1045-00007 · Client 1045 · Engagement

privilege-protocol-document-preservation-memo.docx DOCUMENT Litigation

19 / 35 ← → ✕

PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT

MEMORANDUM

FROM: Calderwood & Harkness LLP 425 Lexington Avenue, 30th Floor New York, NY 10017

TO: Derek Sung General Counsel & Chief Legal Officer Belmont Ridge Bank National Association 200 Park Avenue South, 38th Floor New York, NY 10003

September 25, 2023

RE: Privilege Protocol & Document Preservation Obligations — SEC Investigation File No. HO-14287

MATTER NO.: SC-MAT-2023-4172

AUTHORS: Victoria Chambers, Partner; Jasmine Thornton, Lead Associate

CC: Marcus R. Ellingham (CEO), Patricia "Trish" Navarrete (CFO), Annette Kowalski (CRO), Raymond Hu (CAO), Gwendolyn Prescott (Audit Committee Chair) — via Derek Sung's distribution at his discretion

Right-click to update Table of Contents

I. PURPOSE AND SCOPE OF THIS MEMORANDUM

Calderwood & Harkness LLP ("C&H") has been engaged by Belmont Ridge Bank National Association ("BRB" or the "Bank") as of September 20, 2023, to represent BRB in connection with an investigation initiated by the United States Securities and Exchange Commission ("SEC"), Division of Enforcement, which was opened by voluntary request letter dated September 18, 2023, and assigned File No. HO-14287. C&H's representation encompasses all matters arising out of or related to the investigation, including but not limited to document preservation and production, privilege analysis, interactions with the SEC Staff, and potential defense against any enforcement action that may result from the investigation.

This memorandum establishes binding protocols governing the following critical areas:

(a) Document preservation and the imposition of a comprehensive litigation hold;

(b) Identification and protection of communications and materials subject to attorney-client privilege, the attorney work-product doctrine, and the bank-examination privilege;

(d) Communications protocols with third parties — including BRB's independent auditor, forensic accounting consultant, D&O insurers, and prior outside counsel — designed to preserve attorney-client privilege and work-product protection; and

(e) Clawback protections and non-waiver procedures to address the inadvertent disclosure of privileged materials.

These protocols are applicable to all BRB officers, directors, employees, and agents who may possess documents or communications relevant to the investigation, including without limitation all personnel within the BridgeFin digital lending division. BRB is a publicly traded national bank, listed on the Nasdaq Stock Market under the ticker symbol BRDG, and is chartered by the Office of the Comptroller of the Currency ("OCC") under Charter No. 24891. The investigation concerns BRB's public disclosures regarding its allowance for credit losses ("ACL") related to the BridgeFin digital lending portfolio, as reported in the following SEC filings:

• BRB's FY 2022 Annual Report on Form 10-K, filed with the SEC on February 28, 2023;

• BRB's Quarterly Report on Form 10-Q for the fiscal quarter ended March 31, 2023 (Q1 2023), filed with the SEC on May 10, 2023; and

• BRB's Quarterly Report on Form 10-Q for the fiscal quarter ended June 30, 2023 (Q2 2023), filed with the SEC on August 9, 2023.

The SEC's voluntary request letter raises questions concerning whether BRB's reported ACL figures and related disclosures in these filings were materially accurate and whether BRB's internal processes for estimating expected credit losses complied with applicable accounting standards and disclosure requirements.

All BRB personnel must comply with these protocols immediately upon receipt of this memorandum. Noncompliance may result in the waiver of attorney-client privilege and work-product protections, which cannot be restored once lost. In the context of an SEC enforcement investigation, the loss of privilege protections can have severe adverse consequences, including the compelled disclosure of communications and materials that would otherwise remain confidential, and exposure to potential sanctions or obstruction charges. The protocols set forth herein are mandatory and not discretionary.

II. LITIGATION HOLD — DOCUMENT PRESERVATION OBLIGATIONS

A. Scope of the Litigation Hold

Effective immediately upon distribution of this memorandum, BRB must preserve all documents, communications, and electronically stored information ("ESI") that are or may be relevant to the SEC investigation identified above. This obligation extends to materials in any form or medium, including paper documents, electronic files, emails, text messages, instant messages, voicemails, audio recordings, video recordings, photographs, and any other tangible or intangible records. The obligation to preserve relevant materials is not limited to documents that are directly responsive to any specific request from the SEC; rather, it encompasses all materials that bear upon or could reasonably lead to evidence bearing upon the subject matter of the investigation.

As set forth in the SEC's voluntary request letter, the investigation concerns whether BRB's reported ACL of $143.5 million — representing approximately 3.50% of the $4.1 billion BridgeFin outstanding loan portfolio — materially understated expected credit losses. The SEC Staff has specifically inquired into BRB's treatment of 12,847 re-aged and modified BridgeFin loans, which carried an aggregate outstanding balance of approximately $236.4 million as of the relevant reporting dates. The SEC Staff's interest extends to the methodology by which BRB classified, reported, and reserved against these modified and re-aged loans, and whether the treatment of these loans resulted in a material understatement of BRB's reported ACL.

Accordingly, the litigation hold covers all documents and ESI relating to the following subject-matter categories, without limitation:

1. BRB's methodology for calculating and reporting its ACL under the Current Expected Credit Losses ("CECL") framework, which BRB adopted effective January 1, 2020, in accordance with Accounting Standards Codification ("ASC") Topic 326, Financial Instruments — Credit Losses;

2. BridgeFin digital lending division loan origination, underwriting, modification, re-aging, and servicing practices, including all policies, procedures, guidelines, and manuals governing these functions;

3. ACL estimation, including vintage cohort analysis, qualitative factor overlays, quantitative model outputs, scenario analysis, management judgment adjustments, and quarterly true-up procedures;

4. Communications regarding the preparation, review, approval, and filing of BRB's periodic SEC filings, including the FY 2022 Form 10-K and the Q1 2023 and Q2 2023 Forms 10-Q;

5. Credit-quality metrics maintained or reported by BRB or the BridgeFin division, including charge-off rates, delinquency rates (30-day, 60-day, 90-day, and 90+ day), loss-rate modeling inputs and outputs, probability-of-default calculations, loss-given-default estimates, and exposure-at-default calculations;

6. Internal communications among senior management, the Board of Directors, the Audit Committee, and BRB's independent auditor, Whitfield Keane LLP, relating to credit quality, ACL estimation, financial statement disclosures, and the BridgeFin portfolio;

7. All documents and communications relating to BridgeFin division operations since its launch in Q3 2020, including but not limited to the division's AI-driven underwriting platform, marketing materials, borrower demographic analyses, and performance reports; and

8. Any other documents or communications that may be relevant to the SEC's investigation of BRB's public disclosures concerning expected credit losses.

B. Custodians Subject to Hold

The following individuals are hereby designated as named custodians subject to the litigation hold. Each named custodian must preserve all relevant documents and ESI in his or her possession, custody, or control:

Additional custodians may be identified as the investigation progresses, including but not limited to other members of the Audit Committee, BridgeFin division personnel, members of BRB's credit risk and financial reporting teams, and any other individuals identified through the custodian interview process or through the SEC Staff's requests. C&H will promptly notify Derek Sung of any additions to the custodian list.

Each custodian's administrative assistant, executive assistant, or any other delegate with access to the custodian's files, email accounts, calendars, or other documents is also subject to the hold. Each custodian should identify any such individuals to Derek Sung so that they may receive appropriate hold notices.

BRB's Information Technology department must take the following immediate steps with respect to the named custodians and all relevant shared resources:

• Suspend all auto-delete functions, message retention policies, and automated purge schedules applicable to the named custodians' email accounts, including both Strathmore Data Systems/Outlook mailboxes and any cloud-based email or messaging platforms;

• Suspend all routine document-destruction schedules, records-management disposal programs, and recycling policies that could result in the deletion or destruction of relevant documents;

• Preserve the contents of all shared drives, network folders, and collaboration platforms (including, without limitation, Aldermere Systems sites, Northgate Data Systems channels, Meridian Solutions workspaces, and any BridgeFin-specific platforms) that contain documents relating to the subject matter of the investigation; and

• Preserve BridgeFin division servers, databases, and data repositories in their current state, including the BridgeFin AI-driven underwriting model environment and associated data stores.

C. Categories of Documents and ESI to Be Preserved

Without limiting the general scope of the litigation hold described in Section II.A above, the following specific categories of documents and ESI must be preserved:

Electronic Communications. All emails, text messages (including SMS, Westmark Software, and any other mobile messaging format), instant messages (including communications on BRB's internal messaging platforms, Northgate Data Systems, Meridian Solutions, or any other collaboration tool), voicemails, and other electronic communications sent or received by custodians that relate to the subject matter of the investigation.

ACL and CECL Materials. All paper and electronic files related to ACL methodology, CECL model documentation, model inputs and outputs, vintage cohort analyses, loss-rate models, probability-of-default and loss-given-default calculations, qualitative factor assessments, management judgment overlays, and quarterly ACL true-up procedures. This includes all versions and iterations of such documents, not merely final versions.

BridgeFin Credit Dashboards and Portfolio Analytics. All credit dashboards, portfolio performance reports, loan-level data exports, delinquency tracking reports, modification and re-aging logs, and related analytics maintained by the BridgeFin division or BRB's credit risk management function.

Board and Audit Committee Materials. All Board of Directors and Audit Committee meeting minutes, agendas, presentations, board packages, and supporting materials relating to credit-quality reporting, ACL estimation, financial statement disclosures, and the BridgeFin portfolio. This includes materials from any special meetings or executive sessions addressing these topics.

Communications with Caldwell Pratt & Stein LLP. All communications between BRB and Caldwell Pratt & Stein LLP ("CPS"), BRB's securities reporting counsel (lead partner Martin Caldwell, 51 West 52nd Street, 24th Floor, New York, NY 10019), who prepared and reviewed the Form 10-K and Form 10-Q filings at issue in the investigation. This includes drafts, comments, markup, correspondence, and any memoranda relating to the preparation and review of the relevant filings.

Communications with Whitfield Keane LLP. All communications between BRB and Whitfield Keane LLP, BRB's independent registered public accounting firm (engagement partner Lorraine Dupont, PCAOB Registration No. 2847; 600 Third Avenue, 22nd Floor, New York, NY 10016), relating to the FY 2021 and FY 2022 audits, the quarterly reviews for Q1 2023 and Q2 2023, and any communications relating to BRB's ACL methodology, the BridgeFin portfolio, or the treatment of re-aged and modified loans.

Models, Spreadsheets, and Databases. All working papers, models, spreadsheets, databases, and analytical tools used in calculating ACL or in evaluating BridgeFin portfolio credit quality, including BridgeFin's AI-driven underwriting model documentation, model validation reports, and backtesting analyses.

Regulatory Correspondence. All regulatory correspondence with the OCC, including examination reports, matters requiring attention ("MRAs"), matters requiring immediate attention ("MRIAs"), supervisory letters, and BRB's responses thereto, to the extent they relate to BRB's credit risk management, ACL methodology, or the BridgeFin portfolio.

Relevant Date Range. The relevant date range for preservation purposes is January 1, 2020 (the date of BRB's adoption of the CECL framework under ASC 326) through the date of this memorandum and continuing forward for the duration of the litigation hold. Documents created or received after the date of this memorandum that fall within the scope of the hold must also be preserved on an ongoing basis.

D. Preservation Obligations — Practical Requirements

The following practical requirements apply to all custodians and relevant BRB personnel:

No Destruction or Alteration. No documents may be deleted, altered, overwritten, or destroyed, whether in hard copy or electronic form. This prohibition applies regardless of whether the document appears duplicative, immaterial, or routine. If there is any doubt as to whether a document falls within the scope of the hold, the document must be preserved.

Backup Tapes and Disaster-Recovery Archives. Backup tapes, disaster-recovery archives, and other archival media must be preserved to the extent they contain unique relevant data that is not otherwise available from primary sources. BRB's IT department should inventory all backup tapes and archival media and coordinate with C&H to determine which must be preserved.

Personal Devices. Personal devices — including mobile phones, tablets, and laptops — used by custodians for BRB business must be preserved. Custodians who use personal devices for BRB-related communications (including email, text messages, and messaging applications) must ensure that all such communications are retained and not deleted. Custodians should not reset, wipe, replace, or dispose of personal devices used for BRB business without prior authorization from Derek Sung and C&H.

Cloud-Based Storage and Collaboration Tools. Cloud-based storage accounts, collaboration tools, and third-party platforms used by the BridgeFin division or other relevant BRB business units must be placed on hold. This includes, without limitation, any cloud-based data analytics platforms, data lakes, or machine learning model repositories used by the BridgeFin division.

Litigation Hold Coordinator. Derek Sung, as General Counsel, is designated as the Litigation Hold Coordinator for BRB. In this capacity, Derek Sung is responsible for:

(i) Distributing this memorandum and the accompanying hold notices to all custodians and relevant BRB personnel;

(ii) Obtaining a signed written acknowledgment from each custodian confirming receipt and understanding of the hold (using the form attached as Appendix A);

(iii) Periodically reminding custodians of their preservation obligations (at least quarterly, or more frequently if circumstances warrant);

(iv) Identifying and notifying additional custodians as the investigation develops; and

(v) Serving as the primary point of contact between BRB personnel and C&H for all matters relating to document preservation.

C&H should receive a copy of each signed acknowledgment promptly upon execution. Derek Sung should maintain a master log of all hold notices distributed and acknowledgments received, and should provide periodic status reports to C&H.

E. Consequences of Non-Compliance

The consequences of failing to comply with the litigation hold and document preservation obligations set forth in this memorandum cannot be overstated. BRB and its personnel should be aware of the following:

Sanctions and Adverse Inferences. Failure to preserve relevant documents may result in the imposition of sanctions by the SEC or, in any subsequent litigation, by a federal court. In enforcement proceedings or civil litigation, a tribunal may draw adverse inferences against BRB based on the destruction or loss of relevant evidence — that is, the tribunal may presume that the destroyed documents were unfavorable to BRB.

Obstruction of Justice. The willful destruction of documents relevant to a federal investigation may constitute obstruction of justice under 18 U.S.C. § 1519 (destruction of records in federal investigations) or 18 U.S.C. § 1512(c) (obstruction of an official proceeding). These are federal criminal offenses carrying significant penalties.

Evidence of Scienter or Bad Faith. In the context of an SEC enforcement investigation, the SEC Staff may treat the spoliation of evidence as indicative of scienter or bad faith — both of which are elements of certain securities-law violations. Document destruction during a pending investigation significantly increases the risk of an enforcement action and may transform a case that might otherwise be resolved through a settlement into one in which the SEC pursues more severe penalties.

Federal Securities Law Obligations. BRB's obligations under the federal securities laws, including its duty to cooperate with SEC requests and its obligations as a public reporting company, require full and complete preservation of relevant documents. If a Formal Order of Investigation is issued (which C&H anticipates may occur in the near term), BRB will be subject to compulsory process, and any failure to preserve documents may be treated as a violation of a subpoena.

All custodians and BRB personnel are directed to take these obligations with the utmost seriousness and to contact Derek Sung immediately with any questions about the scope of the hold or their individual obligations.

III. PRIVILEGE IDENTIFICATION AND PROTECTION

A. Categories of Privilege

Three distinct privilege doctrines are relevant to this investigation. Understanding the scope and requirements of each is essential to ensuring that BRB's privileged materials are properly identified and protected.

1. Attorney-Client Privilege

The attorney-client privilege protects confidential communications between BRB and its attorneys — including both outside counsel (C&H and, as applicable, Caldwell Pratt & Stein LLP) and in-house counsel (Derek Sung and the members of BRB's in-house legal department) — made for the purpose of obtaining or providing legal advice. The privilege covers communications in both directions: communications from BRB to its attorneys seeking legal advice, and communications from BRB's attorneys to BRB providing legal advice or requesting information necessary to render legal advice.

The attorney-client privilege extends to communications between BRB employees and in-house counsel (Derek Sung and his legal team) where the communication is made for the primary purpose of seeking or rendering legal advice. It is important to recognize that not all communications with in-house counsel are privileged; communications that are primarily business in nature — such as routine business reporting or operational discussions — do not become privileged merely because an attorney is included on the communication. The purpose of the communication, not the identity of the participants, is the controlling factor.

The attorney-client privilege belongs to BRB as the corporate entity, not to individual officers or employees. Consistent with the Upjohn protocols established in the companion memorandum to this document, all BRB employees should understand that when they communicate with BRB's attorneys in the course of the investigation, they are doing so as representatives of BRB, and the privilege belongs to the corporation. BRB, through its authorized representatives, has the sole authority to assert or waive the privilege.

With respect to communications between BRB and Caldwell Pratt & Stein LLP, it should be noted that communications regarding the preparation and review of the Form 10-K and Form 10-Q filings at issue may be privileged to the extent they involve legal advice about BRB's disclosure obligations under the Securities Act of 1933, the Securities Exchange Act of 1934, and the rules and regulations promulgated thereunder. However, communications that are purely factual — such as the transmission of financial data for inclusion in the filings — or that relate solely to the business aspects of the filing process may not be protected by the privilege. Mixed-purpose communications will require careful, document-by-document analysis by C&H.

2. Attorney Work-Product Doctrine

The attorney work-product doctrine, established by the United States Supreme Court in Hickman v. Taylor, 329 U.S. 495 (1947), and codified in Federal Rule of Civil Procedure 26(b)(3), protects documents and tangible things prepared by or for BRB's attorneys in anticipation of litigation or in preparation for the investigation. The work-product doctrine is broader than the attorney-client privilege in certain respects, as it protects not only communications but also an attorney's own research, analysis, and mental impressions.

The work-product doctrine applies to C&H's internal memoranda, legal research, legal analyses, case assessments, witness preparation materials, strategy documents, investigation plans, and any other materials prepared in connection with the defense of the SEC investigation. It also applies to drafts of Wells Submissions, defensive memoranda, and communications concerning legal strategy.

Critically, the work-product doctrine also applies to materials prepared by non-attorneys at the direction of counsel for the purpose of assisting with legal advice and defense strategy. This includes materials prepared by Brindoval Analytic Partners LLC, the forensic accounting consultant retained by C&H under a Kovel engagement — a subject discussed in greater detail in Section V.B below.

The work-product doctrine provides two tiers of protection. Fact work product — consisting of factual compilations, chronologies, and other materials reflecting factual information — is subject to a qualified privilege and may be overcome upon a showing of substantial need and inability to obtain the substantial equivalent of the materials by other means without undue hardship. Opinion work product — consisting of an attorney's mental impressions, conclusions, opinions, and legal theories — receives near-absolute protection and is virtually never discoverable. C&H will take care to mark documents reflecting opinion work product accordingly and to argue for the highest level of protection available.

3. Bank-Examination Privilege

The bank-examination privilege protects confidential communications between BRB and its prudential regulators, particularly the OCC. This privilege serves the important public policy of encouraging full and frank communication between regulated financial institutions and their supervisory agencies, thereby facilitating effective bank supervision.

BRB's CAMELS composite rating of 2 (Satisfactory), OCC examination reports, supervisory findings, and supervisory correspondence are protected under the bank-examination privilege. Unlike the attorney-client privilege, which is held by the client, the bank-examination privilege is generally considered to be held by the regulator — in this case, the OCC. As a result, BRB cannot unilaterally waive the bank-examination privilege, and BRB should not produce OCC examination materials to the SEC without first consulting with C&H and, if necessary, obtaining authorization from the OCC.

Documents reflecting BRB's internal responses to OCC examination findings may also warrant protection under the bank-examination privilege. The scope of protection afforded to such derivative documents varies by jurisdiction, and C&H will analyze the applicable case law as specific documents are identified during the privilege review process. BRB personnel should flag all documents that reference, summarize, or quote OCC examination findings for review by C&H.

B. Practical Guidance for Identifying Privileged Documents

The following practical guidance is intended to assist BRB personnel in identifying documents that may be subject to privilege protection. While the ultimate determination of privilege will be made by C&H during the formal privilege review process, early identification and segregation of potentially privileged materials will significantly enhance the efficiency and effectiveness of that review.

Communications with Attorneys. Any communication to or from an attorney — whether in-house or outside counsel — that seeks, provides, or reflects legal advice should be flagged as potentially privileged. This includes emails, memoranda, letters, text messages, and other written communications, as well as notes or summaries of telephone calls or in-person meetings at which legal advice was discussed.

Documents with Privilege Markings. Documents marked "PRIVILEGED," "ATTORNEY-CLIENT," "WORK PRODUCT," "PRIVILEGED & CONFIDENTIAL," or similar designations should be segregated for privilege review. While the presence or absence of a privilege marking is not dispositive of whether the document is in fact privileged, such markings are relevant evidence of the communicants' intent to maintain confidentiality.

Mixed-Purpose Documents. Documents that contain both legal advice and business content present particular challenges. BRB personnel should flag all such documents for C&H review. Privilege may attach only to the legal-advice portions of such documents; in some cases, the privileged content may be redacted while the non-privileged portions are produced. The analysis of mixed-purpose documents requires careful consideration of the dominant purpose of the communication and the extent to which the legal and business content can be separated.

Forwarded or CC'd Communications. The forwarding of a privileged communication to additional persons within the corporation does not automatically waive the privilege, provided that the recipients have a need to know the legal advice in order to perform their duties on behalf of the corporation. However, forwarding privileged communications to persons outside the scope of the representation — or to third parties who do not share a common-interest or Kovel relationship with BRB — may result in waiver of the privilege. BRB personnel should exercise caution when forwarding communications that contain legal advice and should consult with Derek Sung if there is any doubt about whether a proposed forwarding or distribution would jeopardize privilege.

Draft Documents. Draft documents circulated for legal review should be preserved and flagged as potentially privileged. Drafts of SEC filings, draft ACL disclosures, and draft Board or Audit Committee presentations that were circulated to BRB's attorneys for legal review may be protected to the extent they reflect the substance of legal advice provided by counsel.

IV. PRIVILEGE LOGGING STANDARDS

A. General Requirements

All documents withheld from production to the SEC on privilege grounds must be entered on a privilege log. The privilege log is a critical document in any enforcement investigation; it must be prepared with care, specificity, and accuracy. An inadequate privilege log may result in the SEC Staff challenging BRB's privilege claims, potentially leading to compelled production of documents that would otherwise be protected.

The privilege log must contain, at a minimum, the following fields for each entry:

Descriptions of privileged documents must be sufficiently specific to allow the SEC Staff to evaluate the validity of the privilege claim. Boilerplate descriptions — such as "Confidential communication between attorney and client regarding legal matter" — are inadequate, may be challenged by the SEC Staff, and may result in an order compelling production or in camera review. Each entry should identify, at a minimum, the general subject matter of the communication and the purpose for which legal advice was sought or rendered, without revealing the substance of the legal advice itself.

B. Redaction Protocol

Where a document contains both privileged and non-privileged content, the document should be produced in redacted form rather than withheld in its entirety. Redactions must be clearly marked on the face of the document, using opaque redaction boxes or highlighting that obscures the privileged content while leaving the non-privileged portions visible and legible.

Each redaction must be logged on the privilege log with the same information required for a fully withheld document, as set forth in Section IV.A above. The privilege log entry for a redacted document should identify the specific privilege basis for each redaction and should describe the subject matter of the redacted content in non-waiving terms.

Redacted documents should bear a footer or stamp reading: "Redacted — [Privilege Basis]" (e.g., "Redacted — Attorney-Client Privilege" or "Redacted — Attorney Work Product"). This notation alerts the SEC Staff that the document has been produced in redacted form and identifies the privilege basis for the redaction.

C. Logging Responsibilities and Workflow

C&H's document review team, led by Jasmine Thornton (Lead Associate) and Liam Donahue (Senior Associate), will conduct the first-pass and second-pass privilege review of all documents collected from BRB custodians. The first-pass review will involve an initial assessment of each document for responsiveness and privilege, using a structured review protocol and coding taxonomy developed by C&H. The second-pass review will focus specifically on documents coded as potentially privileged during the first pass, applying a more rigorous analysis to confirm the applicability of the claimed privilege.

BRB's in-house legal team should perform an initial pre-collection screening to segregate clearly privileged materials from the broader document population. Clearly privileged materials include, for example, communications with outside counsel that solely seek or provide legal advice and contain no factual business content. Pre-collection screening will reduce the volume of documents requiring detailed privilege review by C&H and will expedite the overall review and production process.

The estimated document volume for this investigation is substantial. Based on C&H's preliminary assessment of the number of custodians, the breadth of the relevant subject matter, and the three-year date range for preservation, BRB should anticipate that the total document population may encompass hundreds of thousands of individual documents. The resulting privilege log is expected to be extensive, potentially comprising thousands of entries. C&H will employ technology-assisted review ("TAR") and other document review tools to enhance the efficiency and consistency of the privilege review process.

C&H will maintain a running cumulative privilege log throughout the rolling production process. As documents are reviewed and produced on a rolling basis, the privilege log will be updated to reflect newly identified privileged documents and will be provided to the SEC Staff at agreed-upon intervals.

D. Quality Control

To ensure the accuracy and completeness of the privilege review, C&H will implement the following quality-control measures:

Non-Privileged Document Sampling. A statistically significant sample of documents coded as non-privileged during the review process will be subjected to a quality-control review by a senior attorney. The purpose of this review is to identify any documents that were inadvertently coded as non-privileged but that should have been withheld or redacted on privilege grounds. The sampling rate and methodology will be determined by C&H based on the total document volume and the observed error rate during the initial quality-control reviews.

Privileged Document Sampling. Similarly, a sample of documents coded as privileged will be reviewed by a senior attorney to ensure that the privilege claims are defensible, that the privilege log descriptions are adequate and non-waiving, and that the documents are properly categorized by privilege basis. Overclaiming privilege — asserting privilege over documents that do not genuinely qualify — can undermine BRB's credibility with the SEC Staff and may lead to increased scrutiny of the entire privilege log.

The results of quality-control reviews will be documented and used to refine the review protocol as needed. Any systemic issues identified during quality control will be addressed through supplemental training of the review team and adjustment of the coding guidelines.

V. PROTOCOLS FOR COMMUNICATIONS WITH THIRD PARTIES TO PRESERVE PRIVILEGE

Maintaining the attorney-client privilege and work-product protection in an enforcement investigation requires careful management of communications with third parties. The involvement of multiple outside parties — including BRB's independent auditor, forensic accounting consultant, D&O insurers, and prior outside counsel — creates numerous opportunities for inadvertent waiver if communications are not properly structured and controlled. The following protocols are designed to minimize the risk of waiver.

A. Communications with Whitfield Keane LLP (Independent Auditor)

Whitfield Keane LLP serves as BRB's independent registered public accounting firm and is registered with the Public Company Accounting Oversight Board ("PCAOB") under Registration No. 2847. The engagement partner is Lorraine Dupont. Whitfield Keane's offices are located at 600 Third Avenue, 22nd Floor, New York, NY 10016. Whitfield Keane audited BRB's financial statements for FY 2021 and FY 2022, and performed quarterly reviews of BRB's interim financial statements for Q1 2023 and Q2 2023.

General Rule — No Privilege. Communications between BRB and Whitfield Keane in the ordinary course of the audit engagement are generally NOT protected by the attorney-client privilege. The attorney-client privilege applies only to communications with an attorney made for the purpose of obtaining or providing legal advice. Whitfield Keane is not BRB's attorney, and the communications between BRB and Whitfield Keane serve an audit function, not a legal-advice function. Accordingly, BRB personnel should expect that the SEC Staff may request production of BRB's communications with Whitfield Keane, and BRB will generally be obligated to produce such communications.

Exceptions. Certain categories of communications involving Whitfield Keane may be protected:

• Common-Interest Communications. Communications between C&H and Whitfield Keane's counsel, Hargrove & Millstein LLP (lead partner Samuel Hargrove, 1700 K Street NW, Suite 900, Washington, D.C. 20006), may be protected pursuant to a common-interest or joint-defense arrangement, as described in Section V.C below.

• Attorney-Directed Communications. Communications directed by C&H through which legal advice is channeled via the auditor — for example, where C&H requests that Whitfield Keane provide specific accounting information to enable C&H to render legal advice to BRB — may be protected under the Kovel doctrine or the attorney-client privilege, depending on the specific circumstances.

Critical Protocols. BRB personnel should NOT share C&H's legal memoranda, strategy documents, work-product materials, or other privileged communications with Whitfield Keane without prior approval from C&H. The disclosure of privileged materials to the independent auditor may result in waiver of the privilege, as the auditor does not share a common interest with BRB in the defense of the SEC investigation absent a written common-interest agreement.

All communications with Whitfield Keane during the pendency of the investigation should be coordinated through Derek Sung and C&H to avoid inadvertent waiver. Before any BRB employee communicates with Whitfield Keane about any topic that touches upon the SEC investigation, ACL methodology, or the BridgeFin portfolio, the employee should notify Derek Sung and obtain guidance from C&H on the appropriate scope and form of the communication.

Audit Workpapers. Audit workpapers prepared by Whitfield Keane are the property of the auditor, not BRB, and are subject to PCAOB rules and standards governing the retention and confidentiality of audit documentation. BRB should not attempt to produce or withhold Whitfield Keane's workpapers on its own; any requests from the SEC for Whitfield Keane's workpapers should be referred to C&H, which will coordinate with Hargrove & Millstein LLP as necessary.

B. Communications with Brindoval Analytic Partners LLC (Forensic Accounting Consultant)

Brindoval Analytic Partners LLC ("Brindoval") has been retained by C&H (not directly by BRB) under a Kovel engagement, effective October 10, 2023. The engagement lead is Dr. Franklin Osei, CPA, CFF. Brindoval's offices are located at 350 South Grand Avenue, Suite 2100, Los Angeles, CA 90071. Brindoval has been engaged to provide forensic accounting and financial analysis services to C&H in connection with the SEC investigation, including analysis of BRB's CECL methodology, the BridgeFin portfolio's credit performance, and the adequacy of BRB's reported ACL.

Kovel Doctrine. Under the Kovel doctrine, established by the United States Court of Appeals for the Second Circuit in United States v. Kovel, 296 F.2d 918 (2d Cir. 1961), communications between a client, its attorney, and a non-attorney consultant are protected by the attorney-client privilege and/or the work-product doctrine to the extent the consultant is acting as a "translator" or "interpreter" of complex information (in this case, accounting and financial data) to enable the attorney to understand the client's situation and provide informed legal advice. The Kovel doctrine recognizes that, in many complex matters, an attorney cannot render effective legal advice without the assistance of experts who can explain technical subject matter in terms the attorney can understand and apply.

Critical Protocol Requirements to Maintain Kovel Protection. The Kovel privilege is narrower than the general attorney-client privilege and can be easily lost if the engagement is not properly structured and maintained. The following protocols are mandatory:

(i) All communications with Brindoval must be directed through or at the request of C&H. BRB personnel should not communicate directly with Brindoval without C&H's involvement. C&H should be included on all emails (via cc or direct inclusion), and C&H should participate in all telephone calls and meetings with Brindoval.

(ii) BRB personnel should not communicate directly with Brindoval without C&H on the communication. If a BRB employee receives a direct communication from Brindoval that does not include an C&H attorney, the employee should not respond and should promptly forward the communication to Derek Sung and C&H.

(iii) All Brindoval work product — including reports, analyses, memoranda, models, and spreadsheets — must be addressed to C&H as counsel. Each Brindoval deliverable must be marked: "PRIVILEGED & CONFIDENTIAL — PREPARED AT THE DIRECTION OF COUNSEL — ATTORNEY WORK PRODUCT."

(iv) Brindoval's engagement letter specifies that Brindoval is retained by C&H, not BRB, for the purpose of assisting C&H in rendering legal advice to BRB in connection with the SEC investigation. This structure is essential to maintaining the Kovel privilege. If Brindoval's role were characterized as a direct engagement by BRB for a business purpose (such as improving BRB's CECL model), the Kovel privilege would not apply.

(v) Potential waiver through disclosure. If Brindoval's forensic analysis is later used in a Wells Submission or is otherwise provided to the SEC Staff as part of BRB's defense, the privilege with respect to that specific material may be waived as to the disclosed content. However, such a disclosure should not effect a broad subject-matter waiver if the disclosure is properly structured. C&H will carefully evaluate the privilege implications of any proposed disclosure of Brindoval's work product before such disclosure is made.

C. Common-Interest / Joint-Defense Arrangements

C&H and Hargrove & Millstein LLP (counsel to Whitfield Keane) may enter into a common-interest agreement — sometimes referred to as a "joint-defense agreement" — to facilitate the sharing of privileged information related to the SEC investigation without waiving the applicable privilege protections. A common-interest agreement permits parties who share a common legal interest to exchange privileged communications and work product without destroying the confidentiality necessary to maintain the privilege.

Any common-interest agreement entered into by C&H and Hargrove & Millstein must meet the following requirements:

(i) The agreement must be in writing;

(ii) The agreement must identify the common legal interest — namely, the defense against the SEC investigation as it relates to BRB's financial statements and the audit thereof;

(iii) The agreement must specify that communications shared pursuant to the agreement remain privileged and confidential and may not be disclosed to third parties without the consent of the disclosing party; and

(iv) The agreement should address the procedures for sharing information, the scope of the common interest, and the circumstances under which the agreement may be terminated.

As of the date of this memorandum, no common-interest agreement has been executed between C&H and Hargrove & Millstein LLP. C&H will evaluate the need for such an arrangement as the investigation develops and will negotiate the terms of any such agreement with Hargrove & Millstein.

Important Directive: BRB personnel should not share privileged materials — including C&H memoranda, legal advice, work-product materials, or internal communications reflecting legal advice — with Whitfield Keane or Hargrove & Millstein absent (a) a written common-interest agreement and (b) C&H's express authorization for the specific disclosure at issue. Sharing privileged materials outside of a properly established common-interest arrangement may constitute a waiver of the privilege.

D. Communications with D&O Insurers

BRB has tendered the SEC investigation as a Claim under its directors and officers liability insurance program. The relevant policies are as follows:

The primary policy carries an entity retention (self-insured retention) of $2.5 million, and the policy period runs from July 1, 2023, through July 1, 2024. The tender was made through BRB's insurance broker, Ridgeline Governance Advisors LLC (SVP Melinda Tran, 100 Federal Street, Suite 3600, Boston, MA 02110). Northcastle's claims counsel for this matter is Thornfield & Rowe LLP (contact: Brenda Alvaro, 227 West Monroe Street, Suite 4400, Chicago, IL 60606).

Privilege Considerations. Communications with the D&O carrier and its claims counsel concerning coverage, defense costs, and the substance of the investigation are generally protected by a common interest in the defense of the claim. Courts have recognized that an insured and its insurer share a common interest in defending against underlying claims, and that communications made in furtherance of that common interest are protected from disclosure to third parties.

However, BRB should exercise caution in its communications with the insurers. If a coverage dispute arises — for example, if Northcastle denies coverage for certain aspects of the investigation or asserts a policy exclusion — communications between BRB and the insurer may not be privileged as against the insurer in a subsequent coverage action. BRB personnel should be mindful of this limitation and should avoid including in communications with the insurer any content that BRB would not want disclosed in a coverage dispute.

C&H will coordinate all substantive communications with Northcastle, Cascade Fidelity, and Thornfield & Rowe LLP regarding the investigation. BRB personnel should route all insurer inquiries and requests for information through Derek Sung and C&H. This centralized approach will ensure that communications with the insurers are appropriately tailored to preserve privilege and to avoid inadvertent disclosures.

Fee Statement Redactions. Invoices and fee statements submitted to Northcastle for D&O reimbursement should be reviewed by C&H prior to submission to redact work-product-protected content. Detailed task descriptions that reveal legal strategy, mental impressions, case assessments, or defense theories should be redacted or generalized before the invoices are transmitted to the insurer. The transmission of unredacted detailed billing narratives may result in waiver of the work-product protection as to the strategic information contained therein.

E. Communications with Caldwell Pratt & Stein LLP (Prior Securities Reporting Counsel)

Caldwell Pratt & Stein LLP ("CPS"), under lead partner Martin Caldwell (51 West 52nd Street, 24th Floor, New York, NY 10019), served as BRB's regular outside securities counsel prior to C&H's engagement for the investigation. CPS prepared and reviewed the FY 2022 Form 10-K and the Q1 2023 and Q2 2023 Forms 10-Q — the specific filings at issue in the SEC investigation. CPS initially received the SEC's voluntary request letter dated September 18, 2023, before C&H was retained to handle the investigation.

Privilege Status of CPS Communications. Communications between BRB and CPS regarding the preparation of the SEC filings may be privileged to the extent they involve legal advice on disclosure obligations under the federal securities laws. For example, communications in which CPS advised BRB on the adequacy of its ACL disclosures, the appropriateness of specific language in the filings, or the application of SEC disclosure rules would generally be protected by the attorney-client privilege. By contrast, communications that are purely factual in nature — such as the transmission of financial data or the coordination of filing logistics — may not be protected.

File Preservation. CPS's files may contain documents that are highly relevant to BRB's disclosure decision-making process and to the investigation generally. BRB should request that CPS preserve all files related to the FY 2022 Form 10-K and the Q1 2023 and Q2 2023 Forms 10-Q, including all drafts, redline versions, comment letters, markup, memoranda, and correspondence. C&H will coordinate with CPS to identify and protect privileged materials within CPS's files.

Production Coordination. BRB should not provide CPS's privileged communications to the SEC without C&H's review and approval. If the SEC seeks testimony from CPS personnel or production of CPS's files, BRB — as the holder of the attorney-client privilege with respect to its communications with CPS — will need to assess the assertion or waiver of privilege on a document-by-document basis. C&H will manage this process in coordination with CPS and will advise BRB on the appropriate response to any such requests.

VI. FRE 502(d) CLAWBACK PROTECTIONS

A. Background

Federal Rule of Evidence 502(d) provides a powerful mechanism for protecting against the inadvertent waiver of privilege in the context of large-scale document productions. Rule 502(d) permits a federal court to order that the privilege or protection is not waived by disclosure connected with the litigation pending before the court, and provides that such an order is binding on all persons or entities in all federal and state proceedings — regardless of whether such persons or entities were parties to the proceeding in which the order was entered.

In the current SEC investigation context, there is no pending federal court litigation, and therefore a formal Rule 502(d) order cannot be obtained at this time. However, it is standard practice — and strongly advisable — for counsel to seek an agreement with the SEC Staff (commonly referred to as a "502(d)-type" agreement or a "non-waiver" agreement) providing that the inadvertent production of privileged documents does not constitute a waiver of the attorney-client privilege or the work-product doctrine. Such an agreement provides significant protection against the risk that an inadvertent production during the investigation could be used by third parties in subsequent litigation to argue that BRB's privilege has been waived.

C&H will seek to negotiate a non-waiver agreement with the SEC Staff assigned to this investigation — currently Andrea Felton and Christopher Yuen — as part of the broader document production protocol negotiations. The non-waiver agreement should be memorialized in a written letter or stipulation signed by both C&H and the SEC Staff.

B. Clawback Procedures

In the event that BRB or C&H discovers that a privileged document has been inadvertently produced to the SEC, the following clawback procedures will apply:

1. Prompt Notification. C&H will promptly notify the SEC Staff in writing, identifying the inadvertently produced document by Bates number (in the format BRB-SEC-XXXXXX) and asserting the applicable privilege (attorney-client privilege, work-product doctrine, or bank-examination privilege, as applicable).

2. Request for Return or Destruction. C&H will request that the SEC Staff return or destroy the inadvertently produced document and all copies thereof, including any copies stored in electronic databases, document review platforms, or physical files maintained by the SEC Staff.

3. Non-Use and Non-Waiver Confirmation. C&H will request that the SEC Staff confirm in writing that it will not use the inadvertently produced document or its contents in any way and will not assert that the attorney-client privilege or work-product protection has been waived as a result of the inadvertent production.

BRB personnel who discover, or have reason to believe, that a privileged document may have been included in a production to the SEC should immediately notify Derek Sung and C&H. Time is of the essence in clawback situations; delay in asserting the clawback may undermine the argument that the disclosure was inadvertent and that BRB took prompt steps to rectify the error.

The non-waiver agreement negotiated with the SEC Staff should also address provisions analogous to Federal Rule of Evidence 502(b), which provides that an inadvertent disclosure of privileged information does not constitute a waiver if: (i) the disclosure was inadvertent; (ii) the holder of the privilege took reasonable steps to prevent disclosure; and (iii) the holder took reasonable steps promptly to rectify the error. The agreement should confirm that these protections apply to BRB's document production in the investigation, thereby preserving BRB's privilege even in the absence of a formal court order.

C. Documentation of Protective Measures

C&H will maintain a detailed log of all clawback notifications issued during the course of the investigation, including the date of notification, the Bates number(s) of the affected document(s), the privilege basis asserted, the SEC Staff's response, and the ultimate resolution of each clawback request.

The fact that BRB implemented robust privilege review procedures — including first-pass review, second-pass review, quality-control sampling of both privileged and non-privileged documents, and the use of technology-assisted review tools — will support any argument that a specific disclosure was inadvertent within the meaning of FRE 502(b). The documentation of these procedures and their consistent application throughout the investigation will be important evidence in the event of any dispute over the inadvertent nature of a disclosure.

VII. HANDLING OF BANK-EXAMINATION PRIVILEGED MATERIALS

BRB's examination reports, supervisory correspondence, matters requiring attention ("MRAs"), matters requiring immediate attention ("MRIAs"), and related materials from the OCC are protected by the bank-examination privilege. This privilege serves the vital supervisory purpose of encouraging candid and complete communication between regulated financial institutions and their prudential regulators, and courts have consistently recognized the importance of maintaining the confidentiality of bank-examination communications.

As discussed in Section III.A.3 above, the bank-examination privilege is held by the OCC, not by BRB. BRB cannot unilaterally waive the bank-examination privilege, even if BRB believes that disclosure would be in its interest. Any request by the SEC for OCC examination materials must be addressed with extreme care.

BRB should segregate all OCC examination materials — including, without limitation, the current Satisfactory CAMELS 2 composite rating, any component ratings, OCC examination findings related to ACL methodology, OCC examination findings related to the BridgeFin portfolio, supervisory letters, and BRB's formal responses to examination findings — and should not produce them to the SEC without OCC authorization. If the SEC requests OCC examination materials, C&H will coordinate with BRB and the OCC regarding the appropriate response. In some cases, the OCC may choose to share information with the SEC through interagency channels, but that decision belongs to the OCC, not to BRB.

Internal BRB documents that reference, summarize, or quote OCC examination findings present a more complex question. Derivative documents — that is, BRB's own internal documents that incorporate or reflect the substance of OCC examination communications — may or may not be protected by the bank-examination privilege, depending on the jurisdiction and the extent to which the derivative documents reveal the substance of the examination communications. C&H will review such documents on a case-by-case basis and will provide guidance to BRB on whether each document should be produced, withheld, or produced in redacted form.

BRB personnel should flag all documents that reference, summarize, discuss, or quote OCC examination reports, OCC examination findings, or supervisory correspondence for review by C&H. This includes internal memoranda, board presentations, risk committee reports, and other materials that may contain references to OCC examination findings.

VIII. EMPLOYEE COMMUNICATION GUIDELINES

A. Internal Communications

BRB employees should continue to communicate about ordinary business matters in the normal course. The existence of the SEC investigation and the implementation of the litigation hold do not require employees to cease normal business operations or to refrain from ordinary business communications. However, when communicating about the SEC investigation — including any discussion of the subjects under investigation, the investigation process, or BRB's response to the investigation — employees must observe the following protocols:

(i) Include Counsel on the Communication. To preserve the attorney-client privilege, employees should include Derek Sung or an C&H attorney on any communication relating to the SEC investigation. The presence of counsel on the communication is necessary to bring it within the scope of the attorney-client privilege. Communications about the investigation that do not include an attorney may not be privileged and may be subject to production to the SEC.

(ii) Mark Communications as Privileged. All communications relating to the SEC investigation should bear the following header or subject-line designation: "PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE." While the marking of a communication as privileged is not, by itself, sufficient to establish the privilege, it serves as evidence of the communicants' intent to maintain confidentiality and assists in the identification of privileged documents during the collection and review process.

(iii) Limit Distribution. Communications about the SEC investigation should be distributed only to those individuals who have a need to know the information in order to perform their duties on behalf of BRB. Unnecessary distribution of privileged communications increases the risk of inadvertent disclosure and may, in extreme cases, undermine the argument that the communication was intended to be confidential.

Employees should not discuss the SEC investigation on personal email accounts, personal messaging platforms (including personal text messages, Meridian Services Inc., Signal, or other personal messaging applications), or social media. Communications about the investigation conducted through personal channels are more difficult to preserve, more difficult to control, and more likely to result in inadvertent disclosure. All substantive communications about the investigation should be conducted through BRB's official communication systems.

All substantive questions about the investigation — including questions about the scope of the investigation, BRB's response, the litigation hold, or the privilege protocols set forth in this memorandum — should be directed to Derek Sung, who will coordinate with C&H as appropriate.

B. External Communications

No BRB employee should discuss the SEC investigation with any external party — including members of the media, securities analysts, counterparties, vendors, customers, or any other third party — without prior approval from Derek Sung and C&H. Unauthorized external communications about the investigation may result in the disclosure of privileged or confidential information, may violate BRB's obligations under the federal securities laws, and may adversely affect BRB's defense in the investigation.

Communications with the SEC or its Staff must be made exclusively through C&H. No BRB employee should communicate directly with any member of the SEC Staff assigned to the investigation — including Andrea Felton, Christopher Yuen, Diane Milosevic, Gregory Bonham, or Renata Moss — without C&H's participation. If any BRB employee is contacted directly by a member of the SEC Staff, the employee should politely decline to discuss the matter and should immediately notify Derek Sung and C&H.

Investor relations communications regarding the investigation must be coordinated with Derek Sung, C&H, and BRB's disclosure committee to ensure compliance with Regulation FD (Fair Disclosure) and other securities-law disclosure obligations. The disclosure of material nonpublic information about the investigation to selected persons (such as analysts or institutional investors) without simultaneous public disclosure may violate Regulation FD and expose BRB and its personnel to additional enforcement risk.

IX. DOCUMENT COLLECTION AND PROCESSING

Derek Sung's office, in coordination with BRB's Information Technology department, will oversee the collection of documents and ESI from the custodians identified in Section II.B of this memorandum. The collection process should be designed to be forensically defensible and to withstand scrutiny from the SEC Staff or any court.

Forensically Defensible Collection. Document collections should be performed using appropriate forensic collection tools and methodologies. Each collection should be documented with chain-of-custo

PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT
MEMORANDUM
FROM: Calderwood & Harkness LLP 425 Lexington Avenue, 30th Floor New York, NY 10017
TO: Derek Sung General Counsel & Chief Legal Officer Belmont Ridge Bank National Association 200 Park Avenue South, 38th Floor New York, NY 10003
September 25, 2023
RE: Privilege Protocol & Document Preservation Obligations — SEC Investigation File No. HO-14287
MATTER NO.: SC-MAT-2023-4172
AUTHORS: Victoria Chambers, Partner; Jasmine Thornton, Lead Associate
CC: Marcus R. Ellingham (CEO), Patricia "Trish" Navarrete (CFO), Annette Kowalski (CRO), Raymond Hu (CAO), Gwendolyn Prescott (Audit Committee Chair) — via Derek Sung's distribution at his discretion
Right-click to update Table of Contents
I. PURPOSE AND SCOPE OF THIS MEMORANDUM
Calderwood & Harkness LLP ("C&H") has been engaged by Belmont Ridge Bank National Association ("BRB" or the "Bank") as of September 20, 2023, to represent BRB in connection with an investigation initiated by the United States Securities and Exchange Commission ("SEC"), Division of Enforcement, which was opened by voluntary request letter dated September 18, 2023, and assigned File No. HO-14287. C&H's representation encompasses all matters arising out of or related to the investigation, including but not limited to document preservation and production, privilege analysis, interactions with the SEC Staff, and potential defense against any enforcement action that may result from the investigation.
This memorandum establishes binding protocols governing the following critical areas:
(a) Document preservation and the imposition of a comprehensive litigation hold;
(b) Identification and protection of communications and materials subject to attorney-client privilege, the attorney work-product doctrine, and the bank-examination privilege;
(c) Privilege logging standards to be employed in connection with any production of documents to the SEC;
(d) Communications protocols with third parties — including BRB's independent auditor, forensic accounting consultant, D&O insurers, and prior outside counsel — designed to preserve attorney-client privilege and work-product protection; and
(e) Clawback protections and non-waiver procedures to address the inadvertent disclosure of privileged materials.
These protocols are applicable to all BRB officers, directors, employees, and agents who may possess documents or communications relevant to the investigation, including without limitation all personnel within the BridgeFin digital lending division. BRB is a publicly traded national bank, listed on the Nasdaq Stock Market under the ticker symbol BRDG, and is chartered by the Office of the Comptroller of the Currency ("OCC") under Charter No. 24891. The investigation concerns BRB's public disclosures regarding its allowance for credit losses ("ACL") related to the BridgeFin digital lending portfolio, as reported in the following SEC filings:
• BRB's FY 2022 Annual Report on Form 10-K, filed with the SEC on February 28, 2023;
• BRB's Quarterly Report on Form 10-Q for the fiscal quarter ended March 31, 2023 (Q1 2023), filed with the SEC on May 10, 2023; and
• BRB's Quarterly Report on Form 10-Q for the fiscal quarter ended June 30, 2023 (Q2 2023), filed with the SEC on August 9, 2023.
The SEC's voluntary request letter raises questions concerning whether BRB's reported ACL figures and related disclosures in these filings were materially accurate and whether BRB's internal processes for estimating expected credit losses complied with applicable accounting standards and disclosure requirements.
All BRB personnel must comply with these protocols immediately upon receipt of this memorandum. Noncompliance may result in the waiver of attorney-client privilege and work-product protections, which cannot be restored once lost. In the context of an SEC enforcement investigation, the loss of privilege protections can have severe adverse consequences, including the compelled disclosure of communications and materials that would otherwise remain confidential, and exposure to potential sanctions or obstruction charges. The protocols set forth herein are mandatory and not discretionary.
II. LITIGATION HOLD — DOCUMENT PRESERVATION OBLIGATIONS
A. Scope of the Litigation Hold
Effective immediately upon distribution of this memorandum, BRB must preserve all documents, communications, and electronically stored information ("ESI") that are or may be relevant to the SEC investigation identified above. This obligation extends to materials in any form or medium, including paper documents, electronic files, emails, text messages, instant messages, voicemails, audio recordings, video recordings, photographs, and any other tangible or intangible records. The obligation to preserve relevant materials is not limited to documents that are directly responsive to any specific request from the SEC; rather, it encompasses all materials that bear upon or could reasonably lead to evidence bearing upon the subject matter of the investigation.
As set forth in the SEC's voluntary request letter, the investigation concerns whether BRB's reported ACL of $143.5 million — representing approximately 3.50% of the $4.1 billion BridgeFin outstanding loan portfolio — materially understated expected credit losses. The SEC Staff has specifically inquired into BRB's treatment of 12,847 re-aged and modified BridgeFin loans, which carried an aggregate outstanding balance of approximately $236.4 million as of the relevant reporting dates. The SEC Staff's interest extends to the methodology by which BRB classified, reported, and reserved against these modified and re-aged loans, and whether the treatment of these loans resulted in a material understatement of BRB's reported ACL.
Accordingly, the litigation hold covers all documents and ESI relating to the following subject-matter categories, without limitation:
1. BRB's methodology for calculating and reporting its ACL under the Current Expected Credit Losses ("CECL") framework, which BRB adopted effective January 1, 2020, in accordance with Accounting Standards Codification ("ASC") Topic 326, Financial Instruments — Credit Losses;
2. BridgeFin digital lending division loan origination, underwriting, modification, re-aging, and servicing practices, including all policies, procedures, guidelines, and manuals governing these functions;
3. ACL estimation, including vintage cohort analysis, qualitative factor overlays, quantitative model outputs, scenario analysis, management judgment adjustments, and quarterly true-up procedures;
4. Communications regarding the preparation, review, approval, and filing of BRB's periodic SEC filings, including the FY 2022 Form 10-K and the Q1 2023 and Q2 2023 Forms 10-Q;
5. Credit-quality metrics maintained or reported by BRB or the BridgeFin division, including charge-off rates, delinquency rates (30-day, 60-day, 90-day, and 90+ day), loss-rate modeling inputs and outputs, probability-of-default calculations, loss-given-default estimates, and exposure-at-default calculations;
6. Internal communications among senior management, the Board of Directors, the Audit Committee, and BRB's independent auditor, Whitfield Keane LLP, relating to credit quality, ACL estimation, financial statement disclosures, and the BridgeFin portfolio;
7. All documents and communications relating to BridgeFin division operations since its launch in Q3 2020, including but not limited to the division's AI-driven underwriting platform, marketing materials, borrower demographic analyses, and performance reports; and
8. Any other documents or communications that may be relevant to the SEC's investigation of BRB's public disclosures concerning expected credit losses.
B. Custodians Subject to Hold
The following individuals are hereby designated as named custodians subject to the litigation hold. Each named custodian must preserve all relevant documents and ESI in his or her possession, custody, or control:
Additional custodians may be identified as the investigation progresses, including but not limited to other members of the Audit Committee, BridgeFin division personnel, members of BRB's credit risk and financial reporting teams, and any other individuals identified through the custodian interview process or through the SEC Staff's requests. C&H will promptly notify Derek Sung of any additions to the custodian list.
Each custodian's administrative assistant, executive assistant, or any other delegate with access to the custodian's files, email accounts, calendars, or other documents is also subject to the hold. Each custodian should identify any such individuals to Derek Sung so that they may receive appropriate hold notices.
BRB's Information Technology department must take the following immediate steps with respect to the named custodians and all relevant shared resources:
• Suspend all auto-delete functions, message retention policies, and automated purge schedules applicable to the named custodians' email accounts, including both Strathmore Data Systems/Outlook mailboxes and any cloud-based email or messaging platforms;
• Suspend all routine document-destruction schedules, records-management disposal programs, and recycling policies that could result in the deletion or destruction of relevant documents;
• Preserve the contents of all shared drives, network folders, and collaboration platforms (including, without limitation, Aldermere Systems sites, Northgate Data Systems channels, Meridian Solutions workspaces, and any BridgeFin-specific platforms) that contain documents relating to the subject matter of the investigation; and
• Preserve BridgeFin division servers, databases, and data repositories in their current state, including the BridgeFin AI-driven underwriting model environment and associated data stores.
C. Categories of Documents and ESI to Be Preserved
Without limiting the general scope of the litigation hold described in Section II.A above, the following specific categories of documents and ESI must be preserved:
Electronic Communications. All emails, text messages (including SMS, Westmark Software, and any other mobile messaging format), instant messages (including communications on BRB's internal messaging platforms, Northgate Data Systems, Meridian Solutions, or any other collaboration tool), voicemails, and other electronic communications sent or received by custodians that relate to the subject matter of the investigation.
ACL and CECL Materials. All paper and electronic files related to ACL methodology, CECL model documentation, model inputs and outputs, vintage cohort analyses, loss-rate models, probability-of-default and loss-given-default calculations, qualitative factor assessments, management judgment overlays, and quarterly ACL true-up procedures. This includes all versions and iterations of such documents, not merely final versions.
BridgeFin Credit Dashboards and Portfolio Analytics. All credit dashboards, portfolio performance reports, loan-level data exports, delinquency tracking reports, modification and re-aging logs, and related analytics maintained by the BridgeFin division or BRB's credit risk management function.
Board and Audit Committee Materials. All Board of Directors and Audit Committee meeting minutes, agendas, presentations, board packages, and supporting materials relating to credit-quality reporting, ACL estimation, financial statement disclosures, and the BridgeFin portfolio. This includes materials from any special meetings or executive sessions addressing these topics.
Communications with Caldwell Pratt & Stein LLP. All communications between BRB and Caldwell Pratt & Stein LLP ("CPS"), BRB's securities reporting counsel (lead partner Martin Caldwell, 51 West 52nd Street, 24th Floor, New York, NY 10019), who prepared and reviewed the Form 10-K and Form 10-Q filings at issue in the investigation. This includes drafts, comments, markup, correspondence, and any memoranda relating to the preparation and review of the relevant filings.
Communications with Whitfield Keane LLP. All communications between BRB and Whitfield Keane LLP, BRB's independent registered public accounting firm (engagement partner Lorraine Dupont, PCAOB Registration No. 2847; 600 Third Avenue, 22nd Floor, New York, NY 10016), relating to the FY 2021 and FY 2022 audits, the quarterly reviews for Q1 2023 and Q2 2023, and any communications relating to BRB's ACL methodology, the BridgeFin portfolio, or the treatment of re-aged and modified loans.
Models, Spreadsheets, and Databases. All working papers, models, spreadsheets, databases, and analytical tools used in calculating ACL or in evaluating BridgeFin portfolio credit quality, including BridgeFin's AI-driven underwriting model documentation, model validation reports, and backtesting analyses.
Regulatory Correspondence. All regulatory correspondence with the OCC, including examination reports, matters requiring attention ("MRAs"), matters requiring immediate attention ("MRIAs"), supervisory letters, and BRB's responses thereto, to the extent they relate to BRB's credit risk management, ACL methodology, or the BridgeFin portfolio.
Relevant Date Range. The relevant date range for preservation purposes is January 1, 2020 (the date of BRB's adoption of the CECL framework under ASC 326) through the date of this memorandum and continuing forward for the duration of the litigation hold. Documents created or received after the date of this memorandum that fall within the scope of the hold must also be preserved on an ongoing basis.
D. Preservation Obligations — Practical Requirements
The following practical requirements apply to all custodians and relevant BRB personnel:
No Destruction or Alteration. No documents may be deleted, altered, overwritten, or destroyed, whether in hard copy or electronic form. This prohibition applies regardless of whether the document appears duplicative, immaterial, or routine. If there is any doubt as to whether a document falls within the scope of the hold, the document must be preserved.
Backup Tapes and Disaster-Recovery Archives. Backup tapes, disaster-recovery archives, and other archival media must be preserved to the extent they contain unique relevant data that is not otherwise available from primary sources. BRB's IT department should inventory all backup tapes and archival media and coordinate with C&H to determine which must be preserved.
Personal Devices. Personal devices — including mobile phones, tablets, and laptops — used by custodians for BRB business must be preserved. Custodians who use personal devices for BRB-related communications (including email, text messages, and messaging applications) must ensure that all such communications are retained and not deleted. Custodians should not reset, wipe, replace, or dispose of personal devices used for BRB business without prior authorization from Derek Sung and C&H.
Cloud-Based Storage and Collaboration Tools. Cloud-based storage accounts, collaboration tools, and third-party platforms used by the BridgeFin division or other relevant BRB business units must be placed on hold. This includes, without limitation, any cloud-based data analytics platforms, data lakes, or machine learning model repositories used by the BridgeFin division.
Litigation Hold Coordinator. Derek Sung, as General Counsel, is designated as the Litigation Hold Coordinator for BRB. In this capacity, Derek Sung is responsible for:
(i) Distributing this memorandum and the accompanying hold notices to all custodians and relevant BRB personnel;
(ii) Obtaining a signed written acknowledgment from each custodian confirming receipt and understanding of the hold (using the form attached as Appendix A);
(iii) Periodically reminding custodians of their preservation obligations (at least quarterly, or more frequently if circumstances warrant);
(iv) Identifying and notifying additional custodians as the investigation develops; and
(v) Serving as the primary point of contact between BRB personnel and C&H for all matters relating to document preservation.
C&H should receive a copy of each signed acknowledgment promptly upon execution. Derek Sung should maintain a master log of all hold notices distributed and acknowledgments received, and should provide periodic status reports to C&H.
E. Consequences of Non-Compliance
The consequences of failing to comply with the litigation hold and document preservation obligations set forth in this memorandum cannot be overstated. BRB and its personnel should be aware of the following:
Sanctions and Adverse Inferences. Failure to preserve relevant documents may result in the imposition of sanctions by the SEC or, in any subsequent litigation, by a federal court. In enforcement proceedings or civil litigation, a tribunal may draw adverse inferences against BRB based on the destruction or loss of relevant evidence — that is, the tribunal may presume that the destroyed documents were unfavorable to BRB.
Obstruction of Justice. The willful destruction of documents relevant to a federal investigation may constitute obstruction of justice under 18 U.S.C. § 1519 (destruction of records in federal investigations) or 18 U.S.C. § 1512(c) (obstruction of an official proceeding). These are federal criminal offenses carrying significant penalties.
Evidence of Scienter or Bad Faith. In the context of an SEC enforcement investigation, the SEC Staff may treat the spoliation of evidence as indicative of scienter or bad faith — both of which are elements of certain securities-law violations. Document destruction during a pending investigation significantly increases the risk of an enforcement action and may transform a case that might otherwise be resolved through a settlement into one in which the SEC pursues more severe penalties.
Federal Securities Law Obligations. BRB's obligations under the federal securities laws, including its duty to cooperate with SEC requests and its obligations as a public reporting company, require full and complete preservation of relevant documents. If a Formal Order of Investigation is issued (which C&H anticipates may occur in the near term), BRB will be subject to compulsory process, and any failure to preserve documents may be treated as a violation of a subpoena.
All custodians and BRB personnel are directed to take these obligations with the utmost seriousness and to contact Derek Sung immediately with any questions about the scope of the hold or their individual obligations.
III. PRIVILEGE IDENTIFICATION AND PROTECTION
A. Categories of Privilege
Three distinct privilege doctrines are relevant to this investigation. Understanding the scope and requirements of each is essential to ensuring that BRB's privileged materials are properly identified and protected.
1. Attorney-Client Privilege
The attorney-client privilege protects confidential communications between BRB and its attorneys — including both outside counsel (C&H and, as applicable, Caldwell Pratt & Stein LLP) and in-house counsel (Derek Sung and the members of BRB's in-house legal department) — made for the purpose of obtaining or providing legal advice. The privilege covers communications in both directions: communications from BRB to its attorneys seeking legal advice, and communications from BRB's attorneys to BRB providing legal advice or requesting information necessary to render legal advice.
The attorney-client privilege extends to communications between BRB employees and in-house counsel (Derek Sung and his legal team) where the communication is made for the primary purpose of seeking or rendering legal advice. It is important to recognize that not all communications with in-house counsel are privileged; communications that are primarily business in nature — such as routine business reporting or operational discussions — do not become privileged merely because an attorney is included on the communication. The purpose of the communication, not the identity of the participants, is the controlling factor.
The attorney-client privilege belongs to BRB as the corporate entity, not to individual officers or employees. Consistent with the Upjohn protocols established in the companion memorandum to this document, all BRB employees should understand that when they communicate with BRB's attorneys in the course of the investigation, they are doing so as representatives of BRB, and the privilege belongs to the corporation. BRB, through its authorized representatives, has the sole authority to assert or waive the privilege.
With respect to communications between BRB and Caldwell Pratt & Stein LLP, it should be noted that communications regarding the preparation and review of the Form 10-K and Form 10-Q filings at issue may be privileged to the extent they involve legal advice about BRB's disclosure obligations under the Securities Act of 1933, the Securities Exchange Act of 1934, and the rules and regulations promulgated thereunder. However, communications that are purely factual — such as the transmission of financial data for inclusion in the filings — or that relate solely to the business aspects of the filing process may not be protected by the privilege. Mixed-purpose communications will require careful, document-by-document analysis by C&H.
2. Attorney Work-Product Doctrine
The attorney work-product doctrine, established by the United States Supreme Court in Hickman v. Taylor, 329 U.S. 495 (1947), and codified in Federal Rule of Civil Procedure 26(b)(3), protects documents and tangible things prepared by or for BRB's attorneys in anticipation of litigation or in preparation for the investigation. The work-product doctrine is broader than the attorney-client privilege in certain respects, as it protects not only communications but also an attorney's own research, analysis, and mental impressions.
The work-product doctrine applies to C&H's internal memoranda, legal research, legal analyses, case assessments, witness preparation materials, strategy documents, investigation plans, and any other materials prepared in connection with the defense of the SEC investigation. It also applies to drafts of Wells Submissions, defensive memoranda, and communications concerning legal strategy.
Critically, the work-product doctrine also applies to materials prepared by non-attorneys at the direction of counsel for the purpose of assisting with legal advice and defense strategy. This includes materials prepared by Brindoval Analytic Partners LLC, the forensic accounting consultant retained by C&H under a Kovel engagement — a subject discussed in greater detail in Section V.B below.
The work-product doctrine provides two tiers of protection. Fact work product — consisting of factual compilations, chronologies, and other materials reflecting factual information — is subject to a qualified privilege and may be overcome upon a showing of substantial need and inability to obtain the substantial equivalent of the materials by other means without undue hardship. Opinion work product — consisting of an attorney's mental impressions, conclusions, opinions, and legal theories — receives near-absolute protection and is virtually never discoverable. C&H will take care to mark documents reflecting opinion work product accordingly and to argue for the highest level of protection available.
3. Bank-Examination Privilege
The bank-examination privilege protects confidential communications between BRB and its prudential regulators, particularly the OCC. This privilege serves the important public policy of encouraging full and frank communication between regulated financial institutions and their supervisory agencies, thereby facilitating effective bank supervision.
BRB's CAMELS composite rating of 2 (Satisfactory), OCC examination reports, supervisory findings, and supervisory correspondence are protected under the bank-examination privilege. Unlike the attorney-client privilege, which is held by the client, the bank-examination privilege is generally considered to be held by the regulator — in this case, the OCC. As a result, BRB cannot unilaterally waive the bank-examination privilege, and BRB should not produce OCC examination materials to the SEC without first consulting with C&H and, if necessary, obtaining authorization from the OCC.
Documents reflecting BRB's internal responses to OCC examination findings may also warrant protection under the bank-examination privilege. The scope of protection afforded to such derivative documents varies by jurisdiction, and C&H will analyze the applicable case law as specific documents are identified during the privilege review process. BRB personnel should flag all documents that reference, summarize, or quote OCC examination findings for review by C&H.
B. Practical Guidance for Identifying Privileged Documents
The following practical guidance is intended to assist BRB personnel in identifying documents that may be subject to privilege protection. While the ultimate determination of privilege will be made by C&H during the formal privilege review process, early identification and segregation of potentially privileged materials will significantly enhance the efficiency and effectiveness of that review.
Communications with Attorneys. Any communication to or from an attorney — whether in-house or outside counsel — that seeks, provides, or reflects legal advice should be flagged as potentially privileged. This includes emails, memoranda, letters, text messages, and other written communications, as well as notes or summaries of telephone calls or in-person meetings at which legal advice was discussed.
Documents with Privilege Markings. Documents marked "PRIVILEGED," "ATTORNEY-CLIENT," "WORK PRODUCT," "PRIVILEGED & CONFIDENTIAL," or similar designations should be segregated for privilege review. While the presence or absence of a privilege marking is not dispositive of whether the document is in fact privileged, such markings are relevant evidence of the communicants' intent to maintain confidentiality.
Mixed-Purpose Documents. Documents that contain both legal advice and business content present particular challenges. BRB personnel should flag all such documents for C&H review. Privilege may attach only to the legal-advice portions of such documents; in some cases, the privileged content may be redacted while the non-privileged portions are produced. The analysis of mixed-purpose documents requires careful consideration of the dominant purpose of the communication and the extent to which the legal and business content can be separated.
Forwarded or CC'd Communications. The forwarding of a privileged communication to additional persons within the corporation does not automatically waive the privilege, provided that the recipients have a need to know the legal advice in order to perform their duties on behalf of the corporation. However, forwarding privileged communications to persons outside the scope of the representation — or to third parties who do not share a common-interest or Kovel relationship with BRB — may result in waiver of the privilege. BRB personnel should exercise caution when forwarding communications that contain legal advice and should consult with Derek Sung if there is any doubt about whether a proposed forwarding or distribution would jeopardize privilege.
Draft Documents. Draft documents circulated for legal review should be preserved and flagged as potentially privileged. Drafts of SEC filings, draft ACL disclosures, and draft Board or Audit Committee presentations that were circulated to BRB's attorneys for legal review may be protected to the extent they reflect the substance of legal advice provided by counsel.
IV. PRIVILEGE LOGGING STANDARDS
A. General Requirements
All documents withheld from production to the SEC on privilege grounds must be entered on a privilege log. The privilege log is a critical document in any enforcement investigation; it must be prepared with care, specificity, and accuracy. An inadequate privilege log may result in the SEC Staff challenging BRB's privilege claims, potentially leading to compelled production of documents that would otherwise be protected.
The privilege log must contain, at a minimum, the following fields for each entry:
Descriptions of privileged documents must be sufficiently specific to allow the SEC Staff to evaluate the validity of the privilege claim. Boilerplate descriptions — such as "Confidential communication between attorney and client regarding legal matter" — are inadequate, may be challenged by the SEC Staff, and may result in an order compelling production or in camera review. Each entry should identify, at a minimum, the general subject matter of the communication and the purpose for which legal advice was sought or rendered, without revealing the substance of the legal advice itself.
B. Redaction Protocol
Where a document contains both privileged and non-privileged content, the document should be produced in redacted form rather than withheld in its entirety. Redactions must be clearly marked on the face of the document, using opaque redaction boxes or highlighting that obscures the privileged content while leaving the non-privileged portions visible and legible.
Each redaction must be logged on the privilege log with the same information required for a fully withheld document, as set forth in Section IV.A above. The privilege log entry for a redacted document should identify the specific privilege basis for each redaction and should describe the subject matter of the redacted content in non-waiving terms.
Redacted documents should bear a footer or stamp reading: "Redacted — [Privilege Basis]" (e.g., "Redacted — Attorney-Client Privilege" or "Redacted — Attorney Work Product"). This notation alerts the SEC Staff that the document has been produced in redacted form and identifies the privilege basis for the redaction.
C. Logging Responsibilities and Workflow
C&H's document review team, led by Jasmine Thornton (Lead Associate) and Liam Donahue (Senior Associate), will conduct the first-pass and second-pass privilege review of all documents collected from BRB custodians. The first-pass review will involve an initial assessment of each document for responsiveness and privilege, using a structured review protocol and coding taxonomy developed by C&H. The second-pass review will focus specifically on documents coded as potentially privileged during the first pass, applying a more rigorous analysis to confirm the applicability of the claimed privilege.
BRB's in-house legal team should perform an initial pre-collection screening to segregate clearly privileged materials from the broader document population. Clearly privileged materials include, for example, communications with outside counsel that solely seek or provide legal advice and contain no factual business content. Pre-collection screening will reduce the volume of documents requiring detailed privilege review by C&H and will expedite the overall review and production process.
The estimated document volume for this investigation is substantial. Based on C&H's preliminary assessment of the number of custodians, the breadth of the relevant subject matter, and the three-year date range for preservation, BRB should anticipate that the total document population may encompass hundreds of thousands of individual documents. The resulting privilege log is expected to be extensive, potentially comprising thousands of entries. C&H will employ technology-assisted review ("TAR") and other document review tools to enhance the efficiency and consistency of the privilege review process.
C&H will maintain a running cumulative privilege log throughout the rolling production process. As documents are reviewed and produced on a rolling basis, the privilege log will be updated to reflect newly identified privileged documents and will be provided to the SEC Staff at agreed-upon intervals.
D. Quality Control
To ensure the accuracy and completeness of the privilege review, C&H will implement the following quality-control measures:
Non-Privileged Document Sampling. A statistically significant sample of documents coded as non-privileged during the review process will be subjected to a quality-control review by a senior attorney. The purpose of this review is to identify any documents that were inadvertently coded as non-privileged but that should have been withheld or redacted on privilege grounds. The sampling rate and methodology will be determined by C&H based on the total document volume and the observed error rate during the initial quality-control reviews.
Privileged Document Sampling. Similarly, a sample of documents coded as privileged will be reviewed by a senior attorney to ensure that the privilege claims are defensible, that the privilege log descriptions are adequate and non-waiving, and that the documents are properly categorized by privilege basis. Overclaiming privilege — asserting privilege over documents that do not genuinely qualify — can undermine BRB's credibility with the SEC Staff and may lead to increased scrutiny of the entire privilege log.
The results of quality-control reviews will be documented and used to refine the review protocol as needed. Any systemic issues identified during quality control will be addressed through supplemental training of the review team and adjustment of the coding guidelines.
V. PROTOCOLS FOR COMMUNICATIONS WITH THIRD PARTIES TO PRESERVE PRIVILEGE
Maintaining the attorney-client privilege and work-product protection in an enforcement investigation requires careful management of communications with third parties. The involvement of multiple outside parties — including BRB's independent auditor, forensic accounting consultant, D&O insurers, and prior outside counsel — creates numerous opportunities for inadvertent waiver if communications are not properly structured and controlled. The following protocols are designed to minimize the risk of waiver.
A. Communications with Whitfield Keane LLP (Independent Auditor)
Whitfield Keane LLP serves as BRB's independent registered public accounting firm and is registered with the Public Company Accounting Oversight Board ("PCAOB") under Registration No. 2847. The engagement partner is Lorraine Dupont. Whitfield Keane's offices are located at 600 Third Avenue, 22nd Floor, New York, NY 10016. Whitfield Keane audited BRB's financial statements for FY 2021 and FY 2022, and performed quarterly reviews of BRB's interim financial statements for Q1 2023 and Q2 2023.
General Rule — No Privilege. Communications between BRB and Whitfield Keane in the ordinary course of the audit engagement are generally NOT protected by the attorney-client privilege. The attorney-client privilege applies only to communications with an attorney made for the purpose of obtaining or providing legal advice. Whitfield Keane is not BRB's attorney, and the communications between BRB and Whitfield Keane serve an audit function, not a legal-advice function. Accordingly, BRB personnel should expect that the SEC Staff may request production of BRB's communications with Whitfield Keane, and BRB will generally be obligated to produce such communications.
Exceptions. Certain categories of communications involving Whitfield Keane may be protected:
• Common-Interest Communications. Communications between C&H and Whitfield Keane's counsel, Hargrove & Millstein LLP (lead partner Samuel Hargrove, 1700 K Street NW, Suite 900, Washington, D.C. 20006), may be protected pursuant to a common-interest or joint-defense arrangement, as described in Section V.C below.
• Attorney-Directed Communications. Communications directed by C&H through which legal advice is channeled via the auditor — for example, where C&H requests that Whitfield Keane provide specific accounting information to enable C&H to render legal advice to BRB — may be protected under the Kovel doctrine or the attorney-client privilege, depending on the specific circumstances.
Critical Protocols. BRB personnel should NOT share C&H's legal memoranda, strategy documents, work-product materials, or other privileged communications with Whitfield Keane without prior approval from C&H. The disclosure of privileged materials to the independent auditor may result in waiver of the privilege, as the auditor does not share a common interest with BRB in the defense of the SEC investigation absent a written common-interest agreement.
All communications with Whitfield Keane during the pendency of the investigation should be coordinated through Derek Sung and C&H to avoid inadvertent waiver. Before any BRB employee communicates with Whitfield Keane about any topic that touches upon the SEC investigation, ACL methodology, or the BridgeFin portfolio, the employee should notify Derek Sung and obtain guidance from C&H on the appropriate scope and form of the communication.
Audit Workpapers. Audit workpapers prepared by Whitfield Keane are the property of the auditor, not BRB, and are subject to PCAOB rules and standards governing the retention and confidentiality of audit documentation. BRB should not attempt to produce or withhold Whitfield Keane's workpapers on its own; any requests from the SEC for Whitfield Keane's workpapers should be referred to C&H, which will coordinate with Hargrove & Millstein LLP as necessary.
B. Communications with Brindoval Analytic Partners LLC (Forensic Accounting Consultant)
Brindoval Analytic Partners LLC ("Brindoval") has been retained by C&H (not directly by BRB) under a Kovel engagement, effective October 10, 2023. The engagement lead is Dr. Franklin Osei, CPA, CFF. Brindoval's offices are located at 350 South Grand Avenue, Suite 2100, Los Angeles, CA 90071. Brindoval has been engaged to provide forensic accounting and financial analysis services to C&H in connection with the SEC investigation, including analysis of BRB's CECL methodology, the BridgeFin portfolio's credit performance, and the adequacy of BRB's reported ACL.
Kovel Doctrine. Under the Kovel doctrine, established by the United States Court of Appeals for the Second Circuit in United States v. Kovel, 296 F.2d 918 (2d Cir. 1961), communications between a client, its attorney, and a non-attorney consultant are protected by the attorney-client privilege and/or the work-product doctrine to the extent the consultant is acting as a "translator" or "interpreter" of complex information (in this case, accounting and financial data) to enable the attorney to understand the client's situation and provide informed legal advice. The Kovel doctrine recognizes that, in many complex matters, an attorney cannot render effective legal advice without the assistance of experts who can explain technical subject matter in terms the attorney can understand and apply.
Critical Protocol Requirements to Maintain Kovel Protection. The Kovel privilege is narrower than the general attorney-client privilege and can be easily lost if the engagement is not properly structured and maintained. The following protocols are mandatory:
(i) All communications with Brindoval must be directed through or at the request of C&H. BRB personnel should not communicate directly with Brindoval without C&H's involvement. C&H should be included on all emails (via cc or direct inclusion), and C&H should participate in all telephone calls and meetings with Brindoval.
(ii) BRB personnel should not communicate directly with Brindoval without C&H on the communication. If a BRB employee receives a direct communication from Brindoval that does not include an C&H attorney, the employee should not respond and should promptly forward the communication to Derek Sung and C&H.
(iii) All Brindoval work product — including reports, analyses, memoranda, models, and spreadsheets — must be addressed to C&H as counsel. Each Brindoval deliverable must be marked: "PRIVILEGED & CONFIDENTIAL — PREPARED AT THE DIRECTION OF COUNSEL — ATTORNEY WORK PRODUCT."
(iv) Brindoval's engagement letter specifies that Brindoval is retained by C&H, not BRB, for the purpose of assisting C&H in rendering legal advice to BRB in connection with the SEC investigation. This structure is essential to maintaining the Kovel privilege. If Brindoval's role were characterized as a direct engagement by BRB for a business purpose (such as improving BRB's CECL model), the Kovel privilege would not apply.
(v) Potential waiver through disclosure. If Brindoval's forensic analysis is later used in a Wells Submission or is otherwise provided to the SEC Staff as part of BRB's defense, the privilege with respect to that specific material may be waived as to the disclosed content. However, such a disclosure should not effect a broad subject-matter waiver if the disclosure is properly structured. C&H will carefully evaluate the privilege implications of any proposed disclosure of Brindoval's work product before such disclosure is made.
C. Common-Interest / Joint-Defense Arrangements
C&H and Hargrove & Millstein LLP (counsel to Whitfield Keane) may enter into a common-interest agreement — sometimes referred to as a "joint-defense agreement" — to facilitate the sharing of privileged information related to the SEC investigation without waiving the applicable privilege protections. A common-interest agreement permits parties who share a common legal interest to exchange privileged communications and work product without destroying the confidentiality necessary to maintain the privilege.
Any common-interest agreement entered into by C&H and Hargrove & Millstein must meet the following requirements:
(i) The agreement must be in writing;
(ii) The agreement must identify the common legal interest — namely, the defense against the SEC investigation as it relates to BRB's financial statements and the audit thereof;
(iii) The agreement must specify that communications shared pursuant to the agreement remain privileged and confidential and may not be disclosed to third parties without the consent of the disclosing party; and
(iv) The agreement should address the procedures for sharing information, the scope of the common interest, and the circumstances under which the agreement may be terminated.
As of the date of this memorandum, no common-interest agreement has been executed between C&H and Hargrove & Millstein LLP. C&H will evaluate the need for such an arrangement as the investigation develops and will negotiate the terms of any such agreement with Hargrove & Millstein.
Important Directive: BRB personnel should not share privileged materials — including C&H memoranda, legal advice, work-product materials, or internal communications reflecting legal advice — with Whitfield Keane or Hargrove & Millstein absent (a) a written common-interest agreement and (b) C&H's express authorization for the specific disclosure at issue. Sharing privileged materials outside of a properly established common-interest arrangement may constitute a waiver of the privilege.
D. Communications with D&O Insurers
BRB has tendered the SEC investigation as a Claim under its directors and officers liability insurance program. The relevant policies are as follows:
The primary policy carries an entity retention (self-insured retention) of $2.5 million, and the policy period runs from July 1, 2023, through July 1, 2024. The tender was made through BRB's insurance broker, Ridgeline Governance Advisors LLC (SVP Melinda Tran, 100 Federal Street, Suite 3600, Boston, MA 02110). Northcastle's claims counsel for this matter is Thornfield & Rowe LLP (contact: Brenda Alvaro, 227 West Monroe Street, Suite 4400, Chicago, IL 60606).
Privilege Considerations. Communications with the D&O carrier and its claims counsel concerning coverage, defense costs, and the substance of the investigation are generally protected by a common interest in the defense of the claim. Courts have recognized that an insured and its insurer share a common interest in defending against underlying claims, and that communications made in furtherance of that common interest are protected from disclosure to third parties.
However, BRB should exercise caution in its communications with the insurers. If a coverage dispute arises — for example, if Northcastle denies coverage for certain aspects of the investigation or asserts a policy exclusion — communications between BRB and the insurer may not be privileged as against the insurer in a subsequent coverage action. BRB personnel should be mindful of this limitation and should avoid including in communications with the insurer any content that BRB would not want disclosed in a coverage dispute.
C&H will coordinate all substantive communications with Northcastle, Cascade Fidelity, and Thornfield & Rowe LLP regarding the investigation. BRB personnel should route all insurer inquiries and requests for information through Derek Sung and C&H. This centralized approach will ensure that communications with the insurers are appropriately tailored to preserve privilege and to avoid inadvertent disclosures.
Fee Statement Redactions. Invoices and fee statements submitted to Northcastle for D&O reimbursement should be reviewed by C&H prior to submission to redact work-product-protected content. Detailed task descriptions that reveal legal strategy, mental impressions, case assessments, or defense theories should be redacted or generalized before the invoices are transmitted to the insurer. The transmission of unredacted detailed billing narratives may result in waiver of the work-product protection as to the strategic information contained therein.
E. Communications with Caldwell Pratt & Stein LLP (Prior Securities Reporting Counsel)
Caldwell Pratt & Stein LLP ("CPS"), under lead partner Martin Caldwell (51 West 52nd Street, 24th Floor, New York, NY 10019), served as BRB's regular outside securities counsel prior to C&H's engagement for the investigation. CPS prepared and reviewed the FY 2022 Form 10-K and the Q1 2023 and Q2 2023 Forms 10-Q — the specific filings at issue in the SEC investigation. CPS initially received the SEC's voluntary request letter dated September 18, 2023, before C&H was retained to handle the investigation.
Privilege Status of CPS Communications. Communications between BRB and CPS regarding the preparation of the SEC filings may be privileged to the extent they involve legal advice on disclosure obligations under the federal securities laws. For example, communications in which CPS advised BRB on the adequacy of its ACL disclosures, the appropriateness of specific language in the filings, or the application of SEC disclosure rules would generally be protected by the attorney-client privilege. By contrast, communications that are purely factual in nature — such as the transmission of financial data or the coordination of filing logistics — may not be protected.
File Preservation. CPS's files may contain documents that are highly relevant to BRB's disclosure decision-making process and to the investigation generally. BRB should request that CPS preserve all files related to the FY 2022 Form 10-K and the Q1 2023 and Q2 2023 Forms 10-Q, including all drafts, redline versions, comment letters, markup, memoranda, and correspondence. C&H will coordinate with CPS to identify and protect privileged materials within CPS's files.
Production Coordination. BRB should not provide CPS's privileged communications to the SEC without C&H's review and approval. If the SEC seeks testimony from CPS personnel or production of CPS's files, BRB — as the holder of the attorney-client privilege with respect to its communications with CPS — will need to assess the assertion or waiver of privilege on a document-by-document basis. C&H will manage this process in coordination with CPS and will advise BRB on the appropriate response to any such requests.
VI. FRE 502(d) CLAWBACK PROTECTIONS
A. Background
Federal Rule of Evidence 502(d) provides a powerful mechanism for protecting against the inadvertent waiver of privilege in the context of large-scale document productions. Rule 502(d) permits a federal court to order that the privilege or protection is not waived by disclosure connected with the litigation pending before the court, and provides that such an order is binding on all persons or entities in all federal and state proceedings — regardless of whether such persons or entities were parties to the proceeding in which the order was entered.
In the current SEC investigation context, there is no pending federal court litigation, and therefore a formal Rule 502(d) order cannot be obtained at this time. However, it is standard practice — and strongly advisable — for counsel to seek an agreement with the SEC Staff (commonly referred to as a "502(d)-type" agreement or a "non-waiver" agreement) providing that the inadvertent production of privileged documents does not constitute a waiver of the attorney-client privilege or the work-product doctrine. Such an agreement provides significant protection against the risk that an inadvertent production during the investigation could be used by third parties in subsequent litigation to argue that BRB's privilege has been waived.
C&H will seek to negotiate a non-waiver agreement with the SEC Staff assigned to this investigation — currently Andrea Felton and Christopher Yuen — as part of the broader document production protocol negotiations. The non-waiver agreement should be memorialized in a written letter or stipulation signed by both C&H and the SEC Staff.
B. Clawback Procedures
In the event that BRB or C&H discovers that a privileged document has been inadvertently produced to the SEC, the following clawback procedures will apply:
1. Prompt Notification. C&H will promptly notify the SEC Staff in writing, identifying the inadvertently produced document by Bates number (in the format BRB-SEC-XXXXXX) and asserting the applicable privilege (attorney-client privilege, work-product doctrine, or bank-examination privilege, as applicable).
2. Request for Return or Destruction. C&H will request that the SEC Staff return or destroy the inadvertently produced document and all copies thereof, including any copies stored in electronic databases, document review platforms, or physical files maintained by the SEC Staff.
3. Non-Use and Non-Waiver Confirmation. C&H will request that the SEC Staff confirm in writing that it will not use the inadvertently produced document or its contents in any way and will not assert that the attorney-client privilege or work-product protection has been waived as a result of the inadvertent production.
BRB personnel who discover, or have reason to believe, that a privileged document may have been included in a production to the SEC should immediately notify Derek Sung and C&H. Time is of the essence in clawback situations; delay in asserting the clawback may undermine the argument that the disclosure was inadvertent and that BRB took prompt steps to rectify the error.
The non-waiver agreement negotiated with the SEC Staff should also address provisions analogous to Federal Rule of Evidence 502(b), which provides that an inadvertent disclosure of privileged information does not constitute a waiver if: (i) the disclosure was inadvertent; (ii) the holder of the privilege took reasonable steps to prevent disclosure; and (iii) the holder took reasonable steps promptly to rectify the error. The agreement should confirm that these protections apply to BRB's document production in the investigation, thereby preserving BRB's privilege even in the absence of a formal court order.
C. Documentation of Protective Measures
C&H will maintain a detailed log of all clawback notifications issued during the course of the investigation, including the date of notification, the Bates number(s) of the affected document(s), the privilege basis asserted, the SEC Staff's response, and the ultimate resolution of each clawback request.
The fact that BRB implemented robust privilege review procedures — including first-pass review, second-pass review, quality-control sampling of both privileged and non-privileged documents, and the use of technology-assisted review tools — will support any argument that a specific disclosure was inadvertent within the meaning of FRE 502(b). The documentation of these procedures and their consistent application throughout the investigation will be important evidence in the event of any dispute over the inadvertent nature of a disclosure.
VII. HANDLING OF BANK-EXAMINATION PRIVILEGED MATERIALS
BRB's examination reports, supervisory correspondence, matters requiring attention ("MRAs"), matters requiring immediate attention ("MRIAs"), and related materials from the OCC are protected by the bank-examination privilege. This privilege serves the vital supervisory purpose of encouraging candid and complete communication between regulated financial institutions and their prudential regulators, and courts have consistently recognized the importance of maintaining the confidentiality of bank-examination communications.
As discussed in Section III.A.3 above, the bank-examination privilege is held by the OCC, not by BRB. BRB cannot unilaterally waive the bank-examination privilege, even if BRB believes that disclosure would be in its interest. Any request by the SEC for OCC examination materials must be addressed with extreme care.
BRB should segregate all OCC examination materials — including, without limitation, the current Satisfactory CAMELS 2 composite rating, any component ratings, OCC examination findings related to ACL methodology, OCC examination findings related to the BridgeFin portfolio, supervisory letters, and BRB's formal responses to examination findings — and should not produce them to the SEC without OCC authorization. If the SEC requests OCC examination materials, C&H will coordinate with BRB and the OCC regarding the appropriate response. In some cases, the OCC may choose to share information with the SEC through interagency channels, but that decision belongs to the OCC, not to BRB.
Internal BRB documents that reference, summarize, or quote OCC examination findings present a more complex question. Derivative documents — that is, BRB's own internal documents that incorporate or reflect the substance of OCC examination communications — may or may not be protected by the bank-examination privilege, depending on the jurisdiction and the extent to which the derivative documents reveal the substance of the examination communications. C&H will review such documents on a case-by-case basis and will provide guidance to BRB on whether each document should be produced, withheld, or produced in redacted form.
BRB personnel should flag all documents that reference, summarize, discuss, or quote OCC examination reports, OCC examination findings, or supervisory correspondence for review by C&H. This includes internal memoranda, board presentations, risk committee reports, and other materials that may contain references to OCC examination findings.
VIII. EMPLOYEE COMMUNICATION GUIDELINES
A. Internal Communications
BRB employees should continue to communicate about ordinary business matters in the normal course. The existence of the SEC investigation and the implementation of the litigation hold do not require employees to cease normal business operations or to refrain from ordinary business communications. However, when communicating about the SEC investigation — including any discussion of the subjects under investigation, the investigation process, or BRB's response to the investigation — employees must observe the following protocols:
(i) Include Counsel on the Communication. To preserve the attorney-client privilege, employees should include Derek Sung or an C&H attorney on any communication relating to the SEC investigation. The presence of counsel on the communication is necessary to bring it within the scope of the attorney-client privilege. Communications about the investigation that do not include an attorney may not be privileged and may be subject to production to the SEC.
(ii) Mark Communications as Privileged. All communications relating to the SEC investigation should bear the following header or subject-line designation: "PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE." While the marking of a communication as privileged is not, by itself, sufficient to establish the privilege, it serves as evidence of the communicants' intent to maintain confidentiality and assists in the identification of privileged documents during the collection and review process.
(iii) Limit Distribution. Communications about the SEC investigation should be distributed only to those individuals who have a need to know the information in order to perform their duties on behalf of BRB. Unnecessary distribution of privileged communications increases the risk of inadvertent disclosure and may, in extreme cases, undermine the argument that the communication was intended to be confidential.
Employees should not discuss the SEC investigation on personal email accounts, personal messaging platforms (including personal text messages, Meridian Services Inc., Signal, or other personal messaging applications), or social media. Communications about the investigation conducted through personal channels are more difficult to preserve, more difficult to control, and more likely to result in inadvertent disclosure. All substantive communications about the investigation should be conducted through BRB's official communication systems.
All substantive questions about the investigation — including questions about the scope of the investigation, BRB's response, the litigation hold, or the privilege protocols set forth in this memorandum — should be directed to Derek Sung, who will coordinate with C&H as appropriate.
B. External Communications
No BRB employee should discuss the SEC investigation with any external party — including members of the media, securities analysts, counterparties, vendors, customers, or any other third party — without prior approval from Derek Sung and C&H. Unauthorized external communications about the investigation may result in the disclosure of privileged or confidential information, may violate BRB's obligations under the federal securities laws, and may adversely affect BRB's defense in the investigation.
Communications with the SEC or its Staff must be made exclusively through C&H. No BRB employee should communicate directly with any member of the SEC Staff assigned to the investigation — including Andrea Felton, Christopher Yuen, Diane Milosevic, Gregory Bonham, or Renata Moss — without C&H's participation. If any BRB employee is contacted directly by a member of the SEC Staff, the employee should politely decline to discuss the matter and should immediately notify Derek Sung and C&H.
Investor relations communications regarding the investigation must be coordinated with Derek Sung, C&H, and BRB's disclosure committee to ensure compliance with Regulation FD (Fair Disclosure) and other securities-law disclosure obligations. The disclosure of material nonpublic information about the investigation to selected persons (such as analysts or institutional investors) without simultaneous public disclosure may violate Regulation FD and expose BRB and its personnel to additional enforcement risk.
IX. DOCUMENT COLLECTION AND PROCESSING
Derek Sung's office, in coordination with BRB's Information Technology department, will oversee the collection of documents and ESI from the custodians identified in Section II.B of this memorandum. The collection process should be designed to be forensically defensible and to withstand scrutiny from the SEC Staff or any court.
Forensically Defensible Collection. Document collections should be performed using appropriate forensic collection tools and methodologies. Each collection should be documented with chain-of-custo