ATTORNEY WORK PRODUCT / PRIVILEGED AND CONFIDENTIAL
CALDERWOOD & HARKNESS LLP 425 Lexington Avenue, 30th Floor New York, New York 10017
MEMORANDUM ATTORNEY WORK PRODUCT / PRIVILEGED AND CONFIDENTIAL
October 18, 2023
TO: All Review Team Members — Matter No. SC-MAT-2023-4172
FROM: Jasmine Thornton, Lead Associate; Liam Donahue, Working Associate
APPROVED BY: Victoria Chambers, Partner
RE: Privilege Review Protocol and Quality-Control Guidelines — In re Belmont Ridge Bank NA, SEC Investigation File No. HO-14287
CLASSIFICATION: Attorney-Client Privileged / Attorney Work Product — Not for Distribution Outside Calderwood & Harkness LLP Review Team
This memorandum is protected by the attorney-client privilege and the attorney work-product doctrine. It contains the mental impressions, conclusions, opinions, and legal theories of attorneys at Calderwood & Harkness LLP. This memorandum is intended solely for use by authorized members of the Calderwood & Harkness LLP review team assigned to Matter No. SC-MAT-2023-4172. Any unauthorized disclosure, reproduction, or distribution of this memorandum is strictly prohibited and may constitute a waiver of applicable privileges. If you have received this memorandum in error, please contact Jasmine Thornton immediately at (212) 555-4100.
Right-click to update Table of Contents
I. PURPOSE AND SCOPE OF THIS PROTOCOL
This memorandum establishes the privilege review procedures and quality-control guidelines governing the document production by Belmont Ridge Bank National Association ("BRB" or the "Bank") to the United States Securities and Exchange Commission ("SEC"), Division of Enforcement, in connection with Investigation File No. HO-14287, pursuant to Formal Order of Investigation No. EN-2023-0947, issued by the SEC on October 12, 2023. All members of the Calderwood & Harkness LLP ("C&H") review team must read, understand, and adhere to this protocol in its entirety before commencing any privilege review work on this matter.
BRB received SEC document subpoena No. HO-14287-001 on October 15, 2023. The subpoena calls for the production of a broad range of documents relating to, among other things, BRB's allowance for credit losses ("ACL") methodology, the Bank's BridgeFin consumer lending platform, credit quality reporting, loan modification and re-aging practices, and related SEC filings. This subpoena follows the SEC's initial voluntary request letter dated September 18, 2023, which was received by BRB's prior outside securities reporting counsel, Caldwell Pratt & Stein LLP ("CPS"), and which prompted the Bank's retention of C&H as defense counsel on September 20, 2023.
The production universe for this matter is estimated at approximately 284,617 documents, comprising approximately 1.42 million pages, collected from identified custodians and non-custodial data sources as described in Section IV of this protocol. The scope of this collection is expected to be refined and may be expanded as the investigation progresses. Documents will be produced across multiple rolling productions as outlined in Section II below, and this protocol governs all privilege review conducted prior to each such production.
The central objective of this protocol is twofold. First, the protocol is designed to ensure that no documents protected by the attorney-client privilege, the attorney work-product doctrine, or the bank-examination privilege are inadvertently produced to the SEC Staff, thereby safeguarding the Bank's and the firm's privilege interests. Second, the protocol is designed to facilitate timely compliance with the subpoena's production schedule and to ensure that the privilege review process does not unreasonably delay the Bank's response to the Division of Enforcement.
Every member of the review team bears personal responsibility for the careful and accurate application of the privilege standards set forth herein. Privilege errors — whether over-designation (which may undermine credibility with the SEC Staff) or under-designation (which may result in inadvertent waiver) — have significant consequences for the Bank's defense. This protocol should be consulted throughout the review as a reference guide. Questions that cannot be resolved by reference to this protocol should be escalated as directed in Section XII below.
This matter is tracked internally under C&H Engagement No. SC-MAT-2023-4172. All time entries, document storage, and communications related to this matter must be recorded under that engagement number.
II. PRODUCTION FORMAT AND BATES NUMBERING CONVENTION
The production format for documents responsive to subpoena No. HO-14287-001 has been addressed in preliminary correspondence with the SEC Staff. As set forth in C&H's October 20, 2023 letter to SEC Staff Attorneys Andrea Felton and Christopher Yuen, documents will be produced in TIFF image format accompanied by extracted text files to ensure that all produced documents are text-searchable. This format is consistent with the SEC Division of Enforcement's standard document production specifications and is intended to facilitate the Staff's review of produced materials.
All documents produced in this matter will be assigned Bates numbers according to the following convention:
BRB-SEC-000001 et seq., numbered sequentially across all rolling productions.
Bates numbering will be continuous and sequential across all production tranches. No Bates numbers will be skipped or reassigned. Documents withheld on privilege grounds will not receive Bates numbers within the production range; rather, withheld documents will be identified on the privilege log by their internal review platform document identification numbers and, where applicable, by a separate privileged-document Bates range to be assigned for privilege log tracking purposes.
The production will be organized by custodian. Each document's associated load file will include, at a minimum, the following metadata fields:
• Custodian name
• Document date (or, where no document date is available, the date of last modification or creation)
• Author
• Recipient(s) and CC recipient(s)
• File type (e.g., .msg, .doc, .xlsx, .pdf, .ppt)
• Bates range (beginning Bates and ending Bates)
Additional metadata fields may be included as agreed upon with the SEC Staff or as required by the Division of Enforcement's standard production specifications.
C&H currently anticipates six rolling productions, the specific dates of which will be determined in consultation with the SEC Staff and BRB. The target date for the first rolling production is November 1, 2023. Subsequent production dates will depend on the volume of documents remaining in the review queue, the progress of first-pass and second-pass review, and any modifications to the production schedule negotiated with the Staff. The review team will be notified of production deadlines as they are confirmed.
It is essential that all reviewers understand that the Bates numbering and production formatting process occurs after the privilege review is complete. Reviewers should focus on accurate privilege coding; Bates number assignment and load file preparation will be handled by the litigation support team under the direction of Liam Donahue.
III. CATEGORIES OF PRIVILEGE
This section describes the privilege doctrines applicable to this review and provides guidance on how each privilege should be identified and applied during the document review process. Reviewers must be familiar with all four categories described below.
A. Attorney-Client Privilege
1. Definition and Scope
The attorney-client privilege protects confidential communications between BRB personnel (acting as the client or as authorized representatives of the client) and attorneys acting in a legal advisory capacity, where such communications are made for the purpose of obtaining or providing legal advice. The privilege belongs to the client — here, BRB — and may be asserted only by the client or its authorized representatives. The privilege applies to communications in both directions: from client to attorney and from attorney to client.
To be protected by the attorney-client privilege, a communication must satisfy each of the following elements:
(a) The communication was made between a client (or the client's representative) and an attorney (or the attorney's representative);
(b) The attorney was acting in a professional legal capacity at the time of the communication;
(c) The communication was made for the purpose of seeking, obtaining, or providing legal advice;
(d) The communication was intended to be, and was in fact, confidential; and
(e) The privilege has not been waived.
In the corporate context, the Upjohn Co. v. United States, 449 U.S. 383 (1981), framework governs. Communications between corporate employees and counsel are privileged when the employees communicate with counsel at the direction of corporate superiors for the purpose of enabling counsel to provide legal advice to the corporation. Reviewers should be attentive to communications from employees at all levels of the organization — not merely senior officers — where such communications were made at the direction of management or counsel for purposes of securing legal advice.
2. Covered Attorneys and Firms
The following attorneys and law firms have been identified as counsel whose communications with BRB personnel may be protected by the attorney-client privilege. Reviewers should be familiar with these names and should flag any communications involving individuals not listed below who appear to be acting in a legal advisory capacity.
(a) Calderwood & Harkness LLP — Defense counsel in the SEC investigation. C&H was retained by BRB pursuant to an engagement letter executed on September 20, 2023. The C&H attorneys principally involved in this matter are:
• Victoria Chambers, Partner
• Howard Quinn, Partner
• Jasmine Thornton, Lead Associate
• Liam Donahue, Working Associate
All communications between BRB personnel and C&H attorneys made for the purpose of the SEC defense or related legal advice are presumptively privileged.
(b) Caldwell Pratt & Stein LLP ("CPS") — BRB's prior and regular outside securities reporting counsel. The lead partner is Martin Caldwell, with offices at 51 West 52nd Street, 24th Floor, New York, New York 10019. CPS prepared and reviewed the following SEC filings that are at issue in this investigation:
• Form 10-K for fiscal year 2022, filed February 28, 2023
• Form 10-Q for the first quarter of 2023, filed May 10, 2023
• Form 10-Q for the second quarter of 2023, filed August 9, 2023
CPS initially received the SEC voluntary request letter dated September 18, 2023 before C&H was retained. Communications between BRB personnel and CPS attorneys seeking or providing legal advice regarding the Bank's SEC disclosure obligations, the content and accuracy of the above-referenced filings, and the Bank's response to the SEC voluntary request are presumptively privileged.
(c) Derek Sung, General Counsel / Chief Legal Officer of BRB — Mr. Sung serves as the Bank's in-house counsel. Communications in which Mr. Sung provides legal advice, or in which BRB personnel seek legal advice from Mr. Sung, are privileged. However, reviewers must exercise particular care with respect to Mr. Sung's communications, as he occupies a dual role: he is both the Bank's chief legal officer and a member of its senior management team. Communications in which Mr. Sung participates solely in his capacity as a business executive — for example, operational discussions regarding the BridgeFin platform, staffing decisions, or budget matters — are not privileged merely because Mr. Sung is an attorney. The privilege attaches only to communications in which Mr. Sung is functioning in his capacity as legal advisor, and the communication was made for the purpose of seeking or providing legal advice. Where this distinction is unclear, the document should be flagged for SECOND-PASS ESCALATION.
(d) Other In-House Lawyers and Outside Counsel — During the course of the review, reviewers may encounter communications involving BRB in-house lawyers or outside law firms not identified above. Any such communications should be flagged for SECOND-PASS ESCALATION with a detailed note identifying the attorney and the nature of the communication.
3. Key Considerations
Reviewers should bear in mind the following important principles when applying the attorney-client privilege during this review:
Confidentiality Requirement. The communication must have been confidential at the time it was made. A communication shared with third parties outside the scope of the privilege relationship is generally not privileged, unless the disclosure was made pursuant to a joint-interest or common-interest arrangement (see Section III.D below) or the third party was an agent of the attorney or client for purposes of facilitating legal representation (e.g., Brindoval Analytic Partners LLC, retained under the Kovel doctrine as discussed in Section III.B below). Reviewers should pay close attention to the recipients of emails and memoranda. If a communication otherwise meeting the elements of the privilege was forwarded to or shared with a third party outside the privilege relationship (e.g., auditors, regulators, business counterparties, or the press), the privilege may have been waived as to that communication. Flag such documents for SECOND-PASS ESCALATION.
Mixed Business and Legal Advice. Many communications between BRB officers and counsel will contain a mixture of business advice and legal advice. In such cases, reviewers should apply the dominant purpose test: if the dominant purpose of the communication, viewed as a whole, was to seek or provide legal advice, the entire communication is privileged, even if business matters are also discussed. If the dominant purpose was business, the communication is not privileged. Where the dominant purpose is genuinely unclear or where legal and business advice are so intertwined that they cannot be separated, the document should be tagged for SECOND-PASS ESCALATION. Do not attempt to resolve close calls at first pass.
Pre-Existing Documents Transmitted to Counsel. A pre-existing business document does not become privileged merely because it is transmitted to an attorney. For example, if a BRB employee sends an existing financial spreadsheet to Martin Caldwell at CPS for purposes of preparing a 10-K filing, the spreadsheet itself remains non-privileged (it is a pre-existing business record). However, the cover email requesting legal advice about the spreadsheet may be privileged. Additionally, the act of selecting and compiling specific documents for transmission to counsel may be protected by the work-product doctrine (as reflecting counsel's litigation strategy), though the underlying documents themselves remain non-privileged.
Board and Audit Committee Materials. Communications to or from Gwendolyn Prescott, Chair of the BRB Audit Committee, are privileged if made for the purpose of obtaining or providing legal advice regarding the SEC investigation or related legal matters. Audit Committee meeting minutes that reflect or summarize legal advice provided by C&H, CPS, or Derek Sung should be flagged as privileged. However, routine Audit Committee materials — such as financial reporting packages, risk dashboards, internal audit summaries, and similar governance documents — are not privileged merely because they were presented to or reviewed by the Audit Committee. Reviewers should examine the content of each document carefully and should not assume that all Audit Committee materials are privileged.
B. Attorney Work-Product Doctrine
1. Definition and Scope
The attorney work-product doctrine, codified in Federal Rule of Civil Procedure 26(b)(3) and recognized by the Supreme Court in Hickman v. Taylor, 329 U.S. 495 (1947), protects documents and tangible things prepared in anticipation of litigation or for trial by or for a party or its representative, including the party's attorney, consultant, surety, indemnitor, insurer, or agent. The doctrine is broader than the attorney-client privilege in that it protects materials prepared by non-attorneys (e.g., consultants, investigators, forensic accountants) so long as the materials were prepared in anticipation of litigation or for trial and at the direction of or for the benefit of counsel.
2. Applicable Standard — Anticipation-of-Litigation Trigger Date
A critical threshold question for work-product analysis is the identification of the date upon which BRB could reasonably have anticipated litigation or a government enforcement proceeding. For purposes of this review, the earliest trigger date for the anticipation of litigation is September 18, 2023 — the date on which BRB received the SEC voluntary request letter through CPS. While the voluntary request letter did not itself constitute litigation or a formal enforcement proceeding, the receipt of an inquiry from the SEC Division of Enforcement was sufficient to cause BRB and its counsel to reasonably anticipate the possibility of a formal investigation and potential enforcement action.
Accordingly, documents created on or after September 18, 2023 by or at the direction of C&H, CPS, or their agents in anticipation of the SEC investigation are presumptively attorney work product. Documents created prior to September 18, 2023 are generally not work product unless there is evidence that an earlier event triggered a reasonable anticipation of litigation; no such earlier event has been identified as of the date of this protocol.
3. Brindoval Analytic Partners LLC — Kovel Consultant
Brindoval Analytic Partners LLC ("Brindoval") is a forensic accounting consulting firm retained by C&H under the United States v. Kovel, 296 F.2d 918 (2d Cir. 1961), doctrine, effective October 10, 2023. The engagement lead at Brindoval is Dr. Franklin Osei, CPA, CFF. Brindoval was engaged at the direction of C&H specifically to provide forensic accounting analysis of BRB's ACL methodology and BridgeFin loss-rate modeling for purposes of the SEC defense.
All Brindoval communications, reports, draft analyses, work papers, data compilations, and related materials that are routed through or prepared at the direction of C&H are attorney work product and must not be produced. This includes, without limitation:
• Communications between C&H attorneys and Brindoval personnel
• Communications between BRB personnel and Brindoval personnel that are routed through or directed by C&H
• Draft and final Brindoval analytical reports and memoranda
• Brindoval data requests and data compilations prepared in connection with the engagement
• Notes, summaries, and presentations prepared by Brindoval in connection with the C&H engagement
Direct communications between BRB personnel and Brindoval that are not routed through or directed by C&H present a closer question. If such communications are identified during first-pass review, they should be flagged for SECOND-PASS ESCALATION. Do not code them as PRODUCE without escalation.
4. Whitfield Keane LLP — Independent Auditor
Whitfield Keane LLP is BRB's independent auditor. The engagement partner is Lorraine Dupont, PCAOB Registration No. 2847. Materials prepared by Whitfield Keane in the ordinary course of its audit engagement — including audit work papers, engagement letters, management representation letters, and audit reports — are not attorney work product. They were prepared in the ordinary course of a professional audit engagement, not in anticipation of litigation.
However, communications between C&H and Whitfield Keane (or Whitfield Keane's own counsel, Hargrove & Millstein LLP, lead partner Samuel Hargrove) made after September 18, 2023 for purposes of the investigation defense may constitute work product depending on context. If such communications are identified, they should be flagged for SECOND-PASS ESCALATION. Reviewers should not assume that all post-September 18, 2023 communications with Whitfield Keane are work product, nor should they assume that all such communications are non-privileged.
5. Fact Work Product vs. Opinion Work Product
Reviewers should be aware of the distinction between fact work product and opinion work product, as it affects the level of protection afforded:
(a) Opinion Work Product — Materials reflecting the mental impressions, conclusions, opinions, or legal theories of an attorney receive near-absolute protection. Opinion work product is discoverable only in the rarest of circumstances. Examples include internal C&H memoranda analyzing the strengths and weaknesses of the SEC's potential theories, legal research memoranda, and attorney notes reflecting case strategy.
(b) Fact Work Product — Factual compilations, chronologies, and interview summaries prepared in anticipation of litigation receive qualified protection. Fact work product may be discoverable upon a showing of substantial need and inability to obtain the substantial equivalent by other means without undue hardship. Nevertheless, fact work product should be withheld from the SEC production and logged on the privilege log.
For coding purposes, both fact and opinion work product should be coded as PRIVILEGE — WORK PRODUCT (or PRIVILEGE — MULTIPLE BASES if other privileges also apply). If a reviewer believes a document contains opinion work product, a notation to that effect should be included in the reviewer's notes, as this may be relevant if the SEC challenges the work-product assertion.
C. Bank-Examination Privilege
1. Definition and Scope
The bank-examination privilege protects confidential communications between BRB and its federal banking regulators — specifically, the Office of the Comptroller of the Currency ("OCC") — related to the supervisory and examination process. BRB is a nationally chartered bank operating under OCC Charter No. 24891. As a national bank, BRB is subject to periodic examinations by the OCC, and the confidential information generated in connection with those examinations is protected from disclosure to third parties, including other government agencies, absent the OCC's authorization.
2. Applicable Authority
The bank-examination privilege and the protections afforded to confidential supervisory information ("CSI") are grounded in the following authorities:
• 12 C.F.R. § 4.32 et seq. (OCC regulations governing the release of non-public OCC information)
• 12 U.S.C. § 1828(x) (restrictions on disclosure of examination reports)
• Inter-agency guidance on the treatment of confidential supervisory information
• In re Subpoena Served Upon the Comptroller of the Currency, 967 F.2d 630 (D.C. Cir. 1992)
3. Scope of Protected Materials
The following categories of documents constitute or may constitute CSI and must be withheld from production to the SEC on the basis of the bank-examination privilege:
(a) OCC examination reports, Reports of Examination ("ROEs"), supervisory letters, Matters Requiring Attention ("MRAs"), and any BRB responses thereto.
(b) Internal BRB documents prepared specifically for, or in direct response to, OCC examinations, including examination preparation materials, self-assessments prepared for examiner review, and corrective action plans submitted to the OCC.
(c) BRB's CAMELS rating. The Bank is currently rated a 2 composite (Satisfactory) as of its most recent examination in September 2023. Any documents referencing the CAMELS rating, whether the composite rating or individual component ratings, must be withheld as CSI.
(d) OCC correspondence regarding BRB's ACL methodology. Certain such correspondence will be referenced in redacted or summary form in the anticipated Wells Submission (Exhibit D), but the underlying correspondence itself must not be produced to the SEC without OCC authorization.
4. Special Handling Procedures
No CSI may be produced to the SEC without prior written authorization from the OCC. This rule is absolute. If a document contains CSI, it must be withheld regardless of whether it is also responsive to the subpoena. If the SEC Staff specifically requests CSI or materials containing CSI, the request must be immediately escalated to Victoria Chambers and Derek Sung. The SEC may seek such materials through inter-agency channels or by directing a request to the OCC itself; BRB must not unilaterally produce CSI to the SEC.
Reviewers should be aware that CSI can appear in unexpected places — for example, in the body of an email discussing OCC examination findings, in board presentations that summarize MRA status, or in management reports that reference the CAMELS rating. Any document containing or referencing CSI should be coded PRIVILEGE — BANK EXAMINATION (or PRIVILEGE — MULTIPLE BASES if other privileges also apply).
D. Common-Interest / Joint-Defense Privilege
1. Status. As of the date of this protocol, no formal joint-defense agreement or common-interest agreement has been executed between BRB and any other party. If BRB enters into a common-interest arrangement with any other party — for example, individual officers or directors of the Bank who retain separate counsel in connection with the SEC investigation — this protocol will be amended to address the scope and implications of such an agreement.
2. Preliminary Note Regarding Hargrove & Millstein LLP
Communications with Hargrove & Millstein LLP (counsel to Whitfield Keane LLP, the Bank's independent auditor; lead partner Samuel Hargrove) are not covered by any common-interest agreement and should be treated as third-party communications unless and until a formal agreement is executed and approved by Victoria Chambers. Because Hargrove & Millstein represents the auditor — whose interests may diverge from those of the Bank — the sharing of privileged communications with Hargrove & Millstein absent a common-interest agreement could result in a waiver of privilege.
All documents involving communications with Hargrove & Millstein LLP should be flagged for partner-level review by Victoria Chambers. Do not code such documents as PRODUCE or as privileged without such review.
IV. CUSTODIANS AND DATA SOURCES
A. Identified Custodians
The following individuals have been identified as custodians whose files have been collected for review in this matter. Reviewers will be assigned custodian-based batches (as described in Section V.A) and should familiarize themselves with the role and communication patterns of each custodian to whom they are assigned.
Reviewers should note that testimony subpoenas have been issued or are anticipated for certain custodians. Documents from these custodians' files may be particularly sensitive, as they may include testimony preparation materials (which are work product) or communications reflecting legal strategy in connection with testimony. Exercise heightened vigilance when reviewing documents from these custodians' files, particularly documents dated in the period immediately preceding each testimony date.
B. Non-Custodial Data Sources
In addition to individual custodian files, the following non-custodial data sources have been collected for review:
(a) BridgeFin Platform Data. Loan-level data, modification records, and re-aging records for the 12,847 re-aged loans at issue, which have an aggregate outstanding balance of approximately $236.4 million. This data is maintained in BRB's loan servicing and origination systems and has been extracted for review and potential production. BridgeFin platform data is generally not privileged (it consists of pre-existing business records), but reviewers should be alert to any annotations, comments, or overlays that may reflect legal advice or work-product analysis.
(b) CECL Model Documentation and Quarterly ACL Calculation Files. BRB's Current Expected Credit Losses ("CECL") model documentation, including model validation reports, back-testing analyses, and quarterly ACL calculation worksheets. These materials are generally pre-existing business records and are not privileged per se, unless prepared at the direction of counsel in anticipation of the investigation. See Section X.B for additional guidance on proprietary model documentation.
(c) Board and Audit Committee Minutes. Minutes of meetings of the BRB Board of Directors and Audit Committee, together with associated presentations, agendas, and supporting materials. Board and Audit Committee minutes may contain privileged communications (see Section III.A.3 above) and should be reviewed carefully.
(d) SEC Filings. The Bank's Form 10-K for fiscal year 2022 (filed February 28, 2023) and Forms 10-Q for the first and second quarters of 2023 (filed May 10, 2023 and August 9, 2023, respectively). These are publicly filed documents and are not privileged. However, draft versions of these filings, particularly those bearing attorney mark-ups or comments reflecting legal advice, may be privileged (see Section VI.C below).
(e) Shared Drives, Aldermere Systems Sites, and Document Management System Repositories. Electronic repositories related to financial reporting, credit risk management, and the BridgeFin platform. Documents from these sources should be reviewed on the same basis as custodial documents, applying the privilege analysis described in this protocol.
V. FIRST-PASS REVIEW PROCEDURES
A. Staffing and Assignment
First-pass privilege review will be conducted by C&H associates and contract attorneys under the direct supervision of Liam Donahue, Working Associate. All reviewers must read this protocol in its entirety and execute a written acknowledgment of receipt and understanding before commencing review. The acknowledgment form will be distributed by Liam Donahue and must be returned to him before any reviewer is granted access to the review platform.
Reviewers will be assigned custodian-based batches wherever practicable. This approach is intended to ensure that each reviewer develops familiarity with a particular custodian's communication patterns, writing style, typical correspondents, and role within the organization. Such familiarity enhances the reviewer's ability to identify privileged communications accurately and efficiently. If a reviewer identifies a communication pattern or recurring privilege issue within a custodian's files that is not addressed by this protocol, the reviewer should bring the issue to Liam Donahue's attention promptly.
Contract attorneys assigned to this matter must, in addition to acknowledging this protocol, execute a non-disclosure agreement and a data-security acknowledgment before being granted access to the review platform. These requirements are described further in Section XI below.
B. Coding Categories
Each document in the review population must be coded with one — and only one — of the following disposition codes. Reviewers should select the code that most accurately reflects the privilege status of the document. If a document falls within more than one privilege category, the reviewer should use code 5 (PRIVILEGE — MULTIPLE BASES) and specify all applicable privilege grounds in the notes field.
1. PRODUCE — The document is not privileged, is responsive to the subpoena, and is cleared for production to the SEC Staff. No privilege applies, and no redaction is required.
2. PRIVILEGE — ATTORNEY-CLIENT — The document is withheld in full on the basis of the attorney-client privilege. The entire document is protected by the privilege and no portion of it may be produced.
3. PRIVILEGE — WORK PRODUCT — The document is withheld in full on the basis of the attorney work-product doctrine. The entire document is protected and no portion of it may be produced.
4. PRIVILEGE — BANK EXAMINATION — The document is withheld in full on the basis of the bank-examination privilege. The document constitutes or contains confidential supervisory information and may not be produced to the SEC without OCC authorization.
5. PRIVILEGE — MULTIPLE BASES — The document is withheld on more than one privilege ground. The reviewer must specify all applicable privilege bases in the notes field (e.g., "AC + WP" for attorney-client and work product; "AC + BE" for attorney-client and bank examination).
6. REDACT — The document is partially privileged. Specific passages within the document are privileged, but the remainder of the document is responsive and may be produced in redacted form. The reviewer must identify the specific passages to be redacted (by highlighting, annotation, or precise description in the notes field) and must specify the privilege basis for each proposed redaction. Documents coded as REDACT will be routed to second-pass review for confirmation of redaction boundaries.
7. SECOND-PASS ESCALATION — The document presents a privilege question that the first-pass reviewer is unable to resolve with confidence by reference to this protocol. The reviewer must include a detailed note in the review platform explaining the specific privilege issue, the reviewer's preliminary analysis, and the reason for escalation. This code should be used for close calls, ambiguous situations, and documents that do not fit neatly within the guidance provided herein.
8. NON-RESPONSIVE — The document falls outside the scope of the subpoena and is not responsive to any document request. Non-responsiveness determinations should be made by reference to the subpoena specifications as described in the October 20, 2023 production protocol letter to the SEC Staff. Documents coded as NON-RESPONSIVE will not be produced and will not appear on the privilege log, but will be retained in the review database for reference.
C. Tagging and Notation Requirements
Accurate and complete notation is essential to the production of a defensible privilege log and to the quality-control process. For every document coded as privileged (disposition codes 2 through 6), the reviewer must populate the following privilege log fields at the time of first-pass review:
• Bates Number: Enter the document's temporary review platform identification number. This will be replaced with a permanent Bates number upon finalization of the privilege log.
• Document Date: Enter the date of the document. For emails, use the sent date. For undated documents, enter "undated" and, if possible, estimate the date range based on context.
• Author(s): Enter the full name(s) of all authors.
• Recipient(s) / CC: Enter the full name(s) of all recipients and CC recipients.
• Document Type: Specify the document type (e.g., email, memorandum, presentation, spreadsheet, letter, board minutes, draft SEC filing).
• Brief, Non-Waiving Description of Subject Matter: Provide a concise description of the document's subject matter that does not disclose the substance of any privileged communication. For example: "Email from BRB General Counsel to outside counsel seeking legal advice regarding ACL disclosure obligations." Do not describe the specific legal advice sought or given.
• Privilege Basis: Specify the privilege basis using the following abbreviations: AC (attorney-client), WP (work product), BE (bank examination), or a combination thereof (e.g., AC/WP).
• Reviewer Initials and Date of Review: Enter the reviewer's initials and the date on which the privilege determination was made.
For documents coded as SECOND-PASS ESCALATION (disposition code 7), the reviewer must include, in addition to the above fields (to the extent populated), a detailed note explaining the specific privilege question presented by the document. The note should identify the relevant parties to the communication, the nature of the privilege issue, the reviewer's preliminary assessment, and the reason the reviewer was unable to resolve the issue at first pass. Conclusory notes (e.g., "unclear if privileged") are insufficient; reviewers should provide enough detail to enable the second-pass reviewer to understand the issue without having to start the analysis from scratch.
D. Common Privilege Scenarios — First-Pass Guidance
The following scenarios are among the most frequently encountered privilege situations in this review. This guidance is intended to assist first-pass reviewers in making coding determinations efficiently and consistently. It is not exhaustive, and reviewers should consult the general principles set forth in Section III above when confronted with situations not specifically addressed here.
1. Emails Between BRB Personnel and Caldwell Pratt & Stein LLP (Martin Caldwell) Regarding SEC Filing Preparation
Communications in which BRB personnel seek legal advice from CPS regarding the Bank's disclosure obligations under the federal securities laws, or in which CPS provides such advice, are privileged (attorney-client). This includes, for example, emails in which BRB's CFO or CAO asks Martin Caldwell whether a particular disclosure is required by Regulation S-K or ASC 326, and CPS's responses providing legal analysis of the disclosure question.
However, communications that are purely ministerial in nature — such as emails regarding the formatting of a filing, the logistics of the EDGAR submission process, or the scheduling of a filing review call — are not privileged. Such communications do not seek or provide legal advice; they relate to administrative aspects of the filing process. Code such communications as PRODUCE (if responsive) or NON-RESPONSIVE.
Where a communication contains both legal advice and ministerial content, apply the dominant-purpose test. If the dominant purpose is legal advice, the communication is privileged. If uncertain, escalate to SECOND-PASS.
2. Emails Forwarding Non-Privileged Business Documents to Counsel
When a BRB employee forwards a pre-existing business document (e.g., a financial spreadsheet, a loan modification report, or a credit quality dashboard) to counsel, the underlying business document is generally not privileged. It was not created for the purpose of seeking or providing legal advice; it is a pre-existing business record. However, the transmittal email may be privileged if it requests legal advice about the document or reflects legal strategy. In such cases, code the transmittal email as privileged (attorney-client or work product, as applicable) and code the attachment as PRODUCE (assuming it is responsive and not independently privileged).
If the attachment itself contains annotations, comments, or mark-ups by counsel reflecting legal advice, the annotated version of the attachment is privileged. The clean, unannotated version (if it exists separately in the document population) is not privileged. If only the annotated version exists, code the document as REDACT (with proposed redaction of the counsel annotations) or as privileged in full, depending on the extent and nature of the annotations.
3. BridgeFin Credit Metrics Spreadsheets and Data Analyses
BridgeFin credit metrics spreadsheets and data analyses are generally pre-existing business records and are not privileged. They were created in the ordinary course of the Bank's business operations, not in anticipation of litigation or for the purpose of seeking legal advice. Code such documents as PRODUCE (if responsive).
However, if a spreadsheet or data analysis was created after September 18, 2023 by or at the direction of C&H or CPS for purposes of the SEC defense — for example, a custom analysis of re-aging patterns prepared by Brindoval at C&H's direction — the document may be work product. If a reviewer encounters a data analysis that appears to have been prepared after the trigger date specifically for litigation purposes, the document should be flagged for SECOND-PASS ESCALATION.
4. Communications with Whitfield Keane LLP (Lorraine Dupont)
Communications between BRB and its independent auditor, Whitfield Keane LLP, are generally not privileged. The auditor is not BRB's attorney, and the audit engagement is a business relationship, not a legal representation. Routine audit communications — including audit inquiry letters, management representation letters, and discussions regarding accounting treatments — should be coded as PRODUCE (if responsive).
However, communications that occur after September 18, 2023 and that involve C&H or CPS — for example, a three-way call or email thread among BRB, C&H, and Whitfield Keane discussing the SEC investigation and its implications for the audit — may involve work product or attorney-client privilege depending on context. Flag any such post-September 18, 2023 communications involving counsel for SECOND-PASS ESCALATION.
5. Communications With or About Brindoval Analytic Partners LLC (Dr. Franklin Osei)
All communications involving Brindoval that are routed through or directed by C&H are work product. Code such documents as PRIVILEGE — WORK PRODUCT. This includes emails between C&H attorneys and Brindoval personnel, Brindoval reports and analyses prepared for C&H, and BRB-to-Brindoval communications that were directed by C&H (e.g., where C&H instructed a BRB employee to provide data to Brindoval for the forensic analysis).
Direct BRB-to-Brindoval communications that do not appear to have been routed through or directed by C&H present a closer question. Flag such documents for SECOND-PASS ESCALATION.
6. Board and Audit Committee Materials
Board and Audit Committee minutes, presentations, and communications that reflect legal advice from C&H, CPS, or Derek Sung regarding the SEC investigation are privileged (attorney-client). For example, a board presentation in which Victoria Chambers provides an update on the status of the SEC investigation and recommends a course of action is privileged.
Routine governance materials — such as quarterly financial reporting packages, risk committee reports, credit quality dashboards, and similar materials — that do not involve or reflect legal advice are not privileged. Code as PRODUCE (if responsive). The fact that a document was presented to the board or the Audit Committee does not, standing alone, make it privileged.
7. OCC-Related Materials
Any document bearing OCC letterhead, referencing OCC examination findings, referencing the Bank's CAMELS rating, referencing Matters Requiring Attention, or otherwise constituting or containing confidential supervisory information must be coded PRIVILEGE — BANK EXAMINATION. This includes OCC Reports of Examination, supervisory letters, and any BRB responses to such materials.
BRB internal documents that were prepared in direct response to OCC examinations — such as corrective action plans, MRA response memoranda, or examination preparation checklists — should also be coded as bank-examination privilege and escalated for SECOND-PASS review, as the precise scope of the bank-examination privilege as applied to internally generated responsive documents may require partner-level analysis.
8. Communications Among BRB Officers Discussing Business Operations (No Attorney Involvement, No Legal Advice)
Communications among BRB business personnel that do not involve any attorney (whether in-house or outside counsel) and do not seek or reflect legal advice are not privileged. The fact that a communication discusses a topic that is also the subject of the SEC investigation does not make the communication privileged. For example, an email between the CFO and the CAO discussing the Bank's quarterly ACL calculation, without any involvement of or reference to counsel, is a business communication and should be coded as PRODUCE (if responsive) or NON-RESPONSIVE.
Reviewers should be careful, however, to examine the full email chain. A business discussion between officers may later be forwarded to counsel for legal advice, in which case the forwarding email and any subsequent attorney responses may be privileged even though the original business discussion is not.
VI. SECOND-PASS REVIEW PROCEDURES
A. Staffing
Second-pass review will be conducted by Jasmine Thornton, Lead Associate. Documents presenting particularly complex or close-call privilege determinations will be escalated to Victoria Chambers, Partner, for final resolution. All documents coded as SECOND-PASS ESCALATION during first-pass review will be routed to a dedicated second-pass review queue within the review platform.
Jasmine Thornton will review second-pass documents on a rolling basis, with priority given to documents from custodians and date ranges included in the next scheduled production tranche. Victoria Chambers will be available for real-time consultation on urgent privilege questions; however, all escalations to Victoria Chambers should be accompanied by a brief written memorandum (email is sufficient) summarizing the issue, the relevant facts, and Jasmine Thornton's preliminary recommendation.
B. Scope of Second-Pass Review
Second-pass review encompasses the following categories of documents and tasks:
(1) Resolution of all privilege questions flagged during first-pass review (all documents coded SECOND-PASS ESCALATION).
(2) Review of all documents coded as REDACT to confirm the specific redaction boundaries, verify that the proposed redaction is narrowly tailored to the privileged content, and ensure that the redacted version does not inadvertently disclose privileged information. Redaction boundaries must be approved by Jasmine Thornton before any redacted document is cleared for production.
(3) A targeted review of documents from the following high-sensitivity custodians to verify first-pass coding accuracy:
• Derek Sung (General Counsel / CLO) — Given Mr. Sung's dual role as legal advisor and business executive, his files present the highest risk of privilege miscoding. All documents from Mr. Sung's custodian file coded PRODUCE at first pass will be subject to 100% second-pass review.
• Gwendolyn Prescott (Audit Committee Chair) — Materials from Ms. Prescott's files frequently involve legal advice provided to the Audit Committee and require careful analysis.
• Patricia "Trish" Navarrete (CFO) — As a witness who has testified before the SEC Staff, Ms. Navarrete's files may contain testimony preparation materials and related privileged communications.
• Raymond Hu (CAO) — Mr. Hu's files are expected to contain extensive correspondence regarding ACL methodology and SEC filings, with a mix of privileged and non-privileged content.
(4) Review of any documents involving communications with the following third parties to ensure that privilege is properly assessed:
• Whitfield Keane LLP (independent auditor)
• Hargrove & Millstein LLP (counsel to Whitfield Keane)
• Ridgeline Governance Advisors LLC (D&O insurance broker)
• Northcastle Mutual Assurance Company (D&O primary insurer)
• Cascade Omnivrel Insurance Group (D&O excess insurer)
• Thornfield & Rowe LLP (claims counsel for Northcastle)
Communications with these third parties require nuanced privilege analysis, as discussed in Sections III and X of this protocol, and are not appropriate for first-pass resolution except in clear-cut cases.
C. Decisional Framework
The following principles will guide second-pass privilege determinations:
1. Mixed Business-and-Legal-Advice Communications