1045-00007 · Client 1045 · Client Communications

audit-committee-briefing-investigation-notification.docx DOCUMENT Litigation

4 / 35 ← → ✕

Contract analysis Extract to table

PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT COMMUNICATION — ATTORNEY WORK PRODUCT

CALDERWOOD & HARKNESS LLP 425 Lexington Avenue, 30th Floor New York, NY 10017

October 2, 2023

MEMORANDUM

TO: Gwendolyn Prescott, Chair, Audit Committee of the Board of Directors, Belmont Ridge Bank National Association

CC: Derek Sung, General Counsel & Chief Legal Officer, Belmont Ridge Bank National Association

FROM: Victoria Chambers, Partner, Calderwood & Harkness LLP Jasmine Thornton, Lead Associate, Calderwood & Harkness LLP

RE: SEC Division of Enforcement Investigation — File No. HO-14287; Inquiry into Allowance for Credit Losses Disclosures — BridgeFin Portfolio

MATTER NO.: SC-MAT-2023-4172

This memorandum is a privileged and confidential attorney-client communication and attorney work product prepared by Calderwood & Harkness LLP at the direction of and for the benefit of the Audit Committee of the Board of Directors of Belmont Ridge Bank National Association. This memorandum should not be disclosed, disseminated, or distributed to any person or entity beyond the members of the Audit Committee, the Office of the General Counsel of Belmont Ridge Bank National Association, and outside counsel without the prior written authorization of Calderwood & Harkness LLP. Any unauthorized disclosure may result in a waiver of applicable privileges.

I. Executive Summary

Calderwood & Harkness LLP ("C&H" or "the Firm") was retained on September 20, 2023 to represent Belmont Ridge Bank National Association ("BRB" or the "Bank") (Nasdaq: BRDG) in connection with an inquiry initiated by the Division of Enforcement (the "Division" or "Enforcement") of the U.S. Securities and Exchange Commission (the "SEC" or the "Commission") into BRB's public disclosures concerning the allowance for credit losses ("ACL") related to the Bank's digital lending platform, BridgeFin.

On September 18, 2023, BRB received a voluntary request letter (the "Voluntary Request" or the "Request") from the SEC Staff (the "Staff") requesting documents and information related to the Bank's Annual Report on Form 10-K for the fiscal year ended December 31, 2022, filed with the Commission on February 28, 2023 (the "FY 2022 10-K"), and the Bank's Quarterly Reports on Form 10-Q for the fiscal quarters ended March 31, 2023, filed May 10, 2023 (the "Q1 2023 10-Q"), and June 30, 2023, filed August 9, 2023 (the "Q2 2023 10-Q," and collectively with the FY 2022 10-K and Q1 2023 10-Q, the "Subject Filings"). The Request pertains specifically to the Bank's disclosures regarding the ACL for BridgeFin's consumer loan and small-business microloan portfolio, including the Bank's application of the Current Expected Credit Losses standard under Accounting Standards Codification Topic 326, Financial Instruments — Credit Losses ("CECL" or "ASC 326").

The Voluntary Request was initially received by Caldwell Pratt & Stein LLP ("CPS"), located at 51 West 52nd Street, 24th Floor, New York, NY 10019, which serves as BRB's regular outside securities counsel. CPS, under the leadership of its lead partner Martin Caldwell, had prepared and reviewed the Subject Filings at issue. Upon receipt of the Voluntary Request, CPS promptly communicated the matter to BRB's General Counsel and Chief Legal Officer, Derek Sung. Following consultation among Mr. Sung, the Bank's Chief Executive Officer, Marcus R. Ellingham, and Ms. Prescott in her capacity as Chair of the Audit Committee, the Bank determined that it was advisable to engage separate, specialized counsel to represent BRB in connection with the SEC investigation. Calderwood & Harkness was subsequently retained specifically for the investigation on September 20, 2023.

The purpose of this memorandum is fourfold:

(a) to inform the Audit Committee of the nature, scope, and current status of the SEC inquiry;

(b) to assess the potential legal exposure facing BRB and, where applicable, individual officers who may be implicated if the investigation broadens;

(c) to outline the privilege and confidentiality considerations that must guide the Bank's conduct throughout this matter, including issues relating to the attorney-client privilege, the work-product doctrine, the bank-examination privilege, and document preservation obligations; and

(d) to recommend an immediate and near-term course of action for the Bank's response to the SEC inquiry, including the engagement of forensic accounting consultants, cooperation strategy, and disclosure considerations.

We emphasize at the outset that the SEC's inquiry is at a preliminary stage. The Voluntary Request does not constitute a formal subpoena; it is, as its name implies, a request for voluntary cooperation. No Formal Order of Investigation has been issued, and no individual officers or directors have been identified as targets or subjects of the inquiry. Nevertheless, the seriousness of any contact from the Division of Enforcement warrants immediate attention and a carefully coordinated response.

This memorandum is protected in its entirety by the attorney-client privilege and the work-product doctrine, and it should not be disseminated beyond the Audit Committee, the General Counsel's office, and outside counsel without prior authorization from C&H. We respectfully request that each recipient of this memorandum treat it accordingly and refrain from forwarding, copying, or discussing its contents with any person or entity not specifically identified as an authorized recipient.

II. Background: BRB and the BridgeFin Portfolio

A. The Bank

Belmont Ridge Bank National Association is a national banking association organized and existing under the laws of the United States, operating under Office of the Comptroller of the Currency ("OCC") Charter No. 24891. The Bank's principal executive offices are located at 200 Park Avenue South, 38th Floor, New York, NY 10003. BRB operates 127 retail banking branches across the northeastern United States, with a particular concentration in the New York, New Jersey, Connecticut, and Pennsylvania metropolitan areas, and additionally conducts substantial lending and deposit-gathering activities through its digital channels.

BRB's common stock is listed on the Nasdaq Global Select Market under the ticker symbol "BRDG." As of the end of September 2023, the Bank's approximate market capitalization stood at approximately $4.7 billion, based on approximately 76.7 million shares of common stock outstanding and a closing share price in the range of $61 per share.

As reported in the FY 2022 10-K, the Bank's consolidated financial position as of December 31, 2022 included the following:

The Bank is supervised and examined by the OCC as its primary federal banking regulator, and additionally is subject to examination and oversight by the Federal Deposit Insurance Corporation ("FDIC") as the administrator of the Deposit Insurance Fund. As of the most recent completed examination cycle in September 2023, BRB maintains a composite CAMELS rating of 2 (Satisfactory), reflecting the OCC's assessment that the Bank is fundamentally sound and that any identified weaknesses are moderate and well within the Bank's ability and willingness to correct.

The following senior officers of BRB are particularly relevant to the matters discussed in this memorandum:

Each of these individuals may possess information relevant to the SEC's inquiry, and their respective roles in the ACL estimation process, financial reporting, and risk oversight are discussed further below.

B. The BridgeFin Platform

BridgeFin is an internal division of BRB — not a separately incorporated subsidiary or distinct legal entity — that operates a digital-first consumer and small-business lending platform. BridgeFin was launched in the third quarter of 2020, in part as a strategic response to the accelerating shift toward digital financial services and in part to capture market share in the rapidly growing fintech-enabled lending space. The division is headed by Naveen Chakravarti, who reports directly to the Bank's Chief Risk Officer, Annette Kowalski, and has a dotted-line reporting relationship to the CEO.

BridgeFin originates two principal categories of loans through its platform:

(i) Unsecured consumer personal loans, with an average loan size of approximately $18,400, typically extended to borrowers with credit profiles in the near-prime to prime range, with maturities ranging from 24 to 60 months; and

(ii) Small-business microloans, with an average loan size of approximately $42,000, typically extended to small businesses with annual revenues between $250,000 and $5 million, with maturities ranging from 12 to 36 months.

BridgeFin's underwriting process relies on a proprietary artificial intelligence-driven credit scoring and decisioning model (internally referred to as the "BridgeScore Model"), which incorporates traditional credit bureau data alongside alternative data inputs, including bank account transaction data, cash-flow analysis, and certain behavioral scoring metrics. The BridgeScore Model was developed in-house by BRB's data science and credit risk teams and has been subject to model validation by the Bank's internal model risk management function, as well as periodic review by the OCC as part of its supervisory examination program.

For the fiscal year ended December 31, 2022, BridgeFin originated approximately $2.87 billion in new loans across both product categories. The total outstanding balance of the BridgeFin portfolio as of December 31, 2022 was approximately $4.1 billion, representing approximately 10.7% of the Bank's total consolidated assets of $38.2 billion. By any measure, BridgeFin constitutes a material component of BRB's lending operations, and the performance of the BridgeFin portfolio has a direct and significant impact on the Bank's overall credit quality metrics and financial results.

In accordance with generally accepted accounting principles ("GAAP"), BRB adopted the Current Expected Credit Losses standard (CECL, codified at ASC 326) effective January 1, 2020, the mandatory adoption date for SEC-reporting entities that are public business entities. Under CECL, BRB is required to estimate and record an allowance for credit losses reflecting the Bank's current estimate of all expected credit losses over the remaining contractual life of loans held at amortized cost, considering historical experience, current conditions, and reasonable and supportable forecasts.

As reported in the FY 2022 10-K, the Bank's key credit quality metrics for the BridgeFin portfolio were as follows:

These metrics were disclosed in the critical accounting estimates section and the credit quality disclosures accompanying the consolidated financial statements in the FY 2022 10-K, and were updated in the Q1 2023 and Q2 2023 10-Q filings.

C. Re-Aged / Modified Loans at Issue

The central factual issue underlying the SEC inquiry concerns the Bank's treatment of a subset of BridgeFin loans that were re-aged or modified during the period under review. Specifically, BRB's CECL model treated 12,847 re-aged or modified BridgeFin loans, with an aggregate outstanding balance of approximately $236.4 million, as "current" after modification, thereby resetting the delinquency clocks for those loans and, in effect, reclassifying them from delinquent status to current status for purposes of the Bank's loss-rate estimation.

These 12,847 loans were predominantly originated after the second quarter of 2021 and fell within vintage cohorts that experienced deteriorating credit quality as economic conditions tightened through 2022 and into 2023. In particular, vintage cohorts originated in Q3 2021, Q4 2021, and Q1 2022 exhibited higher-than-projected early-stage delinquency rates, reflecting, among other factors, the post-pandemic normalization of consumer credit performance, rising interest rates, and inflationary pressures on borrower cash flows.

Under BRB's loan modification and re-aging policies — which were developed by the BridgeFin credit risk team under Mr. Chakravarti's oversight and approved by the Bank's Credit Policy Committee — a loan that received a qualifying modification (such as a payment deferral, term extension, or interest rate reduction) and on which the borrower subsequently made a specified number of consecutive timely payments (typically three) was reclassified from its delinquent status to "current" status. Upon reclassification, the loan's delinquency history was reset to zero days past due, and for purposes of the CECL model, the loan was included in the "current" bucket rather than its original vintage delinquency bucket.

The Staff's inquiry appears to focus on whether this reclassification practice had the effect of understating the Bank's ACL by removing from the delinquent population a group of loans that, based on their original vintage cohort performance and underlying credit characteristics, continued to carry elevated loss expectations. In other words, the Staff's preliminary concern is that these re-aged loans should have remained classified in their original vintage delinquency buckets — or, at a minimum, should have been assigned loss rates reflective of their pre-modification delinquency experience — for purposes of loss-rate estimation under CECL. The implications of this treatment for the Bank's reported ACL, net charge-off rate, and delinquency metrics are discussed in detail in Section III below.

III. The SEC Inquiry

A. Voluntary Request Letter

The Voluntary Request was dated September 18, 2023 and was received by Caldwell Pratt & Stein LLP on the same date. CPS promptly forwarded the letter to BRB General Counsel Derek Sung, who in turn communicated the matter to CEO Marcus Ellingham and Audit Committee Chair Gwendolyn Prescott.

The Voluntary Request was issued by Senior Staff Attorney Andrea Felton of the Division of Enforcement's Home Office in Washington, D.C. (located at 100 F Street NE, Washington, D.C. 20549), and references SEC Investigation File No. HO-14287. Based on the information contained in the Voluntary Request and our initial communications with the Staff, we understand the investigation team to be composed of the following individuals:

The Voluntary Request seeks the production of documents and information relating to BRB's ACL disclosures for the BridgeFin consumer loan portfolio, as reflected in the FY 2022 10-K, the Q1 2023 10-Q, and the Q2 2023 10-Q. The specific categories of documents and information requested include, but are not limited to:

(i) all CECL model documentation, including model development documentation, model validation reports, and any model change logs, for the period from January 1, 2020 through the present;

(ii) all internal memoranda, analyses, presentations, and communications relating to the estimation of the ACL for the BridgeFin portfolio;

(iii) all documents relating to the Bank's loan modification, restructuring, and re-aging policies applicable to BridgeFin loans, including policy manuals, committee approvals, and any amendments thereto;

(iv) data files or reports reflecting the delinquency status, modification history, and loss experience of BridgeFin loans by vintage cohort;

(v) all communications between BRB management and its independent auditor, Whitfield Keane LLP, regarding the ACL for the BridgeFin portfolio;

(vi) minutes and materials from meetings of the Board of Directors, Audit Committee, and any management-level committees (including the Credit Policy Committee, Asset-Liability Committee, and Risk Committee) at which the BridgeFin ACL or credit quality metrics were discussed; and

(vii) any correspondence with the OCC or other regulatory agencies concerning the BridgeFin portfolio's credit quality or the Bank's CECL methodology.

It is important to note that the Voluntary Request is currently voluntary in nature. The Staff has not issued a Formal Order of Investigation, and the letter does not carry the force of a subpoena. BRB is not legally compelled to produce documents or provide testimony in response to a voluntary request. However, as discussed in Section VIII below, it is our strong recommendation that BRB adopt a posture of cooperation with the Staff's inquiry, subject to appropriate privilege protections. Refusal to cooperate at this stage could prompt the Staff to seek a Formal Order of Investigation from the Commission, which would confer subpoena authority and potentially escalate the matter. Moreover, a cooperative posture is a well-recognized factor that the Staff considers favorably in determining the appropriate resolution of an investigation.

We anticipate, based on our experience and the nature of the inquiry, that the Staff may seek a Formal Order of Investigation in the near term, particularly if the preliminary document review and analysis confirm their initial concerns regarding the ACL understatement. A Formal Order would authorize the Staff to compel testimony through investigative subpoenas and to obtain documents from third parties, including the Bank's auditor, Whitfield Keane LLP.

B. Core Issue Identified by the Staff

Based on a careful review of the Voluntary Request and our preliminary analysis of the publicly available financial disclosures, the core issue identified by the Staff can be summarized as follows:

The Staff is investigating whether BRB's reported ACL of $143.5 million (3.50% of the $4.1 billion in outstanding BridgeFin loans as of December 31, 2022) materially understated expected credit losses by failing to incorporate deteriorating credit quality metrics — specifically, rising delinquency rates and increased charge-offs in vintage cohorts originated after Q2 2021 — in the BridgeFin consumer personal-loan sub-segment. The Staff's preliminary concern, as we understand it, centers on the treatment of the 12,847 re-aged or modified loans discussed in Section II.C above.

The Staff's preliminary analysis appears to suggest that, if the re-aged loans had been maintained in their original vintage delinquency buckets (rather than reclassified as "current"), the resulting ACL would have been significantly higher. Specifically, the Staff's preliminary view appears to be that the ACL should have been approximately $180.8 million, representing 4.41% of the $4.1 billion in outstanding BridgeFin loans. This would represent a potential understatement of the ACL of approximately $37.3 million ($180.8 million minus $143.5 million).

If the Staff's preliminary view is credited, the recalculation would also affect certain other credit quality metrics disclosed in the Subject Filings:

The difference in the net charge-off rate and the 90+ day delinquency rate reflects the Staff's view that, if the re-aged loans were counted in their original delinquency buckets, the overall delinquency and loss profile of the BridgeFin portfolio would appear materially worse than what BRB disclosed.

We note that the Staff's recalculation is preliminary and has not been shared with us in detail. Our understanding of the Staff's position is based on the nature and focus of the questions posed in the Voluntary Request, as well as certain informal comments made by Senior Staff Attorney Andrea Felton during an initial telephone call with C&H on September 27, 2023. We expect that the Staff's analysis will be further refined as the investigation progresses, and we will work with Brindoval Analytic Partners (discussed in Section V.D below) to develop our own independent analysis of the appropriate ACL level.

C. Materiality Assessment

The question of materiality is central to any potential enforcement action under the securities laws. The Staff will need to demonstrate that any alleged misstatement or omission in BRB's financial disclosures was material to investors — that is, that there is a substantial likelihood that a reasonable investor would consider the information important in making an investment decision. TSC Industries, Inc. v. Northway, Inc., 426 U.S. 438, 449 (1976); Basic Inc. v. Levinson, 485 U.S. 224, 231-32 (1988).

BRB's internal materiality threshold, as established by the Bank's accounting policies and applied in connection with the independent audit, is calculated at 5% of pre-tax income. For FY 2022, this yields a materiality threshold of $30.6 million ($612 million × 5%).

The $37.3 million potential ACL understatement identified by the Staff exceeds this internal materiality threshold by approximately $6.7 million ($37.3 million minus $30.6 million), or approximately 21.9% above the threshold level. This excess is a factor that the Staff will likely emphasize in any potential enforcement action, as it suggests that the alleged misstatement crossed the line of quantitative materiality under the Bank's own framework.

However, several countervailing considerations temper this conclusion. First, the $37.3 million figure is derived from the Staff's preliminary recalculation, which has not been verified by the Bank's own analysis or by an independent forensic accounting review. Second, the proximity of the alleged understatement to the materiality threshold — $37.3 million versus a threshold of $30.6 million — is itself a mitigating factor, as courts and the SEC have recognized that close-call materiality determinations must account for the inherently judgmental nature of accounting estimates. Third, SAB 99 (Materiality) and subsequent guidance from the SEC Staff make clear that both quantitative and qualitative factors must be considered in assessing materiality. Qualitative factors that may weigh in BRB's favor include: (a) the alleged understatement does not mask a change in earnings trend; (b) BRB's re-aging methodology was consistently applied and disclosed to its auditor; (c) the ACL is by its nature an estimate subject to significant management judgment; and (d) the potential understatement, even if accepted, would not have caused BRB to fail any regulatory capital requirements or violate any debt covenants.

C&H will work with Brindoval Analytic Partners to develop a comprehensive materiality analysis that addresses both quantitative and qualitative factors, with the objective of presenting the strongest possible case that BRB's ACL was within the range of reasonable estimates permissible under ASC 326.

IV. Potential Legal Exposure

A. Statutory and Regulatory Framework

The Staff's inquiry implicates several provisions of the Securities Exchange Act of 1934 (the "Exchange Act") and the rules promulgated thereunder. Based on the nature and scope of the Voluntary Request, the most directly relevant provisions are as follows:

Section 13(a) of the Exchange Act (15 U.S.C. § 78m(a)). Section 13(a) requires every issuer of a security registered under Section 12 of the Exchange Act to file with the Commission, in accordance with such rules and regulations as the Commission may prescribe, such annual reports, quarterly reports, and other periodic reports as the Commission may require. BRB's common stock is registered under Section 12, and the Bank is accordingly required to file annual reports on Form 10-K and quarterly reports on Form 10-Q. The Subject Filings constitute reports filed pursuant to Section 13(a), and any material inaccuracy in those filings could give rise to a violation.

Section 13(b)(2)(A) of the Exchange Act (15 U.S.C. § 78m(b)(2)(A)). Section 13(b)(2)(A) requires every issuer that has a class of securities registered under Section 12 to make and keep books, records, and accounts which, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the issuer. If BRB's internal books and records — including the CECL model outputs, loss-rate calculations, and delinquency classifications — did not accurately reflect the true credit quality of the BridgeFin portfolio, the Staff could allege a violation of this provision.

Rule 13a-1 under the Exchange Act (17 C.F.R. § 240.13a-1). Rule 13a-1 implements Section 13(a) with respect to the annual report filing requirement, mandating that every issuer having securities registered pursuant to Section 12 file an annual report on Form 10-K for each fiscal year. Any material inaccuracy in the FY 2022 10-K could be framed as a violation of this rule.

Rule 12b-20 under the Exchange Act (17 C.F.R. § 240.12b-20). Rule 12b-20 provides that, in addition to the information expressly required to be included in a statement or report, there shall be added such further material information, if any, as may be necessary to make the required statements, in light of the circumstances under which they are made, not misleading. If the Staff concludes that BRB's ACL disclosures were misleading in the absence of additional information about the re-aging practices, this rule could be implicated.

It is critically important to note that Sections 13(a) and 13(b)(2)(A), together with the implementing rules, are strict-liability provisions. This means that the Staff need not prove that BRB or its officers acted with scienter (i.e., intentional fraud or recklessness), or even negligence, in order to establish a violation. The Staff need only demonstrate that the filings were materially inaccurate or that the books and records did not accurately reflect the Bank's transactions and asset dispositions. This significantly lowers the Staff's burden of proof as compared to a scienter-based fraud charge.

B. Range of Potential Outcomes

Based on our assessment of the current state of the investigation, the applicable legal framework, and our experience with SEC Enforcement matters of this nature, we identify the following range of potential outcomes, listed in order from most favorable to least favorable from the Bank's perspective:

1. No Action. The Staff concludes, following its review of documents and analysis, that BRB's CECL methodology was within the range of reasonable judgments under ASC 326, and that the reported ACL was not materially misstated. The investigation is terminated with no further action. This outcome would be reflected in a closing letter from the Staff (or, more commonly in recent practice, a verbal notification that the investigation has been concluded).

2. Staff Comment / No Formal Action. The Staff determines that certain aspects of BRB's ACL methodology or disclosure practices could be improved, and issues informal guidance or comments to that effect, but does not pursue formal enforcement action. This outcome may be accompanied by a request that BRB enhance its disclosures in future filings or make prospective changes to its CECL model.

3. Cease-and-Desist Proceeding. The Staff recommends, and the Commission authorizes, an administrative proceeding under Section 21C of the Exchange Act seeking a cease-and-desist order directing BRB to cease and desist from committing or causing violations of Sections 13(a) and/or 13(b)(2)(A). Such a proceeding could result in prospective relief (i.e., an order prohibiting future violations) and could also involve the imposition of civil monetary penalties. For non-scienter-based violations, penalties are assessed under a three-tier structure established by the Securities Enforcement Remedies and Penny Stock Reform Act of 1990, as amended, and can range from tens of thousands of dollars to several million dollars per violation, depending on the severity of the violation and the extent of harm to investors.

4. Civil Injunctive Action. In a more aggressive posture, the Staff could recommend, and the Commission could authorize, a civil action in federal court seeking a permanent injunction against future violations and the imposition of civil penalties. This outcome is less likely in a non-scienter case involving accounting estimates, but cannot be entirely excluded if the Staff develops evidence suggesting intentional manipulation of the CECL model or deliberate concealment of credit quality deterioration.

5. Monetary Penalties. Across the range of enforcement outcomes involving formal action (scenarios 3 and 4 above), civil penalties for non-scienter-based Section 13 violations can range from approximately $10,000 to several million dollars per violation under the current penalty tiers, which are adjusted periodically for inflation. In recent enforcement actions involving books-and-records violations by financial institutions of comparable size, penalties have ranged from approximately $1 million to $10 million, though each case is highly fact-specific.

At this stage of the investigation, we do not anticipate that the Staff is pursuing scienter-based fraud charges under Section 10(b) of the Exchange Act or Rule 10b-5 thereunder. A fraud-based theory would require the Staff to prove that BRB or its officers acted with intent to deceive, manipulate, or defraud, or with severe recklessness — a substantially higher evidentiary burden. However, it is premature to rule out the possibility that the investigation could expand in this direction if the Staff uncovers evidence suggesting intentional misconduct. We will continue to monitor the Staff's focus and areas of inquiry as the investigation progresses.

C. Individual Exposure

The Voluntary Request is currently directed at BRB as an entity, and no individual officers or directors have been named as subjects or targets of the investigation. This is consistent with the preliminary nature of the inquiry and the Staff's typical practice of focusing initially on the entity before broadening to individuals, if warranted.

Nevertheless, the Audit Committee should be aware that certain individual officers could face personal exposure if the investigation broadens or if the Staff develops evidence suggesting individual responsibility for the alleged misstatements:

Patricia "Trish" Navarrete, Chief Financial Officer. As CFO, Ms. Navarrete signed the certifications required under Sections 302 and 906 of the Sarbanes-Oxley Act of 2002 ("SOX") in each of the Subject Filings. These certifications attest, among other things, that the financial statements and other financial information included in the report fairly present in all material respects the financial condition and results of operations of the issuer, and that the officer has evaluated the effectiveness of the issuer's disclosure controls and procedures. If the Staff concludes that the ACL disclosures were materially inaccurate, Ms. Navarrete's SOX certifications could become a basis for individual liability.

Raymond Hu, Chief Accounting Officer. Mr. Hu also signed certifications under SOX Sections 302 and 906 in the Subject Filings and, as CAO, bore direct responsibility for the preparation and accuracy of the financial statements. His role in overseeing the CECL model outputs and the accounting treatment of re-aged loans will be a natural focus of the Staff's inquiry.

Naveen Chakravarti, SVP & Division Head, BridgeFin. Mr. Chakravarti, as the head of the BridgeFin division, oversaw the development and implementation of the loan modification and re-aging policies at the center of the Staff's inquiry. While Mr. Chakravarti did not sign the SOX certifications, his operational responsibility for BridgeFin's credit risk management and his knowledge of the re-aging practices make him a likely witness — and potentially a subject — if the investigation progresses.

As noted in Section V.A below, C&H represents BRB the entity, not any individual officer or director. Upjohn corporate-client protocols have been established to ensure that all employees understand this distinction. If the investigation broadens to target individual officers, those individuals should be advised to retain personal counsel at the Bank's expense (subject to applicable indemnification and advancement provisions in BRB's bylaws and D&O insurance policies).

V. Engagement of Calderwood & Harkness and Related Advisors

A. Calderwood & Harkness LLP Engagement

Calderwood & Harkness LLP was retained on September 20, 2023 as defense counsel for BRB the entity in connection with SEC Investigation File No. HO-14287. The engagement has been assigned C&H Matter No. SC-MAT-2023-4172.

The C&H team assigned to this matter includes the following attorneys:

The fee arrangement provides for hourly billing with an annual fee cap of $4.5 million for C&H's legal fees (exclusive of out-of-pocket disbursements and the fees of any separately engaged consultants). Based on our preliminary estimate of the scope and duration of the engagement, we anticipate that total C&H fees will fall within this cap, producing an effective reduction of approximately 19.3% on aggregate fees relative to uncapped hourly billing for a matter of this nature. The annual cap is subject to renegotiation if the scope of the engagement materially expands (e.g., if the matter proceeds to a contested administrative proceeding or federal court litigation).

As part of the engagement process, C&H has established comprehensive Upjohn/corporate-client protocols to ensure that all BRB employees who interact with C&H in connection with the investigation understand the following critical points:

(i) C&H represents BRB the entity, and only BRB the entity, in connection with this investigation. C&H does not represent any individual officer, director, or employee in his or her personal capacity.

(ii) Any communications between BRB employees and C&H in the course of the investigation are protected by the attorney-client privilege, but the privilege belongs to BRB the entity (through the Board and the Audit Committee), not to the individual employee. BRB may, in its sole discretion, choose to waive the privilege with respect to any such communications.

(iii) Individual employees who believe they may have personal exposure in connection with the investigation are encouraged to consult with personal counsel. BRB's indemnification and advancement provisions may apply to the costs of personal counsel, subject to applicable terms and conditions.

C&H has prepared a form Upjohn warning to be read to each BRB employee at the outset of any interview conducted by C&H attorneys in connection with the investigation. Copies of the Upjohn warning have been provided to Derek Sung for review and approval.

B. Role of Caldwell Pratt & Stein LLP

Caldwell Pratt & Stein LLP, under the leadership of Martin Caldwell, has served as BRB's regular outside securities counsel for approximately eight years and was directly involved in the preparation and review of the Subject Filings. CPS attorneys participated in the drafting of the financial statement disclosures, including the ACL disclosures, and provided legal review of the filings prior to their submission to the Commission.

CPS initially received the SEC's Voluntary Request on September 18, 2023, before C&H was retained to handle the investigation. Given CPS's role in preparing the Subject Filings, we determined — in consultation with Mr. Sung and Ms. Prescott — that it was prudent to engage separate counsel for the investigation to avoid any actual or perceived conflict of interest. CPS's work on the Subject Filings could become a subject of the Staff's inquiry, and the Bank's defense counsel should be positioned to evaluate CPS's work independently if necessary.

CPS will continue to serve as BRB's regular outside securities counsel for all matters other than the SEC investigation. C&H and CPS have agreed to establish coordination protocols to facilitate information sharing where appropriate and to avoid duplication of effort, while maintaining appropriate boundaries to protect privilege and to ensure that C&H can independently assess the legal and factual issues, including the adequacy of the disclosures that CPS prepared.

C. Independent Auditor: Whitfield Keane LLP

BRB's independent registered public accounting firm for the fiscal years ended December 31, 2021 and December 31, 2022 was Whitfield Keane LLP ("Whitfield Keane"), a firm registered with the Public Company Accounting Oversight Board ("PCAOB") under Registration No. 2847. The engagement partner for the BRB audit was Lorraine Dupont. Whitfield Keane's offices are located at 600 Third Avenue, 22nd Floor, New York, NY 10016.

As the independent auditor, Whitfield Keane audited BRB's consolidated financial statements for FY 2022, including the ACL for the BridgeFin portfolio, and issued an unqualified audit opinion. Whitfield Keane also performed interim review procedures on the Q1 2023 and Q2 2023 quarterly financial statements. The Staff's inquiry will inevitably touch upon Whitfield Keane's audit and review procedures, including the firm's evaluation of the reasonableness of BRB's CECL estimates, its assessment of the re-aging practices, and its conclusions regarding the adequacy of the ACL disclosures.

We have been advised that Whitfield Keane has retained its own independent counsel in connection with the SEC inquiry. The firm has engaged Hargrove & Millstein LLP, a Washington, D.C.-based firm with a recognized SEC enforcement defense practice. The lead partner on the Hargrove & Millstein engagement is Samuel Hargrove, located at 1700 K Street NW, Suite 900, Washington, D.C. 20006.

Communications between BRB (and its counsel) and Whitfield Keane (and its counsel) must be carefully structured to preserve applicable privileges. In particular, the common-interest doctrine may or may not apply to certain communications between the Bank and its auditor, depending on the jurisdiction and the specific circumstances. C&H has issued a detailed protocol memorandum to Derek Sung addressing the parameters for communications with Whitfield Keane and Hargrove & Millstein during the pendency of the investigation. The key principle is that substantive discussions regarding legal strategy, privilege issues, and defense positions should be conducted only through counsel-to-counsel channels and only to the extent covered by a formal common-interest agreement, if one is entered into. C&H is evaluating whether a common-interest agreement with Hargrove & Millstein is advisable and will report back to the Audit Committee on this question.

D. Forensic Accounting Consultant: Brindoval Analytic Partners LLC

C&H recommends, and has initiated the engagement of, Brindoval Analytic Partners LLC ("Brindoval") to provide forensic accounting analysis of BRB's CECL methodology and BridgeFin loss-rate modeling. Brindoval is a forensic accounting and financial advisory firm with recognized expertise in credit loss modeling, financial institution regulatory matters, and SEC enforcement defense support. The lead consultant for this engagement will be Dr. Franklin Osei, CPA, CFF (Certified in Financial Forensics), whose office is located at 350 South Grand Avenue, Suite 2100, Los Angeles, CA 90071.

Brindoval's scope of work will include:

(i) a comprehensive review and evaluation of BRB's CECL model as applied to the BridgeFin portfolio, including the model's inputs, assumptions, vintage cohort analysis, and loss-rate calculations;

(ii) an independent assessment of the reasonableness of BRB's treatment of re-aged and modified loans within the CECL framework;

(iii) a comparison of BRB's methodology to industry practices and applicable regulatory guidance (including FASB guidance, OCC examination guidance, and relevant SEC Staff observations);

(iv) a recalculation of the ACL under alternative assumptions, including the Staff's apparent methodology, to identify and quantify the range of reasonable estimates; and

(v) preparation of a written analysis, at C&H's direction, for use in connection with the Bank's defense of the SEC investigation.

Brindoval will be engaged under the Kovel doctrine, which provides that communications between a client and a non-attorney expert retained at the direction of counsel to assist in the provision of legal services may be protected by the attorney-client privilege. United States v. Kovel, 296 F.2d 918 (2d Cir. 1961). Additionally, Brindoval's work product, prepared in anticipation of litigation or regulatory enforcement and at the direction of counsel, will be protected as attorney work product under Federal Rule of Civil Procedure 26(b)(3) and its equivalents. To ensure the maximum protection of privilege, Brindoval's engagement letter will be executed by C&H (not BRB directly), and all communications with Brindoval will be channeled through C&H attorneys.

The engagement letter with Brindoval is expected to be executed on or about October 10, 2023. Brindoval's fees are budgeted separately from C&H's fees and are not subject to the $4.5 million annual fee cap applicable to C&H.

VI. D&O Insurance Coverage

BRB maintains directors' and officers' liability insurance (the "D&O Program") to protect the Bank, its directors, and its officers against liability arising from claims alleging wrongful acts in their capacities as such. The D&O Program is structured as a tower of coverage consisting of a primary layer and one excess layer, as summarized below:

The combined D&O tower thus provides aggregate coverage of $25 million, subject to a $2.5 million entity retention under the primary policy. The primary policy issued by Northcastle Mutual is a "claims-made" policy, meaning that coverage is triggered by claims first made during the policy period. Because the SEC's Voluntary Request was received on September 18, 2023 — within the July 1, 2023 to July 1, 2024 policy period — the timing of the claim satisfies the claims-made requirement, provided that the claim is properly tendered.

Northcastle Mutual has designated Thornfield & Rowe LLP as its claims counsel for the BRB D&O Program. The lead contact at Thornfield & Rowe is Brenda Alvaro, located at 227 West Monroe Street, Suite 4400, Chicago, IL 60606. BRB's D&O insurance broker, responsible for the placement and administration of the D&O Program, is Ridgeline Governance Advisors LLC, led by Melinda Tran, Senior Vice President, located at 100 Federal Street, Suite 3600, Boston, MA 02110.

C&H has prepared a formal tender letter addressed to Northcastle Mutual, tendering the SEC investigation as a "Claim" under the primary D&O policy. The tender letter is expected to be transmitted on or about October 5, 2023, following review by Mr. Sung. The tender letter identifies the SEC Voluntary Request, describes the nature of the inquiry, and formally invokes coverage under the policy for defense costs incurred in connection with the investigation.

Under the terms of the primary policy, defense costs — including outside counsel fees and forensic consultant fees — are advanced by the insurer on a current basis, subject to the $2.5 million entity retention. This means that the first $2.5 million in defense costs will be borne by BRB out of its own funds before D&O coverage begins to respond. Based on our preliminary budget (discussed in Section IX below), we anticipate that BRB's defense costs will exceed the retention, at which point Northcastle Mutual will be responsible for reimbursing defense costs up to the $15 million primary policy limit, subject to applicable policy terms and conditions.

The Audit Committee should be aware that Northcastle Mutual, through its claims counsel Thornfield & Rowe, may seek to exercise certain rights under the D&O policy with respect to the defense of the investigation. These rights may include the right to approve defense counsel, the right to receive copies of significant pleadings and reports, and the right to monitor fee levels and defense strategy to ensure compliance with the policy's billing guidelines. C&H will cooperate with Northcastle Mutual's reasonable requests for information, while taking care not to waive any applicable privileges or to compromise the Bank's defense strategy. Compliance with the insurer's billing guidelines will be an important consideration in the management of defense costs, and C&H will work with Ms. Tran and Mr. Sung to ensure that billing practices conform to the policy's requirements.

We also note that, in the event the investigation broadens to include individual officers or directors, the D&O Program provides coverage for defense costs and indemnification of individuals to the extent provided in the policy terms, subject to applicable exclusions. C&H has reviewed the policy terms and does not, at this time, identify any exclusions that would obviously preclude coverage for the type of claims at issue, but we will continue to monitor this as the investigation develops.

VII. Privilege and Confidentiality Considerations

The preservation of applicable privileges and the maintenance of confidentiality are of paramount importance throughout the course of this investigation. An inadvertent disclosure of privileged information could result in a waiver of privilege with respect to the disclosed materials — and potentially related materials — significantly undermining the Bank's defense position. The following sections outline the principal privilege and confidentiality considerations.

A. Attorney-Client Privilege

All communications between BRB officers, directors, and employees and C&H (or CPS) for the purpose of obtaining or providing legal advice in connection with this investigation are protected by the attorney-client privilege. The privilege applies to communications in all forms, including oral communications, written correspondence, electronic mail, and electronically stored information.

The attorney-client privilege belongs to BRB the entity, and the power to waive (or assert) the privilege rests with the Board of Directors, acting through the Audit Committee, in consultation with the General Counsel. No individual employee has the unilateral authority to waive the entity's privilege.

BRB's Upjohn corporate-client protocols, as discussed in Section V.A above, are designed to ensure that the contours of the attorney-client relationship are clearly communicated to every BRB employee who participates in an interview or other communication with C&H in connection with the investigation. Specifically, each employee will be advised at the outset of any interview that:

(i) C&H represents BRB the entity, not the individual employee;

(ii) the interview is being conducted for the purpose of providing legal advice to BRB in connection with the investigation;

(iii) the communications during the interview are protected by BRB's attorney-client privilege;

(iv) the privilege belongs to BRB, not to the individual, and BRB may choose to waive the privilege and disclose the contents of the interview at any time; and

(v) the individual should consider retaining personal counsel if the individual believes that his or her personal interests may diverge from those of BRB.

B. Work-Product Doctrine

All memoranda, analyses, draft documents, internal strategy discussions, interview notes, legal research, and mental impressions prepared by C&H attorneys (or by Brindoval at C&H's direction) in anticipation of litigation or regulatory enforcement proceedings are protected by the work-product doctrine. The work-product doctrine provides broader protection than the attorney-client privilege in certain respects, as it protects materials prepared in anticipation of litigation regardless of whether those materials constitute communications between attorney and client.

Brindoval's engagement under the Kovel doctrine is specifically designed to extend work-product protection to Brindoval's forensic analysis and expert opinions. To maintain this protection, all communications between Brindoval and BRB will be channeled through C&H, and Brindoval's engagement letter will be executed by C&H, confirming that Brindoval is acting as a consulting expert retained at the direction of counsel to assist in the provision of legal services.

It is important to distinguish between "opinion" work product (which reflects the mental impressions, conclusions, and legal theories of attorneys) and "fact" work product (which consists of factual compilations and analyses prepared in anticipation of litigation). Opinion work product enjoys near-absolute protection from discovery, while fact work product may be discoverable in limited circumstances upon a showing of substantial need and inability to obtain the equivalent information through other means. C&H will take care to clearly label and segregate opinion work product to maximize its protection.

C. Bank-Examination Privilege

Certain communications between BRB and the OCC, including supervisory correspondence, examination reports, Reports of Examination, Matters Requiring Attention ("MRAs"), and related regulatory communications, are protected by the bank-examination privilege. This privilege, which is distinct from the attorney-client privilege and the work-product doctrine, is designed to protect the confidentiality of the bank supervisory process and to encourage candid communication between regulated institutions and their supervisors.

The bank-examination privilege is held by the regulator (the OCC), not by the regulated institution, and the OCC's consent may be required before any privileged supervisory materials can be disclosed to the SEC or other third parties. C&H will work closely with Derek Sung to identify and log all OCC supervisory materials in BRB's possession that may be responsive to the SEC's document requests. Any such materials will be withheld from production pending a determination of whether the bank-examination privilege applies and, if so, whether the OCC consents to their disclosure.

We note that the SEC and the OCC have established interagency information-sharing protocols, and the SEC may independently seek supervisory information from the OCC through those channels. Nevertheless, it remains BRB's obligation to assert the bank-examination privilege with respect to any supervisory materials in its possession and to refrain from producing such materials to the SEC without the OCC's authorization.

D. Litigation Hold

On September 22, 2023, C&H issued, through Derek Sung, a comprehensive litigation hold and document preservation memorandum (the "Hold Memorandum") to all BRB employees identified as potentially possessing documents or information relevant to the SEC's areas of inquiry. The Hold Memorandum directs each recipient to preserve, and to refrain from destroying, altering, modifying, or deleting, all documents and electronically stored information ("ESI") that may be potentially relevant to the SEC investigation, including but not limited to:

(i) all documents and communications relating to the CECL model and ACL estimates for the BridgeFin portfolio;

(ii) all documents and communications relating to BridgeFin loan modifications, restructurings, and re-aging practices;

(iii) all documents and communications relating to the preparation, review, and filing of the Subject Filings;

(iv) all communications with the independent auditor, Whitfield Keane, regarding the BridgeFin portfolio and ACL;

(v) all internal committee materials (Audit Committee, Credit Policy Committee, Risk Committee, Asset-Liability Committee) relating to BridgeFin credit quality and ACL;

(vi) all OCC supervisory correspondence, examination materials, and related communications regarding BridgeFin; and

(vii) any personal devices, personal email accounts, or messaging applications used for business-related communications regarding BridgeFin.

The following individuals have been identified as custodians and have received the Hold Memorandum:

• Patricia "Trish" Navarrete, CFO

• Raymond Hu, CAO

• Naveen Chakravarti, SVP & Division Head, BridgeFin

• Annette Kowalski, CRO

• Derek Sung, General Counsel & CLO

• Marcus R. Ellingham, CEO

• Gwendolyn Prescott, Chair, Audit Committee

• Relevant BridgeFin credit-risk analysts, model developers, and accounting personnel (approximately 14 additional custodians, identified by name in a supplemental custodian list provided to Mr. Sung)

The Hold Memorandum covers all electronic and hard-copy records from January 1, 2020 (the effective date of BRB's CECL adoption) through the present, and requires ongoing preservation until the hold is formally lifted by C&H.

C&H has also coordinated with BRB's Information Technology department to ensure that automatic deletion protocols (including email purge schedules and data retention policies) are suspended for the relevant custodians and data repositories for the duration of the hold. Backup tapes and archived data sources covering the relevant time period have been identified and are being preserved.

E. FRE 502(d) Protections

In the event that the SEC obtains a Formal Order of Investigation and issues subpoenas requiring the production of documents, C&H will seek to negotiate with the Staff a stipulation — or, if necessary, to obtain a court order — under Federal Rule of Evidence 502(d) providing that the inadvertent production of privileged or work-product-protected materials shall not constitute a waiver of privilege with respect to the produced materials or any related undisclosed materials. A 502(d) order provides a critical safeguard against the risk that the production of a privileged document, in the context of a large-scale document review, could be deemed a waiver of privilege over a broader subject matter.

We note that the Staff has generally been receptive to 502(d) stipulations in recent enforcement investigations, and we anticipate that this request will not be a point of significant contention.

VIII. Recommended Course of Action

A. Immediate Steps (Completed or In Progress)

Based on our assessment of the investigation and the applicable legal and practical considerations, C&H has taken or is in the process of taking the following immediate steps:

1. Engagement and Upjohn Protocols. C&H's engagement as defense counsel was completed on September 20, 2023. Upjohn corporate-client protocols have been established and documented, and the form Upjohn warning for employee interviews has been prepared and approved by Mr. Sung.

2. Litigation Hold. A comprehensive litigation hold and document preservation memorandum was issued to all relevant BRB custodians on September 22, 2023. Confirmation of receipt and compliance has been obtained from all custodians, and IT department coordination for the suspension of automatic deletion protocols is complete.

3. Initial Response to SEC Staff. C&H has prepared an initial response letter to the SEC Staff, to be transmitted on or about September 29, 2023. The letter will (a) formally enter C&H's appearance as counsel for BRB in connection with SEC Investigation File No. HO-14287; (b) confirm that BRB intends to cooperate with the Staff's inquiry; and (c) request a meet-and-confer to discuss the scope, custodians, date ranges, search terms, and production format for the document collection and production process. The letter will also request an extension of the initial response deadline set forth in the Voluntary Request to allow adequate time for document collection and privilege review.

4. D&O Insurance Tender. C&H has prepared a formal tender letter to Northcastle Mutual Assurance Company, tendering the SEC investigation as a "Claim" under BRB's primary D&O policy. The tender letter is expected to be transmitted on or about October 5, 2023.

5. Brindoval Analytic Partners Engagement. C&H has initiated the engagement of Brindoval Analytic Partners LLC as a forensic accounting consultant. The engagement letter is expected to be executed on or about October 10, 2023, and Brindoval is prepared to commence its analysis promptly thereafter.

B. Near-Term Steps (October–November 2023)

In the October through November 2023 timeframe, C&H plans to undertake the following activities:

1. Internal Fact-Gathering. Conduct interviews of key BRB personnel — including Ms. Navarrete, Mr. Hu, Mr. Chakravarti, and Ms. Kowalski — under Upjohn protocols to develop a thorough understanding of the ACL estimation process, the re-aging policies and their rationale, the internal deliberations regarding the treatment of modified loans, and any internal concerns or dissenting views that may have been expressed regarding the methodology. Additional interviews of BridgeFin credit-risk analysts and model developers will be conducted as needed.

2. Document Collection and Privilege Review. Commence systematic collection of potentially responsive documents from the identified custodians and data repositories. C&H will oversee the collection, processing, and review of documents, including the application of search terms and other culling methodologies, and will conduct a privilege review to identify and withhold privileged and work-product-protected materials. A detailed privilege log will be prepared for any documents withheld on privilege grounds.

3. Staff Engagement. Engage with the SEC Staff — initially through the meet-and-confer requested in C&H's initial response letter, and thereafter through ongoing dialogue — to negotiate the scope of the investigation, the number and identity of custodians, the applicable date ranges, the production format (including any requirements for structured data or database productions), and the timeline for rolling productions.

4. Forensic Accounting Analysis. Work with Brindoval Analytic Partners to conduct a rigorous, independent analysis of BRB's CECL model and the BridgeFin loss-rate modeling. This analysis will include a review of the model's inputs, assumptions, and outputs; an assessment of the reasonableness of the re-aging treatment under applicable accounting standards and regulatory guidance; a recalculation of the ACL under alternative scenarios; and a materiality assessment incorporating both quantitative and qualitative factors.

5. Coordination with Auditor's Counsel. Through appropriate channels and subject to the privilege protocols discussed in Section VII above, coordinate with Hargrove & Millstein LLP (counsel to Whitfield Keane) to ensure that BRB's and Whitfield Keane's positions are aligned to the extent appropriate, while maintaining the independence of each party's legal strategy and defense. C&H will evaluate whether a common-interest agreement is advisable and, if so, will negotiate and execute such an agreement with Hargrove & Millstein.

6. Monitoring for Formal Order. Continuously monitor for any indication that the Staff is seeking or has obtained a Formal Order of Investigation from the Commission. A Formal Order would expand the Staff's authority to issue subpoenas for documents and testimony and could signal an escalation of the investigation. C&H will promptly notify the Audit Committee and Mr. Sung if a Formal Order is issued.

C. Ongoing Obligations

Throughout the pendency of the investigation, BRB will be subject to the following ongoing obligations and considerations:

1. Regular Updates to the Audit Committee. C&H will provide regular updates to the Audit Committee regarding the status of the investigation, any significant developments, and any changes in our assessment of the Bank's legal exposure. Updates will be provided at least quarterly, or more frequently as developments warrant. Updates will be delivered through secure, privilege-protected channels, and written reports will be clearly labeled as privileged and confidential.

2. Public Disclosure Considerations. BRB should carefully evaluate whether the existence of the SEC investigation triggers any public disclosure obligations. Specifically, the Bank should consider whether an immediate report on Form 8-K is warranted and, in any event, whether the risk factors section or legal proceedings disclosure in the Bank's next periodic report (the Q3 2023 10-Q, expected to be filed in November 2023) should be updated to reflect the existence of the investigation. C&H and CPS will advise jointly on this question. The relevant factors include: (a) the materiality of the investigation to investors, considering both the magnitude of the potential exposure and the stage and

PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT COMMUNICATION — ATTORNEY WORK PRODUCT
CALDERWOOD & HARKNESS LLP 425 Lexington Avenue, 30th Floor New York, NY 10017
October 2, 2023
MEMORANDUM
TO: Gwendolyn Prescott, Chair, Audit Committee of the Board of Directors, Belmont Ridge Bank National Association
CC: Derek Sung, General Counsel & Chief Legal Officer, Belmont Ridge Bank National Association
FROM: Victoria Chambers, Partner, Calderwood & Harkness LLP Jasmine Thornton, Lead Associate, Calderwood & Harkness LLP
RE: SEC Division of Enforcement Investigation — File No. HO-14287; Inquiry into Allowance for Credit Losses Disclosures — BridgeFin Portfolio
MATTER NO.: SC-MAT-2023-4172
This memorandum is a privileged and confidential attorney-client communication and attorney work product prepared by Calderwood & Harkness LLP at the direction of and for the benefit of the Audit Committee of the Board of Directors of Belmont Ridge Bank National Association. This memorandum should not be disclosed, disseminated, or distributed to any person or entity beyond the members of the Audit Committee, the Office of the General Counsel of Belmont Ridge Bank National Association, and outside counsel without the prior written authorization of Calderwood & Harkness LLP. Any unauthorized disclosure may result in a waiver of applicable privileges.
I. Executive Summary
Calderwood & Harkness LLP ("C&H" or "the Firm") was retained on September 20, 2023 to represent Belmont Ridge Bank National Association ("BRB" or the "Bank") (Nasdaq: BRDG) in connection with an inquiry initiated by the Division of Enforcement (the "Division" or "Enforcement") of the U.S. Securities and Exchange Commission (the "SEC" or the "Commission") into BRB's public disclosures concerning the allowance for credit losses ("ACL") related to the Bank's digital lending platform, BridgeFin.
On September 18, 2023, BRB received a voluntary request letter (the "Voluntary Request" or the "Request") from the SEC Staff (the "Staff") requesting documents and information related to the Bank's Annual Report on Form 10-K for the fiscal year ended December 31, 2022, filed with the Commission on February 28, 2023 (the "FY 2022 10-K"), and the Bank's Quarterly Reports on Form 10-Q for the fiscal quarters ended March 31, 2023, filed May 10, 2023 (the "Q1 2023 10-Q"), and June 30, 2023, filed August 9, 2023 (the "Q2 2023 10-Q," and collectively with the FY 2022 10-K and Q1 2023 10-Q, the "Subject Filings"). The Request pertains specifically to the Bank's disclosures regarding the ACL for BridgeFin's consumer loan and small-business microloan portfolio, including the Bank's application of the Current Expected Credit Losses standard under Accounting Standards Codification Topic 326, Financial Instruments — Credit Losses ("CECL" or "ASC 326").
The Voluntary Request was initially received by Caldwell Pratt & Stein LLP ("CPS"), located at 51 West 52nd Street, 24th Floor, New York, NY 10019, which serves as BRB's regular outside securities counsel. CPS, under the leadership of its lead partner Martin Caldwell, had prepared and reviewed the Subject Filings at issue. Upon receipt of the Voluntary Request, CPS promptly communicated the matter to BRB's General Counsel and Chief Legal Officer, Derek Sung. Following consultation among Mr. Sung, the Bank's Chief Executive Officer, Marcus R. Ellingham, and Ms. Prescott in her capacity as Chair of the Audit Committee, the Bank determined that it was advisable to engage separate, specialized counsel to represent BRB in connection with the SEC investigation. Calderwood & Harkness was subsequently retained specifically for the investigation on September 20, 2023.
The purpose of this memorandum is fourfold:
(a) to inform the Audit Committee of the nature, scope, and current status of the SEC inquiry;
(b) to assess the potential legal exposure facing BRB and, where applicable, individual officers who may be implicated if the investigation broadens;
(c) to outline the privilege and confidentiality considerations that must guide the Bank's conduct throughout this matter, including issues relating to the attorney-client privilege, the work-product doctrine, the bank-examination privilege, and document preservation obligations; and
(d) to recommend an immediate and near-term course of action for the Bank's response to the SEC inquiry, including the engagement of forensic accounting consultants, cooperation strategy, and disclosure considerations.
We emphasize at the outset that the SEC's inquiry is at a preliminary stage. The Voluntary Request does not constitute a formal subpoena; it is, as its name implies, a request for voluntary cooperation. No Formal Order of Investigation has been issued, and no individual officers or directors have been identified as targets or subjects of the inquiry. Nevertheless, the seriousness of any contact from the Division of Enforcement warrants immediate attention and a carefully coordinated response.
This memorandum is protected in its entirety by the attorney-client privilege and the work-product doctrine, and it should not be disseminated beyond the Audit Committee, the General Counsel's office, and outside counsel without prior authorization from C&H. We respectfully request that each recipient of this memorandum treat it accordingly and refrain from forwarding, copying, or discussing its contents with any person or entity not specifically identified as an authorized recipient.
II. Background: BRB and the BridgeFin Portfolio
A. The Bank
Belmont Ridge Bank National Association is a national banking association organized and existing under the laws of the United States, operating under Office of the Comptroller of the Currency ("OCC") Charter No. 24891. The Bank's principal executive offices are located at 200 Park Avenue South, 38th Floor, New York, NY 10003. BRB operates 127 retail banking branches across the northeastern United States, with a particular concentration in the New York, New Jersey, Connecticut, and Pennsylvania metropolitan areas, and additionally conducts substantial lending and deposit-gathering activities through its digital channels.
BRB's common stock is listed on the Nasdaq Global Select Market under the ticker symbol "BRDG." As of the end of September 2023, the Bank's approximate market capitalization stood at approximately $4.7 billion, based on approximately 76.7 million shares of common stock outstanding and a closing share price in the range of $61 per share.
As reported in the FY 2022 10-K, the Bank's consolidated financial position as of December 31, 2022 included the following:
The Bank is supervised and examined by the OCC as its primary federal banking regulator, and additionally is subject to examination and oversight by the Federal Deposit Insurance Corporation ("FDIC") as the administrator of the Deposit Insurance Fund. As of the most recent completed examination cycle in September 2023, BRB maintains a composite CAMELS rating of 2 (Satisfactory), reflecting the OCC's assessment that the Bank is fundamentally sound and that any identified weaknesses are moderate and well within the Bank's ability and willingness to correct.
The following senior officers of BRB are particularly relevant to the matters discussed in this memorandum:
Each of these individuals may possess information relevant to the SEC's inquiry, and their respective roles in the ACL estimation process, financial reporting, and risk oversight are discussed further below.
B. The BridgeFin Platform
BridgeFin is an internal division of BRB — not a separately incorporated subsidiary or distinct legal entity — that operates a digital-first consumer and small-business lending platform. BridgeFin was launched in the third quarter of 2020, in part as a strategic response to the accelerating shift toward digital financial services and in part to capture market share in the rapidly growing fintech-enabled lending space. The division is headed by Naveen Chakravarti, who reports directly to the Bank's Chief Risk Officer, Annette Kowalski, and has a dotted-line reporting relationship to the CEO.
BridgeFin originates two principal categories of loans through its platform:
(i) Unsecured consumer personal loans, with an average loan size of approximately $18,400, typically extended to borrowers with credit profiles in the near-prime to prime range, with maturities ranging from 24 to 60 months; and
(ii) Small-business microloans, with an average loan size of approximately $42,000, typically extended to small businesses with annual revenues between $250,000 and $5 million, with maturities ranging from 12 to 36 months.
BridgeFin's underwriting process relies on a proprietary artificial intelligence-driven credit scoring and decisioning model (internally referred to as the "BridgeScore Model"), which incorporates traditional credit bureau data alongside alternative data inputs, including bank account transaction data, cash-flow analysis, and certain behavioral scoring metrics. The BridgeScore Model was developed in-house by BRB's data science and credit risk teams and has been subject to model validation by the Bank's internal model risk management function, as well as periodic review by the OCC as part of its supervisory examination program.
For the fiscal year ended December 31, 2022, BridgeFin originated approximately $2.87 billion in new loans across both product categories. The total outstanding balance of the BridgeFin portfolio as of December 31, 2022 was approximately $4.1 billion, representing approximately 10.7% of the Bank's total consolidated assets of $38.2 billion. By any measure, BridgeFin constitutes a material component of BRB's lending operations, and the performance of the BridgeFin portfolio has a direct and significant impact on the Bank's overall credit quality metrics and financial results.
In accordance with generally accepted accounting principles ("GAAP"), BRB adopted the Current Expected Credit Losses standard (CECL, codified at ASC 326) effective January 1, 2020, the mandatory adoption date for SEC-reporting entities that are public business entities. Under CECL, BRB is required to estimate and record an allowance for credit losses reflecting the Bank's current estimate of all expected credit losses over the remaining contractual life of loans held at amortized cost, considering historical experience, current conditions, and reasonable and supportable forecasts.
As reported in the FY 2022 10-K, the Bank's key credit quality metrics for the BridgeFin portfolio were as follows:
These metrics were disclosed in the critical accounting estimates section and the credit quality disclosures accompanying the consolidated financial statements in the FY 2022 10-K, and were updated in the Q1 2023 and Q2 2023 10-Q filings.
C. Re-Aged / Modified Loans at Issue
The central factual issue underlying the SEC inquiry concerns the Bank's treatment of a subset of BridgeFin loans that were re-aged or modified during the period under review. Specifically, BRB's CECL model treated 12,847 re-aged or modified BridgeFin loans, with an aggregate outstanding balance of approximately $236.4 million, as "current" after modification, thereby resetting the delinquency clocks for those loans and, in effect, reclassifying them from delinquent status to current status for purposes of the Bank's loss-rate estimation.
These 12,847 loans were predominantly originated after the second quarter of 2021 and fell within vintage cohorts that experienced deteriorating credit quality as economic conditions tightened through 2022 and into 2023. In particular, vintage cohorts originated in Q3 2021, Q4 2021, and Q1 2022 exhibited higher-than-projected early-stage delinquency rates, reflecting, among other factors, the post-pandemic normalization of consumer credit performance, rising interest rates, and inflationary pressures on borrower cash flows.
Under BRB's loan modification and re-aging policies — which were developed by the BridgeFin credit risk team under Mr. Chakravarti's oversight and approved by the Bank's Credit Policy Committee — a loan that received a qualifying modification (such as a payment deferral, term extension, or interest rate reduction) and on which the borrower subsequently made a specified number of consecutive timely payments (typically three) was reclassified from its delinquent status to "current" status. Upon reclassification, the loan's delinquency history was reset to zero days past due, and for purposes of the CECL model, the loan was included in the "current" bucket rather than its original vintage delinquency bucket.
The Staff's inquiry appears to focus on whether this reclassification practice had the effect of understating the Bank's ACL by removing from the delinquent population a group of loans that, based on their original vintage cohort performance and underlying credit characteristics, continued to carry elevated loss expectations. In other words, the Staff's preliminary concern is that these re-aged loans should have remained classified in their original vintage delinquency buckets — or, at a minimum, should have been assigned loss rates reflective of their pre-modification delinquency experience — for purposes of loss-rate estimation under CECL. The implications of this treatment for the Bank's reported ACL, net charge-off rate, and delinquency metrics are discussed in detail in Section III below.
III. The SEC Inquiry
A. Voluntary Request Letter
The Voluntary Request was dated September 18, 2023 and was received by Caldwell Pratt & Stein LLP on the same date. CPS promptly forwarded the letter to BRB General Counsel Derek Sung, who in turn communicated the matter to CEO Marcus Ellingham and Audit Committee Chair Gwendolyn Prescott.
The Voluntary Request was issued by Senior Staff Attorney Andrea Felton of the Division of Enforcement's Home Office in Washington, D.C. (located at 100 F Street NE, Washington, D.C. 20549), and references SEC Investigation File No. HO-14287. Based on the information contained in the Voluntary Request and our initial communications with the Staff, we understand the investigation team to be composed of the following individuals:
The Voluntary Request seeks the production of documents and information relating to BRB's ACL disclosures for the BridgeFin consumer loan portfolio, as reflected in the FY 2022 10-K, the Q1 2023 10-Q, and the Q2 2023 10-Q. The specific categories of documents and information requested include, but are not limited to:
(i) all CECL model documentation, including model development documentation, model validation reports, and any model change logs, for the period from January 1, 2020 through the present;
(ii) all internal memoranda, analyses, presentations, and communications relating to the estimation of the ACL for the BridgeFin portfolio;
(iii) all documents relating to the Bank's loan modification, restructuring, and re-aging policies applicable to BridgeFin loans, including policy manuals, committee approvals, and any amendments thereto;
(iv) data files or reports reflecting the delinquency status, modification history, and loss experience of BridgeFin loans by vintage cohort;
(v) all communications between BRB management and its independent auditor, Whitfield Keane LLP, regarding the ACL for the BridgeFin portfolio;
(vi) minutes and materials from meetings of the Board of Directors, Audit Committee, and any management-level committees (including the Credit Policy Committee, Asset-Liability Committee, and Risk Committee) at which the BridgeFin ACL or credit quality metrics were discussed; and
(vii) any correspondence with the OCC or other regulatory agencies concerning the BridgeFin portfolio's credit quality or the Bank's CECL methodology.
It is important to note that the Voluntary Request is currently voluntary in nature. The Staff has not issued a Formal Order of Investigation, and the letter does not carry the force of a subpoena. BRB is not legally compelled to produce documents or provide testimony in response to a voluntary request. However, as discussed in Section VIII below, it is our strong recommendation that BRB adopt a posture of cooperation with the Staff's inquiry, subject to appropriate privilege protections. Refusal to cooperate at this stage could prompt the Staff to seek a Formal Order of Investigation from the Commission, which would confer subpoena authority and potentially escalate the matter. Moreover, a cooperative posture is a well-recognized factor that the Staff considers favorably in determining the appropriate resolution of an investigation.
We anticipate, based on our experience and the nature of the inquiry, that the Staff may seek a Formal Order of Investigation in the near term, particularly if the preliminary document review and analysis confirm their initial concerns regarding the ACL understatement. A Formal Order would authorize the Staff to compel testimony through investigative subpoenas and to obtain documents from third parties, including the Bank's auditor, Whitfield Keane LLP.
B. Core Issue Identified by the Staff
Based on a careful review of the Voluntary Request and our preliminary analysis of the publicly available financial disclosures, the core issue identified by the Staff can be summarized as follows:
The Staff is investigating whether BRB's reported ACL of $143.5 million (3.50% of the $4.1 billion in outstanding BridgeFin loans as of December 31, 2022) materially understated expected credit losses by failing to incorporate deteriorating credit quality metrics — specifically, rising delinquency rates and increased charge-offs in vintage cohorts originated after Q2 2021 — in the BridgeFin consumer personal-loan sub-segment. The Staff's preliminary concern, as we understand it, centers on the treatment of the 12,847 re-aged or modified loans discussed in Section II.C above.
The Staff's preliminary analysis appears to suggest that, if the re-aged loans had been maintained in their original vintage delinquency buckets (rather than reclassified as "current"), the resulting ACL would have been significantly higher. Specifically, the Staff's preliminary view appears to be that the ACL should have been approximately $180.8 million, representing 4.41% of the $4.1 billion in outstanding BridgeFin loans. This would represent a potential understatement of the ACL of approximately $37.3 million ($180.8 million minus $143.5 million).
If the Staff's preliminary view is credited, the recalculation would also affect certain other credit quality metrics disclosed in the Subject Filings:
The difference in the net charge-off rate and the 90+ day delinquency rate reflects the Staff's view that, if the re-aged loans were counted in their original delinquency buckets, the overall delinquency and loss profile of the BridgeFin portfolio would appear materially worse than what BRB disclosed.
We note that the Staff's recalculation is preliminary and has not been shared with us in detail. Our understanding of the Staff's position is based on the nature and focus of the questions posed in the Voluntary Request, as well as certain informal comments made by Senior Staff Attorney Andrea Felton during an initial telephone call with C&H on September 27, 2023. We expect that the Staff's analysis will be further refined as the investigation progresses, and we will work with Brindoval Analytic Partners (discussed in Section V.D below) to develop our own independent analysis of the appropriate ACL level.
C. Materiality Assessment
The question of materiality is central to any potential enforcement action under the securities laws. The Staff will need to demonstrate that any alleged misstatement or omission in BRB's financial disclosures was material to investors — that is, that there is a substantial likelihood that a reasonable investor would consider the information important in making an investment decision. TSC Industries, Inc. v. Northway, Inc., 426 U.S. 438, 449 (1976); Basic Inc. v. Levinson, 485 U.S. 224, 231-32 (1988).
BRB's internal materiality threshold, as established by the Bank's accounting policies and applied in connection with the independent audit, is calculated at 5% of pre-tax income. For FY 2022, this yields a materiality threshold of $30.6 million ($612 million × 5%).
The $37.3 million potential ACL understatement identified by the Staff exceeds this internal materiality threshold by approximately $6.7 million ($37.3 million minus $30.6 million), or approximately 21.9% above the threshold level. This excess is a factor that the Staff will likely emphasize in any potential enforcement action, as it suggests that the alleged misstatement crossed the line of quantitative materiality under the Bank's own framework.
However, several countervailing considerations temper this conclusion. First, the $37.3 million figure is derived from the Staff's preliminary recalculation, which has not been verified by the Bank's own analysis or by an independent forensic accounting review. Second, the proximity of the alleged understatement to the materiality threshold — $37.3 million versus a threshold of $30.6 million — is itself a mitigating factor, as courts and the SEC have recognized that close-call materiality determinations must account for the inherently judgmental nature of accounting estimates. Third, SAB 99 (Materiality) and subsequent guidance from the SEC Staff make clear that both quantitative and qualitative factors must be considered in assessing materiality. Qualitative factors that may weigh in BRB's favor include: (a) the alleged understatement does not mask a change in earnings trend; (b) BRB's re-aging methodology was consistently applied and disclosed to its auditor; (c) the ACL is by its nature an estimate subject to significant management judgment; and (d) the potential understatement, even if accepted, would not have caused BRB to fail any regulatory capital requirements or violate any debt covenants.
C&H will work with Brindoval Analytic Partners to develop a comprehensive materiality analysis that addresses both quantitative and qualitative factors, with the objective of presenting the strongest possible case that BRB's ACL was within the range of reasonable estimates permissible under ASC 326.
IV. Potential Legal Exposure
A. Statutory and Regulatory Framework
The Staff's inquiry implicates several provisions of the Securities Exchange Act of 1934 (the "Exchange Act") and the rules promulgated thereunder. Based on the nature and scope of the Voluntary Request, the most directly relevant provisions are as follows:
Section 13(a) of the Exchange Act (15 U.S.C. § 78m(a)). Section 13(a) requires every issuer of a security registered under Section 12 of the Exchange Act to file with the Commission, in accordance with such rules and regulations as the Commission may prescribe, such annual reports, quarterly reports, and other periodic reports as the Commission may require. BRB's common stock is registered under Section 12, and the Bank is accordingly required to file annual reports on Form 10-K and quarterly reports on Form 10-Q. The Subject Filings constitute reports filed pursuant to Section 13(a), and any material inaccuracy in those filings could give rise to a violation.
Section 13(b)(2)(A) of the Exchange Act (15 U.S.C. § 78m(b)(2)(A)). Section 13(b)(2)(A) requires every issuer that has a class of securities registered under Section 12 to make and keep books, records, and accounts which, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the issuer. If BRB's internal books and records — including the CECL model outputs, loss-rate calculations, and delinquency classifications — did not accurately reflect the true credit quality of the BridgeFin portfolio, the Staff could allege a violation of this provision.
Rule 13a-1 under the Exchange Act (17 C.F.R. § 240.13a-1). Rule 13a-1 implements Section 13(a) with respect to the annual report filing requirement, mandating that every issuer having securities registered pursuant to Section 12 file an annual report on Form 10-K for each fiscal year. Any material inaccuracy in the FY 2022 10-K could be framed as a violation of this rule.
Rule 12b-20 under the Exchange Act (17 C.F.R. § 240.12b-20). Rule 12b-20 provides that, in addition to the information expressly required to be included in a statement or report, there shall be added such further material information, if any, as may be necessary to make the required statements, in light of the circumstances under which they are made, not misleading. If the Staff concludes that BRB's ACL disclosures were misleading in the absence of additional information about the re-aging practices, this rule could be implicated.
It is critically important to note that Sections 13(a) and 13(b)(2)(A), together with the implementing rules, are strict-liability provisions. This means that the Staff need not prove that BRB or its officers acted with scienter (i.e., intentional fraud or recklessness), or even negligence, in order to establish a violation. The Staff need only demonstrate that the filings were materially inaccurate or that the books and records did not accurately reflect the Bank's transactions and asset dispositions. This significantly lowers the Staff's burden of proof as compared to a scienter-based fraud charge.
B. Range of Potential Outcomes
Based on our assessment of the current state of the investigation, the applicable legal framework, and our experience with SEC Enforcement matters of this nature, we identify the following range of potential outcomes, listed in order from most favorable to least favorable from the Bank's perspective:
1. No Action. The Staff concludes, following its review of documents and analysis, that BRB's CECL methodology was within the range of reasonable judgments under ASC 326, and that the reported ACL was not materially misstated. The investigation is terminated with no further action. This outcome would be reflected in a closing letter from the Staff (or, more commonly in recent practice, a verbal notification that the investigation has been concluded).
2. Staff Comment / No Formal Action. The Staff determines that certain aspects of BRB's ACL methodology or disclosure practices could be improved, and issues informal guidance or comments to that effect, but does not pursue formal enforcement action. This outcome may be accompanied by a request that BRB enhance its disclosures in future filings or make prospective changes to its CECL model.
3. Cease-and-Desist Proceeding. The Staff recommends, and the Commission authorizes, an administrative proceeding under Section 21C of the Exchange Act seeking a cease-and-desist order directing BRB to cease and desist from committing or causing violations of Sections 13(a) and/or 13(b)(2)(A). Such a proceeding could result in prospective relief (i.e., an order prohibiting future violations) and could also involve the imposition of civil monetary penalties. For non-scienter-based violations, penalties are assessed under a three-tier structure established by the Securities Enforcement Remedies and Penny Stock Reform Act of 1990, as amended, and can range from tens of thousands of dollars to several million dollars per violation, depending on the severity of the violation and the extent of harm to investors.
4. Civil Injunctive Action. In a more aggressive posture, the Staff could recommend, and the Commission could authorize, a civil action in federal court seeking a permanent injunction against future violations and the imposition of civil penalties. This outcome is less likely in a non-scienter case involving accounting estimates, but cannot be entirely excluded if the Staff develops evidence suggesting intentional manipulation of the CECL model or deliberate concealment of credit quality deterioration.
5. Monetary Penalties. Across the range of enforcement outcomes involving formal action (scenarios 3 and 4 above), civil penalties for non-scienter-based Section 13 violations can range from approximately $10,000 to several million dollars per violation under the current penalty tiers, which are adjusted periodically for inflation. In recent enforcement actions involving books-and-records violations by financial institutions of comparable size, penalties have ranged from approximately $1 million to $10 million, though each case is highly fact-specific.
At this stage of the investigation, we do not anticipate that the Staff is pursuing scienter-based fraud charges under Section 10(b) of the Exchange Act or Rule 10b-5 thereunder. A fraud-based theory would require the Staff to prove that BRB or its officers acted with intent to deceive, manipulate, or defraud, or with severe recklessness — a substantially higher evidentiary burden. However, it is premature to rule out the possibility that the investigation could expand in this direction if the Staff uncovers evidence suggesting intentional misconduct. We will continue to monitor the Staff's focus and areas of inquiry as the investigation progresses.
C. Individual Exposure
The Voluntary Request is currently directed at BRB as an entity, and no individual officers or directors have been named as subjects or targets of the investigation. This is consistent with the preliminary nature of the inquiry and the Staff's typical practice of focusing initially on the entity before broadening to individuals, if warranted.
Nevertheless, the Audit Committee should be aware that certain individual officers could face personal exposure if the investigation broadens or if the Staff develops evidence suggesting individual responsibility for the alleged misstatements:
Patricia "Trish" Navarrete, Chief Financial Officer. As CFO, Ms. Navarrete signed the certifications required under Sections 302 and 906 of the Sarbanes-Oxley Act of 2002 ("SOX") in each of the Subject Filings. These certifications attest, among other things, that the financial statements and other financial information included in the report fairly present in all material respects the financial condition and results of operations of the issuer, and that the officer has evaluated the effectiveness of the issuer's disclosure controls and procedures. If the Staff concludes that the ACL disclosures were materially inaccurate, Ms. Navarrete's SOX certifications could become a basis for individual liability.
Raymond Hu, Chief Accounting Officer. Mr. Hu also signed certifications under SOX Sections 302 and 906 in the Subject Filings and, as CAO, bore direct responsibility for the preparation and accuracy of the financial statements. His role in overseeing the CECL model outputs and the accounting treatment of re-aged loans will be a natural focus of the Staff's inquiry.
Naveen Chakravarti, SVP & Division Head, BridgeFin. Mr. Chakravarti, as the head of the BridgeFin division, oversaw the development and implementation of the loan modification and re-aging policies at the center of the Staff's inquiry. While Mr. Chakravarti did not sign the SOX certifications, his operational responsibility for BridgeFin's credit risk management and his knowledge of the re-aging practices make him a likely witness — and potentially a subject — if the investigation progresses.
As noted in Section V.A below, C&H represents BRB the entity, not any individual officer or director. Upjohn corporate-client protocols have been established to ensure that all employees understand this distinction. If the investigation broadens to target individual officers, those individuals should be advised to retain personal counsel at the Bank's expense (subject to applicable indemnification and advancement provisions in BRB's bylaws and D&O insurance policies).
V. Engagement of Calderwood & Harkness and Related Advisors
A. Calderwood & Harkness LLP Engagement
Calderwood & Harkness LLP was retained on September 20, 2023 as defense counsel for BRB the entity in connection with SEC Investigation File No. HO-14287. The engagement has been assigned C&H Matter No. SC-MAT-2023-4172.
The C&H team assigned to this matter includes the following attorneys:
The fee arrangement provides for hourly billing with an annual fee cap of $4.5 million for C&H's legal fees (exclusive of out-of-pocket disbursements and the fees of any separately engaged consultants). Based on our preliminary estimate of the scope and duration of the engagement, we anticipate that total C&H fees will fall within this cap, producing an effective reduction of approximately 19.3% on aggregate fees relative to uncapped hourly billing for a matter of this nature. The annual cap is subject to renegotiation if the scope of the engagement materially expands (e.g., if the matter proceeds to a contested administrative proceeding or federal court litigation).
As part of the engagement process, C&H has established comprehensive Upjohn/corporate-client protocols to ensure that all BRB employees who interact with C&H in connection with the investigation understand the following critical points:
(i) C&H represents BRB the entity, and only BRB the entity, in connection with this investigation. C&H does not represent any individual officer, director, or employee in his or her personal capacity.
(ii) Any communications between BRB employees and C&H in the course of the investigation are protected by the attorney-client privilege, but the privilege belongs to BRB the entity (through the Board and the Audit Committee), not to the individual employee. BRB may, in its sole discretion, choose to waive the privilege with respect to any such communications.
(iii) Individual employees who believe they may have personal exposure in connection with the investigation are encouraged to consult with personal counsel. BRB's indemnification and advancement provisions may apply to the costs of personal counsel, subject to applicable terms and conditions.
C&H has prepared a form Upjohn warning to be read to each BRB employee at the outset of any interview conducted by C&H attorneys in connection with the investigation. Copies of the Upjohn warning have been provided to Derek Sung for review and approval.
B. Role of Caldwell Pratt & Stein LLP
Caldwell Pratt & Stein LLP, under the leadership of Martin Caldwell, has served as BRB's regular outside securities counsel for approximately eight years and was directly involved in the preparation and review of the Subject Filings. CPS attorneys participated in the drafting of the financial statement disclosures, including the ACL disclosures, and provided legal review of the filings prior to their submission to the Commission.
CPS initially received the SEC's Voluntary Request on September 18, 2023, before C&H was retained to handle the investigation. Given CPS's role in preparing the Subject Filings, we determined — in consultation with Mr. Sung and Ms. Prescott — that it was prudent to engage separate counsel for the investigation to avoid any actual or perceived conflict of interest. CPS's work on the Subject Filings could become a subject of the Staff's inquiry, and the Bank's defense counsel should be positioned to evaluate CPS's work independently if necessary.
CPS will continue to serve as BRB's regular outside securities counsel for all matters other than the SEC investigation. C&H and CPS have agreed to establish coordination protocols to facilitate information sharing where appropriate and to avoid duplication of effort, while maintaining appropriate boundaries to protect privilege and to ensure that C&H can independently assess the legal and factual issues, including the adequacy of the disclosures that CPS prepared.
C. Independent Auditor: Whitfield Keane LLP
BRB's independent registered public accounting firm for the fiscal years ended December 31, 2021 and December 31, 2022 was Whitfield Keane LLP ("Whitfield Keane"), a firm registered with the Public Company Accounting Oversight Board ("PCAOB") under Registration No. 2847. The engagement partner for the BRB audit was Lorraine Dupont. Whitfield Keane's offices are located at 600 Third Avenue, 22nd Floor, New York, NY 10016.
As the independent auditor, Whitfield Keane audited BRB's consolidated financial statements for FY 2022, including the ACL for the BridgeFin portfolio, and issued an unqualified audit opinion. Whitfield Keane also performed interim review procedures on the Q1 2023 and Q2 2023 quarterly financial statements. The Staff's inquiry will inevitably touch upon Whitfield Keane's audit and review procedures, including the firm's evaluation of the reasonableness of BRB's CECL estimates, its assessment of the re-aging practices, and its conclusions regarding the adequacy of the ACL disclosures.
We have been advised that Whitfield Keane has retained its own independent counsel in connection with the SEC inquiry. The firm has engaged Hargrove & Millstein LLP, a Washington, D.C.-based firm with a recognized SEC enforcement defense practice. The lead partner on the Hargrove & Millstein engagement is Samuel Hargrove, located at 1700 K Street NW, Suite 900, Washington, D.C. 20006.
Communications between BRB (and its counsel) and Whitfield Keane (and its counsel) must be carefully structured to preserve applicable privileges. In particular, the common-interest doctrine may or may not apply to certain communications between the Bank and its auditor, depending on the jurisdiction and the specific circumstances. C&H has issued a detailed protocol memorandum to Derek Sung addressing the parameters for communications with Whitfield Keane and Hargrove & Millstein during the pendency of the investigation. The key principle is that substantive discussions regarding legal strategy, privilege issues, and defense positions should be conducted only through counsel-to-counsel channels and only to the extent covered by a formal common-interest agreement, if one is entered into. C&H is evaluating whether a common-interest agreement with Hargrove & Millstein is advisable and will report back to the Audit Committee on this question.
D. Forensic Accounting Consultant: Brindoval Analytic Partners LLC
C&H recommends, and has initiated the engagement of, Brindoval Analytic Partners LLC ("Brindoval") to provide forensic accounting analysis of BRB's CECL methodology and BridgeFin loss-rate modeling. Brindoval is a forensic accounting and financial advisory firm with recognized expertise in credit loss modeling, financial institution regulatory matters, and SEC enforcement defense support. The lead consultant for this engagement will be Dr. Franklin Osei, CPA, CFF (Certified in Financial Forensics), whose office is located at 350 South Grand Avenue, Suite 2100, Los Angeles, CA 90071.
Brindoval's scope of work will include:
(i) a comprehensive review and evaluation of BRB's CECL model as applied to the BridgeFin portfolio, including the model's inputs, assumptions, vintage cohort analysis, and loss-rate calculations;
(ii) an independent assessment of the reasonableness of BRB's treatment of re-aged and modified loans within the CECL framework;
(iii) a comparison of BRB's methodology to industry practices and applicable regulatory guidance (including FASB guidance, OCC examination guidance, and relevant SEC Staff observations);
(iv) a recalculation of the ACL under alternative assumptions, including the Staff's apparent methodology, to identify and quantify the range of reasonable estimates; and
(v) preparation of a written analysis, at C&H's direction, for use in connection with the Bank's defense of the SEC investigation.
Brindoval will be engaged under the Kovel doctrine, which provides that communications between a client and a non-attorney expert retained at the direction of counsel to assist in the provision of legal services may be protected by the attorney-client privilege. United States v. Kovel, 296 F.2d 918 (2d Cir. 1961). Additionally, Brindoval's work product, prepared in anticipation of litigation or regulatory enforcement and at the direction of counsel, will be protected as attorney work product under Federal Rule of Civil Procedure 26(b)(3) and its equivalents. To ensure the maximum protection of privilege, Brindoval's engagement letter will be executed by C&H (not BRB directly), and all communications with Brindoval will be channeled through C&H attorneys.
The engagement letter with Brindoval is expected to be executed on or about October 10, 2023. Brindoval's fees are budgeted separately from C&H's fees and are not subject to the $4.5 million annual fee cap applicable to C&H.
VI. D&O Insurance Coverage
BRB maintains directors' and officers' liability insurance (the "D&O Program") to protect the Bank, its directors, and its officers against liability arising from claims alleging wrongful acts in their capacities as such. The D&O Program is structured as a tower of coverage consisting of a primary layer and one excess layer, as summarized below:
The combined D&O tower thus provides aggregate coverage of $25 million, subject to a $2.5 million entity retention under the primary policy. The primary policy issued by Northcastle Mutual is a "claims-made" policy, meaning that coverage is triggered by claims first made during the policy period. Because the SEC's Voluntary Request was received on September 18, 2023 — within the July 1, 2023 to July 1, 2024 policy period — the timing of the claim satisfies the claims-made requirement, provided that the claim is properly tendered.
Northcastle Mutual has designated Thornfield & Rowe LLP as its claims counsel for the BRB D&O Program. The lead contact at Thornfield & Rowe is Brenda Alvaro, located at 227 West Monroe Street, Suite 4400, Chicago, IL 60606. BRB's D&O insurance broker, responsible for the placement and administration of the D&O Program, is Ridgeline Governance Advisors LLC, led by Melinda Tran, Senior Vice President, located at 100 Federal Street, Suite 3600, Boston, MA 02110.
C&H has prepared a formal tender letter addressed to Northcastle Mutual, tendering the SEC investigation as a "Claim" under the primary D&O policy. The tender letter is expected to be transmitted on or about October 5, 2023, following review by Mr. Sung. The tender letter identifies the SEC Voluntary Request, describes the nature of the inquiry, and formally invokes coverage under the policy for defense costs incurred in connection with the investigation.
Under the terms of the primary policy, defense costs — including outside counsel fees and forensic consultant fees — are advanced by the insurer on a current basis, subject to the $2.5 million entity retention. This means that the first $2.5 million in defense costs will be borne by BRB out of its own funds before D&O coverage begins to respond. Based on our preliminary budget (discussed in Section IX below), we anticipate that BRB's defense costs will exceed the retention, at which point Northcastle Mutual will be responsible for reimbursing defense costs up to the $15 million primary policy limit, subject to applicable policy terms and conditions.
The Audit Committee should be aware that Northcastle Mutual, through its claims counsel Thornfield & Rowe, may seek to exercise certain rights under the D&O policy with respect to the defense of the investigation. These rights may include the right to approve defense counsel, the right to receive copies of significant pleadings and reports, and the right to monitor fee levels and defense strategy to ensure compliance with the policy's billing guidelines. C&H will cooperate with Northcastle Mutual's reasonable requests for information, while taking care not to waive any applicable privileges or to compromise the Bank's defense strategy. Compliance with the insurer's billing guidelines will be an important consideration in the management of defense costs, and C&H will work with Ms. Tran and Mr. Sung to ensure that billing practices conform to the policy's requirements.
We also note that, in the event the investigation broadens to include individual officers or directors, the D&O Program provides coverage for defense costs and indemnification of individuals to the extent provided in the policy terms, subject to applicable exclusions. C&H has reviewed the policy terms and does not, at this time, identify any exclusions that would obviously preclude coverage for the type of claims at issue, but we will continue to monitor this as the investigation develops.
VII. Privilege and Confidentiality Considerations
The preservation of applicable privileges and the maintenance of confidentiality are of paramount importance throughout the course of this investigation. An inadvertent disclosure of privileged information could result in a waiver of privilege with respect to the disclosed materials — and potentially related materials — significantly undermining the Bank's defense position. The following sections outline the principal privilege and confidentiality considerations.
A. Attorney-Client Privilege
All communications between BRB officers, directors, and employees and C&H (or CPS) for the purpose of obtaining or providing legal advice in connection with this investigation are protected by the attorney-client privilege. The privilege applies to communications in all forms, including oral communications, written correspondence, electronic mail, and electronically stored information.
The attorney-client privilege belongs to BRB the entity, and the power to waive (or assert) the privilege rests with the Board of Directors, acting through the Audit Committee, in consultation with the General Counsel. No individual employee has the unilateral authority to waive the entity's privilege.
BRB's Upjohn corporate-client protocols, as discussed in Section V.A above, are designed to ensure that the contours of the attorney-client relationship are clearly communicated to every BRB employee who participates in an interview or other communication with C&H in connection with the investigation. Specifically, each employee will be advised at the outset of any interview that:
(i) C&H represents BRB the entity, not the individual employee;
(ii) the interview is being conducted for the purpose of providing legal advice to BRB in connection with the investigation;
(iii) the communications during the interview are protected by BRB's attorney-client privilege;
(iv) the privilege belongs to BRB, not to the individual, and BRB may choose to waive the privilege and disclose the contents of the interview at any time; and
(v) the individual should consider retaining personal counsel if the individual believes that his or her personal interests may diverge from those of BRB.
B. Work-Product Doctrine
All memoranda, analyses, draft documents, internal strategy discussions, interview notes, legal research, and mental impressions prepared by C&H attorneys (or by Brindoval at C&H's direction) in anticipation of litigation or regulatory enforcement proceedings are protected by the work-product doctrine. The work-product doctrine provides broader protection than the attorney-client privilege in certain respects, as it protects materials prepared in anticipation of litigation regardless of whether those materials constitute communications between attorney and client.
Brindoval's engagement under the Kovel doctrine is specifically designed to extend work-product protection to Brindoval's forensic analysis and expert opinions. To maintain this protection, all communications between Brindoval and BRB will be channeled through C&H, and Brindoval's engagement letter will be executed by C&H, confirming that Brindoval is acting as a consulting expert retained at the direction of counsel to assist in the provision of legal services.
It is important to distinguish between "opinion" work product (which reflects the mental impressions, conclusions, and legal theories of attorneys) and "fact" work product (which consists of factual compilations and analyses prepared in anticipation of litigation). Opinion work product enjoys near-absolute protection from discovery, while fact work product may be discoverable in limited circumstances upon a showing of substantial need and inability to obtain the equivalent information through other means. C&H will take care to clearly label and segregate opinion work product to maximize its protection.
C. Bank-Examination Privilege
Certain communications between BRB and the OCC, including supervisory correspondence, examination reports, Reports of Examination, Matters Requiring Attention ("MRAs"), and related regulatory communications, are protected by the bank-examination privilege. This privilege, which is distinct from the attorney-client privilege and the work-product doctrine, is designed to protect the confidentiality of the bank supervisory process and to encourage candid communication between regulated institutions and their supervisors.
The bank-examination privilege is held by the regulator (the OCC), not by the regulated institution, and the OCC's consent may be required before any privileged supervisory materials can be disclosed to the SEC or other third parties. C&H will work closely with Derek Sung to identify and log all OCC supervisory materials in BRB's possession that may be responsive to the SEC's document requests. Any such materials will be withheld from production pending a determination of whether the bank-examination privilege applies and, if so, whether the OCC consents to their disclosure.
We note that the SEC and the OCC have established interagency information-sharing protocols, and the SEC may independently seek supervisory information from the OCC through those channels. Nevertheless, it remains BRB's obligation to assert the bank-examination privilege with respect to any supervisory materials in its possession and to refrain from producing such materials to the SEC without the OCC's authorization.
D. Litigation Hold
On September 22, 2023, C&H issued, through Derek Sung, a comprehensive litigation hold and document preservation memorandum (the "Hold Memorandum") to all BRB employees identified as potentially possessing documents or information relevant to the SEC's areas of inquiry. The Hold Memorandum directs each recipient to preserve, and to refrain from destroying, altering, modifying, or deleting, all documents and electronically stored information ("ESI") that may be potentially relevant to the SEC investigation, including but not limited to:
(i) all documents and communications relating to the CECL model and ACL estimates for the BridgeFin portfolio;
(ii) all documents and communications relating to BridgeFin loan modifications, restructurings, and re-aging practices;
(iii) all documents and communications relating to the preparation, review, and filing of the Subject Filings;
(iv) all communications with the independent auditor, Whitfield Keane, regarding the BridgeFin portfolio and ACL;
(v) all internal committee materials (Audit Committee, Credit Policy Committee, Risk Committee, Asset-Liability Committee) relating to BridgeFin credit quality and ACL;
(vi) all OCC supervisory correspondence, examination materials, and related communications regarding BridgeFin; and
(vii) any personal devices, personal email accounts, or messaging applications used for business-related communications regarding BridgeFin.
The following individuals have been identified as custodians and have received the Hold Memorandum:
• Patricia "Trish" Navarrete, CFO
• Raymond Hu, CAO
• Naveen Chakravarti, SVP & Division Head, BridgeFin
• Annette Kowalski, CRO
• Derek Sung, General Counsel & CLO
• Marcus R. Ellingham, CEO
• Gwendolyn Prescott, Chair, Audit Committee
• Relevant BridgeFin credit-risk analysts, model developers, and accounting personnel (approximately 14 additional custodians, identified by name in a supplemental custodian list provided to Mr. Sung)
The Hold Memorandum covers all electronic and hard-copy records from January 1, 2020 (the effective date of BRB's CECL adoption) through the present, and requires ongoing preservation until the hold is formally lifted by C&H.
C&H has also coordinated with BRB's Information Technology department to ensure that automatic deletion protocols (including email purge schedules and data retention policies) are suspended for the relevant custodians and data repositories for the duration of the hold. Backup tapes and archived data sources covering the relevant time period have been identified and are being preserved.
E. FRE 502(d) Protections
In the event that the SEC obtains a Formal Order of Investigation and issues subpoenas requiring the production of documents, C&H will seek to negotiate with the Staff a stipulation — or, if necessary, to obtain a court order — under Federal Rule of Evidence 502(d) providing that the inadvertent production of privileged or work-product-protected materials shall not constitute a waiver of privilege with respect to the produced materials or any related undisclosed materials. A 502(d) order provides a critical safeguard against the risk that the production of a privileged document, in the context of a large-scale document review, could be deemed a waiver of privilege over a broader subject matter.
We note that the Staff has generally been receptive to 502(d) stipulations in recent enforcement investigations, and we anticipate that this request will not be a point of significant contention.
VIII. Recommended Course of Action
A. Immediate Steps (Completed or In Progress)
Based on our assessment of the investigation and the applicable legal and practical considerations, C&H has taken or is in the process of taking the following immediate steps:
1. Engagement and Upjohn Protocols. C&H's engagement as defense counsel was completed on September 20, 2023. Upjohn corporate-client protocols have been established and documented, and the form Upjohn warning for employee interviews has been prepared and approved by Mr. Sung.
2. Litigation Hold. A comprehensive litigation hold and document preservation memorandum was issued to all relevant BRB custodians on September 22, 2023. Confirmation of receipt and compliance has been obtained from all custodians, and IT department coordination for the suspension of automatic deletion protocols is complete.
3. Initial Response to SEC Staff. C&H has prepared an initial response letter to the SEC Staff, to be transmitted on or about September 29, 2023. The letter will (a) formally enter C&H's appearance as counsel for BRB in connection with SEC Investigation File No. HO-14287; (b) confirm that BRB intends to cooperate with the Staff's inquiry; and (c) request a meet-and-confer to discuss the scope, custodians, date ranges, search terms, and production format for the document collection and production process. The letter will also request an extension of the initial response deadline set forth in the Voluntary Request to allow adequate time for document collection and privilege review.
4. D&O Insurance Tender. C&H has prepared a formal tender letter to Northcastle Mutual Assurance Company, tendering the SEC investigation as a "Claim" under BRB's primary D&O policy. The tender letter is expected to be transmitted on or about October 5, 2023.
5. Brindoval Analytic Partners Engagement. C&H has initiated the engagement of Brindoval Analytic Partners LLC as a forensic accounting consultant. The engagement letter is expected to be executed on or about October 10, 2023, and Brindoval is prepared to commence its analysis promptly thereafter.
B. Near-Term Steps (October–November 2023)
In the October through November 2023 timeframe, C&H plans to undertake the following activities:
1. Internal Fact-Gathering. Conduct interviews of key BRB personnel — including Ms. Navarrete, Mr. Hu, Mr. Chakravarti, and Ms. Kowalski — under Upjohn protocols to develop a thorough understanding of the ACL estimation process, the re-aging policies and their rationale, the internal deliberations regarding the treatment of modified loans, and any internal concerns or dissenting views that may have been expressed regarding the methodology. Additional interviews of BridgeFin credit-risk analysts and model developers will be conducted as needed.
2. Document Collection and Privilege Review. Commence systematic collection of potentially responsive documents from the identified custodians and data repositories. C&H will oversee the collection, processing, and review of documents, including the application of search terms and other culling methodologies, and will conduct a privilege review to identify and withhold privileged and work-product-protected materials. A detailed privilege log will be prepared for any documents withheld on privilege grounds.
3. Staff Engagement. Engage with the SEC Staff — initially through the meet-and-confer requested in C&H's initial response letter, and thereafter through ongoing dialogue — to negotiate the scope of the investigation, the number and identity of custodians, the applicable date ranges, the production format (including any requirements for structured data or database productions), and the timeline for rolling productions.
4. Forensic Accounting Analysis. Work with Brindoval Analytic Partners to conduct a rigorous, independent analysis of BRB's CECL model and the BridgeFin loss-rate modeling. This analysis will include a review of the model's inputs, assumptions, and outputs; an assessment of the reasonableness of the re-aging treatment under applicable accounting standards and regulatory guidance; a recalculation of the ACL under alternative scenarios; and a materiality assessment incorporating both quantitative and qualitative factors.
5. Coordination with Auditor's Counsel. Through appropriate channels and subject to the privilege protocols discussed in Section VII above, coordinate with Hargrove & Millstein LLP (counsel to Whitfield Keane) to ensure that BRB's and Whitfield Keane's positions are aligned to the extent appropriate, while maintaining the independence of each party's legal strategy and defense. C&H will evaluate whether a common-interest agreement is advisable and, if so, will negotiate and execute such an agreement with Hargrove & Millstein.
6. Monitoring for Formal Order. Continuously monitor for any indication that the Staff is seeking or has obtained a Formal Order of Investigation from the Commission. A Formal Order would expand the Staff's authority to issue subpoenas for documents and testimony and could signal an escalation of the investigation. C&H will promptly notify the Audit Committee and Mr. Sung if a Formal Order is issued.
C. Ongoing Obligations
Throughout the pendency of the investigation, BRB will be subject to the following ongoing obligations and considerations:
1. Regular Updates to the Audit Committee. C&H will provide regular updates to the Audit Committee regarding the status of the investigation, any significant developments, and any changes in our assessment of the Bank's legal exposure. Updates will be provided at least quarterly, or more frequently as developments warrant. Updates will be delivered through secure, privilege-protected channels, and written reports will be clearly labeled as privileged and confidential.
2. Public Disclosure Considerations. BRB should carefully evaluate whether the existence of the SEC investigation triggers any public disclosure obligations. Specifically, the Bank should consider whether an immediate report on Form 8-K is warranted and, in any event, whether the risk factors section or legal proceedings disclosure in the Bank's next periodic report (the Q3 2023 10-Q, expected to be filed in November 2023) should be updated to reflect the existence of the investigation. C&H and CPS will advise jointly on this question. The relevant factors include: (a) the materiality of the investigation to investors, considering both the magnitude of the potential exposure and the stage and

PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT COMMUNICATION — ATTORNEY WORK PRODUCT

MEMORANDUM

MATTER NO.: SC-MAT-2023-4172

Record

Parties

Dates

Amounts