privilege-protocol-memorandum.docx

1045-00002 · Calderwood & Harkness LLP · documents

privilege-protocol-memorandum.docx DOCUMENT Antitrust

56 / 84 ← → ✕

PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGED AND CONFIDENTIAL / ATTORNEY WORK PRODUCT DO NOT DISTRIBUTE WITHOUT PRIOR APPROVAL OF GENERAL COUNSEL OR CALDERWOOD & HARKNESS LLP

PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT

PRIVILEGE AND WORK-PRODUCT PROTECTION PROTOCOL MEMORANDUM

PRIVILEGE DESIGNATION: This memorandum and all attachments hereto are protected by the attorney-client privilege and the attorney work-product doctrine. This document contains confidential legal advice and the mental impressions, conclusions, opinions, and legal theories of attorneys at Calderwood & Harkness LLP. This memorandum is intended solely for the use of the addressee and copied individuals identified above. No portion of this memorandum may be disclosed, distributed, copied, or otherwise disseminated to any person or entity without the prior written approval of the General Counsel of Belmont Ridge Bank National Association or the undersigned at Calderwood & Harkness LLP. Any unauthorized disclosure may constitute a waiver of applicable privileges and protections and may have severe and irreversible legal consequences.

Right-click to update Table of Contents

I. PURPOSE AND SCOPE

The purpose of this memorandum is to establish binding privilege and work-product protection guidelines governing all communications, memoranda, reports, analyses, and other materials generated in connection with the Bank Secrecy Act / Anti-Money Laundering ("BSA/AML") and sanctions compliance program remediation undertaken by Belmont Ridge Bank National Association ("BRB" or the "Bank") (OCC Charter No. 48271; FDIC Certificate No. 31845) and its holding company, Belmont Ridge Financial Group, Inc. ("BRFG," NYSE: BRFG) (collectively, the "Belmont Ridge Entities"), in response to OCC Consent Order No. OCC-2025-003, issued January 15, 2025 (the "Consent Order").

Calderwood & Harkness LLP ("C&H") has been retained as outside regulatory counsel to advise the Belmont Ridge Entities on all matters arising out of and related to the Consent Order, including but not limited to the assessment of existing BSA/AML and sanctions compliance program deficiencies, the development and implementation of a comprehensive remediation plan, and the management of associated regulatory, enforcement, and litigation risks. This engagement was formalized by the Engagement Letter dated February 3, 2025, and encompasses the full scope of legal advisory services required to bring the Bank into compliance with the Consent Order and to protect the legal interests of the Belmont Ridge Entities throughout the remediation process.

Engagement Phases. The scope of this Privilege Protocol covers the full engagement period, which is divided into two principal phases:

Phase 1 — Assessment & Remediation Plan: February 10, 2025 through May 15, 2025. During this phase, C&H will conduct a comprehensive legal assessment of the Bank's BSA/AML and sanctions compliance program, identify regulatory and enforcement risks, advise on the development of the Comprehensive Remediation Action Plan required under Article IV of the Consent Order, and coordinate with Thornfield Consulting Group LLC ("Thornfield") in its capacity as OCC-mandated independent consultant.

Phase 2 — Implementation & Monitoring: May 16, 2025 through February 15, 2026. During this phase, C&H will advise on the implementation of the Remediation Action Plan, provide legal guidance on quarterly progress reports required under Article V of the Consent Order, advise on the compliance self-certification required under Article VIII, and continue to manage regulatory and enforcement risks across all relevant agencies.

Applicability. This Privilege Protocol applies to, and is binding upon, the following individuals and entities:

(a) All BRB personnel involved in or having access to the BSA/AML remediation, including officers, employees, contractors, and temporary staff;

(b) All BRFG Board members, including Diane Whitford (Chair and Chief Executive Officer), Arthur Connelly (Vice Chair and Risk Committee Chair), Margaret Dao (Audit Committee Chair), James Rutherford (Compliance Committee Chair), Sandra Villarreal (Director), and Keith Yamamoto (Director);

(c) All Calderwood & Harkness LLP engagement team members, including Philip Hartmann (Responsible Partner), Marcus Delgado (Billing Partner, cross-staffed for fintech patent/licensing compliance), Yuki Nakamura (Lead Associate), and Carlos Espinoza (Working Associate), together with any additional C&H attorneys or staff who may be assigned to the engagement;

(d) All third parties operating under common-interest agreements, confidentiality agreements, or engagement agreements executed in connection with the remediation, including Thornfield Consulting Group LLC and its counsel, Hargrove & Stein PC; and

(e) All vendors and service providers to the extent specified in Section IX of this Protocol.

Critical Importance of Privilege Maintenance. The rigorous maintenance of attorney-client privilege and work-product protection is of paramount importance in the present matter. The Belmont Ridge Entities face an unusually complex and multi-faceted regulatory and litigation landscape that demands the highest level of care in the handling of privileged materials. The following circumstances underscore the criticality of the protocols set forth herein:

(a) OCC Consent Order. The Consent Order itself imposes extensive remediation obligations, including specific deliverables and reporting requirements, and provides for potential further enforcement action in the event of noncompliance. The OCC's oversight of the remediation process will generate significant volumes of documentation, and the Belmont Ridge Entities must carefully distinguish between materials that are properly disclosed to the OCC as part of the examination and supervisory process and materials that are protected by the attorney-client privilege and work-product doctrine.

(b) Potential FinCEN Enforcement. The Financial Crimes Enforcement Network ("FinCEN") is actively monitoring the Bank's SAR filing remediation. FinCEN liaison Angela Drummond, Associate Director of the Enforcement Division, has indicated that FinCEN has reserved its enforcement rights with respect to the Bank's SAR filing deficiencies. FinCEN has not entered into any non-prosecution or deferred prosecution agreement with the Bank, and the possibility of a separate FinCEN civil enforcement action remains.

(c) Risk of DOJ Criminal Referral. As of the date of this memorandum, the Department of Justice has not received a criminal referral from the OCC or FinCEN regarding the Bank's BSA/AML deficiencies. However, the Consent Order does not preclude such a referral, and the nature and scope of the compliance failures — particularly the OFAC screening gaps and SAR filing deficiencies — could potentially give rise to criminal liability under 31 U.S.C. §§ 5322 and 5324, among other provisions. The risk of a DOJ criminal inquiry, while not imminent, is not negligible and must be factored into all privilege determinations.

(d) Potential OFAC Enforcement Exposure. The Bank's failure to screen approximately 3,800,000 transactions processed through the NovaPay banking-as-a-service ("BaaS") partnership during calendar year 2023 against the OFAC Specially Designated Nationals and blocked Persons List ("SDN List") creates substantial exposure to civil enforcement action by the Office of Foreign Assets Control. These unscreened transactions represent approximately 12% of the total 31.7 million NovaPay transactions in CY 2023. C&H is currently evaluating the merits and strategic implications of a voluntary self-disclosure to OFAC, and this analysis is among the most sensitive privileged work product generated in connection with the engagement.

(e) Potential Shareholder Litigation. Brindoval Capital Partners LP, an approximately 8.3% holder of BRFG common stock (approximately 14.9 million shares), represented by Amberly Knox LLP (Steven Briggs, Partner), has expressed significant concern regarding the financial impact of the remediation and the decline in BRFG's share price. On January 16, 2025, the first trading day following public disclosure of the Consent Order, BRFG shares declined from approximately $47.82 to $41.15, a decline of approximately 13.9%. The potential for shareholder derivative suits, securities class actions, or demand letters creates an additional front on which privilege maintenance is essential.

(f) Significant Financial Exposure. The total financial outlay associated with the Consent Order is estimated at approximately $57,000,000, comprising the $42.5 million remediation budget and the $14.5 million civil money penalty imposed under Article X of the Consent Order. This figure represents a material expenditure relative to the Bank's financial position and will attract ongoing scrutiny from shareholders, analysts, and regulatory agencies alike.

Given these circumstances, any inadvertent waiver of privilege could have cascading and potentially catastrophic consequences for the Belmont Ridge Entities. A single waiver event could expose the organization's internal legal analysis, enforcement risk assessments, and litigation strategy to adverse parties across multiple proceedings. This Privilege Protocol is therefore intended to serve as a comprehensive and mandatory set of guidelines that must be followed without exception by all individuals and entities to whom it applies.

II. LEGAL FRAMEWORK FOR PRIVILEGE AND WORK-PRODUCT PROTECTION

A. Attorney-Client Privilege

The attorney-client privilege is the oldest recognized privilege for confidential communications in Anglo-American jurisprudence and serves the fundamental purpose of encouraging full and frank communication between attorneys and their clients, thereby promoting the broader public interest in the observance of law and the administration of justice. In the corporate context, the privilege protects confidential communications between a corporation's employees and its legal counsel when such communications are made for the purpose of obtaining or providing legal advice and are intended to be kept confidential.

For purposes of this engagement, BRB and BRFG are the institutional clients. Calderwood & Harkness LLP serves as outside counsel. The privilege attaches to confidential communications between BRB and BRFG personnel, on the one hand, and C&H attorneys, on the other hand, when such communications are made for the purpose of obtaining or providing legal advice in connection with the BSA/AML and sanctions compliance program remediation. The privilege extends to communications in all forms, including oral communications, written memoranda, electronic mail, presentations, telephone calls, and video conferences.

Gregory Nardone, as General Counsel and Corporate Secretary of BRB and BRFG, is the primary privilege holder on behalf of the institutional client. Mr. Nardone has the authority to assert, maintain, and, where appropriate, waive the privilege on behalf of the Belmont Ridge Entities, subject to the fiduciary duties owed by the Board of Directors. It is a foundational principle that the privilege belongs to the client — that is, to BRB and BRFG as institutions — and not to any individual officer, director, or employee. Accordingly, the privilege can only be waived by the client, acting through Mr. Nardone or through other duly authorized action of the Board, or through circumstances that constitute an implied or involuntary waiver under applicable law.

The C&H attorneys who are authorized to engage in privileged communications with BRB and BRFG personnel in connection with this engagement are Philip Hartmann (Responsible Partner), Marcus Delgado (Billing Partner), Yuki Nakamura (Lead Associate), and Carlos Espinoza (Working Associate). Additional C&H attorneys or staff may be designated from time to time, and any such designation will be communicated to Mr. Nardone in writing.

It bears emphasis that not all communications between an attorney and a client are privileged. The privilege applies only to communications made in confidence for the purpose of seeking or providing legal advice. Communications that are purely factual, business-related, or operational in nature — even if transmitted between an attorney and a client — may not be protected by the privilege. This distinction is of particular significance in the remediation context, where there is necessarily a significant volume of factual and operational information exchanged between C&H and BRB personnel, and care must be taken to ensure that the privileged and non-privileged components of such communications are properly identified and handled.

B. Attorney Work-Product Doctrine

The attorney work-product doctrine, codified in Federal Rule of Civil Procedure 26(b)(3) and recognized under analogous state rules and common-law principles, protects from discovery documents and tangible things that are prepared in anticipation of litigation or for trial by or for another party or its representative. The doctrine serves the dual purpose of protecting the integrity of the adversarial process and preserving the privacy of an attorney's mental processes and legal analysis.

The work-product doctrine applies with particular force in the present engagement. The Consent Order, the potential FinCEN enforcement action, the risk of a DOJ criminal referral, the potential OFAC enforcement action, and the possibility of shareholder litigation each independently establish a reasonable anticipation of litigation or adversarial regulatory proceedings sufficient to trigger work-product protection. Materials prepared by C&H in connection with the remediation engagement — including legal memoranda, research analyses, strategy documents, risk assessments, and related materials — are prepared in anticipation of these proceedings and are entitled to work-product protection.

The law recognizes an important distinction between two categories of work product:

(a) Ordinary (Fact) Work Product. This category encompasses documents and materials that contain or reflect factual information gathered by counsel in anticipation of litigation. Ordinary work product may be discoverable upon a showing of substantial need and undue hardship — that is, when the party seeking discovery demonstrates that it has a substantial need for the materials and cannot, without undue hardship, obtain their substantial equivalent by other means.

(b) Opinion Work Product. This category encompasses documents and materials that reflect the mental impressions, conclusions, opinions, and legal theories of an attorney. Opinion work product receives heightened, near-absolute protection and is virtually never discoverable, even upon a showing of substantial need. Courts have consistently held that opinion work product lies at the core of the work-product doctrine and may be discovered only in the rarest of circumstances.

A substantial portion of the materials generated by C&H in connection with this engagement will constitute opinion work product, reflecting C&H attorneys' legal analysis, strategic judgments, risk assessments, and recommendations regarding the Consent Order, regulatory enforcement exposure, and litigation risks. These materials are entitled to the highest level of protection and must be handled accordingly.

C. Bank Examination Privilege / Self-Evaluative Privilege

The bank examination privilege — sometimes referred to as the self-evaluative or self-critical analysis privilege — provides limited protection for certain internal assessments, evaluations, and analyses conducted by regulated financial institutions in connection with supervisory and examination processes. The contours of this privilege vary by jurisdiction and are not uniformly recognized, but it has been applied in some contexts to protect candid internal evaluations prepared by banks in response to regulatory concerns, on the theory that such protection encourages honest self-assessment and promotes the public interest in sound banking practices.

In the present context, certain of BRB's internal assessments, gap analyses, and compliance evaluations prepared in response to OCC supervisory actions — including matters arising prior to and in connection with the Consent Order — may be eligible for limited protection under this doctrine. However, the self-evaluative privilege has significant limitations and is not universally accepted by courts.

Of particular importance, the OCC as the Bank's primary federal regulator retains broad examination authority under the National Bank Act and related statutes. Materials shared with the OCC under its examination authority are generally treated as confidential supervisory information ("CSI") and are protected from disclosure to third parties under 12 C.F.R. Part 4 (OCC regulations governing the availability and disclosure of information). Specifically, 12 C.F.R. § 4.32 provides that CSI is the property of the OCC and is not to be disclosed by any person or entity without the prior written approval of the OCC. This means that even where BRB provides factual and evaluative information to the OCC as part of the examination and remediation process, such disclosure generally does not constitute a broad waiver of privilege as to third parties — the information retains its confidential character as CSI, and third parties (including litigants, other regulators not entitled to CSI, and the general public) are not entitled to access such materials without OCC authorization.

Notwithstanding this protection, the Belmont Ridge Entities should not rely exclusively on the bank examination privilege or the CSI framework to protect materials that are independently protected by the attorney-client privilege or work-product doctrine. The protocols set forth in this memorandum are designed to ensure that the stronger and more well-established protections of the attorney-client privilege and work-product doctrine are properly invoked and maintained, independent of and in addition to any protections available under the bank examination privilege or CSI regulations.

D. Common-Interest Privilege

The common-interest privilege (sometimes referred to as the "joint-defense privilege" or "allied-litigant privilege") operates as an extension of the attorney-client privilege and permits parties who share a common legal interest to exchange privileged communications without waiving the privilege. The doctrine recognizes that parties with a shared legal interest — even if they are not parties to the same litigation — may need to communicate freely with each other and with their respective counsel in order to advance their common legal objectives, and that such communications should not be subject to discovery by adverse parties.

The common-interest privilege is particularly relevant to the relationship among BRB, C&H, and Thornfield Consulting Group LLC. Although Thornfield serves as the OCC-mandated independent consultant and has a reporting obligation to the OCC, there are certain categories of communications among BRB, C&H, and Thornfield that relate to shared legal interests — specifically, the interest in ensuring that the remediation is conducted in a manner that complies with the Consent Order, minimizes legal exposure, and protects the legitimate legal interests of all parties.

The requirements for invoking the common-interest privilege are as follows:

(a) The parties must share a common legal interest. The interest must be legal in nature, not merely commercial or business-oriented. In the present context, the common legal interest arises from the shared objective of achieving compliance with the Consent Order while protecting the legal interests of BRB and managing the regulatory and litigation risks that attend the remediation process.

(b) The communications must be made in furtherance of the common legal interest. Communications that are purely operational, administrative, or factual — and that do not relate to the provision or receipt of legal advice or the advancement of a shared legal strategy — are not protected by the common-interest privilege.

(c) The communications must be made with a reasonable expectation of confidentiality. All parties to the common-interest arrangement must treat the communications as confidential and must not disclose them to parties outside the common-interest group without authorization.

The terms and conditions of the common-interest arrangement among BRB, C&H, and Thornfield are set forth in the separate Privilege & Confidentiality Side Letter executed in connection with the Thornfield engagement (Thornfield Engagement Reference TCG-BRB-2025-001). That Side Letter defines the categories of communications that are subject to the common-interest privilege, the protocols for handling such communications, and the procedures for resolving disputes regarding the scope of the privilege. All parties and personnel should familiarize themselves with the terms of the Side Letter and ensure that their conduct conforms to its requirements.

III. IDENTIFICATION OF PRIVILEGED AND PROTECTED CATEGORIES OF MATERIALS

The following sections identify the principal categories of materials generated in connection with the BSA/AML remediation engagement and describe the privilege status of each category. This identification is intended to provide practical guidance to all personnel involved in the remediation and to facilitate consistent and defensible privilege determinations. It is not exhaustive; questions regarding the privilege status of specific documents or communications not addressed below should be directed to Philip Hartmann (C&H) and Gregory Nardone (BRB General Counsel).

A. Calderwood & Harkness Legal Advice and Analysis

All memoranda, letters, emails, presentations, and oral communications from C&H to BRB and BRFG providing legal advice regarding the BSA/AML remediation are protected by the attorney-client privilege and, to the extent they constitute documents prepared in anticipation of litigation or regulatory enforcement proceedings, by the work-product doctrine. This category includes, without limitation, the following C&H deliverables:

• Consent Order Analysis Memorandum

• Regulatory Risk Assessment Memorandum

• OFAC Enforcement Risk & Voluntary Self-Disclosure Analysis

• FinCEN Coordination Strategy Memorandum

• Director D&O Liability Analysis Memorandum

• Securities Disclosure Obligations Memorandum

• Shareholder Communication Talking Points

• All other attorney-client privileged memoranda, research memoranda, and strategy documents prepared by C&H in connection with the engagement

In addition, all drafts, redlines, internal C&H communications, and internal working papers relating to the engagement are protected. Internal C&H communications — including communications among C&H attorneys and staff regarding legal analysis, strategy, and case management — constitute opinion work product and are entitled to the highest level of protection.

B. Communications Between BRB Management and C&H

All communications between the C&H engagement team and BRB officers and employees, where such communications are made for the purpose of seeking, obtaining, or providing legal advice in connection with the BSA/AML remediation, are protected by the attorney-client privilege. The BRB personnel whose communications with C&H are anticipated to be most frequent and substantive include, but are not limited to:

• Gregory Nardone, General Counsel & Corporate Secretary

• Patricia Langston, Chief Compliance Officer

• Thomas Ikeda, BSA Officer / AML Program Director

• Melissa Chu, Chief Risk Officer

• Warren Ashby, Head of Fintech Partnerships / BaaS Division

• Linda Petrosian, Chief Information Officer / Chief Technology Officer

• Derek Ballard, Head of Internal Audit

• Raymond Okoye, President / Chief Operating Officer

• Samantha Reeves, Chief Financial Officer

• Diane Whitford, Chief Executive Officer

Communications with BRFG Board members and Board committees regarding legal advice on Consent Order compliance are similarly protected. This includes communications with the Compliance Committee (chaired by James Rutherford), the Audit Committee (chaired by Margaret Dao), and the Risk Committee (chaired by Arthur Connelly). The privilege attaches to these communications to the extent they involve the provision of legal advice or the exchange of confidential information for the purpose of enabling C&H to provide legal advice.

It is important to note, however, that communications between BRB personnel and C&H that are purely factual in nature — for example, the transmission of raw data, transaction records, or system output without any request for or provision of legal advice — may not be privileged in and of themselves. To the extent practicable, BRB personnel who are transmitting factual information to C&H should frame such transmissions in the context of a request for legal advice or in response to a specific request from C&H for information needed to provide legal advice, and should include the privilege legend in the communication.

C. Board-Level Materials

Materials prepared for and presented at Board meetings and Board committee meetings that reflect or incorporate C&H legal advice are protected by the attorney-client privilege. This category includes:

• Board presentations prepared by C&H containing legal analysis, regulatory risk assessments, and strategic recommendations

• Board resolutions reflecting legal advice from C&H

• Board and committee meeting minutes to the extent they record or reflect the substance of C&H legal advice

• Compliance Committee meeting materials, reports, and deliberations reflecting legal guidance from C&H

• The Board Resolution acknowledging the Consent Order and establishing the Compliance Committee, which is due to be adopted no later than February 28, 2025

• The Board Presentation — BSA/AML Remediation Overview, prepared by C&H for the initial Board briefing

An important caveat applies to Board-level materials: Board materials that are purely business or operational in nature — that is, materials that do not contain, reflect, or incorporate legal advice from C&H or in-house counsel — may not be privileged. Many Board materials in the remediation context will be "mixed-content" documents, containing both privileged legal advice and non-privileged business or operational content. Such documents require careful handling. The specific protocols for mixed-content Board materials are addressed in Section VIII below.

D. Thornfield Consulting Group Communications

The privilege status of materials generated by or in connection with Thornfield Consulting Group LLC (Dr. Vivian Castellano, Managing Director; Robert Eastman, Senior Director; Jennifer Hwang, Director; Nathaniel Burgess, Senior Manager) requires particularly careful analysis due to Thornfield's dual role as an OCC-mandated independent consultant and as a participant in the common-interest framework with BRB and C&H.

Thornfield's OCC-Mandated Deliverables. Thornfield's engagement is pursuant to Article VII of the Consent Order, which requires the Bank to retain an independent consultant acceptable to the OCC to conduct specified assessments and to report its findings and recommendations directly to the OCC. Thornfield's formal deliverables to the OCC — specifically, the preliminary gap assessment due April 15, 2025 and the final validation report due February 15, 2026 — are required regulatory deliverables. These deliverables are NOT protected by the attorney-client privilege. They are prepared pursuant to a regulatory mandate and are submitted to the OCC in fulfillment of that mandate, not for the purpose of obtaining or providing legal advice. Once submitted to the OCC, these deliverables become confidential supervisory information subject to 12 C.F.R. Part 4, but they are not attorney-client privileged or work-product protected.

Common-Interest Communications. Communications between Thornfield and C&H or BRB that are made under the common-interest framework and for the purpose of obtaining or providing legal advice may be protected under the common-interest privilege, subject to the terms of the Privilege & Confidentiality Side Letter. For example, if Thornfield consults with C&H regarding the legal implications of a factual finding made during its assessment, that communication may be protected. However, purely operational or factual communications — such as data requests, interview scheduling, and system access arrangements — are not privileged.

Thornfield's Internal Working Papers. Thornfield's internal working papers — including draft analyses, interview notes, and preliminary findings — may have limited work-product protection to the extent they were prepared in anticipation of regulatory enforcement proceedings. However, the applicability of work-product protection to these materials must be evaluated on a document-by-document basis. Thornfield's own counsel, Hargrove & Stein PC (7 Times Square, 34th Floor, New York, NY 10036), should be consulted on questions regarding the privilege status of Thornfield's internal working papers.

C&H Legal Analysis of Thornfield's Findings. C&H's legal analysis of Thornfield's factual findings, preliminary assessments, and recommendations is privileged attorney work product. This includes C&H memoranda analyzing the legal implications of Thornfield's findings, assessing regulatory enforcement risk, and developing legal strategy in response to Thornfield's work. Such analysis must be maintained in separate C&H documents and must not be embedded in or appended to Thornfield's work product or regulatory deliverables.

E. Internal BRB Remediation Documents Created at Direction of Counsel

Documents, reports, analyses, and data compilations prepared by BRB personnel at the specific direction of C&H for the purpose of enabling C&H to provide legal advice in connection with the remediation are protected by the attorney-client privilege and may also qualify as work product. This category encompasses a significant volume of materials, including but not limited to:

• Materials prepared for the SAR lookback project (budgeted at $5.5 million), including historical SAR filing analyses, alert disposition reviews, and transaction re-analyses conducted at C&H's direction

• Materials prepared for the CDD/EDD remediation (budgeted at $4.3 million, covering approximately 47,000 accounts), including customer due diligence files, enhanced due diligence assessments, and risk rating re-evaluations conducted at C&H's direction

• Materials prepared for the OFAC compliance gap analysis, including transaction screening data, sanctions match reports, and gap quantification analyses prepared at C&H's direction

• Internal reports and analyses compiled by BRB personnel in response to specific information requests from C&H

A critical distinction must be drawn between documents prepared at the direction of counsel for the purpose of enabling legal advice and documents prepared for ordinary business purposes or regulatory compliance that would have been created regardless of C&H's engagement. The latter category — for example, routine SARs filed in the ordinary course, standard CDD/EDD files maintained as part of the Bank's compliance program, and regular transaction monitoring reports — is not privileged merely because C&H has been retained. The privilege attaches only where the document was created because of the attorney-client relationship and for the purpose of facilitating legal advice. Where there is any uncertainty, BRB personnel should consult with Mr. Nardone or C&H before making privilege determinations.

F. Vendor and Third-Party Communications

The Bank's remediation effort involves extensive engagement with third-party vendors and service providers. The privilege status of communications with these parties varies depending on the nature of the relationship and the content of the communications.

Veridian Analytics Inc. Communications with Veridian Analytics Inc. (contact: Priya Subramanian, Vice President of Client Solutions; Contract No. VA-BRB-2023-0044) regarding the Transaction Monitoring System ("TMS") v.10.0 upgrade are generally not privileged. Veridian is a technology vendor providing commercial products and services, and the Bank's communications with Veridian regarding system specifications, implementation timelines, testing protocols, and similar matters are business records. However, communications that involve the transmission of legal advice or work product from C&H — for example, C&H's analysis of contractual terms or compliance-related legal requirements to be incorporated into system specifications — may retain their privileged character if properly handled. Commercial negotiations and technical specifications exchanged with Veridian are business records and are not privileged.

Ridgeline Data Systems LLC. Communications with Ridgeline Data Systems LLC (contact: David Marchetti, Chief Revenue Officer) in connection with the evaluation of Ridgeline as a potential alternative or supplementary technology vendor are subject to the mutual non-disclosure agreement ("NDA") between the parties. The NDA imposes contractual confidentiality obligations but does not create attorney-client privilege. Factual and business analysis of the Ridgeline proposal (proposed $7.2 million per year, 5-year term, $36.0 million total contract value) is not privileged. C&H's legal analysis of Ridgeline's proposed contract terms and any comparison memorandum reflecting C&H's legal judgment is privileged work product.

Pinnacle Compliance Solutions LLC. Pinnacle Compliance Solutions LLC (contact: Andrea Solis; Statement of Work Reference: PCS-BRB-2025-0012) has been retained to provide 30 full-time-equivalent temporary compliance analysts at a cost of $3.6 million to support the Bank's operational BSA/AML compliance work during the remediation period. Pinnacle staff are performing operational tasks — SAR investigation, KYC/CDD review, transaction monitoring alert disposition — and are not acting as agents of counsel. Work performed by Pinnacle analysts is generally not privileged; it constitutes ordinary-course compliance activity. Pinnacle staff should not be given access to C&H privileged memoranda or legal analysis. C&H's legal guidance to BRB regarding the supervision protocols, quality control standards, and legal risk aspects of the Pinnacle engagement is privileged.

Caldera & Pope LLP. Caldera & Pope LLP (contact: Franklin Dorsey, CPA; 311 South Wacker Drive, Suite 5400, Chicago, IL 60606) serves as the Bank's external auditor (annual audit fee: $3.4 million) and as the BSA/AML independent testing firm (testing fee: $1.1 million). Audit communications and BSA/AML independent test results are not attorney-client privileged. Independent testing reports — including the September 2024 BSA/AML independent test that identified deficiencies subsequently echoed in the Consent Order — are regulatory compliance documents prepared in the ordinary course and are not privileged. C&H's legal analysis of Caldera & Pope's findings, conclusions, and recommendations is privileged work product. Caldera & Pope should not receive access to C&H privileged legal memoranda, and C&H's legal analysis should not be shared with Caldera & Pope absent express authorization from Mr. Nardone and Mr. Hartmann.

G. Prior Counsel Materials

Drayton Mercer LLP (contact: Helen Frazier, formerly at 55 East 52nd Street, Suite 3100, New York, NY 10055) served as the Bank's outside regulatory counsel from 2019 through 2024. The Drayton Mercer engagement was terminated in January 2025 in connection with the retention of C&H. The Bank's attorney-client privilege in communications with Drayton Mercer continues notwithstanding the termination of that engagement. The privilege is the Bank's privilege, and termination of the attorney-client relationship does not extinguish the privilege in prior communications made during the course of the representation.

C&H should take the following steps with respect to Drayton Mercer materials:

(a) Obtain all Drayton Mercer files, including paper and electronic files, relating to the Bank's BSA/AML compliance program, OCC supervisory matters, and related regulatory issues;

(b) Review the Drayton Mercer files to identify privileged and work-product protected materials;

(d) BRB should issue a formal document preservation and transfer request to Drayton Mercer directing the firm to preserve all files and to transfer such files to C&H or to BRB's General Counsel's office, as appropriate.

Any Drayton Mercer materials that are shared with C&H in connection with the current engagement retain their privileged status. The transfer of privileged materials from one attorney to a successor attorney on behalf of the same client does not constitute a waiver of privilege.

IV. DOCUMENT LABELING AND HANDLING CONVENTIONS

Consistent and conspicuous labeling of privileged documents is a cornerstone of effective privilege protection. While the presence or absence of a privilege label is not dispositive of whether a document is in fact privileged, proper labeling serves several critical functions: it puts all recipients on notice that the document is claimed as privileged, it facilitates the identification and segregation of privileged materials in the event of a document production or regulatory request, and it supports the assertion that the privilege was intentionally invoked and maintained.

A. Required Privilege Labels

All documents prepared by or at the direction of C&H that contain legal advice or reflect attorney mental impressions, conclusions, opinions, or legal theories must bear one of the following header and/or footer legends, as appropriate:

(a) "PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION" — for documents that are protected by the attorney-client privilege;

(b) "PRIVILEGED & CONFIDENTIAL — ATTORNEY WORK PRODUCT" — for documents that are protected by the work-product doctrine;

(c) "PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION / ATTORNEY WORK PRODUCT" — for documents that are protected by both the attorney-client privilege and the work-product doctrine (dual-protected documents).

Documents that are shared under the common-interest framework with Thornfield Consulting Group LLC must additionally bear the following legend:

"COMMON INTEREST — SUBJECT TO JOINT PRIVILEGE"

Documents that contain OCC confidential supervisory information — including the Consent Order itself, examination reports, Matters Requiring Attention ("MRA") or Matters Requiring Immediate Attention ("MRIA") correspondence, and related supervisory communications — must additionally bear the following legend, in accordance with 12 C.F.R. Part 4:

"CONFIDENTIAL SUPERVISORY INFORMATION — NOT FOR PUBLIC DISCLOSURE"

Where a single document is subject to multiple designations (e.g., a privileged attorney-client communication that also incorporates confidential supervisory information), all applicable legends should be included. The legends should appear in the header, footer, or cover page of the document in a manner that is conspicuous and readily identifiable.

B. Electronic Communications (Email)

Email is the predominant medium of communication in the modern legal and business environment, and particular care must be taken to ensure that the privilege is maintained in the electronic communication context.

All emails from C&H attorneys to BRB personnel that contain legal advice must include the appropriate privilege legend in the body of the email or in the signature block. Where an email thread includes both privileged and non-privileged communications, C&H attorneys should clearly delineate the privileged portions of the communication.

Subject lines of emails containing privileged content should not reveal the substance of the privileged communication. Generic, non-descriptive subject lines should be used. For example, an email containing C&H's legal analysis of the OFAC screening gap should use a subject line such as "BSA/AML Remediation — Legal Analysis" rather than a subject line that summarizes the legal conclusion or reveals the nature of the legal advice. This precaution is important because subject lines are frequently visible in email previews, search results, and metadata, and a descriptive subject line could disclose privileged content even if the body of the email is not accessed.

BRB personnel who are emailing C&H to seek legal advice should include the phrase "Attorney-Client Privileged" in the subject line of the email. This practice puts all recipients on notice that the communication is intended to be privileged and reinforces the confidential nature of the exchange.

Inadvertent Forwarding Protocol. In the event that a privileged email is inadvertently forwarded to an unintended recipient — whether an internal BRB employee without a need to know, an external party, or any other person not authorized to receive the communication — the following steps must be taken immediately:

(i) The individual who sent or became aware of the inadvertent forwarding must immediately notify Gregory Nardone and Philip Hartmann;

(ii) The unintended recipient must be contacted promptly and instructed to delete the communication and all copies thereof, to not retain or forward the communication, and to not disclose its contents to any other person;

(iii) C&H will assess the potential for privilege waiver and will take such steps as are necessary to mitigate the risk, including, where appropriate, seeking a claw-back order or invoking the protections of Federal Rule of Evidence 502(b); and

(iv) The incident must be documented in the privilege log with a notation describing the nature of the inadvertent disclosure, the steps taken to remediate, and C&H's assessment of the waiver implications.

C. Physical Documents

Hard-copy privileged documents must be maintained in segregated, clearly labeled files that are physically separate from the Bank's ordinary business records. Physical files containing privileged remediation materials should be stored in a secure location with restricted access, and should be clearly labeled with the C&H Matter No. 1045-00002 designation and the appropriate privilege legend.

Electronic copies of privileged documents must similarly be stored in segregated, access-controlled repositories within the Bank's document management system. The filing convention for all privileged remediation materials should use the C&H Matter No. 1045-00002 designation as the primary organizational identifier. Access to the electronic repository should be limited to individuals who have a need to know and who have executed the written acknowledgment described in Section XIII below.

D. Draft Documents

The handling of draft documents requires particular attention. Throughout the remediation process, numerous deliverables will be prepared, revised, and finalized, including the Comprehensive Remediation Action Plan, revised BSA/AML policies and procedures, SAR/CDD/EDD workstream documents, OFAC screening procedures, and various other documents. Many of these deliverables will be circulated between C&H and BRB in draft form for the purpose of incorporating C&H's legal advice and ensuring legal sufficiency.

All drafts of deliverables circulated between C&H and BRB for the purpose of obtaining or incorporating legal advice should be labeled as drafts (e.g., "DRAFT — FOR DISCUSSION PURPOSES ONLY") and should bear the appropriate privilege legend. The draft status and privilege designation should be maintained throughout the drafting process.

Once a document is finalized and submitted to the OCC — for example, the Comprehensive Remediation Action Plan due May 15, 2025, the quarterly progress reports due September 15, 2025 and December 15, 2025, or the compliance self-certification due February 15, 2026 — the final version as submitted to the OCC loses its privileged status as to the OCC. The document is furnished to the OCC as a regulatory deliverable and becomes confidential supervisory information. However, the final submitted version may retain privilege and work-product protection as to third parties, depending on the circumstances and the content of the document.

Of critical importance, prior drafts of the deliverables — including drafts that reflect C&H's legal advice, redlines showing C&H's edits and comments, internal deliberation memoranda, and all other materials reflecting the evolution of the document through the drafting process — remain privileged and must not be produced to the OCC or to any third party without the express prior authorization of both Gregory Nardone and Philip Hartmann. The distinction between the final submitted version and the prior drafts must be scrupulously maintained.

V. PRIVILEGE LOG MAINTENANCE

A. Obligation to Maintain a Privilege Log

The maintenance of a comprehensive and accurate privilege log is essential to the preservation and defense of privilege claims. A privilege log serves as the evidentiary record of the client's assertion of privilege and provides the factual basis for a court or regulatory body to evaluate the validity of the privilege claim. In the absence of a properly maintained privilege log, privilege assertions may be deemed waived or otherwise unenforceable.

BRB's legal department, under the supervision of Gregory Nardone and with the assistance of designated paralegal support, shall maintain a running privilege log cataloging all documents and communications claimed as privileged or work-product protected in connection with the BSA/AML remediation. This privilege log shall be maintained on an ongoing basis throughout the engagement period and shall be updated promptly as new privileged materials are created or identified.

C&H will maintain a parallel internal privilege log for its own work product and communications. The C&H privilege log will be maintained by Yuki Nakamura (Lead Associate) with the assistance of Carlos Espinoza (Working Associate) and such other C&H personnel as may be designated. The C&H privilege log will track all C&H-generated documents, memoranda, communications, and work product related to the engagement.

B. Privilege Log Contents

Each entry in the privilege log shall include the following information, at a minimum:

(a) Document Date: The date the document was created or the communication was made;

(b) Author: The name and title/position of the author or sender;

(d) Document Type: A description of the type of document (e.g., memorandum, email, letter, presentation, meeting minutes, draft, redline, handwritten notes);

(e) Subject Matter Description: A sufficiently detailed description of the subject matter to support the privilege claim without revealing the substance of the privileged content. The description should identify the general topic and the purpose of the communication (e.g., "Memorandum from C&H to BRB General Counsel providing legal advice regarding OFAC enforcement risk assessment in connection with BSA/AML remediation") without disclosing the specific legal advice, conclusions, or mental impressions contained in the document;

(f) Privilege(s) Asserted: Identification of the specific privilege or protection asserted for the document (e.g., attorney-client privilege, attorney work product, common-interest privilege, or a combination thereof);

(g) Custodian/Location: Identification of the custodian of the document and its physical or electronic storage location.

The level of detail in the privilege log must be sufficient to allow a reviewing court or regulatory body to make an informed determination regarding the validity of the privilege claim. Boilerplate or conclusory descriptions are insufficient and may result in a finding of waiver. At the same time, the descriptions must not disclose the substance of the privileged communication, as such disclosure would undermine the very privilege being asserted.

C. Periodic Review

C&H and BRB's legal department shall conduct a joint review of the privilege log on a monthly basis to ensure its completeness and accuracy. The monthly review shall include:

(a) Verification that all newly created privileged documents and communications have been logged;

(b) Review of existing entries for accuracy and adequacy of descriptions;

(d) Confirmation that the privilege log is in a form that would be defensible if produced in response to a subpoena, litigation discovery request, or regulatory inquiry.

The privilege log must be maintained in a current and defensible state at all times. In the event of any subpoena, civil investigative demand, litigation discovery request, or regulatory inquiry that implicates the privileged materials, the privilege log must be ready for production on short notice.

VI. PROTOCOLS FOR SHARING INFORMATION WITH THE OCC AND FINCEN WITHOUT WAIVER

A. Regulatory Disclosures Under OCC Authority

The Consent Order imposes extensive information-sharing and reporting obligations on BRB. The Bank is required to provide the OCC with detailed information regarding its remediation efforts, including the following principal deliverables:

(a) Comprehensive Remediation Action Plan — due May 15, 2025 (Article IV of the Consent Order);

(b) Quarterly Progress Reports — due September 15, 2025 and December 15, 2025 (Article V of the Consent Order); and

In addition to these formal deliverables, the OCC Examiner-in-Charge, Jonathan Frey (OCC Northeastern District Office, 340 Madison Avenue, New York, NY 10017), may request additional information, documentation, and access to Bank personnel in the exercise of the OCC's examination authority.

Disclosure of factual and operational information to the OCC pursuant to its examination authority and the Consent Order generally does not constitute a broad waiver of the attorney-client privilege or work-product protection as to third parties. The OCC is the Bank's primary federal regulator, and the Bank's cooperation with OCC examination and supervisory processes is required by law. Under 12 C.F.R. Part 4, information provided to the OCC in the supervisory and examination context is treated as confidential supervisory information and is protected from disclosure to third parties. The provision of information to the OCC under these circumstances does not constitute a voluntary disclosure to an adversary or a general publication of the information, and courts have generally held that such disclosures do not waive privilege as to third parties.

However, the distinction between factual and operational information, on the one hand, and legal advice and work product, on the other, must be scrupulously maintained in the regulatory disclosure context. Care must be taken to ensure that C&H's legal analysis, opinions, mental impressions, strategic recommendations, and enforcement risk assessments are NOT embedded in, appended to, or referenced in factual or operational reports submitted to the OCC. Factual deliverables — such as the Remediation Action Plan, quarterly progress reports, and the compliance self-certification — should be drafted as standalone documents that present facts, operational data, and compliance status without incorporating or revealing C&H's privileged legal advice. C&H's privileged analysis should be maintained in separate attorney-client privileged memoranda that are not shared with the OCC.

B. Protocol for OCC Submissions

To implement the principle described above, the following protocol shall govern all submissions to the OCC in connection with the remediation:

(a) Pre-Submission Review. All documents to be submitted to the OCC must be reviewed and approved by both Philip Hartmann and Gregory Nardone prior to submission. No document shall be transmitted to the OCC without this dual approval.

(b) Dual-Version Drafting. Where appropriate, C&H will prepare two versions of key deliverables: (i) a privileged attorney-client version containing C&H's legal analysis, strategic recommendations, risk assessments, and related legal advice, which will be retained as privileged work product and will not be submitted to the OCC; and (ii) a factual and operational version suitable for OCC submission, which will present relevant facts, data, compliance measures, and implementation progress without disclosing C&H's legal advice or work product. The factual version will be drafted by C&H with appropriate care to ensure that it does not inadvertently incorporate or reveal privileged content.

(c) Cover Letters. Cover letters transmitting deliverables to the OCC — such as the cover letter accompanying the Remediation Action Plan on May 15, 2025 — should be carefully drafted to reference the Bank's cooperation obligations under the Consent Order without making admissions of liability, acknowledging legal conclusions, or disclosing legal strategy. Cover letters should be factual and professional in tone, expressing the Bank's commitment to compliance without volunteering information or characterizations that could be used against the Bank in other proceedings.

(d) Prohibition on Incorporation of Legal Advice. No document submitted to the OCC shall quote, summarize, paraphrase, or otherwise incorporate C&H legal advice or work product without prior privilege review and the express written approval of both Philip Hartmann and Gregory Nardone. If there is any question as to whether a document contains privileged content, the document must be submitted to C&H for privilege review before it is transmitted to the OCC.

C. Protocol for FinCEN Communications

FinCEN, through its liaison Angela Drummond, Associate Director of the Enforcement Division, is actively monitoring the Bank's SAR filing remediation efforts and has expressly reserved its enforcement rights. FinCEN has not entered into any formal agreement with the Bank that limits or precludes enforcement action, and the possibility of a separate FinCEN civil monetary penalty or enforcement proceeding remains. In light of these circumstances, communications with FinCEN must be treated with the same level of privilege scrutiny as communications with the OCC.

The following protocol shall govern all communications with FinCEN:

(a) Pre-Approval Requirement. All outgoing communications to FinCEN — whether written or oral — must be pre-approved by both Philip Hartmann and Gregory Nardone. No BRB employee shall communicate with FinCEN regarding the BSA/AML remediation or related matters without prior authorization.

(b) SAR Filings. The Bank's SAR filings themselves are not privileged. SARs are mandatory regulatory filings required under 31 U.S.C. § 5318(g) and the implementing regulations at 31 C.F.R. Part 1020, and they are filed with FinCEN in the ordinary course of the Bank's compliance obligations. The content of SAR filings is governed by applicable legal requirements and must accurately report suspicious activity. However, C&H's legal analysis of SAR filing decisions — including the lookback methodology, the criteria for identifying reportable activity, enforcement risk assessments, and legal strategy regarding borderline cases — is privileged work product and must not be disclosed to FinCEN or any other party.

(c) SAR Lookback Project. The SAR lookback project (budgeted at $5.5 million) and the SAR backlog clearance effort (involving approximately 2,400 pending alerts) will generate large volumes of case files, alert disposition records, and related documentation. Operational disposition records — including case files documenting the facts underlying the filing or non-filing decision — are not privileged and are subject to examination by regulators. However, C&H's legal guidance on filing decisions, particularly for borderline cases that present difficult legal judgments, should be documented in separate privileged memoranda that are distinct from the operational case files. Under no circumstances should C&H's legal advice be incorporated into the narrative of a SAR filing or into the operational case file.

D. Protocol for Potential DOJ or OFAC Inquiries

Given the nature and scope of the Bank's BSA/AML and sanctions compliance failures, the possibility of a DOJ criminal inquiry or an OFAC enforcement investigation cannot be excluded. In the event that either the DOJ or OFAC initiates an inquiry, investigation, or enforcement proceeding, the following protocol shall apply:

(a) Exclusive Routing Through C&H. All communications with the DOJ or OFAC in connection with any inquiry, investigation, or enforcement proceeding shall be routed exclusively through C&H. No BRB employee shall engage in any communication — written, oral, or otherwise — with the DOJ or OFAC regarding the matters covered by this Protocol without the prior authorization of Gregory Nardone and Philip Hartmann.

(b) Prohibition on Unilateral Responses. No BRB employee shall respond to any DOJ or OFAC inquiry, request for information, interview request, or other communication without prior authorization from Gregory Nardone and Philip Hartmann. This prohibition applies to all forms of communication, including informal contacts, telephone calls, and emails.

(c) Legal Process. Grand jury subpoenas, civil investigative demands ("CIDs"), OFAC administrative subpoenas, or any other form of compulsory legal process must be immediately forwarded to C&H for evaluation. C&H will assess the scope of the process, identify privilege objections and protective measures, and develop a response strategy. C&H will coordinate with Gregory Nardone on all responses to legal process.

(d) OFAC Voluntary Self-Disclosure Analysis. C&H's analysis of the strategic considerations relating to a potential voluntary self-disclosure to OFAC regarding the approximately 3,800,000 unscreened NovaPay transactions in calendar year 2023 (representing approximately 12% of the total 31.7 million NovaPay transactions processed during that period) is among the most sensitive privileged work product generated in connection with this engagement. This analysis encompasses C&H's assessment of the legal exposure, the potential mitigating benefits of a voluntary self-disclosure under OFAC's Enforcement Guidelines, the strategic risks and benefits, and C&H's recommendations. This analysis must not be disclosed to any party other than authorized BRB management and the BRFG Board, and access should be limited to individuals with a direct need to know.

VII. TREATMENT OF THORNFIELD CONSULTING GROUP MATERIALS

A. Thornfield's Dual Role

Thornfield Consulting Group LLC, with offices at 200 Park Avenue South, 15th Floor, New York, NY 10003, has been retained to serve as the OCC-mandated independent consultant under Article VII of the Consent Order. Thornfield occupies a unique position in the remediation process, one that creates significant complexity from a privilege standpoint.

On the one hand, Thornfield has a statutory and regulatory reporting obligation to the OCC. Its formal deliverables — the preliminary gap assessment due April 15, 2025 and the final validation report due February 15, 2026 — are regulatory documents that must be submitted directly to the OCC. These deliverables are not attorney-client privileged, and their content is controlled by Thornfield in the exercise of its independ

PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGED AND CONFIDENTIAL / ATTORNEY WORK PRODUCT DO NOT DISTRIBUTE WITHOUT PRIOR APPROVAL OF GENERAL COUNSEL OR CALDERWOOD & HARKNESS LLP
PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT
PRIVILEGE AND WORK-PRODUCT PROTECTION PROTOCOL MEMORANDUM
PRIVILEGE DESIGNATION: This memorandum and all attachments hereto are protected by the attorney-client privilege and the attorney work-product doctrine. This document contains confidential legal advice and the mental impressions, conclusions, opinions, and legal theories of attorneys at Calderwood & Harkness LLP. This memorandum is intended solely for the use of the addressee and copied individuals identified above. No portion of this memorandum may be disclosed, distributed, copied, or otherwise disseminated to any person or entity without the prior written approval of the General Counsel of Belmont Ridge Bank National Association or the undersigned at Calderwood & Harkness LLP. Any unauthorized disclosure may constitute a waiver of applicable privileges and protections and may have severe and irreversible legal consequences.
Right-click to update Table of Contents
I. PURPOSE AND SCOPE
The purpose of this memorandum is to establish binding privilege and work-product protection guidelines governing all communications, memoranda, reports, analyses, and other materials generated in connection with the Bank Secrecy Act / Anti-Money Laundering ("BSA/AML") and sanctions compliance program remediation undertaken by Belmont Ridge Bank National Association ("BRB" or the "Bank") (OCC Charter No. 48271; FDIC Certificate No. 31845) and its holding company, Belmont Ridge Financial Group, Inc. ("BRFG," NYSE: BRFG) (collectively, the "Belmont Ridge Entities"), in response to OCC Consent Order No. OCC-2025-003, issued January 15, 2025 (the "Consent Order").
Calderwood & Harkness LLP ("C&H") has been retained as outside regulatory counsel to advise the Belmont Ridge Entities on all matters arising out of and related to the Consent Order, including but not limited to the assessment of existing BSA/AML and sanctions compliance program deficiencies, the development and implementation of a comprehensive remediation plan, and the management of associated regulatory, enforcement, and litigation risks. This engagement was formalized by the Engagement Letter dated February 3, 2025, and encompasses the full scope of legal advisory services required to bring the Bank into compliance with the Consent Order and to protect the legal interests of the Belmont Ridge Entities throughout the remediation process.
Engagement Phases. The scope of this Privilege Protocol covers the full engagement period, which is divided into two principal phases:
Phase 1 — Assessment & Remediation Plan: February 10, 2025 through May 15, 2025. During this phase, C&H will conduct a comprehensive legal assessment of the Bank's BSA/AML and sanctions compliance program, identify regulatory and enforcement risks, advise on the development of the Comprehensive Remediation Action Plan required under Article IV of the Consent Order, and coordinate with Thornfield Consulting Group LLC ("Thornfield") in its capacity as OCC-mandated independent consultant.
Phase 2 — Implementation & Monitoring: May 16, 2025 through February 15, 2026. During this phase, C&H will advise on the implementation of the Remediation Action Plan, provide legal guidance on quarterly progress reports required under Article V of the Consent Order, advise on the compliance self-certification required under Article VIII, and continue to manage regulatory and enforcement risks across all relevant agencies.
Applicability. This Privilege Protocol applies to, and is binding upon, the following individuals and entities:
(a) All BRB personnel involved in or having access to the BSA/AML remediation, including officers, employees, contractors, and temporary staff;
(b) All BRFG Board members, including Diane Whitford (Chair and Chief Executive Officer), Arthur Connelly (Vice Chair and Risk Committee Chair), Margaret Dao (Audit Committee Chair), James Rutherford (Compliance Committee Chair), Sandra Villarreal (Director), and Keith Yamamoto (Director);
(c) All Calderwood & Harkness LLP engagement team members, including Philip Hartmann (Responsible Partner), Marcus Delgado (Billing Partner, cross-staffed for fintech patent/licensing compliance), Yuki Nakamura (Lead Associate), and Carlos Espinoza (Working Associate), together with any additional C&H attorneys or staff who may be assigned to the engagement;
(d) All third parties operating under common-interest agreements, confidentiality agreements, or engagement agreements executed in connection with the remediation, including Thornfield Consulting Group LLC and its counsel, Hargrove & Stein PC; and
(e) All vendors and service providers to the extent specified in Section IX of this Protocol.
Critical Importance of Privilege Maintenance. The rigorous maintenance of attorney-client privilege and work-product protection is of paramount importance in the present matter. The Belmont Ridge Entities face an unusually complex and multi-faceted regulatory and litigation landscape that demands the highest level of care in the handling of privileged materials. The following circumstances underscore the criticality of the protocols set forth herein:
(a) OCC Consent Order. The Consent Order itself imposes extensive remediation obligations, including specific deliverables and reporting requirements, and provides for potential further enforcement action in the event of noncompliance. The OCC's oversight of the remediation process will generate significant volumes of documentation, and the Belmont Ridge Entities must carefully distinguish between materials that are properly disclosed to the OCC as part of the examination and supervisory process and materials that are protected by the attorney-client privilege and work-product doctrine.
(b) Potential FinCEN Enforcement. The Financial Crimes Enforcement Network ("FinCEN") is actively monitoring the Bank's SAR filing remediation. FinCEN liaison Angela Drummond, Associate Director of the Enforcement Division, has indicated that FinCEN has reserved its enforcement rights with respect to the Bank's SAR filing deficiencies. FinCEN has not entered into any non-prosecution or deferred prosecution agreement with the Bank, and the possibility of a separate FinCEN civil enforcement action remains.
(c) Risk of DOJ Criminal Referral. As of the date of this memorandum, the Department of Justice has not received a criminal referral from the OCC or FinCEN regarding the Bank's BSA/AML deficiencies. However, the Consent Order does not preclude such a referral, and the nature and scope of the compliance failures — particularly the OFAC screening gaps and SAR filing deficiencies — could potentially give rise to criminal liability under 31 U.S.C. §§ 5322 and 5324, among other provisions. The risk of a DOJ criminal inquiry, while not imminent, is not negligible and must be factored into all privilege determinations.
(d) Potential OFAC Enforcement Exposure. The Bank's failure to screen approximately 3,800,000 transactions processed through the NovaPay banking-as-a-service ("BaaS") partnership during calendar year 2023 against the OFAC Specially Designated Nationals and blocked Persons List ("SDN List") creates substantial exposure to civil enforcement action by the Office of Foreign Assets Control. These unscreened transactions represent approximately 12% of the total 31.7 million NovaPay transactions in CY 2023. C&H is currently evaluating the merits and strategic implications of a voluntary self-disclosure to OFAC, and this analysis is among the most sensitive privileged work product generated in connection with the engagement.
(e) Potential Shareholder Litigation. Brindoval Capital Partners LP, an approximately 8.3% holder of BRFG common stock (approximately 14.9 million shares), represented by Amberly Knox LLP (Steven Briggs, Partner), has expressed significant concern regarding the financial impact of the remediation and the decline in BRFG's share price. On January 16, 2025, the first trading day following public disclosure of the Consent Order, BRFG shares declined from approximately $47.82 to $41.15, a decline of approximately 13.9%. The potential for shareholder derivative suits, securities class actions, or demand letters creates an additional front on which privilege maintenance is essential.
(f) Significant Financial Exposure. The total financial outlay associated with the Consent Order is estimated at approximately $57,000,000, comprising the $42.5 million remediation budget and the $14.5 million civil money penalty imposed under Article X of the Consent Order. This figure represents a material expenditure relative to the Bank's financial position and will attract ongoing scrutiny from shareholders, analysts, and regulatory agencies alike.
Given these circumstances, any inadvertent waiver of privilege could have cascading and potentially catastrophic consequences for the Belmont Ridge Entities. A single waiver event could expose the organization's internal legal analysis, enforcement risk assessments, and litigation strategy to adverse parties across multiple proceedings. This Privilege Protocol is therefore intended to serve as a comprehensive and mandatory set of guidelines that must be followed without exception by all individuals and entities to whom it applies.
II. LEGAL FRAMEWORK FOR PRIVILEGE AND WORK-PRODUCT PROTECTION
A. Attorney-Client Privilege
The attorney-client privilege is the oldest recognized privilege for confidential communications in Anglo-American jurisprudence and serves the fundamental purpose of encouraging full and frank communication between attorneys and their clients, thereby promoting the broader public interest in the observance of law and the administration of justice. In the corporate context, the privilege protects confidential communications between a corporation's employees and its legal counsel when such communications are made for the purpose of obtaining or providing legal advice and are intended to be kept confidential.
For purposes of this engagement, BRB and BRFG are the institutional clients. Calderwood & Harkness LLP serves as outside counsel. The privilege attaches to confidential communications between BRB and BRFG personnel, on the one hand, and C&H attorneys, on the other hand, when such communications are made for the purpose of obtaining or providing legal advice in connection with the BSA/AML and sanctions compliance program remediation. The privilege extends to communications in all forms, including oral communications, written memoranda, electronic mail, presentations, telephone calls, and video conferences.
Gregory Nardone, as General Counsel and Corporate Secretary of BRB and BRFG, is the primary privilege holder on behalf of the institutional client. Mr. Nardone has the authority to assert, maintain, and, where appropriate, waive the privilege on behalf of the Belmont Ridge Entities, subject to the fiduciary duties owed by the Board of Directors. It is a foundational principle that the privilege belongs to the client — that is, to BRB and BRFG as institutions — and not to any individual officer, director, or employee. Accordingly, the privilege can only be waived by the client, acting through Mr. Nardone or through other duly authorized action of the Board, or through circumstances that constitute an implied or involuntary waiver under applicable law.
The C&H attorneys who are authorized to engage in privileged communications with BRB and BRFG personnel in connection with this engagement are Philip Hartmann (Responsible Partner), Marcus Delgado (Billing Partner), Yuki Nakamura (Lead Associate), and Carlos Espinoza (Working Associate). Additional C&H attorneys or staff may be designated from time to time, and any such designation will be communicated to Mr. Nardone in writing.
It bears emphasis that not all communications between an attorney and a client are privileged. The privilege applies only to communications made in confidence for the purpose of seeking or providing legal advice. Communications that are purely factual, business-related, or operational in nature — even if transmitted between an attorney and a client — may not be protected by the privilege. This distinction is of particular significance in the remediation context, where there is necessarily a significant volume of factual and operational information exchanged between C&H and BRB personnel, and care must be taken to ensure that the privileged and non-privileged components of such communications are properly identified and handled.
B. Attorney Work-Product Doctrine
The attorney work-product doctrine, codified in Federal Rule of Civil Procedure 26(b)(3) and recognized under analogous state rules and common-law principles, protects from discovery documents and tangible things that are prepared in anticipation of litigation or for trial by or for another party or its representative. The doctrine serves the dual purpose of protecting the integrity of the adversarial process and preserving the privacy of an attorney's mental processes and legal analysis.
The work-product doctrine applies with particular force in the present engagement. The Consent Order, the potential FinCEN enforcement action, the risk of a DOJ criminal referral, the potential OFAC enforcement action, and the possibility of shareholder litigation each independently establish a reasonable anticipation of litigation or adversarial regulatory proceedings sufficient to trigger work-product protection. Materials prepared by C&H in connection with the remediation engagement — including legal memoranda, research analyses, strategy documents, risk assessments, and related materials — are prepared in anticipation of these proceedings and are entitled to work-product protection.
The law recognizes an important distinction between two categories of work product:
(a) Ordinary (Fact) Work Product. This category encompasses documents and materials that contain or reflect factual information gathered by counsel in anticipation of litigation. Ordinary work product may be discoverable upon a showing of substantial need and undue hardship — that is, when the party seeking discovery demonstrates that it has a substantial need for the materials and cannot, without undue hardship, obtain their substantial equivalent by other means.
(b) Opinion Work Product. This category encompasses documents and materials that reflect the mental impressions, conclusions, opinions, and legal theories of an attorney. Opinion work product receives heightened, near-absolute protection and is virtually never discoverable, even upon a showing of substantial need. Courts have consistently held that opinion work product lies at the core of the work-product doctrine and may be discovered only in the rarest of circumstances.
A substantial portion of the materials generated by C&H in connection with this engagement will constitute opinion work product, reflecting C&H attorneys' legal analysis, strategic judgments, risk assessments, and recommendations regarding the Consent Order, regulatory enforcement exposure, and litigation risks. These materials are entitled to the highest level of protection and must be handled accordingly.
C. Bank Examination Privilege / Self-Evaluative Privilege
The bank examination privilege — sometimes referred to as the self-evaluative or self-critical analysis privilege — provides limited protection for certain internal assessments, evaluations, and analyses conducted by regulated financial institutions in connection with supervisory and examination processes. The contours of this privilege vary by jurisdiction and are not uniformly recognized, but it has been applied in some contexts to protect candid internal evaluations prepared by banks in response to regulatory concerns, on the theory that such protection encourages honest self-assessment and promotes the public interest in sound banking practices.
In the present context, certain of BRB's internal assessments, gap analyses, and compliance evaluations prepared in response to OCC supervisory actions — including matters arising prior to and in connection with the Consent Order — may be eligible for limited protection under this doctrine. However, the self-evaluative privilege has significant limitations and is not universally accepted by courts.
Of particular importance, the OCC as the Bank's primary federal regulator retains broad examination authority under the National Bank Act and related statutes. Materials shared with the OCC under its examination authority are generally treated as confidential supervisory information ("CSI") and are protected from disclosure to third parties under 12 C.F.R. Part 4 (OCC regulations governing the availability and disclosure of information). Specifically, 12 C.F.R. § 4.32 provides that CSI is the property of the OCC and is not to be disclosed by any person or entity without the prior written approval of the OCC. This means that even where BRB provides factual and evaluative information to the OCC as part of the examination and remediation process, such disclosure generally does not constitute a broad waiver of privilege as to third parties — the information retains its confidential character as CSI, and third parties (including litigants, other regulators not entitled to CSI, and the general public) are not entitled to access such materials without OCC authorization.
Notwithstanding this protection, the Belmont Ridge Entities should not rely exclusively on the bank examination privilege or the CSI framework to protect materials that are independently protected by the attorney-client privilege or work-product doctrine. The protocols set forth in this memorandum are designed to ensure that the stronger and more well-established protections of the attorney-client privilege and work-product doctrine are properly invoked and maintained, independent of and in addition to any protections available under the bank examination privilege or CSI regulations.
D. Common-Interest Privilege
The common-interest privilege (sometimes referred to as the "joint-defense privilege" or "allied-litigant privilege") operates as an extension of the attorney-client privilege and permits parties who share a common legal interest to exchange privileged communications without waiving the privilege. The doctrine recognizes that parties with a shared legal interest — even if they are not parties to the same litigation — may need to communicate freely with each other and with their respective counsel in order to advance their common legal objectives, and that such communications should not be subject to discovery by adverse parties.
The common-interest privilege is particularly relevant to the relationship among BRB, C&H, and Thornfield Consulting Group LLC. Although Thornfield serves as the OCC-mandated independent consultant and has a reporting obligation to the OCC, there are certain categories of communications among BRB, C&H, and Thornfield that relate to shared legal interests — specifically, the interest in ensuring that the remediation is conducted in a manner that complies with the Consent Order, minimizes legal exposure, and protects the legitimate legal interests of all parties.
The requirements for invoking the common-interest privilege are as follows:
(a) The parties must share a common legal interest. The interest must be legal in nature, not merely commercial or business-oriented. In the present context, the common legal interest arises from the shared objective of achieving compliance with the Consent Order while protecting the legal interests of BRB and managing the regulatory and litigation risks that attend the remediation process.
(b) The communications must be made in furtherance of the common legal interest. Communications that are purely operational, administrative, or factual — and that do not relate to the provision or receipt of legal advice or the advancement of a shared legal strategy — are not protected by the common-interest privilege.
(c) The communications must be made with a reasonable expectation of confidentiality. All parties to the common-interest arrangement must treat the communications as confidential and must not disclose them to parties outside the common-interest group without authorization.
The terms and conditions of the common-interest arrangement among BRB, C&H, and Thornfield are set forth in the separate Privilege & Confidentiality Side Letter executed in connection with the Thornfield engagement (Thornfield Engagement Reference TCG-BRB-2025-001). That Side Letter defines the categories of communications that are subject to the common-interest privilege, the protocols for handling such communications, and the procedures for resolving disputes regarding the scope of the privilege. All parties and personnel should familiarize themselves with the terms of the Side Letter and ensure that their conduct conforms to its requirements.
III. IDENTIFICATION OF PRIVILEGED AND PROTECTED CATEGORIES OF MATERIALS
The following sections identify the principal categories of materials generated in connection with the BSA/AML remediation engagement and describe the privilege status of each category. This identification is intended to provide practical guidance to all personnel involved in the remediation and to facilitate consistent and defensible privilege determinations. It is not exhaustive; questions regarding the privilege status of specific documents or communications not addressed below should be directed to Philip Hartmann (C&H) and Gregory Nardone (BRB General Counsel).
A. Calderwood & Harkness Legal Advice and Analysis
All memoranda, letters, emails, presentations, and oral communications from C&H to BRB and BRFG providing legal advice regarding the BSA/AML remediation are protected by the attorney-client privilege and, to the extent they constitute documents prepared in anticipation of litigation or regulatory enforcement proceedings, by the work-product doctrine. This category includes, without limitation, the following C&H deliverables:
• Consent Order Analysis Memorandum
• Regulatory Risk Assessment Memorandum
• OFAC Enforcement Risk & Voluntary Self-Disclosure Analysis
• FinCEN Coordination Strategy Memorandum
• Director D&O Liability Analysis Memorandum
• Securities Disclosure Obligations Memorandum
• Shareholder Communication Talking Points
• All other attorney-client privileged memoranda, research memoranda, and strategy documents prepared by C&H in connection with the engagement
In addition, all drafts, redlines, internal C&H communications, and internal working papers relating to the engagement are protected. Internal C&H communications — including communications among C&H attorneys and staff regarding legal analysis, strategy, and case management — constitute opinion work product and are entitled to the highest level of protection.
B. Communications Between BRB Management and C&H
All communications between the C&H engagement team and BRB officers and employees, where such communications are made for the purpose of seeking, obtaining, or providing legal advice in connection with the BSA/AML remediation, are protected by the attorney-client privilege. The BRB personnel whose communications with C&H are anticipated to be most frequent and substantive include, but are not limited to:
• Gregory Nardone, General Counsel & Corporate Secretary
• Patricia Langston, Chief Compliance Officer
• Thomas Ikeda, BSA Officer / AML Program Director
• Melissa Chu, Chief Risk Officer
• Warren Ashby, Head of Fintech Partnerships / BaaS Division
• Linda Petrosian, Chief Information Officer / Chief Technology Officer
• Derek Ballard, Head of Internal Audit
• Raymond Okoye, President / Chief Operating Officer
• Samantha Reeves, Chief Financial Officer
• Diane Whitford, Chief Executive Officer
Communications with BRFG Board members and Board committees regarding legal advice on Consent Order compliance are similarly protected. This includes communications with the Compliance Committee (chaired by James Rutherford), the Audit Committee (chaired by Margaret Dao), and the Risk Committee (chaired by Arthur Connelly). The privilege attaches to these communications to the extent they involve the provision of legal advice or the exchange of confidential information for the purpose of enabling C&H to provide legal advice.
It is important to note, however, that communications between BRB personnel and C&H that are purely factual in nature — for example, the transmission of raw data, transaction records, or system output without any request for or provision of legal advice — may not be privileged in and of themselves. To the extent practicable, BRB personnel who are transmitting factual information to C&H should frame such transmissions in the context of a request for legal advice or in response to a specific request from C&H for information needed to provide legal advice, and should include the privilege legend in the communication.
C. Board-Level Materials
Materials prepared for and presented at Board meetings and Board committee meetings that reflect or incorporate C&H legal advice are protected by the attorney-client privilege. This category includes:
• Board presentations prepared by C&H containing legal analysis, regulatory risk assessments, and strategic recommendations
• Board resolutions reflecting legal advice from C&H
• Board and committee meeting minutes to the extent they record or reflect the substance of C&H legal advice
• Compliance Committee meeting materials, reports, and deliberations reflecting legal guidance from C&H
• The Board Resolution acknowledging the Consent Order and establishing the Compliance Committee, which is due to be adopted no later than February 28, 2025
• The Board Presentation — BSA/AML Remediation Overview, prepared by C&H for the initial Board briefing
An important caveat applies to Board-level materials: Board materials that are purely business or operational in nature — that is, materials that do not contain, reflect, or incorporate legal advice from C&H or in-house counsel — may not be privileged. Many Board materials in the remediation context will be "mixed-content" documents, containing both privileged legal advice and non-privileged business or operational content. Such documents require careful handling. The specific protocols for mixed-content Board materials are addressed in Section VIII below.
D. Thornfield Consulting Group Communications
The privilege status of materials generated by or in connection with Thornfield Consulting Group LLC (Dr. Vivian Castellano, Managing Director; Robert Eastman, Senior Director; Jennifer Hwang, Director; Nathaniel Burgess, Senior Manager) requires particularly careful analysis due to Thornfield's dual role as an OCC-mandated independent consultant and as a participant in the common-interest framework with BRB and C&H.
Thornfield's OCC-Mandated Deliverables. Thornfield's engagement is pursuant to Article VII of the Consent Order, which requires the Bank to retain an independent consultant acceptable to the OCC to conduct specified assessments and to report its findings and recommendations directly to the OCC. Thornfield's formal deliverables to the OCC — specifically, the preliminary gap assessment due April 15, 2025 and the final validation report due February 15, 2026 — are required regulatory deliverables. These deliverables are NOT protected by the attorney-client privilege. They are prepared pursuant to a regulatory mandate and are submitted to the OCC in fulfillment of that mandate, not for the purpose of obtaining or providing legal advice. Once submitted to the OCC, these deliverables become confidential supervisory information subject to 12 C.F.R. Part 4, but they are not attorney-client privileged or work-product protected.
Common-Interest Communications. Communications between Thornfield and C&H or BRB that are made under the common-interest framework and for the purpose of obtaining or providing legal advice may be protected under the common-interest privilege, subject to the terms of the Privilege & Confidentiality Side Letter. For example, if Thornfield consults with C&H regarding the legal implications of a factual finding made during its assessment, that communication may be protected. However, purely operational or factual communications — such as data requests, interview scheduling, and system access arrangements — are not privileged.
Thornfield's Internal Working Papers. Thornfield's internal working papers — including draft analyses, interview notes, and preliminary findings — may have limited work-product protection to the extent they were prepared in anticipation of regulatory enforcement proceedings. However, the applicability of work-product protection to these materials must be evaluated on a document-by-document basis. Thornfield's own counsel, Hargrove & Stein PC (7 Times Square, 34th Floor, New York, NY 10036), should be consulted on questions regarding the privilege status of Thornfield's internal working papers.
C&H Legal Analysis of Thornfield's Findings. C&H's legal analysis of Thornfield's factual findings, preliminary assessments, and recommendations is privileged attorney work product. This includes C&H memoranda analyzing the legal implications of Thornfield's findings, assessing regulatory enforcement risk, and developing legal strategy in response to Thornfield's work. Such analysis must be maintained in separate C&H documents and must not be embedded in or appended to Thornfield's work product or regulatory deliverables.
E. Internal BRB Remediation Documents Created at Direction of Counsel
Documents, reports, analyses, and data compilations prepared by BRB personnel at the specific direction of C&H for the purpose of enabling C&H to provide legal advice in connection with the remediation are protected by the attorney-client privilege and may also qualify as work product. This category encompasses a significant volume of materials, including but not limited to:
• Materials prepared for the SAR lookback project (budgeted at $5.5 million), including historical SAR filing analyses, alert disposition reviews, and transaction re-analyses conducted at C&H's direction
• Materials prepared for the CDD/EDD remediation (budgeted at $4.3 million, covering approximately 47,000 accounts), including customer due diligence files, enhanced due diligence assessments, and risk rating re-evaluations conducted at C&H's direction
• Materials prepared for the OFAC compliance gap analysis, including transaction screening data, sanctions match reports, and gap quantification analyses prepared at C&H's direction
• Internal reports and analyses compiled by BRB personnel in response to specific information requests from C&H
A critical distinction must be drawn between documents prepared at the direction of counsel for the purpose of enabling legal advice and documents prepared for ordinary business purposes or regulatory compliance that would have been created regardless of C&H's engagement. The latter category — for example, routine SARs filed in the ordinary course, standard CDD/EDD files maintained as part of the Bank's compliance program, and regular transaction monitoring reports — is not privileged merely because C&H has been retained. The privilege attaches only where the document was created because of the attorney-client relationship and for the purpose of facilitating legal advice. Where there is any uncertainty, BRB personnel should consult with Mr. Nardone or C&H before making privilege determinations.
F. Vendor and Third-Party Communications
The Bank's remediation effort involves extensive engagement with third-party vendors and service providers. The privilege status of communications with these parties varies depending on the nature of the relationship and the content of the communications.
Veridian Analytics Inc. Communications with Veridian Analytics Inc. (contact: Priya Subramanian, Vice President of Client Solutions; Contract No. VA-BRB-2023-0044) regarding the Transaction Monitoring System ("TMS") v.10.0 upgrade are generally not privileged. Veridian is a technology vendor providing commercial products and services, and the Bank's communications with Veridian regarding system specifications, implementation timelines, testing protocols, and similar matters are business records. However, communications that involve the transmission of legal advice or work product from C&H — for example, C&H's analysis of contractual terms or compliance-related legal requirements to be incorporated into system specifications — may retain their privileged character if properly handled. Commercial negotiations and technical specifications exchanged with Veridian are business records and are not privileged.
Ridgeline Data Systems LLC. Communications with Ridgeline Data Systems LLC (contact: David Marchetti, Chief Revenue Officer) in connection with the evaluation of Ridgeline as a potential alternative or supplementary technology vendor are subject to the mutual non-disclosure agreement ("NDA") between the parties. The NDA imposes contractual confidentiality obligations but does not create attorney-client privilege. Factual and business analysis of the Ridgeline proposal (proposed $7.2 million per year, 5-year term, $36.0 million total contract value) is not privileged. C&H's legal analysis of Ridgeline's proposed contract terms and any comparison memorandum reflecting C&H's legal judgment is privileged work product.
Pinnacle Compliance Solutions LLC. Pinnacle Compliance Solutions LLC (contact: Andrea Solis; Statement of Work Reference: PCS-BRB-2025-0012) has been retained to provide 30 full-time-equivalent temporary compliance analysts at a cost of $3.6 million to support the Bank's operational BSA/AML compliance work during the remediation period. Pinnacle staff are performing operational tasks — SAR investigation, KYC/CDD review, transaction monitoring alert disposition — and are not acting as agents of counsel. Work performed by Pinnacle analysts is generally not privileged; it constitutes ordinary-course compliance activity. Pinnacle staff should not be given access to C&H privileged memoranda or legal analysis. C&H's legal guidance to BRB regarding the supervision protocols, quality control standards, and legal risk aspects of the Pinnacle engagement is privileged.
Caldera & Pope LLP. Caldera & Pope LLP (contact: Franklin Dorsey, CPA; 311 South Wacker Drive, Suite 5400, Chicago, IL 60606) serves as the Bank's external auditor (annual audit fee: $3.4 million) and as the BSA/AML independent testing firm (testing fee: $1.1 million). Audit communications and BSA/AML independent test results are not attorney-client privileged. Independent testing reports — including the September 2024 BSA/AML independent test that identified deficiencies subsequently echoed in the Consent Order — are regulatory compliance documents prepared in the ordinary course and are not privileged. C&H's legal analysis of Caldera & Pope's findings, conclusions, and recommendations is privileged work product. Caldera & Pope should not receive access to C&H privileged legal memoranda, and C&H's legal analysis should not be shared with Caldera & Pope absent express authorization from Mr. Nardone and Mr. Hartmann.
G. Prior Counsel Materials
Drayton Mercer LLP (contact: Helen Frazier, formerly at 55 East 52nd Street, Suite 3100, New York, NY 10055) served as the Bank's outside regulatory counsel from 2019 through 2024. The Drayton Mercer engagement was terminated in January 2025 in connection with the retention of C&H. The Bank's attorney-client privilege in communications with Drayton Mercer continues notwithstanding the termination of that engagement. The privilege is the Bank's privilege, and termination of the attorney-client relationship does not extinguish the privilege in prior communications made during the course of the representation.
C&H should take the following steps with respect to Drayton Mercer materials:
(a) Obtain all Drayton Mercer files, including paper and electronic files, relating to the Bank's BSA/AML compliance program, OCC supervisory matters, and related regulatory issues;
(b) Review the Drayton Mercer files to identify privileged and work-product protected materials;
(c) Prepare or supplement the privilege log to include all Drayton Mercer materials that are claimed as privileged; and
(d) BRB should issue a formal document preservation and transfer request to Drayton Mercer directing the firm to preserve all files and to transfer such files to C&H or to BRB's General Counsel's office, as appropriate.
Any Drayton Mercer materials that are shared with C&H in connection with the current engagement retain their privileged status. The transfer of privileged materials from one attorney to a successor attorney on behalf of the same client does not constitute a waiver of privilege.
IV. DOCUMENT LABELING AND HANDLING CONVENTIONS
Consistent and conspicuous labeling of privileged documents is a cornerstone of effective privilege protection. While the presence or absence of a privilege label is not dispositive of whether a document is in fact privileged, proper labeling serves several critical functions: it puts all recipients on notice that the document is claimed as privileged, it facilitates the identification and segregation of privileged materials in the event of a document production or regulatory request, and it supports the assertion that the privilege was intentionally invoked and maintained.
A. Required Privilege Labels
All documents prepared by or at the direction of C&H that contain legal advice or reflect attorney mental impressions, conclusions, opinions, or legal theories must bear one of the following header and/or footer legends, as appropriate:
(a) "PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION" — for documents that are protected by the attorney-client privilege;
(b) "PRIVILEGED & CONFIDENTIAL — ATTORNEY WORK PRODUCT" — for documents that are protected by the work-product doctrine;
(c) "PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION / ATTORNEY WORK PRODUCT" — for documents that are protected by both the attorney-client privilege and the work-product doctrine (dual-protected documents).
Documents that are shared under the common-interest framework with Thornfield Consulting Group LLC must additionally bear the following legend:
"COMMON INTEREST — SUBJECT TO JOINT PRIVILEGE"
Documents that contain OCC confidential supervisory information — including the Consent Order itself, examination reports, Matters Requiring Attention ("MRA") or Matters Requiring Immediate Attention ("MRIA") correspondence, and related supervisory communications — must additionally bear the following legend, in accordance with 12 C.F.R. Part 4:
"CONFIDENTIAL SUPERVISORY INFORMATION — NOT FOR PUBLIC DISCLOSURE"
Where a single document is subject to multiple designations (e.g., a privileged attorney-client communication that also incorporates confidential supervisory information), all applicable legends should be included. The legends should appear in the header, footer, or cover page of the document in a manner that is conspicuous and readily identifiable.
B. Electronic Communications (Email)
Email is the predominant medium of communication in the modern legal and business environment, and particular care must be taken to ensure that the privilege is maintained in the electronic communication context.
All emails from C&H attorneys to BRB personnel that contain legal advice must include the appropriate privilege legend in the body of the email or in the signature block. Where an email thread includes both privileged and non-privileged communications, C&H attorneys should clearly delineate the privileged portions of the communication.
Subject lines of emails containing privileged content should not reveal the substance of the privileged communication. Generic, non-descriptive subject lines should be used. For example, an email containing C&H's legal analysis of the OFAC screening gap should use a subject line such as "BSA/AML Remediation — Legal Analysis" rather than a subject line that summarizes the legal conclusion or reveals the nature of the legal advice. This precaution is important because subject lines are frequently visible in email previews, search results, and metadata, and a descriptive subject line could disclose privileged content even if the body of the email is not accessed.
BRB personnel who are emailing C&H to seek legal advice should include the phrase "Attorney-Client Privileged" in the subject line of the email. This practice puts all recipients on notice that the communication is intended to be privileged and reinforces the confidential nature of the exchange.
Inadvertent Forwarding Protocol. In the event that a privileged email is inadvertently forwarded to an unintended recipient — whether an internal BRB employee without a need to know, an external party, or any other person not authorized to receive the communication — the following steps must be taken immediately:
(i) The individual who sent or became aware of the inadvertent forwarding must immediately notify Gregory Nardone and Philip Hartmann;
(ii) The unintended recipient must be contacted promptly and instructed to delete the communication and all copies thereof, to not retain or forward the communication, and to not disclose its contents to any other person;
(iii) C&H will assess the potential for privilege waiver and will take such steps as are necessary to mitigate the risk, including, where appropriate, seeking a claw-back order or invoking the protections of Federal Rule of Evidence 502(b); and
(iv) The incident must be documented in the privilege log with a notation describing the nature of the inadvertent disclosure, the steps taken to remediate, and C&H's assessment of the waiver implications.
C. Physical Documents
Hard-copy privileged documents must be maintained in segregated, clearly labeled files that are physically separate from the Bank's ordinary business records. Physical files containing privileged remediation materials should be stored in a secure location with restricted access, and should be clearly labeled with the C&H Matter No. 1045-00002 designation and the appropriate privilege legend.
Electronic copies of privileged documents must similarly be stored in segregated, access-controlled repositories within the Bank's document management system. The filing convention for all privileged remediation materials should use the C&H Matter No. 1045-00002 designation as the primary organizational identifier. Access to the electronic repository should be limited to individuals who have a need to know and who have executed the written acknowledgment described in Section XIII below.
D. Draft Documents
The handling of draft documents requires particular attention. Throughout the remediation process, numerous deliverables will be prepared, revised, and finalized, including the Comprehensive Remediation Action Plan, revised BSA/AML policies and procedures, SAR/CDD/EDD workstream documents, OFAC screening procedures, and various other documents. Many of these deliverables will be circulated between C&H and BRB in draft form for the purpose of incorporating C&H's legal advice and ensuring legal sufficiency.
All drafts of deliverables circulated between C&H and BRB for the purpose of obtaining or incorporating legal advice should be labeled as drafts (e.g., "DRAFT — FOR DISCUSSION PURPOSES ONLY") and should bear the appropriate privilege legend. The draft status and privilege designation should be maintained throughout the drafting process.
Once a document is finalized and submitted to the OCC — for example, the Comprehensive Remediation Action Plan due May 15, 2025, the quarterly progress reports due September 15, 2025 and December 15, 2025, or the compliance self-certification due February 15, 2026 — the final version as submitted to the OCC loses its privileged status as to the OCC. The document is furnished to the OCC as a regulatory deliverable and becomes confidential supervisory information. However, the final submitted version may retain privilege and work-product protection as to third parties, depending on the circumstances and the content of the document.
Of critical importance, prior drafts of the deliverables — including drafts that reflect C&H's legal advice, redlines showing C&H's edits and comments, internal deliberation memoranda, and all other materials reflecting the evolution of the document through the drafting process — remain privileged and must not be produced to the OCC or to any third party without the express prior authorization of both Gregory Nardone and Philip Hartmann. The distinction between the final submitted version and the prior drafts must be scrupulously maintained.
V. PRIVILEGE LOG MAINTENANCE
A. Obligation to Maintain a Privilege Log
The maintenance of a comprehensive and accurate privilege log is essential to the preservation and defense of privilege claims. A privilege log serves as the evidentiary record of the client's assertion of privilege and provides the factual basis for a court or regulatory body to evaluate the validity of the privilege claim. In the absence of a properly maintained privilege log, privilege assertions may be deemed waived or otherwise unenforceable.
BRB's legal department, under the supervision of Gregory Nardone and with the assistance of designated paralegal support, shall maintain a running privilege log cataloging all documents and communications claimed as privileged or work-product protected in connection with the BSA/AML remediation. This privilege log shall be maintained on an ongoing basis throughout the engagement period and shall be updated promptly as new privileged materials are created or identified.
C&H will maintain a parallel internal privilege log for its own work product and communications. The C&H privilege log will be maintained by Yuki Nakamura (Lead Associate) with the assistance of Carlos Espinoza (Working Associate) and such other C&H personnel as may be designated. The C&H privilege log will track all C&H-generated documents, memoranda, communications, and work product related to the engagement.
B. Privilege Log Contents
Each entry in the privilege log shall include the following information, at a minimum:
(a) Document Date: The date the document was created or the communication was made;
(b) Author: The name and title/position of the author or sender;
(c) Recipients: The names and titles/positions of all recipients, including any individuals copied on the communication;
(d) Document Type: A description of the type of document (e.g., memorandum, email, letter, presentation, meeting minutes, draft, redline, handwritten notes);
(e) Subject Matter Description: A sufficiently detailed description of the subject matter to support the privilege claim without revealing the substance of the privileged content. The description should identify the general topic and the purpose of the communication (e.g., "Memorandum from C&H to BRB General Counsel providing legal advice regarding OFAC enforcement risk assessment in connection with BSA/AML remediation") without disclosing the specific legal advice, conclusions, or mental impressions contained in the document;
(f) Privilege(s) Asserted: Identification of the specific privilege or protection asserted for the document (e.g., attorney-client privilege, attorney work product, common-interest privilege, or a combination thereof);
(g) Custodian/Location: Identification of the custodian of the document and its physical or electronic storage location.
The level of detail in the privilege log must be sufficient to allow a reviewing court or regulatory body to make an informed determination regarding the validity of the privilege claim. Boilerplate or conclusory descriptions are insufficient and may result in a finding of waiver. At the same time, the descriptions must not disclose the substance of the privileged communication, as such disclosure would undermine the very privilege being asserted.
C. Periodic Review
C&H and BRB's legal department shall conduct a joint review of the privilege log on a monthly basis to ensure its completeness and accuracy. The monthly review shall include:
(a) Verification that all newly created privileged documents and communications have been logged;
(b) Review of existing entries for accuracy and adequacy of descriptions;
(c) Identification and resolution of any privilege classification questions or disputes; and
(d) Confirmation that the privilege log is in a form that would be defensible if produced in response to a subpoena, litigation discovery request, or regulatory inquiry.
The privilege log must be maintained in a current and defensible state at all times. In the event of any subpoena, civil investigative demand, litigation discovery request, or regulatory inquiry that implicates the privileged materials, the privilege log must be ready for production on short notice.
VI. PROTOCOLS FOR SHARING INFORMATION WITH THE OCC AND FINCEN WITHOUT WAIVER
A. Regulatory Disclosures Under OCC Authority
The Consent Order imposes extensive information-sharing and reporting obligations on BRB. The Bank is required to provide the OCC with detailed information regarding its remediation efforts, including the following principal deliverables:
(a) Comprehensive Remediation Action Plan — due May 15, 2025 (Article IV of the Consent Order);
(b) Quarterly Progress Reports — due September 15, 2025 and December 15, 2025 (Article V of the Consent Order); and
(c) Compliance Self-Certification — due February 15, 2026 (Article VIII of the Consent Order).
In addition to these formal deliverables, the OCC Examiner-in-Charge, Jonathan Frey (OCC Northeastern District Office, 340 Madison Avenue, New York, NY 10017), may request additional information, documentation, and access to Bank personnel in the exercise of the OCC's examination authority.
Disclosure of factual and operational information to the OCC pursuant to its examination authority and the Consent Order generally does not constitute a broad waiver of the attorney-client privilege or work-product protection as to third parties. The OCC is the Bank's primary federal regulator, and the Bank's cooperation with OCC examination and supervisory processes is required by law. Under 12 C.F.R. Part 4, information provided to the OCC in the supervisory and examination context is treated as confidential supervisory information and is protected from disclosure to third parties. The provision of information to the OCC under these circumstances does not constitute a voluntary disclosure to an adversary or a general publication of the information, and courts have generally held that such disclosures do not waive privilege as to third parties.
However, the distinction between factual and operational information, on the one hand, and legal advice and work product, on the other, must be scrupulously maintained in the regulatory disclosure context. Care must be taken to ensure that C&H's legal analysis, opinions, mental impressions, strategic recommendations, and enforcement risk assessments are NOT embedded in, appended to, or referenced in factual or operational reports submitted to the OCC. Factual deliverables — such as the Remediation Action Plan, quarterly progress reports, and the compliance self-certification — should be drafted as standalone documents that present facts, operational data, and compliance status without incorporating or revealing C&H's privileged legal advice. C&H's privileged analysis should be maintained in separate attorney-client privileged memoranda that are not shared with the OCC.
B. Protocol for OCC Submissions
To implement the principle described above, the following protocol shall govern all submissions to the OCC in connection with the remediation:
(a) Pre-Submission Review. All documents to be submitted to the OCC must be reviewed and approved by both Philip Hartmann and Gregory Nardone prior to submission. No document shall be transmitted to the OCC without this dual approval.
(b) Dual-Version Drafting. Where appropriate, C&H will prepare two versions of key deliverables: (i) a privileged attorney-client version containing C&H's legal analysis, strategic recommendations, risk assessments, and related legal advice, which will be retained as privileged work product and will not be submitted to the OCC; and (ii) a factual and operational version suitable for OCC submission, which will present relevant facts, data, compliance measures, and implementation progress without disclosing C&H's legal advice or work product. The factual version will be drafted by C&H with appropriate care to ensure that it does not inadvertently incorporate or reveal privileged content.
(c) Cover Letters. Cover letters transmitting deliverables to the OCC — such as the cover letter accompanying the Remediation Action Plan on May 15, 2025 — should be carefully drafted to reference the Bank's cooperation obligations under the Consent Order without making admissions of liability, acknowledging legal conclusions, or disclosing legal strategy. Cover letters should be factual and professional in tone, expressing the Bank's commitment to compliance without volunteering information or characterizations that could be used against the Bank in other proceedings.
(d) Prohibition on Incorporation of Legal Advice. No document submitted to the OCC shall quote, summarize, paraphrase, or otherwise incorporate C&H legal advice or work product without prior privilege review and the express written approval of both Philip Hartmann and Gregory Nardone. If there is any question as to whether a document contains privileged content, the document must be submitted to C&H for privilege review before it is transmitted to the OCC.
C. Protocol for FinCEN Communications
FinCEN, through its liaison Angela Drummond, Associate Director of the Enforcement Division, is actively monitoring the Bank's SAR filing remediation efforts and has expressly reserved its enforcement rights. FinCEN has not entered into any formal agreement with the Bank that limits or precludes enforcement action, and the possibility of a separate FinCEN civil monetary penalty or enforcement proceeding remains. In light of these circumstances, communications with FinCEN must be treated with the same level of privilege scrutiny as communications with the OCC.
The following protocol shall govern all communications with FinCEN:
(a) Pre-Approval Requirement. All outgoing communications to FinCEN — whether written or oral — must be pre-approved by both Philip Hartmann and Gregory Nardone. No BRB employee shall communicate with FinCEN regarding the BSA/AML remediation or related matters without prior authorization.
(b) SAR Filings. The Bank's SAR filings themselves are not privileged. SARs are mandatory regulatory filings required under 31 U.S.C. § 5318(g) and the implementing regulations at 31 C.F.R. Part 1020, and they are filed with FinCEN in the ordinary course of the Bank's compliance obligations. The content of SAR filings is governed by applicable legal requirements and must accurately report suspicious activity. However, C&H's legal analysis of SAR filing decisions — including the lookback methodology, the criteria for identifying reportable activity, enforcement risk assessments, and legal strategy regarding borderline cases — is privileged work product and must not be disclosed to FinCEN or any other party.
(c) SAR Lookback Project. The SAR lookback project (budgeted at $5.5 million) and the SAR backlog clearance effort (involving approximately 2,400 pending alerts) will generate large volumes of case files, alert disposition records, and related documentation. Operational disposition records — including case files documenting the facts underlying the filing or non-filing decision — are not privileged and are subject to examination by regulators. However, C&H's legal guidance on filing decisions, particularly for borderline cases that present difficult legal judgments, should be documented in separate privileged memoranda that are distinct from the operational case files. Under no circumstances should C&H's legal advice be incorporated into the narrative of a SAR filing or into the operational case file.
D. Protocol for Potential DOJ or OFAC Inquiries
Given the nature and scope of the Bank's BSA/AML and sanctions compliance failures, the possibility of a DOJ criminal inquiry or an OFAC enforcement investigation cannot be excluded. In the event that either the DOJ or OFAC initiates an inquiry, investigation, or enforcement proceeding, the following protocol shall apply:
(a) Exclusive Routing Through C&H. All communications with the DOJ or OFAC in connection with any inquiry, investigation, or enforcement proceeding shall be routed exclusively through C&H. No BRB employee shall engage in any communication — written, oral, or otherwise — with the DOJ or OFAC regarding the matters covered by this Protocol without the prior authorization of Gregory Nardone and Philip Hartmann.
(b) Prohibition on Unilateral Responses. No BRB employee shall respond to any DOJ or OFAC inquiry, request for information, interview request, or other communication without prior authorization from Gregory Nardone and Philip Hartmann. This prohibition applies to all forms of communication, including informal contacts, telephone calls, and emails.
(c) Legal Process. Grand jury subpoenas, civil investigative demands ("CIDs"), OFAC administrative subpoenas, or any other form of compulsory legal process must be immediately forwarded to C&H for evaluation. C&H will assess the scope of the process, identify privilege objections and protective measures, and develop a response strategy. C&H will coordinate with Gregory Nardone on all responses to legal process.
(d) OFAC Voluntary Self-Disclosure Analysis. C&H's analysis of the strategic considerations relating to a potential voluntary self-disclosure to OFAC regarding the approximately 3,800,000 unscreened NovaPay transactions in calendar year 2023 (representing approximately 12% of the total 31.7 million NovaPay transactions processed during that period) is among the most sensitive privileged work product generated in connection with this engagement. This analysis encompasses C&H's assessment of the legal exposure, the potential mitigating benefits of a voluntary self-disclosure under OFAC's Enforcement Guidelines, the strategic risks and benefits, and C&H's recommendations. This analysis must not be disclosed to any party other than authorized BRB management and the BRFG Board, and access should be limited to individuals with a direct need to know.
VII. TREATMENT OF THORNFIELD CONSULTING GROUP MATERIALS
A. Thornfield's Dual Role
Thornfield Consulting Group LLC, with offices at 200 Park Avenue South, 15th Floor, New York, NY 10003, has been retained to serve as the OCC-mandated independent consultant under Article VII of the Consent Order. Thornfield occupies a unique position in the remediation process, one that creates significant complexity from a privilege standpoint.
On the one hand, Thornfield has a statutory and regulatory reporting obligation to the OCC. Its formal deliverables — the preliminary gap assessment due April 15, 2025 and the final validation report due February 15, 2026 — are regulatory documents that must be submitted directly to the OCC. These deliverables are not attorney-client privileged, and their content is controlled by Thornfield in the exercise of its independ

PRIVILEGE AND WORK-PRODUCT PROTECTION PROTOCOL MEMORANDUM

I. PURPOSE AND SCOPE

II. LEGAL FRAMEWORK FOR PRIVILEGE AND WORK-PRODUCT PROTECTION

III. IDENTIFICATION OF PRIVILEGED AND PROTECTED CATEGORIES OF MATERIALS

IV. DOCUMENT LABELING AND HANDLING CONVENTIONS

V. PRIVILEGE LOG MAINTENANCE

VI. PROTOCOLS FOR SHARING INFORMATION WITH THE OCC AND FINCEN WITHOUT WAIVER

VII. TREATMENT OF THORNFIELD CONSULTING GROUP MATERIALS

Record

Parties

Dates

Amounts