PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE / WORK PRODUCT DOCTRINE
CALDERWOOD & HARKNESS LLP 1285 Avenue of the Americas, 40th Floor New York, NY 10019 Tel: (212) 555-7400
Fax: (212) 555-7401
www.calderwoodharkness.com
February 10, 2025
PRIVILEGE AND CONFIDENTIALITY SIDE LETTER AGREEMENT
Executed Concurrently with the Independent Consultant Engagement Agreement (Reference: TCG-BRB-2025-001)
Belmont Ridge Bank National Association 680 Lexington Avenue, 22nd Floor New York, NY 10022
Attn: Gregory Nardone, Esq., General Counsel & Corporate Secretary
Thornfield Consulting Group LLC 200 Park Avenue South, 15th Floor New York, NY 10003
Attn: Dr. Vivian Castellano, Managing Director, Financial Crimes Advisory
With a copy to Thornfield's outside counsel: Hargrove & Stein PC 7 Times Square, 34th Floor New York, NY 10036
Ladies and Gentlemen:
This Privilege and Confidentiality Side Letter Agreement (this "Side Letter") is entered into as of February 10, 2025, by and among:
(i) Belmont Ridge Bank National Association, a national banking association chartered under the laws of the United States, OCC Charter No. 48271, FDIC Certificate No. 31845, with its principal offices at 680 Lexington Avenue, 22nd Floor, New York, NY 10022 (together with its parent holding company, Belmont Ridge Financial Group, Inc. ("BRFG"), as applicable, "BRB" or the "Bank"), represented herein by Gregory Nardone, General Counsel & Corporate Secretary;
(ii) Calderwood & Harkness LLP, a limited liability partnership organized under the laws of the State of New York, with offices at 1285 Avenue of the Americas, 40th Floor, New York, NY 10019 ("C&H" or "Outside Counsel"), represented herein by Philip Hartmann, Responsible Partner, Banking & Finance Practice Group, C&H Matter No. 1045-00002; and
(iii) Thornfield Consulting Group LLC, a limited liability company organized under the laws of the State of Delaware, with offices at 200 Park Avenue South, 15th Floor, New York, NY 10003 ("Thornfield" or the "Independent Consultant"), represented herein by Dr. Vivian Castellano, Managing Director, Financial Crimes Advisory. Thornfield's outside counsel in connection with this engagement is Hargrove & Stein PC, 7 Times Square, 34th Floor, New York, NY 10036.
BRB, C&H, and Thornfield are sometimes referred to herein individually as a "Party" and collectively as the "Parties."
RECITALS
WHEREAS, BRB is subject to Consent Order No. OCC-2025-003 (the "Consent Order"), issued by the Office of the Comptroller of the Currency (the "OCC") on January 15, 2025, requiring BRB to undertake a comprehensive uplift and remediation of its Bank Secrecy Act/Anti-Money Laundering ("BSA/AML") compliance program and its Office of Foreign Assets Control ("OFAC") sanctions compliance program;
WHEREAS, the Consent Order requires BRB to engage an independent consultant pursuant to Article VII thereof to conduct a comprehensive assessment of BRB's BSA/AML and OFAC sanctions compliance infrastructure and to validate the remediation of identified deficiencies, including, without limitation: (i) OFAC sanctions screening failures, including the failure to screen approximately 3,800,000 transactions processed through the NovaPay Technologies Inc. banking-as-a-service ("BaaS") channel during calendar year 2023; (ii) Suspicious Activity Report ("SAR") filing deficiencies, including untimely filings and failures to file; (iii) Customer Due Diligence ("CDD") and Enhanced Due Diligence ("EDD") failures affecting approximately 47,000 high-risk accounts; (iv) transaction monitoring model validation deficiencies relating to the Bank's Veridian TMS v.8.3 platform, last independently validated in March 2021; and (v) board and senior management oversight deficiencies in the governance of the BSA/AML compliance program;
WHEREAS, BRB has engaged Thornfield as the independent consultant pursuant to the Independent Consultant Engagement Agreement dated as of February 10, 2025 (the "Engagement Agreement," reference TCG-BRB-2025-001), with a fixed professional fee of $6,500,000 and reimbursable out-of-pocket expenses capped at $400,000, following the OCC's written non-objection to Thornfield's engagement received on February 5, 2025;
WHEREAS, BRB has separately retained C&H as its outside regulatory counsel, effective February 10, 2025, to advise BRB on all matters relating to BSA/AML and sanctions compliance remediation, engagement with the OCC and other federal regulators, and compliance with the terms and requirements of the Consent Order;
WHEREAS, in the course of performing their respective engagements, the Parties will necessarily share and exchange information, documents, analyses, data, and communications, certain of which may be protected by the attorney-client privilege, the attorney work-product doctrine (as articulated in Hickman v. Taylor, 329 U.S. 495 (1947), and codified in Fed. R. Civ. P. 26(b)(3)), or both;
WHEREAS, the Parties desire to establish a comprehensive framework to preserve all applicable privileges and protections attendant to C&H's legal advice and related materials, to define the scope and limitations of a common-interest privilege arrangement among the Parties, to set forth each Party's confidentiality obligations with respect to the handling, marking, storage, and dissemination of Confidential Information and Privileged Materials, and to establish detailed protocols for Thornfield's reporting to the OCC that protect against the inadvertent waiver of privilege over C&H's legal advice to BRB; and
WHEREAS, this Side Letter supplements and is ancillary to the Engagement Agreement and does not alter, modify, or supersede any of the terms thereof except as expressly provided herein.
NOW, THEREFORE, in consideration of the mutual covenants, agreements, representations, and warranties set forth herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:
SECTION 1: DEFINITIONS
As used in this Side Letter, the following terms shall have the meanings set forth below. Capitalized terms used but not defined in this Side Letter shall have the meanings ascribed to them in the Engagement Agreement.
1.1 "Confidential Information" means all non-public information, documents, data, analyses, reports, communications, and work product shared among or generated by the Parties in connection with the Consent Order remediation, whether in written, electronic, oral, or other form. Without limiting the generality of the foregoing, Confidential Information includes, but is not limited to:
(a) BRB's financial data, including but not limited to total assets of approximately $38.7 billion, total deposits of approximately $29.4 billion, and net income of approximately $412 million, each as of December 31, 2024, and any interim or projected financial information shared with the Parties;
(b) BSA/AML program data, including SAR filings and underlying analyses, Currency Transaction Reports, transaction monitoring alerts and dispositions, OFAC sanctions screening results, Know Your Customer and CDD/EDD files, beneficial ownership records, and risk assessment documentation;
(c) customer information, including personally identifiable information, account-level data, and transaction records subject to the privacy and information security requirements of the Gramm-Leach-Bliley Act, 15 U.S.C. §§ 6801–6809, and the OCC's implementing regulations;
(d) technology systems information, including information relating to BRB's current Veridian TMS v.8.3 transaction monitoring platform, the planned upgrade to Veridian TMS v.10.0, the Bank's OFAC screening systems and configurations, and any related data architecture and systems integration documentation;
(e) BaaS partner data, including information relating to NovaPay Technologies Inc., FairLend Digital LLC, VaultEdge Inc., and the remaining eleven (11) active BaaS partners maintained by BRB as of the date hereof, including partnership agreements, transaction volumes, compliance metrics, and risk assessments; and
(f) remediation plans, strategies, timelines, resource allocations, budget information, and all internal and external communications relating thereto.
1.2 "Privileged Materials" means communications and documents protected by the attorney-client privilege, including all communications between C&H and BRB (including communications between C&H and BRB's officers, directors, and employees) made for the purpose of seeking, providing, or reflecting legal advice in connection with the Consent Order and the remediation efforts contemplated thereby. For the avoidance of doubt, the BRB officers, directors, and employees whose communications with C&H are encompassed within this definition include, without limitation:
(a) Patricia Langston, Chief Compliance Officer;
(b) Thomas Ikeda, BSA Officer;
(c) Melissa Chu, Chief Risk Officer;
(d) Warren Ashby, Head of Fintech Partnerships;
(e) Linda Petrosian, Chief Information Officer / Chief Technology Officer;
(f) Derek Ballard, Head of Internal Audit; and
(g) such other BRB personnel as may be designated in writing by Gregory Nardone from time to time.
1.3 "Work Product" means materials prepared by or at the direction of C&H in anticipation of litigation or for the purpose of providing legal advice to BRB, including memoranda, analyses, assessments, strategic recommendations, legal opinions, and other documents reflecting C&H's mental impressions, conclusions, opinions, and legal theories. Without limiting the foregoing, Work Product includes materials addressing:
(a) BRB's compliance posture under the Consent Order and the Bank's strategy for satisfying its terms;
(b) potential enforcement action by the Financial Crimes Enforcement Network ("FinCEN"), including analysis of the monitoring role of FinCEN Associate Director Angela Drummond and FinCEN's reserved enforcement rights;
(c) the risk of criminal referral by the OCC to the Department of Justice ("DOJ") and any related DOJ investigation or enforcement action;
(d) OFAC enforcement risk, including analysis relating to potential voluntary self-disclosure obligations;
(e) shareholder litigation exposure, including potential securities fraud claims or derivative actions; and
(f) any other matter on which C&H provides legal counsel to BRB in connection with the Consent Order remediation.
1.4 "Common Interest Materials" means Privileged Materials and Work Product that are shared among the Parties pursuant to the common-interest privilege framework established in Section 3 of this Side Letter, for the purpose of furthering the Parties' shared legal interest in achieving BRB's compliance with the Consent Order and mitigating associated enforcement, litigation, and regulatory risks.
1.5 "Consultant Work Product" means reports, assessments, analyses, findings, recommendations, memoranda, presentations, and all other materials prepared by Thornfield in connection with the Engagement Agreement, including, without limitation:
(a) the preliminary gap assessment, due April 15, 2025;
(b) ongoing monitoring and validation reports prepared during the remediation period;
(c) the final validation report, due February 15, 2026; and
(d) all supporting work papers, data analyses, testing results, and documentation underlying the foregoing.
1.6 "OCC Deliverables" means reports, correspondence, certifications, and communications that Thornfield or BRB is required or authorized to submit to the OCC pursuant to the Consent Order, including, without limitation:
(a) the interim SAR backlog status report, due March 31, 2025;
(b) the Comprehensive Remediation Action Plan, due May 15, 2025;
(c) quarterly progress reports, due September 15, 2025 and December 15, 2025;
(d) the compliance self-certification, due February 15, 2026; and
(e) any supplemental reports, data submissions, or correspondence required by the OCC or submitted voluntarily by BRB or Thornfield in connection with the Consent Order.
1.7 "Parties" means BRB, C&H, and Thornfield, collectively; each individually, a "Party."
SECTION 2: PURPOSE
2.1 The purpose of this Side Letter is to establish a comprehensive framework that:
(a) preserves the attorney-client privilege and work-product protection applicable to C&H's legal advice, communications, and related materials provided to BRB in connection with the Consent Order remediation, ensuring that the collaboration among the Parties does not result in an inadvertent or implied waiver of such protections;
(b) establishes a common-interest privilege framework among the Parties to the extent their interests are aligned in achieving BRB's compliance with the Consent Order and in mitigating the risk of further regulatory or enforcement actions, thereby permitting the sharing of Privileged Materials and Work Product among the Parties without waiver of applicable privileges;
(c) defines each Party's obligations regarding the handling, marking, labeling, storage, access control, and dissemination of Confidential Information and Privileged Materials, in order to maintain the integrity of such protections throughout the course of the engagement; and
(d) establishes clear and workable protocols for Thornfield's reporting to the OCC and other regulators that protect against the inadvertent disclosure or waiver of privilege over C&H's legal advice to BRB, while ensuring that Thornfield is able to fulfill its independent mandate and obligations under the Consent Order without limitation or impediment.
2.2 The Parties recognize that the effective remediation of the deficiencies identified in the Consent Order requires close collaboration among BRB's legal counsel, its compliance and risk management functions, and the Independent Consultant. This Side Letter is intended to facilitate such collaboration while maintaining appropriate boundaries between legal advice and independent consulting work product, and to provide all Parties with certainty regarding their respective rights and obligations with respect to privileged and confidential information.
SECTION 3: COMMON-INTEREST PRIVILEGE FRAMEWORK
3.1 Common Legal Interest. The Parties acknowledge and agree that they share a common legal interest in achieving BRB's full and timely compliance with Consent Order No. OCC-2025-003, and in defending against, mitigating, or otherwise addressing the risk of further regulatory or enforcement actions by the OCC, FinCEN (including, without limitation, actions taken at the direction of or in coordination with FinCEN Associate Director Angela Drummond, who is monitoring BRB's remediation efforts and whose office has reserved its independent enforcement rights), the DOJ, OFAC, or any other governmental authority. The Parties further acknowledge that this shared legal interest supports the disclosure and exchange of Privileged Materials and Work Product among the Parties without effecting a waiver of any applicable attorney-client privilege, work-product protection, or other applicable privilege or immunity, consistent with the common-interest doctrine as recognized under federal and New York law. See, e.g., In re Teleglobe Commc'ns Corp., 493 F.3d 345 (3d Cir. 2007); Schaeffler v. United States, 806 F.3d 34 (2d Cir. 2015); HSH Nordbank AG v. Ostrander National Bank AG, 95 A.D.3d 185 (N.Y. App. Div. 2012).
3.2 Scope of Common Interest. The common legal interest recognized under this Section 3 extends to, but is not limited to, the following matters:
(a) the assessment and remediation of the five core deficiency categories identified in the Consent Order, namely: (I) OFAC sanctions screening failures; (II) SAR filing deficiencies; (III) CDD/EDD failures affecting the approximately 47,000 high-risk accounts identified by the OCC; (IV) transaction monitoring model validation deficiencies relating to Veridian TMS v.8.3; and (V) board and senior management oversight deficiencies;
(b) strategic advice regarding regulatory engagement with the OCC (including communications with Jonathan Frey, National Bank Examiner, OCC Northeastern District Office) and FinCEN, including the formulation and execution of a comprehensive regulatory response strategy;
(c) analysis and assessment of enforcement risk across all relevant regulatory and law enforcement agencies, including the evaluation of potential OFAC voluntary self-disclosure obligations relating to the approximately 3,800,000 unscreened NovaPay Technologies Inc. transactions processed during calendar year 2023, and the attendant risk-benefit analysis of such disclosure; and
(d) the collaborative preparation and review of OCC Deliverables prior to their submission, to the extent such preparation and review involves the exchange of Privileged Materials or Work Product among the Parties.
3.3 No Attorney-Client Relationship Between C&H and Thornfield. Notwithstanding any other provision of this Side Letter or the sharing of Privileged Materials or Work Product hereunder, nothing in this Side Letter shall be construed to create, establish, or imply an attorney-client relationship between C&H and Thornfield or between C&H and any of Thornfield's officers, employees, subcontractors, or agents. C&H's sole client in connection with the matters addressed by this Side Letter is BRB. Thornfield's outside counsel with respect to this engagement and this Side Letter is and remains Hargrove & Stein PC. Thornfield acknowledges that it has been advised by its own counsel regarding the terms and implications of this Side Letter and the common-interest arrangement established hereby.
3.4 Duration of Common Interest. The common-interest arrangement established by this Section 3 shall continue from the date of this Side Letter through the latest to occur of:
(a) February 15, 2026, which is the full compliance implementation date established by the Consent Order;
(b) the date on which the OCC issues a written acknowledgment, order, or notification that the Consent Order has been satisfied, terminated, or otherwise resolved; or
(c) the conclusion (by final judgment, settlement, administrative resolution, or otherwise) of any regulatory proceeding, enforcement action, investigation, or litigation arising out of or related to the matters addressed by the Consent Order, including any action by FinCEN, the DOJ, OFAC, or any private party.
The termination of the common-interest arrangement shall not affect the survival provisions set forth in Section 9.2 of this Side Letter.
SECTION 4: TREATMENT OF PRIVILEGED MATERIALS
4.1 Identification and Marking. All Privileged Materials shall be clearly and conspicuously marked with the legend "PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE / WORK PRODUCT DOCTRINE" (or such substantially similar legend as reasonably conveys the privileged nature of the materials) prior to sharing among the Parties. C&H shall be responsible for designating and marking its own Work Product prior to any disclosure or distribution. BRB shall mark Privileged Materials originating from BRB (including communications from BRB personnel to C&H that are shared with Thornfield) in coordination with C&H, with C&H providing guidance on appropriate marking where requested. The failure to mark a particular document or communication shall not, standing alone, constitute a waiver of any applicable privilege, provided that the disclosing Party takes prompt corrective action upon discovering the omission.
4.2 Sharing Protocol. Privileged Materials shall be shared among the Parties only on a strict need-to-know basis, limited to individuals who are directly and substantively involved in the Consent Order remediation and whose access to such materials is reasonably necessary for the performance of their duties. For Thornfield, access to Privileged Materials shall be limited to the following designated individuals:
(a) Dr. Vivian Castellano, Managing Director, Financial Crimes Advisory;
(b) Robert Eastman, Senior Director, AML Transaction Monitoring;
(c) Jennifer Hwang, Director, Sanctions & OFAC Compliance; and
(d) Nathaniel Burgess, Director, Fintech & Payments Compliance.
No additional Thornfield personnel shall be granted access to Privileged Materials unless such access has been approved in writing by both BRB (acting through Gregory Nardone or his designee) and C&H (acting through Philip Hartmann or his designee). Any such written approval shall specify the individual(s) being authorized, the scope of materials to which access is granted, and any conditions or limitations on such access. Each individual granted access to Privileged Materials shall be informed of the privileged and confidential nature of such materials and of the obligation to maintain their confidentiality.
4.3 No Further Disclosure. No Party shall disclose, distribute, or make available Privileged Materials to any third party—including, without limitation, any regulatory body, government agency, court, arbitrator, mediator, adverse party, or other person or entity not a Party to this Side Letter—without the prior written consent of both BRB (acting through Gregory Nardone) and C&H (acting through Philip Hartmann), except:
(a) as required by applicable law or regulation, including any lawful demand, subpoena, or court order, subject to the compelled disclosure procedures set forth in Section 5.4; or
(b) as otherwise expressly provided in Section 6 (Protocols for Thornfield Reporting to the OCC) of this Side Letter.
4.4 Return or Destruction. Upon the termination or expiration of Thornfield's engagement under the Engagement Agreement, whether by completion, early termination, or otherwise, Thornfield shall, within thirty (30) calendar days of such termination or expiration:
(a) return to BRB (or, at BRB's written direction, to C&H) all originals and copies of Privileged Materials and Common Interest Materials in Thornfield's possession, custody, or control, in whatever form or medium; or
(b) destroy all such materials, including all electronic copies, backup copies, and copies stored in any cloud-based or hosted environment, and provide written certification of such destruction, executed by Dr. Vivian Castellano or a duly authorized officer of Thornfield, specifying the materials destroyed and the method and date of destruction.
Notwithstanding the foregoing, Thornfield may retain one (1) archival copy of Privileged Materials and Common Interest Materials solely to the extent necessary for compliance with applicable professional standards, regulatory requirements, or legal obligations, including Thornfield's record-retention obligations under applicable law. Any such retained archival copy shall remain subject to the confidentiality and privilege obligations set forth in this Side Letter for as long as it is retained, and Thornfield shall maintain such copy in a secure, access-restricted environment.
SECTION 5: CONFIDENTIALITY OBLIGATIONS
5.1 General Confidentiality. Each Party agrees to hold all Confidential Information in strict confidence and not to disclose, publish, distribute, or otherwise make available any Confidential Information to any person or entity other than as expressly permitted by this Side Letter, the Engagement Agreement, or applicable law or regulation. Each Party shall use Confidential Information solely for the purpose of performing its obligations or exercising its rights in connection with the Consent Order remediation, and not for any other purpose, including any commercial, competitive, or personal purpose. Each Party shall exercise at least the same degree of care in protecting Confidential Information as it uses to protect its own most sensitive confidential information, but in no event less than a reasonable degree of care.
5.2 Permitted Disclosures. Notwithstanding Section 5.1, Confidential Information may be disclosed:
(a) to a Party's employees, officers, directors, and professional advisors (including outside auditors and consultants) who have a demonstrable need to know such information in connection with the Consent Order remediation and who are bound by confidentiality obligations no less restrictive than those set forth in this Side Letter, whether by contract, professional obligation, or applicable law;
(b) to the OCC, FinCEN, or other federal banking regulators, as required by the Consent Order, applicable law or regulation, or the lawful request or directive of such regulator, subject to the protocols set forth in Section 6 with respect to the segregation and protection of Privileged Materials;
(c) as required by court order, subpoena, or other compulsory legal process, subject to the procedures set forth in Section 5.4 below; and
(d) for BRB, to its Board of Directors—including Diane Whitford (Chair of the Board and Chief Executive Officer), Arthur Connelly (Lead Independent Director and Chair of the Risk Committee), Margaret Dao (Chair of the Audit Committee), James Rutherford (Chair of the Compliance Committee), Sandra Villarreal, and Keith Yamamoto—and to BRB's senior management, as needed to fulfill BRB's governance and oversight obligations under the Consent Order and applicable law.
5.3 BaaS Partner Information. The Parties acknowledge that the Consent Order remediation will require the review and analysis of significant volumes of information relating to BRB's BaaS fintech partners, including NovaPay Technologies Inc. (Chief Executive Officer: Ethan Garrison), FairLend Digital LLC (Chief Executive Officer: Aisha Okonkwo), VaultEdge Inc. (Chief Executive Officer: Marcus Tan), and the remaining eleven (11) active BaaS partners maintained by BRB as of the date hereof. Confidential Information relating to such BaaS partners, including transaction data, compliance metrics, contractual terms, and customer information processed through BaaS channels, shall not be disclosed by Thornfield to any BaaS partner or to any third party without BRB's prior written consent, except to the extent that such information is included in aggregated, anonymized, or de-identified form in Consultant Work Product or OCC Deliverables, such that no individual BaaS partner can be identified from the information as presented, unless BRB has specifically authorized the identification of a particular partner in a particular deliverable.
5.4 Compelled Disclosure. If any Party receives a subpoena, court order, civil investigative demand, regulatory request, or other legal process seeking or requiring the disclosure of Confidential Information or Privileged Materials (a "Compelled Disclosure Request"), that Party shall:
(a) promptly notify BRB (through Gregory Nardone) and C&H (through Philip Hartmann) of the receipt of such Compelled Disclosure Request, in writing, within two (2) business days of receipt, providing a copy of the Compelled Disclosure Request and identifying the specific Confidential Information or Privileged Materials at issue;
(b) cooperate fully in any effort by BRB to seek a protective order, motion to quash, or other appropriate judicial or administrative relief to prevent or limit the disclosure of Confidential Information or Privileged Materials;
(c) not disclose any Confidential Information or Privileged Materials in response to such Compelled Disclosure Request until BRB has had a reasonable opportunity (not less than ten (10) business days, unless a shorter period is mandated by the Compelled Disclosure Request and cannot be extended) to assert all applicable privileges, protections, and objections; and
(d) disclose only such information as is legally required after BRB has exhausted its available remedies or has consented to the disclosure.
5.5 Shareholder and Investor Communications. Confidential Information shall not be disclosed, directly or indirectly, to shareholders of BRFG, analysts, investors, the financial press, or any other market participant, including, without limitation, Brindoval Capital Partners LP (Julian Whitmore, Managing Partner, holding an approximately 8.3% ownership stake in BRFG, representing approximately 14.9 million shares) or Brindoval's counsel, Amberly Knox LLP (Steven Briggs), except:
(a) through BRB's authorized public disclosures filed with the Securities and Exchange Commission, including Current Reports on Form 8-K, Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q, and proxy statements; or
(b) as otherwise specifically approved in writing by BRB's General Counsel and C&H.
Each Party acknowledges that certain Confidential Information may constitute material nonpublic information within the meaning of the federal securities laws and agrees to comply with all applicable restrictions on trading and tipping obligations.
5.6 Information Security. Each Party shall implement and maintain reasonable administrative, technical, and physical safeguards to protect the confidentiality, integrity, and availability of Confidential Information and Privileged Materials, consistent with the requirements of the Gramm-Leach-Bliley Act, 15 U.S.C. §§ 6801–6809, the OCC's Heightened Standards for Large Banks (12 C.F.R. Part 30, Appendix D), and applicable OCC guidance on information security (including OCC Bulletin 2013-29 and its supplements). Such safeguards shall include, at a minimum, encryption of Confidential Information in transit and at rest, access controls limiting access to authorized personnel, secure storage and transmission protocols, and timely notification in the event of a data breach or security incident affecting Confidential Information.
SECTION 6: PROTOCOLS FOR THORNFIELD REPORTING TO THE OCC
6.1 Segregation of Legal Advice. Thornfield acknowledges and agrees that its Consultant Work Product and OCC Deliverables shall reflect Thornfield's independent factual findings, professional assessments, and recommendations, based on Thornfield's own analysis and expertise. Consultant Work Product and OCC Deliverables shall not incorporate, quote, paraphrase, summarize, or otherwise reveal or reflect the substance of C&H's legal advice, legal strategy, legal analysis, or attorney Work Product provided to BRB, unless BRB (through Gregory Nardone) and C&H (through Philip Hartmann) have expressly consented in writing to such inclusion on a document-by-document and passage-by-passage basis. For the avoidance of doubt, Thornfield's independent conclusions may overlap with or be consistent with C&H's legal analysis, and such overlap alone shall not be deemed a disclosure of Privileged Materials, provided that Thornfield's conclusions are derived from Thornfield's own independent work and are expressed in Thornfield's own words.
6.2 Pre-Submission Review. Prior to the submission of any Consultant Work Product or OCC Deliverable to the OCC (addressed to Jonathan Frey, National Bank Examiner, OCC Northeastern District Office, 340 Madison Avenue, New York, NY 10017, or to such other OCC examiner or official as may be designated) or to FinCEN or any other regulatory body, Thornfield shall provide a complete draft of the proposed submission to C&H (Philip Hartmann) and BRB (Gregory Nardone and Patricia Langston, Chief Compliance Officer) no fewer than ten (10) business days before the intended submission date.
C&H and BRB shall have the right to review such draft solely for the limited purpose of identifying and requesting the removal of any Privileged Materials, Work Product, attorney-client communications, or other information protected by the attorney-client privilege or work-product doctrine that may have been inadvertently included in the draft. Such review shall not extend to altering, modifying, limiting, or influencing Thornfield's independent findings, conclusions, assessments, or recommendations. C&H and BRB shall provide any comments or requested changes to Thornfield in writing within seven (7) business days of receipt of the draft.
6.3 Dispute Resolution for Pre-Submission Review. If C&H or BRB identifies material in a draft OCC Deliverable that it believes constitutes Privileged Material, Work Product, or attorney-client communications, and Thornfield disagrees with such characterization or with the requested removal, the Parties shall confer promptly and in good faith to resolve the dispute. Such conference may be conducted by telephone, video, or in person, and shall include, at a minimum, Philip Hartmann (or his designee) for C&H, Gregory Nardone (or his designee) for BRB, and Dr. Vivian Castellano (or her designee) for Thornfield.
If no resolution is reached within five (5) business days of the commencement of such conference, BRB may, at its election and expense:
(a) seek guidance from Hargrove & Stein PC, as Thornfield's independent outside counsel, to provide an independent assessment of whether the disputed material constitutes Privileged Material or Work Product; or
(b) if the matter remains unresolved after such consultation, seek a judicial determination from the United States District Court for the Southern District of New York, or such other court of competent jurisdiction as may be appropriate, including by filing a motion for a protective order or for in camera review of the disputed material.
Pending resolution of any such dispute, Thornfield shall not include the disputed material in any submission to the OCC or any other regulatory body, unless the applicable submission deadline cannot reasonably be extended and the omission of the disputed material would render the submission materially incomplete or misleading, in which case Thornfield shall notify C&H and BRB in writing prior to inclusion.
6.4 No Waiver by OCC Submission. The submission of Consultant Work Product or OCC Deliverables to the OCC, FinCEN, or any other regulatory body shall not constitute a waiver of the attorney-client privilege or work-product protection with respect to:
(a) any Privileged Materials or Work Product that are not contained in the submitted materials, including all underlying legal analyses, memoranda, and communications between C&H and BRB;
(b) C&H's underlying legal analysis, strategic advice, conclusions, mental impressions, and legal theories, whether or not such analysis informed or was considered by Thornfield in the preparation of its reports;
(c) any communications between C&H and BRB concerning the substance, findings, conclusions, or recommendations of Thornfield's reports, including discussions of regulatory strategy, enforcement risk, or remediation alternatives; and
(d) any Common Interest Materials shared among the Parties that are not included in the submitted materials.
The Parties acknowledge that the submission of factual information and independent consultant findings to the OCC pursuant to the Consent Order is a regulatory compliance obligation and not a voluntary disclosure for purposes of the attorney-client privilege or work-product doctrine. The Parties further acknowledge that the OCC has taken the position that information provided to it in the course of the examination and supervision process is not publicly available and is subject to the OCC's regulations regarding the availability of information (12 C.F.R. Part 4, Subpart C), and the Parties shall cooperate to preserve such protections.
6.5 Thornfield's Independent Obligations. Nothing in this Side Letter shall be construed to limit, restrict, or impair Thornfield's obligation to comply with the Consent Order, including, without limitation, Article VII thereof, or to provide truthful, complete, and accurate information to the OCC in connection with its engagement as the Independent Consultant. Thornfield shall not be required to omit, suppress, or alter any finding, fact, data, conclusion, or recommendation in its Consultant Work Product or OCC Deliverables based on a privilege objection raised by BRB or C&H; rather, the protocols established in this Section 6 are designed to ensure that C&H's legal advice, strategy, and attorney Work Product are not inadvertently or unnecessarily disclosed while Thornfield fulfills its independent mandate. If Thornfield determines that any factual finding or recommendation that it considers necessary for inclusion in an OCC Deliverable cannot be presented without disclosing Privileged Material, Thornfield shall notify C&H and BRB in writing and the Parties shall follow the dispute resolution procedures set forth in Section 6.3.
SECTION 7: DOCUMENT HANDLING AND PRIVILEGE LOG
7.1 Document Labeling. All documents shared among the Parties in connection with the Consent Order remediation shall be labeled according to the following classification convention, as applicable:
Where a document falls within more than one category, it shall bear all applicable labels. Labels shall be placed prominently on the first page of each document and, where practicable, on each subsequent page. For electronic documents, including emails, the applicable label shall be included in the subject line or as a header/footer, and in the body of any transmitting email.
7.2 Privilege Log. C&H shall establish and maintain a privilege log (the "Privilege Log") documenting all Privileged Materials and Work Product shared with Thornfield under this Side Letter. The Privilege Log shall identify each document or communication by:
(a) date of creation or transmission;
(b) author or sender;
(c) recipient(s);
(d) a general description of the subject matter sufficient to identify the document without disclosing privileged content;
(e) the applicable privilege category (attorney-client privilege, work product, or both); and
(f) the date on which the document was shared with Thornfield and the identity of the Thornfield recipient(s).
The Privilege Log shall be updated on at least a monthly basis and shall be made available for review by BRB's General Counsel upon reasonable request. C&H shall retain the Privilege Log for a minimum of seven (7) years following the termination of the common-interest arrangement established by this Side Letter.
7.3 Inadvertent Disclosure. In the event that any Party inadvertently discloses Privileged Materials to an unauthorized third party—that is, a person or entity not authorized to receive such materials under this Side Letter—the disclosing Party shall:
(a) promptly notify C&H (Philip Hartmann) and BRB (Gregory Nardone) of such inadvertent disclosure, in writing, providing a description of the materials disclosed, the identity of the recipient(s), and the circumstances of the disclosure;
(b) take all reasonable steps to retrieve the inadvertently disclosed materials, including demanding return or destruction of such materials from the unauthorized recipient and, where applicable, seeking confirmation that no copies have been retained or further disseminated; and
(c) cooperate fully with BRB and C&H in asserting privilege over the inadvertently disclosed materials and in seeking any necessary protective orders, claw-back orders, or other judicial or administrative relief.
An inadvertent disclosure of Privileged Materials shall not constitute a waiver of the attorney-client privilege, work-product protection, or any other applicable privilege or protection, provided that the disclosing Party took reasonable precautions to prevent the disclosure and promptly took reasonable steps to remedy the error upon discovering it, consistent with Federal Rule of Evidence 502(b) and any applicable state equivalents. The Parties further agree to invoke the protections of Federal Rule of Evidence 502(d) to the maximum extent available and, if practicable, to seek a court order providing that any inadvertent disclosure of Privileged Materials in connection with the matters addressed by this Side Letter does not constitute a waiver of privilege.
SECTION 8: OWNERSHIP OF MATERIALS
8.1 C&H Work Product. All Work Product created by C&H in connection with its engagement by BRB relating to the Consent Order remediation remains the property of BRB as the client, subject to C&H's rights under applicable professional responsibility rules (including the New York Rules of Professional Conduct) to retain copies of such materials for C&H's own files, internal records, and conflict-checking purposes. BRB's ownership of C&H Work Product shall not be construed to diminish or waive any applicable privilege or protection attaching thereto.
8.2 Consultant Work Product. Consultant Work Product created by Thornfield in connection with the Engagement Agreement is subject to the ownership provisions set forth in Section [applicable section] of the Engagement Agreement (TCG-BRB-2025-001). To the extent that Consultant Work Product incorporates, embodies, or is derived from BRB's Confidential Information, including customer data, transaction data, BSA/AML program data, and other proprietary information of BRB, BRB retains all rights, title, and interest in and to such underlying Confidential Information. Thornfield's use of such Confidential Information shall be limited to the purposes of the engagement and shall not extend beyond the scope authorized by the Engagement Agreement and this Side Letter.
8.3 No License. Nothing in this Side Letter grants any Party a license, right, or interest in or to any other Party's intellectual property, trade secrets, proprietary methodologies, analytical tools, software, models, or other proprietary assets, except to the limited extent necessary for the performance of such Party's obligations in connection with the Consent Order remediation. For the avoidance of doubt, Thornfield retains all rights in and to its proprietary consulting methodologies, analytical frameworks, and tools, and BRB and C&H retain all rights in and to their respective proprietary information and work product, in each case subject to the confidentiality and privilege obligations of this Side Letter.
SECTION 9: TERM AND TERMINATION
9.1 Term. This Side Letter shall be effective as of February 10, 2025, and shall remain in full force and effect until the latest to occur of:
(a) the termination or expiration of the Engagement Agreement (TCG-BRB-2025-001), which is currently scheduled to conclude by February 15, 2026, unless extended or terminated earlier in accordance with its terms;
(b) the termination or expiration of C&H's engagement by BRB in connection with the Consent Order and related matters; or
(c) the conclusion (by final judgment, settlement, administrative resolution, regulatory closure, or otherwise) of any regulatory proceeding, enforcement action, investigation, or litigation arising out of or related to the matters addressed by the Consent Order.
9.2 Survival. The following provisions of this Side Letter shall survive any termination or expiration of this Side Letter and shall remain in full force and effect indefinitely (or, in the case of confidentiality obligations, for so long as the relevant information remains confidential and non-public):
(a) Section 4 (Treatment of Privileged Materials);
(b) Section 5 (Confidentiality Obligations);
(c) Section 7 (Document Handling and Privilege Log); and
(d) Section 8 (Ownership of Materials).
The survival of these provisions is intended to ensure that the Parties' obligations with respect to the protection of privileged and confidential information are not extinguished by the passage of time or the conclusion of the underlying engagement.
SECTION 10: REPRESENTATIONS AND WARRANTIES
10.1 Authority. Each Party represents and warrants that: (a) it has the full power, authority, and legal capacity to enter into this Side Letter and to perform its obligations hereunder; (b) the execution and delivery of this Side Letter and the performance of such Party's obligations hereunder have been duly authorized by all necessary corporate, partnership, or other organizational action, as applicable; and (c) the execution, delivery, and performance of this Side Letter do not and will not violate, conflict with, or constitute a default under any agreement, obligation, order, judgment, or decree to which such Party is a party or by which it is bound.
10.2 No Conflicts. Thornfield represents and warrants that its engagement by BRB pursuant to the Engagement Agreement and its participation in the common-interest arrangement established by this Side Letter do not create a conflict of interest with any other engagement, client relationship, or professional obligation of Thornfield, and that Thornfield has conducted appropriate conflict-of-interest checks and has disclosed to BRB and C&H any actual or potential conflicts that may arise in connection with this engagement. Thornfield further represents that it has no current engagement or relationship with any party adverse to BRB with respect to the matters addressed by the Consent Order.
10.3 Compliance with Consent Order. The Parties acknowledge that this Side Letter is designed to facilitate compliance with Consent Order No. OCC-2025-003 and to support the effective remediation of the deficiencies identified therein. The Parties agree that the terms of this Side Letter shall be interpreted and construed in a manner consistent with that objective, and that no provision of this Side Letter shall be construed to obstruct, impede, or delay BRB's compliance with the Consent Order or Thornfield's fulfillment of its independent mandate thereunder.
SECTION 11: MISCELLANEOUS PROVISIONS
11.1 Governing Law. This Side Letter shall be governed by and construed in accordance with the laws of the State of New York, without regard to its conflict-of-laws principles (whether of the State of New York or any other jurisdiction) that would cause the application of the laws of any jurisdiction other than the State of New York. For purposes of privilege analysis, the Parties agree that questions of privilege arising under this Side Letter shall be governed by applicable federal common law to the extent that such questions arise in connection with federal regulatory proceedings or federal litigation, and by New York law in all other cases.
11.2 Amendments. This Side Letter may not be amended, modified, supplemented, or waived except by a written instrument duly executed by authorized representatives of all three Parties. No oral modification or waiver shall be effective.
11.3 Entire Agreement (as to Subject Matter). This Side Letter constitutes the entire agreement among the Parties with respect to the treatment, handling, and protection of privileged and confidential information in connection with the Consent Order remediation. It supplements but does not supersede, modify, or amend the Engagement Agreement (TCG-BRB-2025-001) or the engagement letter between C&H and BRB dated February 10, 2025 (C&H Matter No. 1045-00002), except to the extent expressly provided herein. In the event of any conflict between this Side Letter and the Engagement Agreement with respect to the treatment of privileged or confidential information, the terms of this Side Letter shall control.
11.4 Notices. All notices, requests, demands, consents, and other communications required or permitted under this Side Letter shall be in writing and shall be delivered by hand, by nationally recognized overnight courier service, or by electronic mail (with confirmation of receipt), to the following addresses:
For BRB:
Gregory Nardone, Esq. General Counsel & Corporate Secretary Belmont Ridge Bank National Association 680 Lexington Avenue, 22nd Floor New York, NY 10022
Email: gnardone@belmontridgebank.com
For C&H:
Philip Hartmann, Esq. Partner, Banking & Finance Practice Group Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, NY 10019
Email: phartmann@calderwoodharkness.com
For Thornfield:
Dr. Vivian Castellano Managing Director, Financial Crimes Advisory Thornfield Consulting Group LLC 200 Park Avenue South, 15th Floor New York, NY 10003
Email: vcastellano@thornfieldconsulting.com
With a copy (which shall not constitute notice) to Thornfield's outside counsel:
Hargrove & Stein PC 7 Times Square, 34th Floor New York, NY 10036
Attn: Engagement Partner — Thornfield/BRB Matter
Email: thornfield-brb@hargrovestein.com
Any Party may change its notice address by providing written notice to the other Parties in accordance with this Section 11.4.
11.5 Counterparts. This Side Letter may be executed in any number of counterparts, each of which shall be deemed an original, and all of which together shall constitute one and the same instrument. Delivery of an executed counterpart of a signature page to this Side Letter by facsimile or electronic transmission (including by .pdf attachment) shall be effective as delivery of a manually executed counterpart.
11.6 Severability. If any provision of this Side Letter, or the application thereof to any Party or circumstance, is held invalid, illegal, or unenforceable by a court of competent jurisdiction, the validity, legality, and enforceability of the remaining provisions shall not be affected or impaired thereby, and such remaining provisions shall continue in full force and effect. The Parties shall negotiate in good faith to replace any invalid, illegal, or unenforceable provision with a valid and enforceable provision that achieves, to the greatest extent possible, the economic, business, and other purposes of the invalid, illegal, or unenforceable provision.
11.7 No Third-Party Beneficiaries. This Side Letter is entered into solely for the benefit of the Parties and their respective successors and permitted assigns, and nothing herein, express or implied, is intended to or shall confer upon any other person or entity any legal or equitable right, benefit, or remedy of any nature whatsoever under or by reason of this Side Letter. Without limiting the generality of the foregoing, this Side Letter confers no rights on: Drayton Mercer LLP (BRB's former outside counsel); Veridian Analytics Inc. (provider of the Veridian TMS platform); Ridgeline Data Systems LLC; Caldera & Pope LLP; Pinnacle Compliance Solutions LLC; any BaaS partner of BRB; any shareholder of BRFG; or any other third party.
11.8 Waiver. The failure of any Party to enforce any provision of this Side Letter at any time shall not constitute a waiver of such provision or of the right to enforce such provision (or any other provision) at any later time. No waiver of any provision of this Side Letter shall be effective unless made in writing and signed by the Party granting such waiver.
[SIGNATURE PAGES FOLLOW]
IN WITNESS WHEREOF, the Parties have executed this Privilege and Confidentiality Side Letter Agreement as of the date first written above.
BELMONT RIDGE BANK NATIONAL ASSOCIATION
By: ________
Name: Gregory Nardone
Title: General Counsel & Corporate Secretary
Date: February 10, 2025
CALDERWOOD & HARKNESS LLP
By: ________