OCC is Thornfield's independent act.
In addition to the final validation report, the Consent Order or the OCC may require Thornfield to submit interim communications or reports to the OCC. Any such interim OCC communications by Thornfield shall be coordinated with C&H and BRB to the maximum extent consistent with Thornfield's independent obligations and applicable law.
B. BRB's OCC Reporting Obligations
BRB, through C&H, is responsible for the following OCC submissions that rely in part on Thornfield's work product and findings:
1.  Comprehensive Remediation Action Plan — Due May 15, 2025. The Remediation Action Plan must set forth BRB's detailed plan for addressing all deficiencies identified in the Consent Order. The plan will be informed by Thornfield's preliminary gap assessment (due April 15, 2025), which is expected to identify the most significant compliance gaps and provide Thornfield's initial observations on remediation priorities and approaches.
2.  First Quarterly Progress Report — Due September 15, 2025. This report will describe BRB's progress in implementing the Remediation Action Plan, including the status of each remediation workstream, milestones achieved and pending, and any issues or challenges encountered. The report will incorporate relevant findings and observations from Thornfield's monthly status reports and assessment activities during the reporting period.
3.  Second Quarterly Progress Report — Due December 15, 2025. This report follows the same format as the first quarterly report and covers the subsequent three-month period. By this date, BRB is expected to have achieved substantial progress across all workstreams, and the report should reflect the status of the CDD/EDD remediation program (targeting 100% completion by January 15, 2026), the Veridian TMS v.10.0 deployment and model validation, and the OFAC screening remediation for BaaS channels.
4.  Compliance Self-Certification — Due February 15, 2026. The self-certification is a formal attestation by BRB's Board of Directors that BRB has achieved compliance with the requirements of the Consent Order. The self-certification will rely in substantial part on Thornfield's final validation report and will be prepared by C&H in coordination with BRB management and the Board.
All OCC submissions are prepared by C&H, reviewed and approved by BRB General Counsel (Gregory Nardone), and transmitted to the OCC by C&H (Philip Hartmann). No OCC submission is transmitted without the express written approval of Mr. Nardone.
Thornfield's monthly status reports and emerging findings are key inputs to these submissions but are synthesized by C&H for purposes of OCC reporting. The information drawn from Thornfield's work is presented in a manner consistent with BRB's regulatory position and privilege protections. Thornfield's monthly reports do not constitute Thornfield's independent OCC reporting and are not submitted to the OCC in their original form as part of BRB's reporting obligations.
C. Coordination on OCC Inquiries
OCC Contact with Thornfield. If the OCC contacts Thornfield directly regarding any matter related to the BRB engagement, Thornfield shall promptly notify C&H (Philip Hartmann) and BRB (Gregory Nardone and Patricia Langston) of the substance of the communication, to the extent permitted by the Consent Order and applicable law. This notification obligation applies to all forms of communication, including telephone calls, emails, written correspondence, and in-person meetings. Thornfield shall provide such notification within twenty-four (24) hours of the OCC communication, or sooner if the communication concerns a matter of urgency.
C&H recognizes that Thornfield, as the independent consultant appointed under the Consent Order, may be required to communicate with the OCC without the participation or prior approval of BRB or C&H. Nothing in this protocol is intended to interfere with Thornfield's ability to fulfill its independent obligations to the OCC. However, the parties agree that prompt notification facilitates coordination and minimizes the risk of inconsistent or contradictory communications reaching the OCC from different sources.
OCC Contact with BRB. If the OCC contacts BRB regarding Thornfield's assessment—whether through formal correspondence, telephone communication, or informal inquiry—BRB shall route the inquiry to C&H (Philip Hartmann) for handling. BRB personnel shall not substantively respond to any OCC inquiry regarding the Thornfield assessment without C&H's involvement. Administrative matters (e.g., scheduling of OCC examiner site visits unrelated to the Thornfield assessment) may be handled directly by BRB, but any inquiry touching upon the Consent Order, the independent consultant engagement, or BSA/AML compliance program matters should be directed to C&H.
OCC Correspondence Log. C&H maintains the OCC Correspondence Log & Tracking Memorandum, which documents all communications with the OCC and FinCEN related to BRB's Consent Order compliance and the Thornfield engagement. The log includes the date, participants, subject matter, and substance of each communication, as well as any follow-up actions required. C&H notes that FinCEN Associate Director Angela Drummond is monitoring BRB's SAR filing remediation and that FinCEN has reserved enforcement rights with respect to BRB's SAR filing deficiencies. Communications with FinCEN, whether initiated by FinCEN or by BRB, are logged and tracked in the same manner as OCC communications.
VIII. PRIVILEGE PRESERVATION AND CONFIDENTIALITY
The protection of attorney-client privilege and attorney work product is of paramount importance throughout the Thornfield engagement. The tripartite nature of the engagement—involving an outside law firm, a regulated institution, and an independent consultant that reports to both the institution and the regulator—creates unique privilege challenges that require careful management. This Section summarizes the key operational protocols for day-to-day privilege preservation.
A. Cross-Reference to Privilege & Confidentiality Side Letter
The detailed privilege framework governing the Thornfield engagement is set forth in the separate Privilege & Confidentiality Side Letter among BRB, C&H, and Thornfield, executed contemporaneously with the Independent Consu