Court filing
Case Deb 25 52372 Kservicing V Frohwein Doc97 2 Joint Appendix Ex01 10 2026 04 09 - Kservicing Bankruptcy
Filed April 9, 2026 in Kservicing Bankruptcy; one of 140 filings from this case.
No. 25-52372 · Doc. 97-1 · 2026-04-09 · Docket on CourtListener
Full text
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
EXHIBIT 1
Page 1 of 162
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 2 of 162
IN THE UNITED STATES BANKRUPTCY COURT
FOR THE DISTRICT OF DELAWARE
In re:
Chapter 11
KSERVICING WIND DOWN CORP., et al., 1
Case No. 22-10951 (CTG)
Post-Confirmation Debtors.
(Jointly Administered)
KSERVICING WIND DOWN CORP.
(f/k/a Kabbage, Inc.),
Plaintiff,
Adv. Pro. No. 25-52372 (CTG)
v.
ROBERT FROHWEIN, et al.,
Defendants.
JOINT DECLARATION ON BEHALF OF ALL DEFENDANTS2
Lena Konanova, Daniel A. Mason, Rebecca L. Butcher, Barry J. Pollack, and
Ani-Rae Lovell, attorneys duly admitted to practice law before this Court, declare the following
under pen-alty of perjury:
1
The post-confirmation Debtors in these chapter 11 cases, along with the last four digits of each
Debtor’s federal tax identification number, as applicable are: KServicing Wind Down Corp. (f/k/a
Kabbage, Inc. d/b/a KServicing) (3937); KServicing Wind Down Canada Holdings LLC (f/k/a
Kabbage Canada Holdings, LLC) (N/A); KServicing Wind Down Asset Securitization LLC (f/k/a
Kabbage Asset Securitization LLC) (N/A); KServicing Wind Down Asset Funding 2017-A LLC
(f/k/a Kabbage Asset Funding 2017-A LLC) (4803); KServicing Wind Down Asset Funding 2019A LLC (f/k/a Kabbage Asset Funding 2019-A LLC) (8973); and KServicing Wind Down Diameter
LLC (f/k/a Kabbage Diameter, LLC) (N/A). The Debtors’ mailing and service address is
KServicing Wind Down Corp. c/o Resolute Commercial Services, 6750 E. Camelback Road, Suite
103, Scottsdale, AZ 85251.
2
The term “All Defendants” refers to all defendants named in the Complaint [Adv. D.I. 1] and
includes Bennu Holdings Limited Co., Blue Run Ventures IV, LP, BRV Opportunities Fund, L.P.,
Curieux Limited Co., The Frohwein Family 2015 Trust, MDV IX, L.P., Raymond James &
Associates, Inc. CSDN FBO Robert Frohwein RIRA U/A/D 5/27/16 A/C 2867A298, Thomvest
A00001
Case 25-52372-CTG
1.
Doc 97-1
Filed 04/09/26
Page 3 of 162
Lena Konanova is a partner of the law firm Selendy Gay PLLC, counsel for the
D&O and Shareholder Defendants. She makes this Declaration based on her personal knowledge
and avers that the exhibits listed below which are cited in the D&O and Shareholder Defendants’
Memorandum of Law in Support of Motion to Dismiss are true and correct.
2.
Daniel Mason is a partner of the law firm Paul, Weiss, Rifkind, Wharton & Garri-
son LLP, counsel for the Reverence Defendants. Rebecca L. Butcher is a partner of the law firm
Landis Rath & Cobb LLP, counsel for the SoftBank Defendants. They make this Declaration
based on their personal knowledge and aver that the exhibits listed below which are cited in the
Memorandum of Law in Support of Certain Defendants’ Motion to Dismiss Counts IV, VI, and VII
and the Memorandum of Law in Support of Motion to Dismiss of Non-Management Director Defendants Ioannis Pipilis and Alex Chulack are true and correct.
3.
Barry J. Pollack is a partner of the law firm Harris St. Laurent LLP, counsel for L.
Scott Askins. He makes this Declaration based on his personal knowledge and avers that the exhibits listed below which are cited in the Memorandum of Law of L. Scott Askins in Support of Her
Motion to Dismiss the Complaint are true and correct.
4.
Lisa Hertzer Schertler is a partner of the law firm Schertler Onorato Mead Sears &
Manning, counsel for Spencer Robinson. She makes this Declaration based on her personal
knowledge and avers that the exhibits listed below which are cited in Defendant Spencer Robinson’s Memorandum in Support of Motion to Dismiss are true and correct.
Ventures Ltd., Donald Butler, Jonathan Ebinger, Robert Frohwein, Kathryn Petralia, and Bryan
Stolle (the “D&O and Shareholder Defendants”); Alex Chulack, Reverence Capital Partners
Opportunities Fund I, L.P., Reverence Capital Partners Opportunities Fund I (Cayman), L.P., RCP
Kicker Co-Invest, L.P., and Reverence Capital Partners Opportunities Fund I (AI), L.P. (the
“Reverence Defendants”); Ioannis Pipilis, SoftBank Vision Fund (AIV M2) L.P., and SoftBank
PrinceVille Investments, L.P. (the “SoftBank Defendants”); Leslie Scott Askins; Spencer
Robinson; and Laurie Simon Hodrick.
A00002
Case 25-52372-CTG
5.
Doc 97-1
Filed 04/09/26
Page 4 of 162
Ani-Rae Lovell is counsel at the law firm Ropes & Gray LLP, counsel for Laurie
Hodrick. She makes this Declaration based on her personal knowledge and avers that the exhibits
listed below which are cited in the Opening Brief in Support of the Motion to Dismiss of Laurie
Simon Hodrick are true and correct.
6.
Attached in the Joint Appendix for All Defendants as Exhibit 2 is a copy of the
Sixth Amended and Restated Certificate of Incorporation of Kabbage, Inc., dated September 7,
2017, the contents of which are subject to judicial notice.
7.
Attached in the Joint Appendix as Exhibit 3 is a copy of an Independent BSA/AML
Audit of Kabbage, Inc. conducted by Treliant LLC, dated October 9, 2018, and incorporated by
reference by paragraphs 87 and 88 of the Complaint [Adv. D.I. 1].
8.
Attached in the Joint Appendix as Exhibit 4 is a copy of an Enterprise Bank Se-
crecy Act / Anti-Money Laundering and Office of Foreign Assets Control Policy adopted by Kabbage, Inc., dated July 24, 2019, and incorporated by reference by paragraphs 82–86 of the Complaint.
9.
Attached in the Joint Appendix as Exhibit 5 is a copy of an Independent Enterprise
BSA/AML and OFAC Audit Report conducted by Treliant LLC, dated November 4, 2019, and
incorporated by reference by paragraphs 19, 88–92, and 126 of the Complaint.
10.
Attached in the Joint Appendix as Exhibit 6 is a Board of Directors Update dated
March 25, 2020, and incorporated by reference by paragraph 71 of the Complaint.
11.
Attached in the Joint Appendix as Exhibit 7 is a copy of a letter from Senators
Marco Rubio, Benjamin Cardin, Susan Collins, and Jeanne Shaheen to Steven Mnuchin and Jovita
Carranza,
dated
March
30,
2020,
which
is
available
to
the
public
at
A00003
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 5 of 162
https://www.shaheen.senate.gov/imo/media/doc/8EF8F376311973C53773AEC96F534D79.3.30.20-final-cares-act-implementation-letter.pdf [https://perma.cc/NRY8-SRJD] and subject to judicial notice.
12.
Attached in the Joint Appendix as Exhibit 8 is a copy of a guidance document
issued by the Small Business Administration titled “Paycheck Protection Program (PPP) Information Sheet: Borrowers,” dated March 31, 2020, which is available to the public at
https://home.treasury.gov/system/files/136/PPP%20Borrower%20Information%20Fact%20Sheet.pdf [https://perma.cc/9ARW-WVFV] and subject to judicial notice.
13.
Attached in the Joint Appendix as Exhibit 9 is a copy of a guidance document
issued by the Small Business Administration titled “Paycheck Protection Program (PPP) Information Sheet: Lenders,” published March 31, 2020, which is available to the public at
https://home.treasury.gov/system/files/136/PPP%20Lender%20Information%20Fact%20Sheet.pdf [https://perma.cc/Z5H5-YBWW] and subject to judicial notice.
14.
Attached in the Joint Appendix as Exhibit 10 is a copy of the Small Business Ad-
ministration’s Archived News Release 20-29, titled “With $349 Billion in Emergency Small Business Capital Cleared, SBA and Treasury Begin Unprecedented Public-Private Mobilization Effort
to Distribute Funds,” dated April 2, 2020, which is available to the public at
https://www.sba.gov/article/2020/apr/02/349-billion-emergency-small-business-capital-clearedsba-treasury-begin-unprecedented-public-private-0 [https://perma.cc/A4W8-UZ2N] and subject
to judicial notice.
15.
Attached in the Joint Appendix as Exhibit 11 is a copy of the Small Business Ad-
ministration’s Form 2484, which took effect on April 3, 2020 and is subject to judicial notice.
A00004
Case 25-52372-CTG
16.
Doc 97-1
Filed 04/09/26
Page 6 of 162
Attached in the Joint Appendix as Exhibit 12 is a copy of an email sent by A. Habib
to C. Brooks on April 4, 2020, which is incorporated by reference by and quoted in paragraphs 97,
98, and 129 of the Complaint.
17.
Attached in the Joint Appendix as Exhibit 13 is a copy of the Small Business Ad-
ministration’s Archived News Release 20-30, titled “SBA’s Paycheck Protection Program for
Small Businesses Affected by the Coronavirus Pandemic Launches” and dated April 3, 2020,
which is available to the public at https://www.sba.gov/article/2020/apr/03/sbas-paycheck-protection-program-small-businesses-affected-coronavirus-pandemic-launches
[https://perma.cc/QXC5-BSTN] and is subject to judicial notice.
18.
Attached in the Joint Appendix as Exhibit 14 is a copy of a guidance document
issued by the Department of the Treasury and the Small Business Administration titled “Paycheck
Protection Program Loans Frequently Asked Questions (FAQs),” as it appeared on April 6, 2020.
This document is available to the public at https://www.sba.gov/sites/default/files/2023-03/Final%20PPP%20FAQs.pdf [https://perma.cc/ELZ6-K5BX] and is subject to judicial notice.
19.
Attached in the Joint Appendix as Exhibit 15 is a copy of a guidance document
issued by the Department of the Treasury and the Small Business Administration titled “Paycheck
Protection Program Loans Frequently Asked Questions (FAQs),” as it appeared on April 7, 2020.
This document is available to the public at https://www.sba.gov/sites/default/files/2023-03/Final%20PPP%20FAQs%204-7-20.pdf [https://perma.cc/R3SC-F3CS] and is subject to judicial notice.
20.
Attached in the Joint Appendix as Exhibit 16 is a copy of an instant message con-
versation between S. Robinson and N. Goel dated April 8, 2020 that is incorporated by reference
by and quoted in paragraph 120 of the Complaint.
A00005
Case 25-52372-CTG
21.
Doc 97-1
Filed 04/09/26
Page 7 of 162
Attached in the Joint Appendix as Exhibit 17 is a copy of Small Business Admin-
istration Form 3507, as filled out on behalf of Kabbage, Inc. on April 9, 2020 and incorporated by
reference by and quoted in paragraph 100 of the Complaint.
22.
Attached in the Joint Appendix as Exhibit 18 is a copy of an instant message con-
versation between S. Robinson and others dated April 12, 2020 that is incorporated by reference
by and quoted in paragraph 115 of the Complaint.
23.
Attached in the Joint Appendix as Exhibit 19 is a copy of an Interim Final Rule
titled “Business Loan Program Temporary Changes; Paycheck Protection Program,” published by
the Small Business Administration on April 15, 2020. The Interim Final Rule is available to the
public at 85 Fed. Reg. 20811 and is subject to judicial notice.
24.
Attached in the Joint Appendix as Exhibit 20 is a copy of a guidance document
issued by the Department of the Treasury and the Small Business Administration titled “Paycheck
Protection Program Loans Frequently Asked Questions (FAQs),” as it appeared on April 23, 2020.
This document is available to the public at https://www.sba.gov/sites/default/files/202303/Paycheck-Protection-Program-Frequently-Asked-Questions_04%2023%2020.pdf
[https://perma.cc/PS47-CJCS] and is subject to judicial notice.
25.
Attached in the Joint Appendix as Exhibit 21 is a copy of a text message thread
between R. Frohwein, K. Petralia, and others dated April 24, 2020. The thread is incorporated by
reference by and quoted in paragraph 115 of the Complaint.
26.
Attached in the Joint Appendix as Exhibit 22 is a copy of Report R46325 of the
Congressional Research Service, titled “Fourth COVID-19 Relief Package (P.L. 116-139): In
Brief” and dated April 24, 2020. The report is available to the public at https://www.congress.gov/crs_external_products/R/PDF/R46325/R46325.2.pdf
A00006
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 8 of 162
[https://web.archive.org/web/20260208034852/https:/www.congress.gov/crs_external_products/R/PDF/R46325/R46325.2.pdf] and is subject to judicial notice.
27.
Attached in the Joint Appendix as Exhibit 23 is a copy of a press release by the
Department of the Treasury titled “Joint Statement by Treasury Secretary Steven T. Mnuchin and
SBA Administrator Jovita Carranza on the Resumption of the Paycheck Protection Program” and
dated April 24, 2020.
The press release is available to the public at https://home.treas-
ury.gov/news/press-releases/sm988 [https://perma.cc/M4ZR-KLKY] and is subject to judicial notice.
28.
Attached in the Joint Appendix as Exhibit 24 is a copy of an email from N. Goel
to S. Robinson dated April 28, 2020 that is incorporated by reference by and quoted in paragraph 118 of the Complaint.
29.
Attached in the Joint Appendix as Exhibit 25 is a copy of an email from A. Habib
to A. Kesarwani and others dated April 28, 2020 that is incorporated by reference by and quoted
in paragraphs 127, 128, and 129 of the Complaint.
30.
Attached in the Joint Appendix as Exhibit 26 is a copy of a guidance document
issued by the Department of the Treasury and the Small Business Administration titled “Paycheck
Protection Program Loans Frequently Asked Questions (FAQs),” as it appeared on April 29, 2020.
This document is available to the public at https://www.sba.gov/sites/default/files/202303/Paycheck-Protection-Program-Frequently-Asked-Questions_04%2029%2020.pdf
[https://perma.cc/NR7S-HRTQ] and is subject to judicial notice.
31.
Attached in the Joint Appendix as Exhibit 27 is a copy of an instant message con-
versation between A. Kesarwani and S. Shah on May 1, 2020. The conversation is incorporated
by reference by and quoted in paragraph 210 of the Complaint.
A00007
Case 25-52372-CTG
32.
Doc 97-1
Filed 04/09/26
Page 9 of 162
Attached in the Joint Appendix as Exhibit 28 is a copy of an email from A. Kesar-
wani to J. Sce dated May 22, 2020 that is incorporated by reference by and quoted in paragraph
173 of the Complaint.
33.
Attached in the Joint Appendix as Exhibit 29 is a copy of the Small Business Ad-
ministration’s Form 2483, as revised in June 2020, which is available to the public at
https://home.treasury.gov/system/files/136/PPP-Borrower-Application-Form-Revised-June2020.pdf [https://perma.cc/73TQ-A6V7] and subject to judicial notice.
34.
Attached in the Joint Appendix as Exhibit 30 is a copy of a report prepared by
Alvarez & Marsal titled “Paycheck Protection Program Assessment” and dated June 11, 2020.
The report is quoted in paragraphs 176 and 177 and incorporated by reference by paragraphs 21,
23, 176, and 177 of the Complaint.
35.
Attached in the Joint Appendix as Exhibit 31 is a copy of an instant message con-
versation between B. Simpson, E. Blackburn, and others dated July 16, 2020. The thread is incorporated by reference by and quoted in paragraphs 12, 149, and 150 of the Complaint.
36.
Attached in the Joint Appendix as Exhibit 32 is a copy of a text message thread
between R. Frohwein and S. Robinson dated July 17, 2020. The thread is incorporated by reference by and quoted in paragraphs 12, 221, and 222 of Complaint.
37.
Attached in the Joint Appendix as Exhibit 33 is a copy of a text message thread
between R. Frohwein, S. Robinson, and S. Taussig dated July 23, 2020. The thread is incorporated
by reference by and quoted in paragraphs 25, 193, and 199 of the Complaint.
38.
Attached in the Joint Appendix as Exhibit 34 is a copy of an email from O. Bham-
bani to L. Chu dated July 26, 2020 that is incorporated by reference by and quoted in paragraph 225
of the Complaint.
A00008
Case 25-52372-CTG
39.
Doc 97-1
Filed 04/09/26
Page 10 of 162
Attached in the Joint Appendix as Exhibit 35 is a copy of an Enterprise Bank Se-
crecy Act / Anti-Money Laundering and Office of Foreign Assets Control Policy adopted by Kabbage, Inc., dated July 29, 2020, and incorporated by reference by paragraphs 82–86 of the Complaint.
40.
Attached in the Joint Appendix as Exhibit 36 is a copy of an email from R.
Frohwein to N. Hagler and others dated August 4, 2020 that is incorporated by reference by and
quoted in paragraph 226 of the Complaint.
41.
Attached in the Joint Appendix as Exhibit 37 is a copy of an email from O. Bham-
bani to R. Frohwein, K. Petralia, and others dated August 10, 2020 that is incorporated by reference
by and quoted in paragraph 242 of the Complaint.
42.
Attached in the Joint Appendix as Exhibit 38 is a copy of an email from S. Askins
to O. Bhambani dated August 11, 2020 that is incorporated by reference by and quoted in paragraph 244 of the Complaint.
43.
Attached in the Joint Appendix as Exhibit 39 is a copy of a report prepared by Duff
& Phelps titled “Solvency Analysis Related to Proposed Distribution” and dated August 11, 2020.
The report is incorporated by reference, quoted, and reproduced in paragraphs 246 and 247 of the
Complaint.
44.
Attached in the Joint Appendix as Exhibit 40 is a copy of a guidance document
issued by the Department of the Treasury and the Small Business Administration titled “Paycheck
Protection Program Loans Frequently Asked Questions (FAQs),” as it appeared on August 11,
2020. This document is available to the public at https://www.sba.gov/sites/default/files/202008/Final%20PPP%20FAQs%20%28August%2011%2C%202020%29-508.pdf
[https://perma.cc/ETJ4-UPNK] and is subject to judicial notice.
A00009
Case 25-52372-CTG
45.
Doc 97-1
Filed 04/09/26
Page 11 of 162
Attached in the Joint Appendix as Exhibit 41 is a copy of an email from S. Askins
to O. Bhambani dated August 12, 2020 that is incorporated by reference by and quoted in paragraph 245 of the Complaint.
46.
Attached in the Joint Appendix as Exhibit 42 is a copy of an Agreement and Plan
of Merger between American Express Travel Related Services Company, Inc.; Green Acquisition
Merger Sub, Inc.; Kabbage, Inc.; Alpha Kabbage, Inc.; and Fortis Advisors LLC dated August 16,
2020 and incorporated by reference by paragraphs 250–55 of the Complaint.
47.
Attached in the Joint Appendix as Exhibit 43 is a copy of Report GAO-21-117T
of the Government Accountability Office containing a statement by William B. Shear titled
“COVID-19 Loans Lack Controls and Are Susceptible to Fraud” dated October 1, 2020. The
report is available to the public at https://www.gao.gov/assets/gao-21-117t.pdf [https://web.archive.org/web/20260407222221/https://www.gao.gov/assets/gao-21-117t.pdf] and is subject to
judicial notice.
48.
Attached in the Joint Appendix as Exhibit 44 is a copy of a Transition Services
Agreement between Alpha Kabbage, Inc. and Kabbage, Inc. dated October 16, 2020 and that is
part of an integrated and interrelated group of contracts that effectuated the Agreement and Plan
of Merger incorporated by reference by paragraphs 250–55 of the Complaint, and thereby also
incorporated by reference.
49.
Attached in the Joint Appendix as Exhibit 45 is a copy of an Interim Final Rule
titled “Business Loan Program Temporary Changes; Paycheck Protection Program—Additional
Revisions to Loan Forgiveness and Loan Review Procedures Interim Final Rule,” published by
the Small Business Administration on October 19, 2020. The Interim Final Rule is available to
the public at 85 Fed. Reg. 66214 and is subject to judicial notice.
A000010
Case 25-52372-CTG
50.
Doc 97-1
Filed 04/09/26
Page 12 of 162
Attached in the Joint Appendix as Exhibit 46 is a copy of a Letter Agreement be-
tween American Express Kabbage Inc. and Kabbage, Inc., titled “Re: Amendment 2 to the Transition Services Agreement.” The Letter Agreement is dated February 10, 2021 and is part of an
integrated and interrelated group of contracts that effectuated the Agreement and Plan of Merger
incorporated by reference by paragraphs 250–55 of the Complaint, and thereby also incorporated
by reference.
51.
Attached in the Joint Appendix as Exhibit 47 is a copy of a press release by the
Department of Justice titled “First-Ever False Claims Act Settlement Received From Paycheck
Protection Program Lender” and dated September 13, 2022. The press release is available to the
public at https://www.justice.gov/usao-sdtx/pr/first-ever-false-claims-act-settlement-receivedpaycheck-protection-program-lender [https://perma.cc/93ZA-7EP7] and is subject to judicial notice.
52.
Attached in the Joint Appendix as Exhibit 48 is a copy of a letter sent by Repre-
sentative Beth Van Duyne to Isabella Castillas Guzman dated April 19, 2023, which is available
to
the
public
at
https://smallbusiness.house.gov/uploadedfiles/04.19.2023_-_let-
ter_from_bvd_to_admin._guzman_re_covid_fraud_pdf.pdf [https://perma.cc/S2PB-UCYQ] and
is subject to judicial notice.
53.
Attached in the Joint Appendix as Exhibit 49 is a copy of a Congressional hearing
titled “Where Do We Go From Here? Examining A Path Forward to Assess Agencies’ Efforts to
Prevent Improper Payments and Fraud” and held on September 10, 2024. The record of the hearing is available to the public at https://www.congress.gov/118/meeting/house/117616/documents/HHRG-118-GO24-Transcript-20240910.pdf [https://perma.cc/T74D-LG7X] and is subject
to judicial notice.
A00011
Case 25-52372-CTG
54.
Doc 97-1
Filed 04/09/26
Page 13 of 162
Attached in the Joint Appendix as Exhibit 50 is a copy of an order staying discov-
ery entered in United States ex rel. Pietschner v. Petralia, Civil No. 4:21-CV-110 (E.D. Tex. Mar.
19, 2026) as ECF No. 109.
55.
The signatories aver that each foregoing copy, supra ¶¶ 6–54, is true and correct
only to the extent that it is cited in each signatory’s respective brief(s), supra ¶¶ 1–5.
Dated:
April 9, 2026
/s/
Lena Konanova
Lena Konanova
/s/
Daniel A. Mason
Daniel A. Mason
/s/
Rebecca L. Butcher
Rebecca L. Butcher
/s/
Barry J. Pollack
Barry J. Pollack
/s/
Lisa Hertzer Schertler
Lisa Hertzer Schertler
/s/
Ani-Rae Lovell
Ani-Rae Lovell
A00012
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 14 of 162
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 15 of 162
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 16 of 162
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 17 of 162
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 18 of 162
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 19 of 162
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 20 of 162
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 21 of 162
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 22 of 162
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 23 of 162
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 24 of 162
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 25 of 162
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 26 of 162
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 27 of 162
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 28 of 162
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 29 of 162
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 30 of 162
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 31 of 162
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 32 of 162
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 33 of 162
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 34 of 162
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 35 of 162
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 36 of 162
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 37 of 162
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
EXHIBIT 3
Page 38 of 162
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 39 of 162
Independent BSA/AML Audit
Kabbage, Inc.
October 9, 2018
Treliant, LLC:
Constandino Papagiannis, Principal
Prasad Chintamaneni, Senior Advisor
Efren Alba, Director
Kenneth Will, Director
Brian Veber, Consultant
Naila Eisa, Senior Consultant
A00036
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 40 of 162
This page is intentionally left blank
Version: Final
Revised Release Date: October 9, 2018
Classification: Treliant, LLC - Highly Confidential
A00037
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 41 of 162
Contents
Executive Summary ...................................................................................................................................... 1
Background ............................................................................................................................................... 1
Objectives and Scope ................................................................................................................................ 1
Overview of BSA/AML and OFAC Control Environment ...................................................................... 2
BSA/AML Program Elements: Summary, Observations, and Issues ........................................................... 3
Risk Assessment ....................................................................................................................................... 3
Risk Assessment ........................................................................................................................... 3
Program Governance ................................................................................................................................ 3
Program Governance..................................................................................................................... 4
Issue Remediation ......................................................................................................................... 4
System of Internal Controls ...................................................................................................................... 4
Know Your Customer (“KYC”) / Know Your Business (“KYB”)............................................... 5
Office of Foreign Assets Control (OFAC).................................................................................... 5
Transaction Monitoring (“TM”) ................................................................................................... 6
Questionable Activity Reporting (“QAR”) ................................................................................... 6
Section 314(a) and External Requests........................................................................................... 7
Quality Assurance (“QA”) ............................................................................................................ 7
Training ..................................................................................................................................................... 8
Training ......................................................................................................................................... 8
Overall Rating and Rationale ........................................................................................................................ 9
Detailed Findings ........................................................................................................................................ 10
Documentation and Record-keeping for Internal Controls ..................................................................... 11
OFAC Name Screening Tool .................................................................................................................. 11
Formal Quality Assurance/Quality Control Framework......................................................................... 12
Appendix A: List of Documents Reviewed ................................................................................................13
Appendix B: List of Meetings and Walkthroughs ...................................................................................... 19
Version: Final
Revised Release Date: October 9, 2018
Classification: Treliant, LLC - Highly Confidential
A00038
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 42 of 162
Executive Summary
Background
Kabbage, Inc. (the “Company”) is an online financial technology company based in Atlanta, Georgia. The
Company provides access to funding to small businesses through an automated lending platform, using a
technology driven underwriting methodology, drawing decision-making metrics from non-traditional data
sources.
The Company retained the services of Treliant, LLC to conduct a risk-based audit of the design and
effectiveness of its Bank Secrecy Act (“BSA”)/Anti-Money Laundering (“AML”) and Office of Foreign
Assets Control (“OFAC”) Compliance Program (“BSA/AML Program”) in connection with the Kabbage®
Small Business Loan Program, with specific focus on how the Federal Financial Institutions Examination
Council (“FFIEC”) and OFAC requirements and guidance impact the BSA/AML Program at the Company
relative to regulatory requirements and expectations.
Performing an independent audit, either through an internal audit function or external auditors/consultants,
is a key component of a BSA/AML and OFAC compliance framework. Independent audit provides
assurance on the design of the BSA/AML Program and effectiveness of internal controls through a riskbased approach, and evaluates the quality of risk management for all banking operations. The Company
conducts the independent BSA/AML Program audit annually.
The results of this independent audit are to be submitted to the Bank’s BSA/AML Officer. Treliant
performed this independent BSA/AML Program, the scope of which is defined below.
Objectives and Scope
Treliant assessed whether the Company’s BSA/AML and OFAC Program was functioning effectively
through a review of its (i) policies and procedures and their implementation; and (ii)evaluation of the design
and operating effectiveness of internal controls within the BSA/AML and OFAC Program. This included
an assessment of staff awareness and their ability to articulate, understand and demonstrate compliance
with BSA/AML and OFAC requirements. The review encompassed a risk-based assessment of the
Company’s compliance with BSA/AML and OFAC regulation by focusing on the internal control
environment.
Treliant conducted on-site interviews and walk-throughs during the audit planning phase, which provided
information on the Company’s control activities. Information gathered during the planning phase
established the audit scope. Planning activities also involved analysis of the Company’s BSA/AML
Program documents, including the Company’s risk assessment, and a review of prior issues from both
internal and external sources.
The scope of the audit was based on multiple factors, including a review of the Company’s most recent risk
assessment in order to develop an understanding of the Company’s size, complexity, scope of activities,
1|Page
Version: Final
Revised Release Date: October 9, 2018
Classification: Treliant, LLC - Highly Confidential
A00039
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 43 of 162
and risk profile; information obtained in the planning phase; operational risk factors; and industry standards
and leading practices.
The following BSA/AML Program elements were included in this audit:
Program Governance
Risk Assessment
Issue Remediation
Training
Know Your Customer
Questionable Activity Reporting
Office of Foreign Assets Control
Quality Assurance
Section 314(a) and External Requests
Transaction Monitoring
Overview of BSA/AML and OFAC Control Environment
The Company’s core product offering consists of providing access to funding for domestic U.S. small- and
medium-sized businesses (“SMBs”) through the Kabbage® Small Business Loan Program (“Kabbage
Program”). Access to such funding is provided through an online platform (“Platform”), which serves as
the application, underwriting, and servicing platform.
The Kabbage Program is supported by a partnership with Celtic Bank, a Utah-chartered, privately owned
industrial bank. Celtic Bank serves as lender for the Kabbage Program, while the Company serves as
“Program Manager” responsible for marketing, servicing, and collections. The Company’s partnership with
Celtic Bank is governed by a Program Management Agreement (“PMA”) detailing the Company’s
responsibilities to Celtic Bank as the Program Manager. Although the Company does not have any legal or
regulatory requirement to put in place a robust BSA/AML and OFAC control environment, Celtic has
placed responsibility with the Company for a number of compliance-related controls.
The Company is exposed to moderate money laundering inherent risk within the Kabbage Program through
two primary channels: customer risk and geographical risk. Its customer risk stems from having a
proportion of accounts from higher risk entity and industry types, account onboarding being completed
through an online process, and expected growth within the overall customer base. The Company also has a
number of customers operating in geographic areas with known higher risks related to money laundering
and forms of illegal trafficking1. Inherent product risk is relatively low due to the single product offering
currently in place. The Company’s transaction risk is reduced as it does not accept cash or cross-border
payments and loan repayments are typically conducted as domestic Automated Clearing House (“ACH”)
transactions from U.S. financial institutions, commonly as recurring auto-debits.
A key component of the Company’s BSA/AML and OFAC control framework, as required by Celtic Bank,
is a robust screening program. The Company screens potential customers during onboarding, including
OFAC screening, as well as periodically as changes are made to customer accounts and to screening lists.
Initial enhanced due diligence (“EDD”) is performed on all client accounts deemed high risk by the
Company. The Company also conducts transaction monitoring on loan repayments using a set of defined
1
High Intensity Drug Trafficking Areas (HIDTA) and High Intensity Financial Crime Areas (HIFCAs).
2|Page
Version: Final
Revised Release Date: October 9, 2018
Classification: Treliant, LLC - Highly Confidential
A00040
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 44 of 162
rules. Any matches or potentially suspicious activity identified by the Company is required to be reported
to Celtic Bank in the form of a Questionable Activity Report (“QAR”). Celtic Bank will complete any
required investigation and file a Suspicious Activity Report (“SAR”) with the Financial Crimes
Enforcement Network (“FinCEN”), if needed.
The Company’s overall BSA/AML and OFAC compliance framework is governed by a BSA/AML Policy
and a BSA/AML Program Manual. Both documents were created in cooperation with Celtic Bank based
on its own related policies, with approval by Celtic Bank required for the BSA/AML Policy on an annual
basis. The Policy and Program Manual are supported by a set of evolving procedures covering the
Company’s customer and transaction screening processes. Effective implementation of the system of
internal controls and governing documentation is the responsibility of the Company’s Board-appointed
BSA/AML Officer.
BSA/AML Program Elements: Summary, Observations, and
Issues
Risk Assessment
Risk Assessment
The Company outsourced its annual BSA/AML and OFAC risk assessment to an independent, third
party provider2. The 2017 risk assessment, which covered the period from December 31, 2016 to
December 31, 2017, was the inaugural risk assessment for the BSA/AML and OFAC Compliance
Program. The process for the risk assessment is defined by the BSA/AML Policy, and the results of the
risk assessment are provided by the BSA/AML Officer to the Audit Committee of the Board of
Directors of Kabbage for review.
The risk assessment methodology focuses on the inherent money laundering and OFAC-related risks
presented by three areas – customers, products and services, and geographies. The 2017 assessment
concluded that the overall inherent risk rating was Moderate, the control effectiveness was Needs
Improvement, and the residual risk rating was High but Decreasing.
Treliant reviewed the 2017 risk assessment, BSA/AML Policy, and formal approval of the risk
assessment by the Board of Directors. Treliant found the ultimate output of the risk assessment to be
reasonable and aligned to the risk profile of the Company.
Program Governance
2
Promontory Inc.
3|Page
Version: Final
Revised Release Date: October 9, 2018
Classification: Treliant, LLC - Highly Confidential
A00041
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 45 of 162
Program Governance
Oversight of the Company’s BSA/AML and OFAC Compliance Program ultimately falls under the
responsibilities of the Company’s Board of Directors (the “Board”). While compliance reporting is
provided directly to the full Board, the charter for the Board’s Audit Committee was amended in March
2018 to delegate the risk and compliance oversight function to the Audit Committee.
The Company’s Board designates a BSA/AML Officer who is responsible for day-to-day management
of the BSA/AML and OFAC Compliance Program, as well as the Chief Compliance Officer (“CCO”).
The Board also approves the Company’s BSA/AML Policy on an annual basis, reviews the results of
annual independent testing of the BSA/AML and OFAC Compliance Program, and addresses any
compliance issues raised internally or by Celtic Bank.
Treliant reviewed a sample of Board and committee meeting minutes, formal approval documentation
of key BSA/AML documents, formal approval of the BSA/AML Officer and CCO, professional
qualifications of the BSA/AML Officer, BSA/AML and OFAC Compliance Program reporting to the
Board, and the amended charter for the Audit Committee and did not find any material concerns or
issues.
Issue Remediation
The Company maintains a “Kabbage Issue Tracker” to catalogue identified issues related to its
Compliance Program, including BSA/AML and OFAC compliance. The Issue Tracker includes the
source of each issue (e.g., self-identified, external audit, partner bank reviews), a description of the
issue, commentary on remediation work related to the issue, and a “latest status” update for each issue.
The Company shares the Issue Tracker with Celtic Bank to help ensure its overall compliance program,
including BSA/AML and OFAC compliance, meets Celtic Bank’s compliance management standards.
Material issues are also escalated to the Company management and the Board of Directors for review
and resolution.
Treliant reviewed Kabbage’s Issue Tracker, as well as guidance in the BSA/AML Policy on Board and
Management responsibilities for resolving compliance-related issues. While overall tracking appears
to be quite thorough, Treliant found that improvements could be made in detailing the risk and priority
of issues listed in the Tracker, as well as a clearer identification of owner(s) for each identified issue.
Additionally, formal guidance, e.g., issue management procedures, could be added to the Company’s
governing documentation, including specific parameters for the types of issues requiring formal
tracking.
System of Internal Controls
4|Page
Version: Final
Revised Release Date: October 9, 2018
Classification: Treliant, LLC - Highly Confidential
A00042
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 46 of 162
Know Your Customer (“KYC”) / Know Your Business (“KYB”)
The Company collects and verifies the identity of all Program customers at the time of onboarding and
periodically, if changes are made to the customer account, through automated non-documentary
verification via Lexis Nexis. If the identity of an applicant cannot be authenticated or if the applicant
information appears to present fraud or money laundering risk, the Company’s Risk Operations Team
will perform an investigation and either place the application in a pending resolution queue, request
additional information, and/or recommend that a QAR be completed. Enhanced due diligence is
performed on all client accounts deemed high risk by the Company based on the Company’s Customer
Risk Rating (“CRR”) Methodology.
Treliant evaluated the design of the KYC Program, and also conducted sample testing on manually
verified KYC/KYB alerts and high risk customers to assess the effectiveness of internal controls.
Observation: KYC and CRR Documentation and Recordkeeping: Treliant found that although the
KYC and CRR written procedures provide some information about specific steps for the compliance
analysts (“Analysts”) to follow to verify customer identity, they do not specify the level of detail
required for Analyst commentary or documentation within the system of record (Salesforce). In the
samples provided, Analyst comments did not indicate what steps were taken to verify the true identity
of the customer in question, which could lead to inconsistent execution of processes, the inability to
perform quality assurance to ensure control effectiveness, and inadequate record-keeping. Treliant
confirmed, through walkthroughs with the Risk Operations Team, that the process for clearing flags is
well-designed and that the issue is primarily related to documentation and recordkeeping.
Office of Foreign Assets Control (OFAC)
The Company has implemented GIACT, a third party screening tool, to perform OFAC screening for
applicants, customers, employees and vendors. Screening is performed during onboarding, on a
monthly recurring basis for existing customers and when changes are made to customer accounts. Due
to the nature of the origination/disbursement flow, the Company does not perform screening on
transactions. Potential true matches are escalated to Celtic Bank and confirmed true matches are
reported to FinCEN and the Board.
Treliant assessed the design of OFAC Name Screening, and also conducted sample testing on OFAC
high and exact matches to assess the effectiveness of internal controls.
Observation: OFAC Documentation and Recordkeeping: Treliant found that although the
procedures currently in place for OFAC Name Screening provide some specific steps for Analysts to
follow, they do not specify the level of detail required for Analyst commentary within the system of
record. As a result, in general, the Analyst did not provide consistent detailed commentary or review
documentation for the dispositioning of OFAC hits. As a result of incomplete record-keeping, third
parties are unable to fully confirm the correctness or justification for the resolution of OFAC hits.
Observation: OFAC Screening Tool: The Company investigates only exact and high matches and
5|Page
Version: Final
Revised Release Date: October 9, 2018
Classification: Treliant, LLC - Highly Confidential
A00043
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 47 of 162
effectively auto-closes conditional matches. Based on testing results, Treliant found that GIACT may
treat exact Specially Designated National (“SDN”) strong alias names as conditional matches instead
of exact or high matches, by stripping special characters such as apostrophes from entity names. As a
result, the Company may not be able to identify all sanctioned entities in its OFAC screening. Treliant
confirmed, through conversations with the Company, that GIACT is updating its platform to
accommodate special characters by Wednesday, August 29th 2018.
Additional Considerations: Screening Merchants Involved in Transactions: The Kabbage Line of
Credit under the Alibaba.com Pay Later Program allows only U.S. buyers to take a loan at point of sale
on Alibaba.com. Payments are routed through Citibank to U.S. subsidiary of Alibaba who is responsible
for sending those payments to the suppliers (US and non-US) on the Alibaba.com platform. Supplier
names and order numbers from Alibaba transactions are stored within the Company’s systems. While
there may be no regulatory requirement on screening Alibaba suppliers, Treliant recommends that the
Company consider screening supplier names, involved in transactions, to eliminate the possibility of a
SDN name in the set of supplier names captured within the Company’s infrastructure. Note that the
Company’s screening tool (GIACT) only screens the US names from the OFAC list.
Additional Considerations: Screening Third Parties who make Loan Payments: Third parties
making loan payments are not systematically screened. Treliant recommends that all parties (customers
and non-customers) making payments be screened.
Transaction Monitoring (“TM”)
The Company conducts automated transaction monitoring on loan repayments greater than $5,000
using a set of defined rules. Each TM alert automatically creates a ticket which is reviewed and
decisioned by the Risk Operations Team. Any unresolved tickets are escalated to the BSA/AML Officer
and the Compliance Manager. The Company does not allow currency (i.e., cash) transactions, which
mitigates transaction monitoring risk and eliminates the need to file currency transaction reports
(“CTRs”).
Treliant evaluated the design for transaction monitoring and conducted sample testing on cleared alerts
to assess the effectiveness of internal controls.
Observation: TM Documentation and Recordkeeping: Treliant found that although the transaction
monitoring procedures provide steps for Analysts to follow based on the rule triggered, they do not
specify the level of detail required for Analyst commentary within the system of record. As a result, in
the samples reviewed, Analyst comments did not indicate why an alert was cleared (i.e., why or how
the funds in question were verified and risk accepted, or what steps, if any, were taken to perform their
review). During on-site meetings between the Company and Treliant, the Company’s personnel
acknowledged the lack of more complete commentary, and further indicated that the review process
would be enhanced to incorporate more detail.
Questionable Activity Reporting (“QAR”)
Any OFAC matches or potentially suspicious activity identified by the Company during customer
6|Page
Version: Final
Revised Release Date: October 9, 2018
Classification: Treliant, LLC - Highly Confidential
A00044
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 48 of 162
onboarding and ongoing monitoring is required to be reported to Celtic Bank in the form of a QAR.
The Compliance Operations Manager is responsible for this process and for evaluating whether to close
accounts on which it completes multiple QARs. The Company may also close an account at the request
of Celtic Bank. Following the receipt of a QAR, Celtic Bank will complete any required further
investigation and file a Suspicious Activity Report (“SAR”), if needed.
Treliant evaluated the design of the suspicious activity process, the interaction between the Company
and Celtic Bank, and also conducted sample testing on QARs filed by the Company in an effort to
assess the effectiveness of internal controls. No exceptions were identified, and the process was found
to be sufficient.
The Company maintains records for customer account information for the five-year time period
consistent with BSA record-keeping requirements. The BSA/AML Program Manual provides specifies
creation of a QAR within 30 days of the identification of potentially suspicious activity.
Section 314(a) and External Requests
Section 314(a) of the USA Patriot Act requires a financial institution to conduct a one-time search of
its customer and transaction databases upon request by law enforcement in order to identify matches to
subjects on the circulated lists, and to provide a response to FinCEN within 14 days of the notification
date.
The Company’s Compliance Operations Manager is responsible for ensuring compliance with 314(a)
information-sharing requests from Celtic Bank and liaising with the Bank regarding all requests and
results within the timelines prescribed in the BSA/AML Program Manual. Celtic Bank will make the
final determination to FinCEN and file a response.
Treliant evaluated the process by which the Company receives, searches, and responds to 314(a) and
other external requests from Celtic Bank. No exceptions were identified.
Quality Assurance (“QA”)
Currently, the Company maintains a limited QA process. On a quarterly basis, the Company’s
Compliance Operations Manager completes compliance checks on processes included in the Program’s
BSA/AML and OFAC control framework (e.g., Customer Identification Program). The Compliance
Operations Manager also performs monthly reviews of OFAC screening results in response to a request
made by Celtic Bank. Any results of such checks are incorporated into compliance reporting provided
to management and the Company’s Board, as well as regular reporting provided to Celtic Bank on
screening outcomes.
Treliant confirmed through interviews with key the Company Compliance personnel that expanded QA
checks are being considered for both screening/monitoring and vendor management aspects of the
overall Compliance Program as the Program continues to develop and evolve.
7|Page
Version: Final
Revised Release Date: October 9, 2018
Classification: Treliant, LLC - Highly Confidential
A00045
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 49 of 162
Observation: Formal Quality Assurance/Quality Control Framework: The Company’s limited
QA process is not formally documented in any of the existing policy or procedural documents, and the
process is currently completed by one individual within the Compliance Department. The lack of formal
documentation of The Company’s existing checks on internal controls can lead to inconsistent or
incomplete checks, as well as the inability to properly scale such checks as resources or controls expand.
Training
Training
The Company currently uses OnCourse (formerly Banker’s Edge) online training as the primary
method of providing training to its staff. Previously, the Company only provided online BSA/AML and
OFAC training to employees with related responsibilities, but such training is now required for all the
Company employees starting in 2018. Training content is appropriate given the Program’s inherent risk
profile. Online training is supplemented with department-specific and on-the-job targeted training as
needed, including a BSA/AML-focused training annually for employees with front-line BSA/AML
responsibilities. Additionally, the Company provides annual BSA/AML and OFAC training to its
Board of Directors.
Employee online training is tracked through OnCourse’s reporting to ensure all employees complete
training on a timely basis; however, Treliant found that tracking non-online training, such as one-time,
role-specific training courses can be improved through a comprehensive training log that combines the
OnCourse online training report and manually entered line items for non-online training.
Treliant assessed the design of the BSA/AML training program, and also conducted testing using
training data to ensure employees completed training as required and in a timely manner and that
content delivered was comprehensive and effective. No exceptions were identified.
8|Page
Version: Final
Revised Release Date: October 9, 2018
Classification: Treliant, LLC - Highly Confidential
A00046
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 50 of 162
Overall Rating and Rationale
Treliant conducted an assessment of the adequacy and effectiveness of the BSA/AML Program. The results
of this review indicate that the design and/or operating effectiveness of controls provide limited assurance
to mitigate the identified key risks for the activities covered within the scope of this review.
The overall rating for the BSA/AML control environment is Limited Assurance
Treliant considers that the incomplete operational review process documentation is an important weakness
that requires prioritization by the Company to allow for robust independent review of control effectiveness
and ongoing Quality Assurance. Without adequate review documentation, the quality of execution of the
control cannot be fully tested. This weakness affects testing of CIP, EDD, OFAC and transaction
monitoring controls and is considered a systemic gap.
The following table supports the rationale for the overall rating by evaluating each of the BSA/AML
Program elements and describes the degree of assurance that can be placed on the current key controls to
effectively mitigate BSA/AML risk.
Assessment Key3
Reasonable assurance can be placed on the effectiveness of the controls to mitigate the identified risk.
Limited assurance can be placed on the effectiveness of the controls to mitigate the identified risk.
Insufficient assurance can be placed on the effectiveness of the controls to mitigate the identified risk.
BSA/AML
Program
Element
Program
Governance
Risk Assessment
KYC/KYB/CRR
Assessment
Summary of Testing Completed
No exceptions were noted regarding the Program Governance of the
BSA/AML and OFAC Compliance Program. The Company’s Board of
Directors maintains sufficient oversight of the BSA/AML Program through
the Audit Committee of the Board, including regular reporting on key
Compliance items and receiving escalation of material issues.
No exceptions were noted regarding the risk assessment process. The annual
risk assessment, which started with the 2017 Program review and is
completed by an independent third party, is comprehensive and sufficient for
the Kabbage Program.
One exception was noted for the KYC & CRR processes: 1) Analysts do not
provide consistent detailed commentary and documentation in the system of
record to indicate what steps were taken to verify the true identity of the
customer in question.
9|Page
Version: Final
Revised Release Date: October 9, 2018
Classification: Treliant, LLC - Highly Confidential
A00047
Case 25-52372-CTG
BSA/AML
Program
Element
Assessment
OFAC
Transaction
Monitoring
Questionable
Activity
Reporting
Section 314(a)
Issue
Management
Quality
Assurance
Training
Doc 97-1
Filed 04/09/26
Page 51 of 162
Summary of Testing Completed
Two exceptions were noted regarding the OFAC name screening process: 1)
Analysts do not provide consistent detailed commentary and documentation
in the system of record for the dispositioning of OFAC alerts, 2) the Company
may not be able to identify all sanctioned individuals in its OFAC screening
due to platform limitations of their screening tool, GIACT.
One exception was noted regarding the Transaction Monitoring process: 1)
Analysts do not provide consistent detailed commentary and documentation
in the system of record for the dispositioning of TM alerts.
No exceptions were noted regarding the questionable activity reporting
process. The process is well-designed, and the interaction between the
Company and Celtic Bank is appropriate. Sample testing of QARs filed by
the Company revealed no material errors which would require
correction/amendment.
No exceptions were noted in the design or operating effectiveness of controls
related to 314(a)
No exceptions were noted regarding the issue management process. All issues
related to the BSA/AML and OFAC Compliance Program, including all
issues relating to meeting Celtic Bank’s compliance standards, were tracked
and managed by the Company’s Compliance personnel. Issues are escalated
to the Board and Celtic Bank, as required.
Quality Assurance on the Company’s overall screening and monitoring
processes and output is limited, as no formal QA process within Compliance
is currently in place.
The Bank utilizes OnCourse for training materials for its employees, which
the audit team determined was appropriate given the Bank’s risk profile.
There were no detected instances in which a training was not provided to
employees as intended.
Treliant would like to extend our appreciation to the Company’s Risk and Compliance teams for their
assistance and cooperation during this Review.
Detailed Findings
10 | P a g e
Version: Final
Revised Release Date: October 9, 2018
Classification: Treliant, LLC - Highly Confidential
A00048
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 52 of 162
Documentation and Record-keeping for Internal Controls
Control Category:
KYC/CRR, OFAC, TM
Issue Rating: Medium
Risk
Company Remediation
Efforts
Issue Description
The audit review for the BSA/AML Program found that although
Procedures provide some steps for Analysts to follow to verify customer
identity and clear alerts, they do not specify the level of detail required for
Analyst commentary and documentation within the system of record. As a
result, in most of the samples reviewed for KYC/KYB, OFAC Screening,
TM, and CRR, the Analyst comments did not indicate why an OFAC or
TM alert was cleared or why a KYC/KYB or CRR flagged customer was
verified and what steps were taken to perform their review. Inadequate
record-keeping measures may lead to inconsistent and inaccurate execution
of processes and a reduced ability to perform independent assessment and
quality assurance to ensure control effectiveness. Treliant confirmed,
through walkthroughs with the Risk Operations Team, that the process for
clearing flags is well-designed and that the issue is primarily related to
documentation and recordkeeping.
During on-site meetings between the Company and Treliant on July ___,
2018, the Company personnel acknowledged the lack of more complete
commentary, and further indicated that the review process would be altered
to incorporate more detail.
OFAC Name Screening Tool
11 | P a g e
Version: Final
Revised Release Date: October 9, 2018
Classification: Treliant, LLC - Highly Confidential
A00049
Case 25-52372-CTG
Control Category:
OFAC Screening
Issue Rating: Medium
Risk
Company Remediation
Efforts
Doc 97-1
Filed 04/09/26
Page 53 of 162
Issue Description
The audit team performed testing on OFAC Name Screening and found
four exact SDN strong alias names that were not alerted for review per the
BSA/AML Policy. Based on testing results, Treliant found that GIACT, the
third party name screening tool used for the Kabbage Program, may treat
exact SDN strong alias names as conditional matches instead of exact or
high matches, by stripping special characters such as apostrophes from
party names. As a result, the Company may not be able to identify all
sanctioned individuals in its OFAC screening as the Company investigates
only exact and high matches and effectively auto-closes conditional
matches.
Treliant confirmed, through conversations with the Company, that GIACT
updated its platform to accommodate special characters on September 10,
2018.
Formal Quality Assurance/Quality Control Framework
12 | P a g e
Version: Final
Revised Release Date: October 9, 2018
Classification: Treliant, LLC - Highly Confidential
A00050
Case 25-52372-CTG
Control Category:
Quality Assurance
Issue Rating: Low Risk
Company Remediation
Efforts
Doc 97-1
Filed 04/09/26
Page 54 of 162
Issue Description
The audit review for the s BSA/AML Program found that a formal QA/QC
framework is not yet in place across all monitoring and screening processes.
Although the Manager, Compliance Operations currently performs periodic
checks on compliance control outputs, including a check on OFAC
screening decisions, these checks are not yet formalized through
documented procedures and a defined QA/QC function across the entire
BSA/AML and OFAC Compliance Program.
During on-site meetings between the Company and Treliant in July 2018,
the Company personnel acknowledged the lack of a complete formal QA
framework, and further indicated that they expected the current compliance
checks related to BSA/AML and OFAC compliance to evolve as the
BSA/AML Program matures.
Appendix A: List of Documents Reviewed
13 | P a g e
Version: Final
Revised Release Date: October 9, 2018
Classification: Treliant, LLC - Highly Confidential
A00051
Case 25-52372-CTG
#
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
Doc 97-1
Filed 04/09/26
Page 55 of 162
Document Name
1. Customer Risk Rating Procedures (FINAL 7.20.18).docx
1. Customer_Risk_Rating_Procedures (FINAL 6.22.18).docx
10-17 DRAFT Kabbage BSA AML Program Manual (AH Draft 6.28.18).docx
19 Compliance Training Policy Notes Rev 20180627.docx
1-Kabbage - 2017 BSA AML and OFAC Risk Assessment (FINAL)(March 2018).docx
2. Transaction_Monitoring_Procedures (FINAL 6.22.18).docx
2. Transaction_Monitoring_Procedures (FINAL 6.23.18).docx
21 Banker's Edge Course Summary 20171226 Final.xls
22 Training Course Catalog.docx
23 Board - Compliance Training (FINAL 11.6.17).pptx
24 26 Compliance Enhancements Project (6.26.18).xlsx
24 26 Kabbage Issues Report 20180625.xlsx
2-BSA-AML Policy 20160720.docx
3. Know Your Customer Procedures (FINAL 7.20.18).docx
4 BSA Org Chart.docx
4 BSA_AML Reporting Structure for Risk.xls
4. OFAC Screen Procedures (FINAL 8.13.18).docx
5 Kabbage Board Minutes Credit Committee 2-7-18.pdf
6 Kabbage - 2017 BSA AML and OFAC Risk Assessment Exec Summary (FINAL)(March 2018).docx
6 Kabbage - 2017 ID Theft Red Flags Risk Assessment Executive Summary (FINAL)(March 2018).pptx
6 Kabbage - Board Consent (Regulatory Policies Risk Assessments) (FINAL)(March 2018)[1].pdf
6 Legal Compliance Policy Board Deck (April 2018)(FINAL).pptx
7-20 Test File for Auditors.xlsx
Board of Directors Meeting Attendance Sheet 11-15-2017 (1).docx
Compliance Issues Log 2018 Treliant.xlsx
Compliance Reporting Slide for 7.25.18 Board Meeting.pptx
Compliance excerpts from Program Management Agreement with Celtic.docx
confirmation of july meeting minutes.pdf
CRR Screenshots for Treliant 09.11.2018 (1).docx
CRR_Accounts_2018.xlsx
Desktop Procedures for Know Your Customer (7.18.18).docx
IDVerified in June (1).xlsx
Kabbage - BSA AML Policy KBG Board Approved 20180406 (002).docx
Kabbage - Code of Conduct KBG Board Approved 20180406.pdf
Kabbage - Proposed Resolutions of Board - July 26, 2017_Redacted.pdf
Kabbage AML Training Discussion Deck (as of 11-30-17)[1].pdf
KBGQuals 201806.xlsx
KYB_KYC Procedures.docx
KYBKYC - Step by Step Salesforce Instructions for working URS Team Queue[1].docx
KYC_ KYB 7-62 Treliant 8.29.2018.docx
14 | P a g e
Version: Final
Revised Release Date: October 9, 2018
Classification: Treliant, LLC - Highly Confidential
A00052
Case 25-52372-CTG
#
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
Doc 97-1
Filed 04/09/26
Page 56 of 162
Document Name
KYC_ KYB screenshots #63- 107 Treliant 08.29.2018.docx
Loan Funding Flowchart.pdf
OFAC Screenshots for Treliant 09.12.2018.docx
On Course AML for Customer Service Representatives.pdf
On Course Bank Secrecy Act for Customer Service Representatives.pdf
Re KYCKYB Initial Questions - Kabbage.msg
Request#8 08.16.2018.docx
Securitization Structure for Treliant.docx
Suspicious Activity Template.xlsx
TM screenshots for treliant (1).docx
TM screenshots for treliant UPDATED.docx
Transaction Monitoring 08.21.2018 (1).xlsx
Transaction Testing - CRR Template (FINAL 7.20.18).docx
Treliant Follow-up Questions (SH 8.8.18).docx
Treliant Preliminary Observations (AH Draft 8.30.18).docx
Updated App Screenshots.docx
Clinton Thorson v.2.xlsx
Clinton Thorson.xlsx
ClintonT Affidavit.pdf
ClintonT Police.pdf
Herb Bennett QAR.xlsx
Larry Sandlin v.2.xlsx
Larry Sandlin.xlsx
LarryS Affidavit.pdf
LarryS Police.pdf
policereport - herb QAR.pdf
QAR-Larry Clark P&A.PDF
QAR-Larry Clark.xlsx
Robert Makhani v.2.xlsx
Robert Makhani.xlsx
RobertM Affidavit.pdf
RobertM Police.pdf
William Barnes Affidavit and Police Report.pdf
William Barnes QAR 20180606.xlsx
2017-07-03 FinCEN 314a Business List.csv
2017-07-03 FinCEN 314a Business List.xls
2017-07-03 FinCEN 314a Personal List.csv
2017-07-03 FinCEN 314a Personal List.xls
2017-07-18 FinCEN 314a Business List.csv
15 | P a g e
Version: Final
Revised Release Date: October 9, 2018
Classification: Treliant, LLC - Highly Confidential
A00053
Case 25-52372-CTG
#
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
Doc 97-1
Filed 04/09/26
Page 57 of 162
Document Name
2017-07-18 FinCEN 314a Business List.xls
2017-07-18 FinCEN 314a Personal List.csv
2017-07-18 FinCEN 314a Personal List.xls
2017-08-01 FinCEN 314a Business List.csv
2017-08-01 FinCEN 314a Business List.xls
2017-08-01 FinCEN 314a Personal List.csv
2017-08-01 FinCEN 314a Personal List.xls
2017-08-15 FinCEN 314a Business List.csv
2017-08-15 FinCEN 314a Business List.xls
2017-08-15 FinCEN 314a Personal List.csv
2017-08-15 FinCEN 314a Personal List.xls
2017-08-29 FinCEN 314a Business List.csv
2017-08-29 FinCEN 314a Business List.xlsx
2017-08-29 FinCEN 314a Personal List.csv
2017-08-29 FinCEN 314a Personal List.xls
2017-09-12 FinCEN 314a Business List.csv
2017-09-12 FinCEN 314a Business List.xls
2017-09-12 FinCEN 314a Personal List.csv
2017-09-12 FinCEN 314a Personal List.xls
2017-09-26 FinCEN 314a Business List.csv
2017-09-26 FinCEN 314a Business List.xls
2017-09-26 FinCEN 314a Personal List.csv
2017-09-26 FinCEN 314a Personal List.xls
2017-10-10 FinCEN 314a Both Lists.csv
2017-10-10 FinCEN 314a Both Lists.xls
2017-10-24 FinCEN 314a Business List - PROCESSED 2017-10-31.csv
2017-10-24 FinCEN 314a Personal List - PROCESSED 2017-10-31.csv
2017-11-07 FinCEN 314a Business List - PROCESSED 2017-11-16.xls
2017-11-07 FinCEN 314a Personal List - PROCESSED 2017-11-16.xls
2017-11-21 FinCEN 314a Business List - PROCESSED 2017-11-28.csv
2017-11-21 FinCEN 314a Personal List - PROCESSED 2017-11-28.csv
2017-12-05 FinCEN 314a Business List - PROCESSED 2017-12-08.csv
2017-12-05 FinCEN 314a Personal List - PROCESSED 2017-12-08.csv
2017-12-19 FinCEN 314a Business List - PROCESSED 2017-12-20.csv
2017-12-19 FinCEN 314a Personal List - PROCESSED 2017-12-20.csv
2018-01-02 FinCEN 314a Business List - PROCESSED 2018-01-10.csv
2018-01-02 FinCEN 314a Personal List - PROCESSED 2018-01-10.csv
2018-01-16 FinCEN 314a Business List - PROCESSED 2018-01-19.csv
2018-01-16 FinCEN 314a Personal List - PROCESSED 2018-01-19.csv
16 | P a g e
Version: Final
Revised Release Date: October 9, 2018
Classification: Treliant, LLC - Highly Confidential
A00054
Case 25-52372-CTG
#
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
Doc 97-1
Filed 04/09/26
Page 58 of 162
Document Name
2018-01-30 FinCEN 314a Business List - PROCESSED 2018-02-06.xlsx
2018-01-30 FinCEN 314a Personal List - PROCESSED 2018-02-06.xlsx
2018-02-13 FinCEN 314a Business List - PROCESSED 2018-02-14.csv
2018-02-13 FinCEN 314a Business List - PROCESSED 2018-02-14.xlsx
2018-02-13 FinCEN 314a Personal List - PROCESSED 2018-02-14.csv
2018-02-27 FinCEN 314a Business List - PROCESSED 2018-03-19.csv
2018-02-27 FinCEN 314a Business List - PROCESSED 2018-03-19.xlsx
2018-02-27 FinCEN 314a Personal List - PROCESSED 2018-03-19.csv
2018-02-27 FinCEN 314a Personal List - PROCESSED 2018-03-19.xlsx
2018-03-27 FinCEN 314a Business List - PROCESSED 2018-03-29.xlsx
2018-03-27 FinCEN 314a Personal List - PROCESSED 2018-03-29.xlsx
2018-04-10 FinCEN 314a Business List - PROCESSED 2018-04-11.xls
2018-04-10 FinCEN 314a Personal List - PROCESSED 2018-04-11.xlsx
2018-04-24 FinCEN 314a Business List - PROCESSED 2018-04-25.xlsx
2018-04-24 FinCEN 314a Business List - PROCESSED 2018-04-26.xls
2018-04-24 FinCEN 314a Personal List - PROCESSED 2018-04-26.xlsx
2018-05-08 FinCEN 314a Business List - PROCESSED 2018-05-17.xlsx
2018-05-08 FinCEN 314a Personal List - PROCESSED 2018-05-17.xlsx
2018-06-05 FinCEN 314a Business List - PROCESSED 2018-06-11.xlsx
2018-06-05 FinCEN 314a Personal List - PROCESSED 2018-06-11.xlsx
2018-06-19 FinCEN 314a Business List - PROCESSED 2018-06-20.xlsx
2018-06-19 FinCEN 314a Personal List - PROCESSED 2018-06-20.xlsx
Re- Kabbage - SPECIAL POST FinCEN 314a list for 03-19-2018.eml
Amazon CloudFront Service Level Agreement.docx
Amazon Compute Service Level Agreement.docx
Amazon DynamoDB Service Level Agreement.docx
Amazon RDS Service Level Agreement.docx
Amazon Route 53 Service Level Agreement.docx
Amazon S3 Service Level Agreement.docx
AWS Shield Advanced Service Level Agreement.docx
CoreCard SLA.pdf
GIACT SLA.pdf
MARQETA SLA.pdf
Socure SLA.jpg
Threatmetrix SLA.pdf
URS SLA - Fraud Investigation.pdf
URS SLA - Industry Code Verification.png
URS SLA - Manual Underwriting.docx
Vendors without SLA on File.docx
17 | P a g e
Version: Final
Revised Release Date: October 9, 2018
Classification: Treliant, LLC - Highly Confidential
A00055
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 59 of 162
18 | P a g e
Version: Final
Revised Release Date: October 9, 2018
Classification: Treliant, LLC - Highly Confidential
A00056
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 60 of 162
Appendix B: List of Meetings and Walkthroughs
#
Date of
Meeting
Meeting Details
1
7/16/2018
2
7/16/2018
Product Demo
Azba Habib, BSA/AML Officer;
Sunita Hall, Compliance Analyst;
Amanda Hurtt, Business Development Project Manager
Cash Flow Walkthrough
Nan Siler, Head of Financial Operations
3
7/16/2018
Compliance Program
Scott Askins, Chief Compliance Officer
4
7/16/2018
KYC/KYB/EDD/Transaction Monitoring
Brad Elsinger, Risk Analyst
5
7/16/2018
Compliance Operations Walkthrough
Kristina Nelson, Manager, Compliance Operations
6
7/16/2018
Capital Markets
Deepesh Jain, Head of Capital Markets
7
7/17/2018
OFAC Screening
Michael Gibson, Risk Analyst
8
7/17/2018
Fraud and Underwriting Walkthrough
Yaakov Erlichman, VP Underwriting and Fraud Strategy
9
7/17/2018
10
7/17/2018
11
7/18/2018
On-Site Follow-Up
Kristina Nelson, Manager, Compliance Operations
8/14/2018
Project Status Follow-Up
Azba Habib, BSA/AML Officer;
Sunita Hall, Compliance Analyst
8/22/2018
Testing Population Walkthrough
Azba Habib, BSA/AML Officer;
Sunita Hall, Compliance Analyst
9/6/2018
Transaction Monitoring Walkthrough
Sunita Hall, Compliance Analyst;
Courtney Kirkpatrick, Risk Analyst
9/13/2018
CRR and OFAC Walkthrough
Sunita Hall, Compliance Analyst;
Brad Elsinger, Risk Analyst;
Michael Gibson, Risk Analyst
12
13
14
15
Screening Ticket Risk Walkthrough
Azba Habib, BSA/AML Officer;
Courtney Kirkpatrick, Risk Analyst
On-Site Follow-Up
Azba Habib, BSA/AML Officer;
Sunita Hall, Compliance Analyst
19 | P a g e
Version: Final
Revised Release Date: October 9, 2018
Classification: Treliant, LLC - Highly Confidential
A00057
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 61 of 162
20 | P a g e
Version: Final
Revised Release Date: October 9, 2018
Classification: Treliant, LLC - Highly Confidential
A00058
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
EXHIBIT 4
Page 62 of 162
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 63 of 162
UNITED STATES OF AMERICA
ENTERPRISE BANK SECRECY ACT/ ANTI-MONEY LAUNDERING
AND OFFICE OF FOREIGN ASSETS CONTROL POLICY
Approval Date: July 24, 2019
Effective Date: July 24, 2019
A00059
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 64 of 162
Enterprise BSA/AML and OFAC Policy
As of 7/24/19
Table of Contents
1.
Introduction............................................................................................................................................2
A.
B.
C.
D.
E.
Purpose.................................................................................................................................................2
Responsibility and Training.........................................................................................................3
Scope......................................................................................................................................................3
Consequences of Non-Compliance............................................................................................3
Key Terms............................................................................................................................................4
2.
Policy Objectives...................................................................................................................................4
3.
Governance, Organizational Structure, and Authority........................................................ 5
A. BSA/AML Programs for Non-Regulated Institutions....................................................... 5
B. Roles and Responsibilities............................................................................................................6
4.
BSA/AML Policy Requirements.....................................................................................................8
A. Designation of BSA/AML Officer and Governance Structure........................................9
B. Internal Controls...............................................................................................................................9
I.
BSA/AML Risk Assessment..................................................................................................9
II. Know Your Customer Program........................................................................................10
III. OFAC Compliance and Name Screening.......................................................................12
IV. Transaction Monitoring...................................................................................................... 14
V. Referrals for Potentially Suspicious Activity............................................................. 14
VI. Mechanisms to Monitor On-going Compliance.........................................................15
VII. Additional BSA/AML Program Considerations........................................................ 16
C. Training..............................................................................................................................................16
D. Independent Testing....................................................................................................................16
E. Risk-Based Controls......................................................................................................................17
5.
BSA/AML Policy Administration................................................................................................17
A. Record Retention and Record Keeping................................................................................17
B. Version Control Management...................................................................................................17
Confidential – BSA/AML Policy
1
A00060
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 65 of 162
Enterprise BSA/AML and OFAC Policy
As of 7/24/19
1. INTRODUCTION
A. PURPOSE
Title III of the Uniting and Strengthening America by Providing Appropriate Tools Required to
Intercept and Obstruct Terrorism Act of 2001 (“USA PATRIOT Act”), the Bank Secrecy Act (“BSA”),
and Office of Foreign Assets Control (“OFAC”) regulations each require compliance with applicable
anti-money laundering (“AML”) and sanctions regulations.
This document contains the Enterprise BSA/AML and OFAC Policy (the “Policy”) for complying with
the BSA and all other relevant statutes relating to money laundering and sanctions, as implemented
by Kabbage, Inc. and Kabbage Payments, LLC (collectively, “Kabbage” or the “Company”) in
connection with both (1) Celtic Bank Corporation’s (“Celtic Bank”) Kabbage small business loan
program, and (2) Kabbage’s role as a payment facilitator and its offering of payment processing
services to its customers through its relationship with Worldpay, LLC (“Processor”) and its
sponsorship by Fifth Third Bank (“Sponsoring Bank”), (collectively, hereafter the “Offerings”), as
well as compliance obligations of Kabbage more generally.
This Policy establishes the enterprise-level policy by which the Offerings comply with applicable
BSA/AML, counter-terrorist financing, and sanctions1 laws and regulations. The Policy sets out how
the Offerings meet guidelines developed by regulators and other government agencies to control,
monitor, detect, prevent, and report possible money laundering, terrorist financing, and other
financial crimes and to screen, prohibit, reject, or block transactions for sanctions violations.
Kabbage is not a “financial institution” (as defined in the BSA at 31 U.S. Code § 5312) and therefore
is not required by law to implement a BSA/AML program. However, Kabbage has made a
commitment to implement an effective BSA/AML program (“BSA/AML Program”) that supports its
contractual obligations to comply with regulations as described in its agreements with Celtic Bank,
Sponsoring Bank, and Processor, including regulations relating to Know Your Customer/Know Your
Business (collectively, “KYC”) requirements and Customer Identification Programs (“CIP”),
transaction monitoring, referrals of potentially suspicious activity, and a comprehensive sanctions
screening process. To operationalize these elements of the BSA/AML Program, Kabbage has
developed a separate BSA/AML Program Manual (“BSA/AML Program Manual”). The BSA/AML
Program Manual is a living operational document and is periodically revised to reflect the
Company’s operational procedures.
Kabbage, its management, and its Board of Directors (the “Board”) are committed to deterring users
and outside parties from using the Offerings as a conduit for illegal activity. This Policy has been
designed to provide the framework for effective compliance with BSA/AML laws and regulations, as
well as to communicate a clear commitment to creating a strong compliance culture for the
Company’s employees. The separate BSA/AML Program Manual includes the detailed information
related to the specific requirements and procedures outlined in this Policy.
The Board and management recognize that there are sanctions risks associated with the Offerings
that may expose Kabbage, Celtic Bank, Sponsoring Bank, and Processor to some inherent BSA/AML
compliance risk. As a result, the Board and management recognize that Kabbage needs
commensurate BSA/AML controls for the Offerings.
1
Hereafter collectively referred to as “BSA/AML,” for simplicity.
Confidential – BSA/AML Policy
2
A00061
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 66 of 162
Enterprise BSA/AML and OFAC Policy
As of 7/24/19
B. RESPONSIBILITY AND TRAINING
This Policy is established to govern the BSA/AML Program upon review by Processor and approval
by Celtic Bank and the Board and is reviewed annually by one or more qualified Kabbage
compliance professionals (“Compliance”) and the Chief Compliance Officer (“CCO”) to determine
any necessary updates resulting from changes in applicable laws, regulations or rules, industry
landscape, product offerings, and/or Kabbage or Celtic Bank processes. In the event there are no
material changes to this Policy, Compliance will notify the Board, or a committee to which Board
has delegated authority for the Policy (“Board Committee”), that there are no material changes for
consideration, in lieu of providing the full Policy document to the Board. However, if there are
material changes, Compliance will provide the full policy document reflecting the recommended
changes to the Board, or appropriate Board Committee, for approval.
The BSA/AML Officer oversees and administers this Policy and may make recommendations of
material changes to the Policy. This responsibility may be transferred to a designated
representative to the extent deemed appropriate by the BSA/AML Officer.
Kabbage personnel will be trained on this Policy in accordance with the Compliance Training Policy.
No part of this Policy or its supporting procedures should be interpreted as contravening or
superseding other applicable legal and regulatory requirements imposed upon Kabbage or the
Offerings. Any conflicts between this Policy and Kabbage’s other applicable legal and regulatory
requirements must be submitted immediately to the BSA/AML Officer for further evaluation. If
necessary, the BSA/AML Officer will consult outside legal counsel.
Any exceptions to this Policy must be approved by the BSA/AML Officer. Questions or suggestions
about this Policy should be sent to the BSA/AML Officer, or designee.
C. SCOPE
This Policy applies to the Offerings and to all Kabbage personnel (i.e., management, Board
members, and employees) performing services related to the Offerings.
D. CONSEQUENCES OF NON-COMPLIANCE
Non-compliance can expose Kabbage, Celtic Bank, Sponsoring Bank, and Processor to substantial
risk. All Kabbage personnel are responsible for understanding this Policy and carrying out any
specific BSA/AML responsibilities assigned to them.
Non-compliance with, or violation of, the Policy’s requirements may result in:
Disciplinary action, up to and including termination in appropriate cases; and/or
Individual and/or company civil and/or criminal penalties.
Willful blindness, or “turning a blind eye,” to a potential BSA/AML violation can expose Kabbage,
Celtic Bank, Sponsoring Bank, and/or Processor to potential liability.
E. KEY TERMS
Money laundering is generally defined as the process by which persons attempt to conceal and
disguise the true origin and ownership of illegal funds. Money laundering is generally viewed as a
three-stage process: placement, layering, and integration:
Confidential – BSA/AML Policy
3
A00062
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 67 of 162
Enterprise BSA/AML and OFAC Policy
As of 7/24/19
Placement is the introduction of unlawful proceeds into the financial system without
attracting the attention of financial institutions or law enforcement;
Layering is the movement of funds around the financial system to disguise their origin and
complicate the paper trail; and
Integration is the incorporation of unlawful proceeds into the financial system to convert
illicit funds into apparently legitimate business earnings and acquire wealth.
Terrorist financing is generally defined as the process by which terrorists and/or terrorist
organizations raise funds through the abuse of financial products. While money laundering is the
process by which funds raised from criminal activities are made to look legitimate for reintegration into the financial system, terrorist financing differs in that it typically concerns what the
funds are to be used for, rather than from where they come.
Sanctions are restrictions against doing business with individuals, entities, or countries. OFAC, as
part of the U.S. Department of the Treasury, is responsible for administering and enforcing
economic and trade sanctions based on U.S. Government requirements to support foreign policy
and national security goals. U.S. persons (a term that includes individuals and entities) are
prohibited from engaging in most transactions with these countries and certain individuals and
entities (“Specifically Designated Nationals” or “SDNs”). OFAC maintains an up-to-date list of SDNs (
“SDN List”).
If a U.S. entity receives a payment from, or is asked to make a payment to, any SDN or restricted
country, for whatever purpose, the entity is required to stop the payment, block or reject the
proceeds, and report the transaction to OFAC within 10 business days.
2. POLICY OBJECTIVES
This Policy seeks to protect the Offerings from being used by individuals and entities engaging in
money laundering, terrorist financing, or sanctions avoidance. Specifically, the Policy:
Defines specific roles and responsibilities for BSA/AML compliance;
Creates an AML risk assessment process;
Outlines the BSA/AML internal control process;
Creates a KYC framework that provides for risk-based customer identification, verification,
and due diligence;
Creates a risk-based transaction monitoring and suspicious activity referral process;
Establishes a policy of compliance with all USA PATRIOT Act Section 314(a) information
sharing requests by Celtic Bank or by the Financial Crimes Enforcement Network (
“FinCEN”);
Establishes controls to ensure compliance with OFAC requirements;
Establishes a process to ensure adherence to all applicable compliance requirements,
including filing of reports, responding to information requests, and maintaining records;
Ensures Kabbage documents efforts to meet its legal and contractual obligations;
Provides a training program for all personnel;
Confidential – BSA/AML Policy
4
A00063
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 68 of 162
Enterprise BSA/AML and OFAC Policy
As of 7/24/19
Requires periodic compliance quality assurance and independent testing; and
Requires regular reporting to management and the Board on Kabbage’s BSA/AML efforts.
3. GOVERNANCE, ORGANIZATIONAL STRUCTURE, AND AUTHORITY
Kabbage’s Board appoints the BSA/AML Officer, who is responsible for the execution of this Policy.
The BSA/AML Officer reports directly to the CCO, who is also appointed by the Board. Both the
BSA/AML Officer and the CCO have accountability and access to the Board, as needed.
The BSA/AML Officer is responsible for maintaining sufficient staffing, both in numbers and
qualifications, to implement this Policy effectively and for requesting additional resources from the
Board as needed. Notwithstanding the delegation of the day-to-day activities of BSA/AML
compliance to the BSA/AML Officer, the CCO, and the Board remain responsible for ensuring that
adequate resources are available for the BSA/AML Officer and for the BSA/AML Program.
Every employee of Kabbage has responsibility for ensuring that he or she implements the BSA/AML
Program within his or her sphere of responsibility. The BSA/AML Officer will receive advance
notice of all new products or services, as well as changes to existing products or services that might
affect BSA/AML risk of the Offerings.
All Kabbage personnel are directly accountable to the Company’s BSA/AML Officer for
implementation of this Policy and its associated procedures. The BSA/AML Officer and his/her team
will have unrestricted access to any business records, IT systems, or any other business locations to
which they require access in order to fulfil their responsibilities.
A. BSA/AML PROGRAMS FOR NON-REGULATED INSTITUTIONS
While Kabbage is not a “financial institution” (as defined in the BSA at 31 U.S. Code § 5312) and
therefore is not required by law to implement a BSA/AML program, Kabbage has made a
commitment to implement an effective BSA/AML program that reflects its contractual obligations
as both a service provider and a payment facilitator and is consistent with the contractual and
regulatory expectations of Celtic Bank, Sponsoring Bank, and Processor. This commitment is
demonstrated through:
Setting a clear “tone from the top” about the importance of BSA/AML compliance;
Board and management’s ongoing involvement in oversight of the BSA/AML Program,
including:
o
Review and, where appropriate, approval of key documents such as the Policy and
the BSA/AML risk assessment;
o
Receipt of regular management updates on the performance of the BSA/AML
Program;
o
Receipt of the results of the independent review of the BSA/AML Program;
o
Resolution of escalated issues; and
o
Prompt corrective action to remediate systematic errors or control deficiencies.
Confidential – BSA/AML Policy
5
A00064
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 69 of 162
Enterprise BSA/AML and OFAC Policy
As of 7/24/19
Kabbage has also developed and implemented internal controls to ensure that it identifies inherent
risks within the organization, including those presented by customers, products and services, and
geographies.
As a U.S. company, Kabbage understands that it must comply with OFAC requirements. OFAC
requirements hold that all U.S. persons2, including U.S. banks, bank holding companies, and nonbank financial institutions, must comply with OFAC’s regulations. The laws and OFAC-issued
regulations apply not only to U.S. entities but also to their foreign branches and in certain
circumstances, foreign subsidiaries.
B. ROLES AND RESPONSIBILITIES
This BSA/AML Policy establishes the following roles and responsibilities:
RESPONSIBLE
PARTY
ROLES & RESPONSIBILITIES
BSA/AML Officer
(Policy Owner)
The BSA/AML Officer owns this Policy and is responsible for:
Developing, implementing and maintaining this Policy’s related
procedures;
Reviewing and refreshing the Policy at least annually, or when
circumstances warrant;
Ensuring Kabbage personnel receive BSA/AML training, and that
Kabbage documents training materials and attendance records;
Ensuring adequate BSA/AML staffing to implement the Policy;
Providing guidance and direction to Kabbage personnel about the
steps they need to take to institute the Policy in their areas of
responsibility;
Conducting an annual risk assessment;
Ensuring the completion of an annual independent test of
Kabbage’s BSA/AML Program;
Monitoring the effectiveness of BSA/AML compliance and taking
corrective action to remedy any deficiencies found;
Reviewing any changes to BSA/AML-related laws, regulations,
guidance, or regulatory expectations and ensuring that Kabbage
implements processes to remain fully in compliance with the
BSA/AML obligations of Celtic Bank, Sponsoring Bank, and
Processor;
Reviewing the BSA/AML implications of any new or changed
products, services, initiatives, or distribution channels, and
advising management and employees on necessary steps to
mitigate BSA/AML risk;
Promptly alerting the Board to any material issues of BSA/AML
All U.S. persons must comply with OFAC regulations, including: all U.S. citizens and permanent resident aliens,
regardless of where they are located; all persons and entities within the United States; and all U.S. incorporated entities
and their foreign branches. In the case of certain programs, such as those regarding Cuba and North Korea, foreign
subsidiaries owned or controlled by U.S. companies also must comply. Certain programs also require foreign persons in
possession of U.S.-origin goods to comply.
2
Confidential – BSA/AML Policy
6
A00065
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 70 of 162
Enterprise BSA/AML and OFAC Policy
As of 7/24/19
Board of Directors
The Board, or a delegated committee thereof, is responsible for:
Chief Compliance
Officer
Promoting and implementing a strong culture of BSA/AML
compliance;
Reviewing the BSA/AML risk assessment for the Offerings;
Reviewing and approving this Policy and any subsequent material
changes to the Policy, prior to submitting to the Board for
approval;
Reviewing the BSA/AML Officer’s periodic reports;
Holding personnel accountable for resolution of BSA/AML
corrective actions;
Ensuring that Kabbage has adequate BSA/AML resources;
Overseeing annual, or more frequent as necessary, compliance
quality assurance, independent control testing, and review of this
Policy and reporting results to the Board; and
As applicable, reviewing feedback from Celtic Bank, Sponsoring
Bank, or Processor relating to the BSA/AML Program and
receiving reports on any remedial action necessary.
All employees of Kabbage with responsibilities impacting the BSA/AML
Program, are responsible for:
Confidential – BSA/AML Policy
Designating a BSA/AML Officer responsible for day-to-day
oversight of BSA/AML compliance at Kabbage;
Reviewing and approving this Policy and any subsequent material
changes to this Policy;
Reviewing Kabbage’s BSA/AML reporting, as appropriate;
Reviewing the annual independent testing of the BSA/AML
Program and any plans for corrective action as necessary;
Addressing any BSA/AML issues escalated to the Board; and
As applicable, reviewing feedback from Celtic Bank, Sponsoring
Bank, or Processor on the BSA/AML Program and receiving
reports on any remedial action necessary.
The CCO is responsible for:
Kabbage
Employees
non-compliance, and instituting and monitoring corrective action;
Providing annual reporting to the Board on the state of BSA/AML
compliance and any significant emerging issues;
As needed, liaising with bank partners on BSA/AML issues; and
Seeking outside legal advice on BSA/AML issues as required.
Promoting a strong culture of BSA/AML compliance;
Knowing their responsibilities under this Policy including the
prohibition on “tipping-off” (i.e., informing the subject of an
investigation or a suspicious activity filing of their status as a
subject), and ensuring they remain in compliance;
Implementing this Policy and its associated procedures within
their areas of responsibility, including designing, implementing
7
A00066
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 71 of 162
Enterprise BSA/AML and OFAC Policy
As of 7/24/19
and maintaining necessary controls;
Identifying BSA/AML compliance weaknesses and promptly
alerting and working with Kabbage’s BSA/AML Officer, or
designee, to take corrective action;
Maintaining systems, controls, and reports used to support
compliance efforts;
Notifying and seeking the approval of the BSA/AML Officer for
any new or modified products, services, initiatives, or distribution
channels;
Reporting unusual activity to the CCO, BSA/AML Officer, or
designee;
Ensuring they complete required BSA/AML training; and
Providing BSA/AML compliance personnel unrestricted access to
any business records, systems or locations necessary to fulfil the
duties described in this Policy and other applicable compliance
policies and procedures.
4. BSA/AML POLICY REQUIREMENTS
This Policy provides a summary of the various procedures and processes Kabbage employs to
comply with both legal requirements and its contractual responsibilities, to establish and maintain
an effective and compliant BSA/AML Program.
It describes the manner in which Kabbage implements the “five pillars” of AML compliance, namely:
A. Designation of a BSA/AML Officer and BSA governance structure;
B. Policies, procedures, and internal controls, which include:
I. A BSA/AML risk assessment process;
II. A risk-based KYC Program, which includes a CIP and customer due diligence (
“CDD”);
III. OFAC screening, review, and reporting;
IV. Transaction monitoring;
V. Referrals of potentially suspicious activity to Celtic Bank or Processor, as
applicable;
VI. Mechanisms designed to monitor on-going compliance; and
VII.
BSA/AML Program controls related to account opening.
C. On-going personnel training and development;
D. Independent testing of the BSA/AML Program; and
E. Risk-based procedures for conducting ongoing customer due diligence.
Confidential – BSA/AML Policy
8
A00067
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 72 of 162
Enterprise BSA/AML and OFAC Policy
As of 7/24/19
A. DESIGNATION OF BSA/AML OFFICER AND GOVERNANCE STRUCTURE
Kabbage’s Board designates the BSA/AML Officer, who has responsibility for day-to-day oversight
of BSA/AML compliance for the Offerings. Section 3 describes the responsibilities of the BSA/AML
Officer and Kabbage’s BSA/AML governance structure.
B. INTERNAL CONTROLS
Kabbage has in place internal BSA/AML controls designed to mitigate risks presented by the
Offerings. Kabbage’s internal controls include those related to customer onboarding, transaction
monitoring, and sanctions screening functions.
I. BSA/AML RISK ASSESSMENT
The BSA/AML Officer conducts an annual risk assessment to identify the inherent BSA/AML and
OFAC risk of the Offerings and the effectiveness of the existing controls.
Consistent with the regulatory obligations of covered financial institutions, the risk assessment
process assigns an inherent risk rating based on an assessment of customers, product and services,
and geographic risks. The BSA/AML Officer then assesses the adequacy of the design and
implementation of mitigating controls to determine the residual risk.3
The BSA/AML risk assessment process forms the foundation of the BSA/AML Program. Using the
results of the BSA/AML risk assessment, the BSA/AML Officer:
Identifies the BSA/AML risk profile of the Offerings;
Determines the adequacy and effectiveness of BSA/AML controls;
Evaluates the adequacy and application of BSA/AML resources;
Identifies the existence of any unmitigated and/or unacceptable BSA/AML risk; and
If necessary, recommends and implements modifications to Kabbage’s activities and/or
Policy (or the underlying procedures and processes) to bring the BSA/AML residual risk of
the Offerings to an acceptable level.
The BSA/AML Officer reports the results of the BSA/AML risk assessment to the Board, including
proposed enhancements to the BSA/AML Program to mitigate any levels of excessive risk or control
weaknesses identified in the risk assessment, for review and approval. The BSA/AML Officer makes
the assessment available to other functions within the organization, including the business (also
referred to as the first line) and any product development functions.
II. KNOW YOUR CUSTOMER PROGRAM
The KYC program (the “KYC Program”) is a fundamental control in preventing the Offerings from
becoming involved in money laundering, terrorist financing, or sanctions violations. The KYC
Program covers all customers.
Customers include any business that (1) qualifies for a line of credit, or (2) opens a merchant
account for the purpose of accepting card payments for the sale of products or services (collectively,
“Account”). Accounts are currently only available to domestic (U.S.) businesses.
3
Refer to the BSA/AML Risk Assessment Methodology for additional details on this process.
Confidential – BSA/AML Policy
9
A00068
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 73 of 162
Enterprise BSA/AML and OFAC Policy
As of 7/24/19
The risk-based KYC processes for the Offerings encompass:
A CIP that allows Kabbage to identify and verify the identity of customers with reasonable
assurance;
A risk-based segmentation of customers; and
A due diligence process that provides a greater depth of insight into certain customers.
Kabbage’s policy is to ensure that it has a reasonable belief that it knows the true identity of all
customers by collecting customer information at Account opening and collecting additional
information, if warranted, depending on customer behavior.
As part of its on-boarding processes, Kabbage is required to collect and verify the identity of its
customers, and does so through non-documentary verification. Kabbage has engaged LexisNexis to
facilitate this function. Kabbage further uses online triangulation of disparate data sources
connected through its unique onboarding process to verify the identity of all customers. The vetting
process for new accounts also includes automated data validation, the use of third-party data
services and, when necessary, manual investigation.
In the event Kabbage is unable to form a reasonable belief that it knows the true identity of the
customer, Kabbage may take the following actions:
Decline to open the Account;
Impose terms under which a customer may draw on its approved credit line while Kabbage
attempts to verify the customer’s identity; or
Close or suspend an Account after attempts to verify a customer’s identity fail.
a. CUSTOMER IDENTIFICATION PROGRAM
For purposes of CIP regulation, all Accounts are considered to be accounts subject to CIP
requirements. Therefore, Kabbage performs CIP on all applicants for an Account. Kabbage collects
CIP information (a) at the time of onboarding, (b) at the time a customer initiates a change in
his/her information on file, and (c) on an ongoing basis thereafter. Kabbage periodically refreshes
CIP information using a risk-based approach. This process is designed to ensure Kabbage is able to
form a reasonable belief that it knows the true identity of each customer and is able to mitigate the
risk of identity theft, money laundering, terrorist financing, and sanctions violations.
b. BENEFICIAL OWNERSHIP REQUIREMENTS FOR LEGAL ENTITY CUSTOMERS
In accordance with FinCEN’s CDD requirements, Kabbage collects and verifies ultimate beneficial
ownership information of legal entity customers at the time a new Account is opened. Legal entity
customers include a corporation, limited liability company (LLC), or other entities that are created
by a filing of a public document with a Secretary of State or similar office, a general partnership, and
any similar business entity formed in the United States or a foreign country. Legal entity customers
do not include sole proprietorships or unincorporated associations. Customers that were Account
holders prior to the effective date of FinCEN’s CDD rule (May 11, 2018) are not subject to the
beneficial ownership verification requirements under the rule.
Kabbage collects, at a minimum, the name, address, date of birth, and social security number (or
passport number or other similar information, in the case of foreign persons) for the following
Confidential – BSA/AML Policy
10
A00069
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 74 of 162
Enterprise BSA/AML and OFAC Policy
As of 7/24/19
individuals, each an ultimate beneficial owner (“UBO”), from the individual opening the Account on
behalf of a legal entity customer:
each individual who, directly or indirectly, owns 25 percent or more of the equity interests
of the legal entity customer (“Owner”); and
an individual who has significant management responsibility for the legal entity customer (
“Control Person”)
Kabbage collects information for up to four Owners and one Control Person. Kabbage further
requires the individual opening the Account on behalf of a legal entity customer to certify as to the
accuracy of the UBO information in a manner substantially similar to the Certification Form
provided by FinCEN.4 Kabbage uses a third-party to verify the UBO information and conducts
enhanced due diligence as necessary. All records related to the identification and verification of the
UBOs are retained consistent with this Policy.
c. CUSTOMER DUE DILIGENCE
The BSA/AML Program requires that CDD be performed on all customers. CDD may include:
information on business and industry type; understanding of the purpose of the loan or transaction;
and a Politically Exposed Person (“PEP”) check.
The BSA/AML Officer, or designee, will file a referral for potentially suspicious activity if Kabbage
identifies such activity in the due diligence processes.
d. HIGH-RISK AND PROHIBITED CUSTOMERS
Kabbage has identified certain types of businesses that pose a higher risk and as a result, require
enhanced due diligence (“EDD”). These include:
Confirmed PEPs or PEP-controlled entities; and
Businesses that are risk rated as “High” through the Customer Risk Rating (“CRR”)
methodology process.
Kabbage has also identified certain types of businesses that pose significant risk and as a result, has
determined that they will not be accepted as customers:
Businesses that are unable to link at least one account from a FinCEN registered money
service business (“MSB”) or financial institution; and
Any business for which Kabbage has made three suspicious activity referrals to Celtic Bank
or Processor, as applicable;
Businesses in the following industries: marijuana, firearms, gambling, financial services,
lending, or non-profit; and
Businesses deemed as prohibited or requiring pre-approval for payment processing
services by the Processor.
Kabbage does not offer access to consumer loans or payment processing services for personal
accounts and therefore, does not have any individual persons as customers.
4
See Appendix A to 31 § CFR 1010.230 – Certification Regarding Beneficial Owners of Legal Entity Customers.
Confidential – BSA/AML Policy
11
A00070
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 75 of 162
Enterprise BSA/AML and OFAC Policy
As of 7/24/19
e. ENHANCED DUE DILIGENCE FOR HIGH-RISK CUSTOMERS
Kabbage utilizes a risk-based methodology to conduct EDD.
Kabbage’s EDD process includes non-documentary means, documentary means, direct contact,
and/or a combination of the foregoing.
A customer risk rating is assigned at the time of onboarding for the purposes of determining the
need for EDD. Once EDD is successfully completed, the relevant documentation is added to the
customer’s profile but the risk level remains the same.
If after an assessment, it is determined that the Account or relationship may pose additional risks,
the Account or relationship will be escalated to the Risk team, and the BSA/AML Officer may be
consulted, to determine whether to open or maintain the Account or relationship.
III. OFAC COMPLIANCE AND NAME SCREENING
As a policy requirement, the BSA/AML Officer ensures that Kabbage complies with the OFAC
requirements to enforce economic and trade sanctions based on U.S. foreign policy and national
security goals.
Kabbage’s policy towards OFAC compliance applies to all parties with which Kabbage does business
including, but not limited to customers, third-party vendors, and Kabbage personnel. The systems
and controls ensure that Kabbage:
Fully incorporates OFAC risk within the BSA/AML risk assessment;
Screens all customers, vendors, and personnel against the SDN List;
Updates OFAC and other applicable lists in a timely fashion when sanctions programs
and/or the SDN List changes and screens existing customers, vendors, and personnel
against changes to the list on a recurring basis;
Blocks internet protocol addresses of countries subject to comprehensive OFAC sanctions,
and any countries subject to narrower OFAC sanctions where the BSA/AML Officer or
designee deems that internet protocol blocking is necessary to mitigate the risk of a
sanctions violation;
Works with its bank partners, Celtic Bank and Sponsoring Bank, and Processor to resolve
any sanctions concerns;
Prevents all customers under review for a potential OFAC hit from conducting transactions;5
and
Documents rationales for clearing all false-positive OFAC hits.
a. OFAC LIST NAME SCREENING
In order to conduct a timely and orderly screening of customers, Kabbage utilizes GIACT, a thirdparty service provider, which screens against OFAC and other sanctions lists to ensure adequate
coverage and risk mitigation for the OFAC screening process.
5
With regard to the Kabbage Small Business Loan Program, because the Account relationship is between Celtic Bank and
the borrower (i.e., Kabbage does not own the Account and therefore cannot block or maintain property), Kabbage does
not have reporting requirements to OFAC related to blocked or rejected property. Kabbage would, however, cease from
disbursing any additional loan proceeds.
Confidential – BSA/AML Policy
12
A00071
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 76 of 162
Enterprise BSA/AML and OFAC Policy
As of 7/24/19
The OFAC screening process includes the following elements:
Name of customer;
Name of the business representative; and
Name of the UBO(s).
For Offerings, names are screened:
Prior to Account creation; and
On a recurring monthly basis.
The Compliance Manager will immediately be advised of any OFAC screening matches and will
work with the BSA/AML Officer to document and communicate the match to Celtic Bank (for loans)
or Processor (for payments). Any true OFAC match will be reported to the Board and maintained as
a record on a regular basis.
In addition to escalating any potential true matches to Celtic Bank or Processor (as applicable) and
the Board, Kabbage will also report any confirmed true matches directly to OFAC and take the
legally mandated actions to manage the Account in accordance with OFAC requirements.
b. USA PATRIOT ACT SECTION 314A – CUSTOMER LIST SCREENING
Section 314(a) grants FinCEN the authority to require that each financial institution expeditiously
search its records to determine whether it maintains or has maintained any accounts for, or
engaged in specified transactions with, each individual entity or organization named in FinCEN’s
request.
The BSA/AML Officer, or designee, is responsible for ensuring compliance with 314(a) information
sharing requests from Celtic Bank and ensuring that such requests and responses stay confidential.
Upon receipt of a FinCEN 314(a) request from Celtic Bank, Kabbage, in compliance with the
requirement, will conduct a one-time search of the Kabbage small business loan program records to
identify any current Account, or any Account maintained in the last twelve (12) months, for a
named suspect.
Positive matches will be provided to Celtic Bank prior to the designated response date and Kabbage
will retain all records in association with the review.
IV. TRANSACTION MONITORING
The BSA/AML Program has in place policies, procedures, and processes to identify and monitor
unusual activity, as well as a formal process for reviewing that activity, filing referrals of potentially
suspicious activity, and managing its systems used to assist in this process.
Transaction monitoring assists in identifying transactional or customer activity that warrants
further investigation and possible referral to Celtic Bank (for loans) or Processor (for payments). In
addition, Kabbage requires all of its employees to report unusual or potentially suspicious activity
to the BSA/AML Officer or designee.
Confidential – BSA/AML Policy
13
A00072
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 77 of 162
Enterprise BSA/AML and OFAC Policy
As of 7/24/19
Since all transactions are conducted online and no currency (i.e., cash) is deposited, withdrawn,
exchanged, or transferred in connection with the Offerings, Kabbage does not have an obligation to
file currency transaction reports (“CTRs”).
V. REFERRALS FOR POTENTIALLY SUSPICIOUS ACTIVITY
Under federal law, covered financial institutions must file a Suspicious Activity Report (“SAR”)
when a transaction is suspicious. While Kabbage is not obligated to file SARs, its relationships with
Celtic Bank, Sponsoring Bank, and Processor require that it refer potentially suspicious activities
that it observes as part of the customer onboarding and monitoring processes.
Kabbage has implemented procedures for referring potentially suspicious activity to Celtic Bank for
loans (i.e., questionable activity reports or “QARs”) and to Processor for payments (i.e., unusual
activity reports or “UARs”) and, consistent with BSA legal requirements, maintains records for
customer Account information (including the information obtained during the customer vetting
process) for the time period required by federal obligations.
The Risk team works closely with the Compliance and Financial Operations teams to refer any
suspicious activities to Celtic Bank (for loans) and Processor (for payments) in the form of QARs
and UARs. QARs/UARs are submitted for any activity involving $5,0006 or more of funds or assets
(individually or in the aggregate) once Kabbage knows, suspects, or has reason to suspect the
transaction:
Involves funds derived from illegal activity or is intended or conducted in order to hide or
disguise funds or assets derived from illegal activity as part of a plan to violate or evade
federal law or regulation or to avoid any transaction reporting requirement under federal
law or regulation;
Is designed, whether through structuring or otherwise, to evade any requirements of the
BSA regulations;
Has no apparent lawful purpose or is not the business activity in which the customer would
normally be expected to engage, and Kabbage knows, after examining the background,
possible purpose of the transaction and other facts, of no reasonable explanation for the
transaction; and/or
Involves the use of the Offerings to facilitate criminal activity.
Information collected by Kabbage for purposes of QARs/UARs submissions may not be discussed
with anyone outside the Kabbage organization (except for relevant parties at Celtic Bank and
Processor, as applicable). Discussion of such matters within Kabbage should be limited to those
who have a need to know. If an inquiry is received from the customer or an outside third party, the
inquiry must be promptly referred to the BSA/AML Officer who will consult with Kabbage’s CCO to
determine the appropriate course of action.
The BSA/AML Officer, or designee, evaluates whether to close accounts on which it files a
QAR/UAR. If an account is closed as a result of a QAR/UAR, the BSA/AML Officer is responsible for
6
Kabbage does not solely base decisions to submit QARs/UARs to Celtic Bank on whether the transaction is above a
predefined threshold. Transactions below $5,000 may also result in a UAR submission if determined to be warranted by
the BSA/AML Officer.
Confidential – BSA/AML Policy
14
A00073
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 78 of 162
Enterprise BSA/AML and OFAC Policy
As of 7/24/19
documenting the basis for the decision. Unless specifically instructed by law enforcement not to
close the account, Kabbage will consider the closure of any account on which it files three
QARs/UARs and/or at the direction of its bank partners.
VI. MECHANISMS TO MONITOR ON-GOING COMPLIANCE
Kabbage has implemented additional mechanisms to monitor on-going compliance as further
detailed in the BSA/AML Program Manual and the Kabbage Payments Risk Document.
a. NEW PRODUCTS APPROVAL
All new or modified Offerings require approval by the BSA/AML Officer. Any launch decisions for
new products or services will appropriately consider AML risks and include plans for additional
controls, as needed.
Kabbage currently only provides the Offerings to domestic (U.S.) businesses. Any expansion of the
permitted customer base constitutes a new or modified business practice for these purposes.
b. INTERNAL CONTROL MONITORING
The BSA/AML Officer is responsible for developing monitoring processes to identify BSA/AML
Program systemic errors and control deficiencies promptly. These processes should facilitate
remediation of identified BSA/AML control deficiencies as well as escalation procedures. The
BSA/AML Officer or designee will then track the remediation of identified control deficiencies
through corrective action plans (e.g., based on recommendations identified by the risk assessment
or independent testing). The purpose of ongoing monitoring is to implement a quality control
function to ensure day-to-day compliance between full, and comprehensive, testing of the BSA/AML
Program.
c. BOARD REPORTING
The BSA/AML Officer provides an annual report on the state of BSA/AML compliance and any
significant emerging issues that assists the Board and CCO in evaluating any Policy changes that
may be appropriate.
d. CONFIDENTIAL REPORTING OF VIOLATIONS
The BSA/AML Officer ensures Kabbage employees can report violations of this Policy anonymously
by telephone. The BSA/AML Officer further ensures that this mechanism is well publicized to all
employees and takes all possible steps to ensure reports of potential violations remain anonymous
and confidential. Kabbage never tolerates retaliation of any type against an employee who reports a
potential violation of the Policy. Any employee who commits such retaliation will be subject to
disciplinary action up to and including termination.
Internal referrals may not be discussed with anyone outside the organization. Discussion of such
matters within Kabbage should be limited to those who have a need to know. If an inquiry is
received from the customer or an outside third party, the inquiry must be promptly referred to the
BSA/AML Officer, who will consult with Kabbage’s CCO to determine the appropriate course of
action.
Confidential – BSA/AML Policy
15
A00074
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 79 of 162
Enterprise BSA/AML and OFAC Policy
As of 7/24/19
VII.
ADDITIONAL BSA/AML PROGRAM CONSIDERATIONS
The process by which Kabbage assesses the BSA/AML risk of a prospective customer is in part
incorporated into the existing credit underwriting process for the Offerings. Kabbage assesses the
credit risk of a customer using multiple sources, many of which may also serve as indicators of
BSA/AML Risk.
Customers are required to link an account from a U.S. financial institution (e.g., a regulated bank or
a money service business, such as PayPal), a process that assists both underwriting and customer
verification.
C. TRAINING
Kabbage requires that all Kabbage personnel receive BSA/AML training appropriate to their roles
and responsibilities at least annually.
New Kabbage employees are required, within 30 days of hire, to participate in an orientation that
contains an overview of BSA/AML requirements.
The BSA/AML Officer is responsible for ensuring training is completed in a timely fashion. Kabbage
provides training on relevant laws and regulations, including BSA/AML requirements, through an
online course provided by a third-party. If deemed necessary by the BSA/AML Officer, additional indepth training may be provided either directly by the BSA/AML Officer or a third party.
D. INDEPENDENT TESTING
Kabbage’s BSA/AML Officer oversees the completion, at least annually, of an independent test of
Kabbage’s BSA/AML Program to assess the implementation and effectiveness of the BSA/AML
Program and the adequacy of its controls over BSA/AML compliance risk.7
The BSA/AML Officer, or designee, is responsible for updating the risk assessment for the Offerings
in light of any issues raised during the independent testing and taking necessary corrective action
to remediate findings.
E. RISK-BASED CONTROLS
Kabbage has in place appropriate risk-based procedures for conducting ongoing customer due
diligence which include, but are not limited to:
understanding the nature and purpose of the customer relationship for the purposes of
developing a customer risk profile; and
conducting ongoing monitoring to identify and report suspicious transactions to Celtic Bank
(for loans) and Processor (for payments) and on a risk-basis, to maintain and update
customer information.
Kabbage has implemented a CRR methodology which assigns a risk-based rating to customers at
the time of on-boarding using the following factors:
entity type,
7 Celtic Bank is required to conduct an independent review of its BSA/AML program to assess the overall effectiveness
and institute practices for monitoring the strength of internal controls. As result, Celtic Bank expects that Kabbage, as
service provider to Celtic Bank, will also conduct an independent testing of the BSA/AML Program on an annual basis.
Confidential – BSA/AML Policy
16
A00075
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 80 of 162
Enterprise BSA/AML and OFAC Policy
As of 7/24/19
industry type,
geographic location (e.g., in HIDTA or HIFCA); and
marketing channel.
Customers with a high CRR rating are subject to EDD. Suspicious activity monitoring and reporting
are also critical internal controls and are addressed under Section 4(B)(IV). Kabbage periodically
refreshes both business and individual verification information to ensure it continues to maintain
updated customer information.
5. BSA/AML POLICY ADMINISTRATION
A. RECORD RETENTION AND RECORD KEEPING
The Offerings must remain in compliance with Celtic Bank, Sponsoring Bank, and Processor
requirements for retaining and being able to provide documentation pertaining to customer and
transaction information.
Kabbage maintains all information related to BSA/AML requirements for a period of at least five (5)
years from the date of last activity on the Account. This includes, but is not limited to: records of all
customer information including, CIP information, purpose of loan information, credit bureau file
information, documentary identification information, loan agreements, statements, transaction
information, customer correspondence, and customer contact information.
B. VERSION CONTROL MANAGEMENT
Ver.
Last
Revised
Date
Edited
By
Comments
1
3/28/18
A. Habib
Revised Policy per feedback from
Promontory
2
7/11/19
A. Habib
Confidential – BSA/AML Policy
Expanded existing Policy to
contemplate payment processing
services
Addressed findings from 2018
BSA/AML audit
Made clarifications and clean-ups
Celtic
Approval
Date
3/28/18
Board
Approval
Date
4/6/18
Last
Reviewed
Date
3/23/18
7/11/19
7/24/19
7/11/19
17
A00076
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
EXHIBIT 5
Page 81 of 162
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 82 of 162
Independent Enterprise BSA/AML and
OFAC Audit Report
November 4, 2019
1255 23rd St. NW
Suite 500
Washington, DC 20037
Phone: 202.249.7950
Fax:
202.223.3071
Treliant, LLC
Dino Papagiannis, Managing Director
Efren Alba, Engagement Director
Frank Meister, Senior Manager
John Atiyeh, Senior Analyst
Version: DRAFT
Release Date: November 4, 2019
Classification: Treliant Confidential
A00077
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 83 of 162
[This Page Intentionally Left Blank]
Version: FINAL
Release Date: November 4, 2019
Classification: Treliant Confidential
A00078
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 84 of 162
Contents
Executive Summary ...................................................................................................................................... 2
Background............................................................................................................................................... 2
Objectives and Scope................................................................................................................................ 2
Overview of BSA/AML and OFAC Risk and Control Environment ....................................................... 3
BSA/AML Program Elements: Summary..................................................................................................... 4
Risk Assessment ....................................................................................................................................... 4
Program Governance ................................................................................................................................ 5
Governance .......................................................................................................................................... 5
System of Internal Controls ...................................................................................................................... 5
Know Your Customer (KYC) / Know Your Business (KYB) ............................................................. 5
Office of Foreign Assets Control (OFAC) ........................................................................................... 6
Transaction Monitoring (TM) .............................................................................................................. 6
Questionable Activity Reporting (QAR).............................................................................................. 6
Section 314(a) and External Requests.................................................................................................. 7
Quality Assurance (QA) ....................................................................................................................... 7
Record-Keeping ........................................................................................................................................ 7
Training .................................................................................................................................................... 7
Overall Rating and Rationale ........................................................................................................................ 8
Detailed Findings ........................................................................................................................................ 11
High Risk Findings ................................................................................................................................. 11
Moderate Risk Findings.......................................................................................................................... 11
Low Risk Findings.................................................................................................................................. 13
Observations ........................................................................................................................................... 15
Appendix ..................................................................................................................................................... 18
Appendix A: List of Documents Reviewed ............................................................................................ 18
Appendix B: List of Meetings and Walkthroughs .................................................................................. 25
1|Page
Version: FINAL
Release Date: November 4, 2019
Classification: Treliant, LLC - Highly Confidential
A00079
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 85 of 162
Executive Summary
Background
Kabbage, Inc. (“Kabbage” or the “Company”) is an online financial technology and cash flow services
company based in Atlanta, Georgia. The Company provides access to funding to small businesses through
an automated lending platform using a technology driven underwriting methodology and drawing decisionmaking metrics from non-traditional data sources. Kabbage is currently expanding its product offerings to
include payment processing services for small businesses.
The Company retained the services of Treliant, LLC (“Treliant”) to conduct a risk-based audit of the design
and effectiveness of the Company’s Enterprise Bank Secrecy Act (BSA)/Anti-Money Laundering (AML)
and Office of Foreign Assets Control (OFAC) Compliance Program (“BSA/AML Program” or “Program”)
governing both the Kabbage® Small Business Loan Program and the Kabbage payments offering, with
specific focus on how the Federal Financial Institutions Examination Council (“FFIEC”) and OFAC
requirements and guidance impact the BSA/AML Program at the Company relative to regulatory
requirements and expectations.
Performing an independent audit, either through an internal audit function or external auditors/consultants,
is a key component of a BSA/AML and OFAC compliance framework. Independent audit provides
assurance on the design of the BSA/AML Program and effectiveness of internal controls through a riskbased approach, and evaluates the quality of risk management operations. The Company conducts the
independent BSA/AML Program audit annually.
The results of this independent audit are to be submitted to the Bank’s BSA/AML Officer. Treliant
performed this independent BSA/AML audit, the scope of which is defined below. This is Treliant’s second
consecutive year for conducting the Company’s BSA/AML and OFAC compliance Program audit.
Objectives and Scope
Treliant assessed whether the Company’s BSA/AML Program was functioning effectively through a review
of its (i) policies and procedures and their implementation; and (ii) evaluation of the design and operating
effectiveness of internal controls within the BSA/AML Program. This included an assessment of staff
awareness and their ability to articulate, understand and demonstrate compliance with BSA/AML and
OFAC requirements. The review encompassed a risk-based assessment of the Company’s compliance with
BSA/AML and OFAC regulation by focusing on the internal control environment.
Treliant conducted on-site interviews and walk-throughs during the audit planning phase, which provided
information on the Company’s control activities. Information gathered during the planning phase
established the audit scope. Planning activities also involved analysis of the Company’s BSA/AML
Program documents, including the Company’s risk assessment, and a review of prior issues from both
internal and external sources.
The scope of the audit was based on multiple factors, including a review of the Company’s most recent risk
assessment in order to develop an understanding of the Company’s size, complexity, scope of activities,
and risk profile; information obtained in the planning phase; operational risk factors; and industry standards
and leading practices.
The following BSA/AML Program elements were included in this audit:
Program Governance
Risk Assessment
Issue Remediation
Training
Know Your Customer
Questionable Activity Reporting
2|Page
Version: FINAL
Release Date: November 4, 2019
Classification: Treliant, LLC - Highly Confidential
A00080
Case 25-52372-CTG
Doc 97-1
Office of Foreign Assets Control
Quality Assurance
Filed 04/09/26
Page 86 of 162
Section 314(a) and External Requests
Transaction Monitoring
Overview of BSA/AML and OFAC Risk and Control Environment
The Company’s core product offering consists of providing access to funding for domestic U.S. small- and
medium-sized businesses (“SMBs”) through the Kabbage® Small Business Loan Program (“Lending
Program”). Access to such funding is provided through an online platform (“Platform”), which serves as
the application, underwriting, and servicing platform.
The Lending Program is supported by a partnership with Celtic Bank, a Utah-chartered, privately owned
industrial bank. Celtic Bank serves as lender for the Lending Program, while the Company serves as
“Program Manager” responsible for marketing, servicing, and collections. The Company’s partnership with
Celtic Bank is governed by a Program Management Agreement (PMA) detailing the Company’s
responsibilities to Celtic Bank as the Program Manager.
The Company also offers payment processing services (“Payments Program”). The Payment Program is
currently in a “beta” phase, with current Lending Program customers as participants. The Payment Program
includes invoicing (ability to generate and email invoices with a link to process card transactions), Unique
1
Pay URL (generation of unique URL to accept one-time payments). Similar to the Lending Program, the
Payment Program is offered through a partnership with Worldpay LLC (“WorldPay”) and Fifth Third Bank,
and is governed by a Payment Facilitator Merchant Agreement (PFMA).
The Company is exposed to moderate money laundering inherent risk within the Lending Program through
two (2) primary channels: customer risk and geographical risk. Its customer risk stems from having a
proportion of accounts from higher risk entity and industry types, account onboarding being completed
through an online process, and expected growth within the overall customer base. The Company also has a
number of customers operating in geographic areas with known higher risks related to money laundering
and forms of illegal trafficking2. Inherent product risk is relatively low due to the limited product offerings
currently in place. The Company’s exposure to risk through the Payments Program is generally unknown
at this time, as it is currently being piloted with a limited number of existing Lending Program customers.
The Company’s transaction risk is reduced as it does not accept cash or cross-border payments and loan
repayments are typically conducted as domestic Automated Clearing House (ACH) transactions from U.S.
financial institutions, commonly as recurring auto-debits. The Company’s exposure to the broader category
of financial crime is primarily through fraud, and the Company has experienced cases of organized fraudring activity, as well as one-off identity theft cases.
Although the Company does not have any legal or regulatory requirement to implement a formal BSA/AML
and OFAC program and related controls, the Company’s bank partners have placed responsibility with the
Company for a number of compliance-related controls. Key BSA-AML and OFAC controls on which
Kabbage’s partners place reliance on the Company include Know Your Customer (Customer Identification
Program, Customer Due Diligence, Enhanced Due Diligence), OFAC screening, transaction monitoring for
identification of potentially suspicious activity, and 314(A) law enforcement information-sharing requests.
A key component of the Company’s BSA/AML and OFAC control framework is a robust screening
program. The Company screens potential customers during onboarding, including OFAC screening, as well
1
2
Uniform Resource Locator
High Intensity Drug Trafficking Areas (HIDTA) and High Intensity Financial Crime Areas (HIFCAs).
3|Page
Version: FINAL
Release Date: November 4, 2019
Classification: Treliant, LLC - Highly Confidential
A00081
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 87 of 162
as periodically as changes are made to customer accounts and to screening lists. Initial enhanced due
diligence (EDD) is performed on all client accounts deemed high risk by the Company. The Company also
conducts transaction monitoring on loan repayments using a set of defined rules. Any matches or potentially
suspicious activity identified by the Company is required to be reported to Celtic Bank in the form of a
Questionable Activity Report (QAR). Celtic Bank will complete any required investigation and file a
Suspicious Activity Report (SAR) with the Financial Crimes Enforcement Network (“FinCEN”), if needed.
A similar process for the Payments Program is expected for Unusual Activity Reports (UARs) escalated to
World Pay and Fifth Third Bank, following the pilot period.
The Company’s overall BSA/AML and OFAC compliance framework is governed by a BSA/AML Policy
and a BSA/AML Program Manual. Both documents were created in cooperation with Celtic Bank based
on its own related policies, with approval by Celtic Bank required for the BSA/AML Policy on an annual
basis. The Policy and Program Manual are supported by a set of evolving procedures covering the
Company’s customer and transaction screening processes. Effective implementation of the system of
internal controls and governing documentation is the responsibility of the Company’s Board-appointed
BSA/AML Officer.
BSA/AML Program Elements: Summary
Risk Assessment
The Company’s risk assessment methodology was developed by an independent, third party provider3. The
latest version, the 2018 Risk Assessment, covers the period from December 31, 2017 to December 31, 2018
for the BSA/AML Program. The requirement and purpose for the risk assessment is outlined by the
BSA/AML Policy, and the results of the risk assessment are provided by the BSA/AML Officer to the
Board of Directors or a delegated committee (currently the Audit Committee) of Kabbage for review.
The risk assessment methodology focuses on the inherent money laundering and OFAC-related risks
presented by three areas – customers, products and services, and geographies. The 2018 assessment
concluded:
Inherent Risk
Control Effectiveness
Residual Risk
Direction of Residual Risk
BSA/AML
Moderate
Satisfactory
Moderate
Decreasing
OFAC
Low
Satisfactory
Low
Stable
The audit team reviewed the 2018 risk assessment, BSA/AML Policy, and formal review of the risk
assessment by the Board of Directors. Treliant found the ultimate output of the risk assessment to be
reasonable and aligned to the risk profile of the Company. However, weaknesses within the methodology
were identified with respect to the weighting calibration for inherent riskand control assessment as well as
with the factors chosen to drive the assessment. Inconsistencies and weaknesses were also identified in the
control effectiveness rating methodology.
3
Promontory, Inc (“Promontory”).
4|Page
Version: FINAL
Release Date: November 4, 2019
Classification: Treliant, LLC - Highly Confidential
A00082
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 88 of 162
Program Governance
Governance
Oversight of the Company’s BSA/AML and OFAC Compliance Program ultimately falls under the
responsibilities of the Company’s Board of Directors (the “Board”). While compliance reporting is
provided directly to the full Board, the charter for the Board’s Audit Committee delegates the risk and
compliance oversight function to the Audit Committee.
The Company’s Board designates a BSA/AML Officer who is responsible for day-to-day management of
the BSA/AML and OFAC Compliance Program, as well as the Chief Compliance Officer (CCO). The
Board also approves the Company’s BSA/AML Policy on an annual basis, reviews the results of annual
independent testing of the BSA/AML Program, and addresses any compliance issues raised internally or
by Celtic Bank.
The audit team reviewed a sample of Board and committee meeting minutes (or “attestation”), formal
approval documentation of key BSA/AML documents, formal approval of the BSA/AML Officer and CCO,
professional qualifications of the BSA/AML Officer, BSA/AML Program reporting to the Board, and the
amended charter for the Audit Committee and did not find any material concerns or issues. However,
within the Program reporting provided to the Board, the audit team identified opportunities for
enhancements in the comprehensiveness of the Key Performance Indicators (KPIs) and Key Risk Indicators
(KRIs) that are collected and reported.
The Company demonstrates a thoughtfully constructed policy and program framework that was originally
developed with the assistance of an independent third party advisory services firm, Promontory. The Policy
and supplemental Program documentation adequately cover the BSA/ AML and OFAC standards that
would be expected for an organization of the type and complexity of the Company.
The Company maintains a catalogue of identified issues related to its BSA/AML Program, including
BSA/AML and OFAC compliance. The issue tracking logs include the source of each issue (e.g., selfidentified, external audit, partner bank reviews), a description of the issue, commentary on remediation
work related to the issue, and a “latest status” update for each issue. The Company shares the issue tracking
log with Celtic Bank to help ensure its overall compliance program, including BSA/AML and OFAC
compliance, meets Celtic Bank’s compliance management standards. Material issues are also escalated to
the Company Management and the Board of Directors (or delegated committee) for review and resolution.
The audit team identified some weaknesses in the tracking related to the formal conclusion of tracked issues.
System of Internal Controls
Treliant reviewed the operational procedures for the Company’s BSA/AML and OFAC control functions,
and found similar issues to those identified during the prior review, i.e., the operational procedures generally
lack the detail and formality needed to fully describe the roles and responsibilities, execution steps and
change control aspects for a process.
Know Your Customer (KYC) / Know Your Business (KYB)
The Company collects and verifies the identity of all Program customers, including beneficial owners and
controllers (referred to as “business leaders” in the application) at the time of onboarding and periodically,
if changes are made to the customer account, through automated non-documentary verification via
LexisNexis. If the identity of an applicant cannot be authenticated or if the applicant information appears
to present fraud or money laundering risk, the Company’s Account Review Team will perform an
investigation and either place the application in a pending resolution queue, request additional information,
and/or recommend that a QAR be completed. Additional review is performed on all client accounts deemed
high risk by the Company based on the Company’s Customer Risk Rating (CRR) Methodology.
5|Page
Version: FINAL
Release Date: November 4, 2019
Classification: Treliant, LLC - Highly Confidential
A00083
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 89 of 162
The audit team evaluated the design of the KYC program, and also conducted sample testing on manually
verified KYC/KYB alerts and high risk customers to assess the effectiveness of internal controls.
Office of Foreign Assets Control (OFAC)
The Company has implemented GIACT, a third-party screening tool, to perform OFAC screening for
applicants, customers, employees and vendors. Screening is performed during onboarding, on a monthly
recurring basis for existing customers and when changes are made to customer accounts. Due to the nature
of the origination/disbursement flow using Automated Clearing House (ACH) transactions, the Company
does not perform screening on transactions. Potential true matches are escalated to Celtic Bank and
confirmed true matches are reported to OFAC and the Board (or delegated committee). The Company has
not identified any true matches that would have require reporting.
During the prior review, Treliant assessed the design of OFAC name screening process and provided
observations. During this review, Treliant reassessed the areas of weakness identified in the prior review
and found the weaknesses to have been resolved. Treliant also conducted sample testing on the OFAC
match review process to assess the effectiveness of internal controls and identified some weaknesses in the
alert clearing processes related to timeliness and sufficiency of clearing commentary.
Transaction Monitoring (TM)
The Company has an automated transaction monitoring process in place based on the money laundering
red flags for lending identified in the FFIEC BSA/AML Examination Manual. The Company conducts
automated transaction monitoring on loan repayments greater than $5,000 using a set of defined rules by
means of custom SQL queries of the Company’s primarily customer business application. Each TM alert
automatically creates a ticket in the Salesforce application which is reviewed and decisioned by the Account
Review team. Any unresolved tickets are escalated to the BSA/AML Officer and the Compliance Manager.
Loan disbursements and payments are primarily conducted through ACH transactions originated through
other U.S. financial institutions. Therefore, the Company is not exposed directly to higher risk transactions,
such as currency, international wires or domestic wires. This also eliminates the need for the Company to
aggregate currency transactions to support Currency Transaction Reports (CTRs).
The audit team evaluated the design for transaction monitoring to assess the effectiveness of internal
controls and identified some weakness and areas for enhancement, such as enhancing the
review/investigation process and potential adoption of more effective detection scenarios.
Questionable Activity Reporting (QAR)
Potentially suspicious activity and OFAC matches identified by the Company during customer onboarding
and ongoing monitoring are required to be reported to Celtic Bank in the form of a QAR. The Compliance
Operations Manager is responsible for this process and for evaluating whether to close accounts with
multiple QARs. The Company may also close an account at the request of Celtic Bank. Following the
receipt of a QAR, Celtic Bank will complete any required further investigation and file a Suspicious
Activity Report (SAR), if needed. A similar process for the Payments Program is expected for UARs
escalated to World Pay and Fifth Third Bank, following the pilot period. Upon receipt of a UAR, Fifth
Third Bank will complete any required further investigation and file a SAR, if needed.
The BSA/AML Program Manual provides specifies creation of a QAR within 30 days of the identification
of potentially suspicious activity.
Treliant evaluated the design of the suspicious activity review process, the interaction between the
Company and Celtic Bank, and also conducted sample testing on cleared transaction monitoring alerts and
on QARs filed by the Company in an effort to assess the effectiveness of internal controls. Treliant
identified several areas for enhancement primarily with the activity narrative quality.
6|Page
Version: FINAL
Release Date: November 4, 2019
Classification: Treliant, LLC - Highly Confidential
A00084
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 90 of 162
Section 314(a) and External Requests
Section 314(a) of the USA Patriot Act requires a financial institution to conduct a one-time search of its
customer and transaction databases upon request by law enforcement in order to identify matches to subjects
on the circulated lists, and to provide a response to FinCEN within fourteen (14) days of the notification
date.
The Company’s Compliance Operations Manager is responsible for ensuring compliance with 314(a)
information-sharing requests from Celtic Bank and liaising with the Bank regarding all requests and results
within the timelines prescribed in the BSA/AML Program Manual. Celtic Bank makes the final
determination to FinCEN and files responses.
Treliant evaluated the process by which the Company receives, searches, and responds to 314(a) and other
external requests from Celtic Bank. No exceptions were identified.
Quality Assurance (QA)
The Company maintains a QA process for a variety of Compliance functions, including BSA/AML Program
functions. On a quarterly basis, the Company’s Compliance Operations Manager completes compliance
checks on CIP identification and verification, CIP notice presentation and initial OFAC screening
processes. Any results of such checks are incorporated into compliance reporting provided to management
and the Company’s Board, as well as regular reporting provided to Celtic Bank on screening outcomes.
During the prior review, Treliant noted that the Company’s QA processes were evolving. During this
review, Treliant evaluated the design of the QA review process and conducted sample testing on QA
reviews in an effort to assess the effectiveness of internal controls, and found that there continue to be
weaknesses in the documented procedures.
Record-Keeping
The Company maintains records for customer account information for the five (5) year time period
consistent with BSA record-keeping requirements.
Training
The Company currently uses OnCourse (formerly Banker’s Edge) online training as the primary method of
providing training to its staff. Training content is appropriate given the Program’s inherent risk profile.
Online training is supplemented with department-specific and on-the-job targeted training as needed,
including a BSA/AML-focused training annually for employees with front-line BSA/AML responsibilities.
Additionally, the Company provides annual BSA/AML and OFAC training to its Board of Directors.
The audit team assessed the design of the BSA/AML training program, and also conducted testing using
training data to ensure employees completed training as required and in a timely manner and that content
delivered was comprehensive and effective. Some weaknesses were identified in the tracking/assurance of
new employee training and exposure of OFAC-related topics for all employees.
7|Page
Version: FINAL
Release Date: November 4, 2019
Classification: Treliant, LLC - Highly Confidential
A00085
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 91 of 162
Overall Rating and Rationale
Treliant conducted an assessment of the adequacy and effectiveness of the BSA/AML Program. The results
of this review indicate that the design and/or operating effectiveness of controls provide limited assurance
to mitigate the identified key risks for the activities covered within the scope of this review.
The overall rating for the BSA/AML control environment is Limited Assurance
The BSA/AML Program demonstrates limited evidence of enhancement since the prior review. Reiterating
last year’s observations, Treliant considers that the lack of enhancements in the Company’s Compliance
Program operational procedures an important weakness that requires prioritization by the Company.
Without adequate written procedural documentation, the quality of execution of the control cannot be fully
tested. This weakness affects testing of CIP, EDD, OFAC and TM controls and is considered a systemic
gap. The program requires additional time for refinement and maturity. The Company has a number of
enhancements underway including implementation of additional TM scenarios, updating the CRR
methodology and applying it to the complete client population and augmentation of Board reporting.
However, these efforts were not fully implemented during the period of review.
The following table supports the rationale for the overall rating by evaluating each of the BSA/AML
Program elements and describes the degree of assurance that can be placed on the current key controls to
effectively mitigate BSA/AML risk.
Assessment Key
4
Reasonable assurance can be placed on the effectiveness of the controls to mitigate the identified risk.
Limited assurance can be placed on the effectiveness of the controls to mitigate the identified risk.
Insufficient assurance can be placed on the effectiveness of the controls to mitigate the identified risk.
BSA/AML
Program
Element
2018
Assessment
2019
Assessment
Program
Governance
Summary of Testing Completed
Weaknesses were observed in the overall tracking and
validation of remediated issues, leading to repeat
findings in this review period. (See Issue #2 and
related Issue #1.)
Additionally, Promontory previously identified the
need to enhance the information provided, and
Treliant concurs with this observation. (See
Observation #1.)
8|Page
Version: FINAL
Release Date: November 4, 2019
Classification: Treliant, LLC - Highly Confidential
A00086
Case 25-52372-CTG
BSA/AML
Program
Element
2018
Assessment
Doc 97-1
2019
Assessment
Risk Assessment
KYC/KYB/CRR
Filed 04/09/26
Page 92 of 162
Summary of Testing Completed
Weaknesses were identified with the Company’s
selection and completeness of inherent risk factors as
well as inconsistencies with the assessment of control
effectiveness. (See Issue #5.)
The CRR demonstrates some weaknesses in the
selection and completeness of risk factors, for
customers and related parties (e.g., business
representatives and UBOs), and with the identification
of prohibited customer types. (See Issues #5 and #7.)
Additionally, the lack of comprehensive operational
procedures for conducing EDD is also a weakness, and
is evident in the quality and consistency of the EDD
reviews that have been performed. (See Issue #1.)
Also, the Company has not yet assigned risk ratings to
all of its customers, a process that is in progress, but
not yet completed.
OFAC
Transaction
Monitoring
Operational testing of the alert deposition processes
identified weaknesses in the alert clearing process.
(See Issue #4 and related Issue #1.)
Also, opportunities for improvement were noted for
model and access mitigation controls (See
Observations #3 and #4.)
The existing monitoring scenarios have generated
limited productive results, and Promontory has
recommended (and the audit team concurs) that the
Company should consider reviewing existing
monitoring scenarios and develop new scenarios. See
Observation #2).
Operational testing of the alert deposition processes
identified weaknesses in the alert clearing process.
(See Issue #4 and related Issue #1.)
Questionable
Activity
Reporting
Operational testing of the investigation process
identified weaknesses in the quality of reporting. (See
Issue #4 and related Issue #1)
Additionally, although not material given the ability
of Celtic to access information with Kabbage to
perform their SAR investigations, it was noted that the
QAR that is provided by Celtic Bank for reporting
does not exactly mimic FinCEN’s SAR.
9|Page
Version: FINAL
Release Date: November 4, 2019
Classification: Treliant, LLC - Highly Confidential
A00087
Case 25-52372-CTG
BSA/AML
Program
Element
2018
Assessment
Doc 97-1
2019
Assessment
Filed 04/09/26
Page 93 of 162
Summary of Testing Completed
Section 314(a)
No exceptions were noted in the design or operating
effectiveness of controls related to 314(a).
Quality
Assurance
Similar to last year’s review, weaknesses were
identified. The process for reviewing the sample or
conducting re-performance testing is not defined or
formally documented within procedures, including the
methodology for determining a representative sample
size or subjective sampling. (See Issue #1.)
Training
Exceptions were noted with ensuring that new
employees took assigned online training within the
Policy mandated 90-days. Also, the OFAC specific
online training was limited to only Compliance and
Risk personnel, rather than being offered to the entire
staff. (See Issue #6.)
Treliant would like to extend our appreciation to the Company’s Compliance and Risk teams for their
assistance and cooperation during this audit.
10 | P a g e
Version: FINAL
Release Date: November 4, 2019
Classification: Treliant, LLC - Highly Confidential
A00088
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 94 of 162
Detailed Findings
High Risk Findings
Issue #: 1
Operating Procedures
Control Category:
KYC/KYB/CRR, OFAC,
TM, QAR, 314(a), QA
Similar to the prior review, although BSA/AML and OFAC written
procedures provide steps for Risk Analysts to verify customer identity and
clear alerts, they do not specify the level of detail required for Risk Analyst
commentary and documentation within Salesforce, the system of record. As
a result, for most samples reviewed for KYC/KYB, OFAC Screening, TM,
and CRR (see related Issue #4), the Risk Analyst comments did not indicate
why an OFAC or TM alert was cleared or why a KYC/KYB or CRR flagged
customer was verified and what steps were taken to perform the review.
Issue Rating:
High Risk
Repeat Issue:
Yes, 2019 Treliant Audit
The Procedures/ Desktop Operating Instructions (DOIs) generally lack the
common elements found in documents at similar organizations and financial
institutions that maintain KYC, TM, and OFAC related processes. For
example, common procedural sections include: purpose and scope, roles and
responsibilities, process summary, specified operating instructions,
procedure governance, terms and definitions, and procedure version control.
With respect to specified operating instructions, the procedures lack
information about the input, processing and output for the process that
would provide information about where the inputs to the process originate,
the specific steps to perform the tasks as well as the
systems/applications/tools used to compete the tasks, and the desired output
for the process.
Moderate Risk Findings
Issue #: 2
Issue Management
Control Category:
Governance
The audit team reviewed the issue logs (i.e., Remediation Plan and
Compliance Issue Log) of the Company’s BSA/AML and OFAC Risk
Assessment and CRR methodologies. The review identified a primary
weakness in the issue management process. The current process allows for
an issue to be closed without validation by an independent or separate
testing/ review function.
Issue Rating:
Moderate Risk
Repeat Issue:
No
The impact of this weakness was most evident in the closing of the finding
from Treliant’s prior review related to the enhancement of operating
procedures. Minimal updates were made to the procedures and the updates
not address the risks identified by the finding.
Issue #: 3
OFAC Alert Clearing
Control Category:
OFAC
The audit team reviewed the timing for reviewing Saleforce tickets (alerts)
generated as a result of watch list matches from the GIACT screening.
During onsite interviews, Management indicated that alerts are to be cleared
11 | P a g e
Version: FINAL
Release Date: November 4, 2019
Classification: Treliant, LLC - Highly Confidential
A00089
Case 25-52372-CTG
Issue Rating:
Moderate Risk
Repeat Issue:
No
Doc 97-1
Filed 04/09/26
Page 95 of 162
within two (2) days. Testing identified that eight (8) of ten (10) alerts (80%)
were cleared in a period longer than two (2) days (mode = 1, median = 1.3,
max = 4).
Issue #: 4
Alert and Investigation Narrative
Control Category:
OFAC, TM, QAR
The audit team reviewed the concluding Salesforce ticket comments and
QAR narratives and generally found them to be lacking in clear and concise
details that explain why the review is being conducted and why the resulting
analysis either mitigates the risk identified by the alert or why the results are
being escalated for further action either by the Company or the partner bank.
Issue Rating:
Moderate Risk
Repeat Issue:
No
OFAC operational testing identified that eight (8) of the ten (10) alerts
reviewed (80%) lacked sufficient commentary to explain why the match
entity (Company relationship) was not the same as the watch list entity (e.g.,
insufficient commentary that describes the specifics for why the name, dateof-birth and/or address did not match). Testing also identified that four (4)
of the ten (10) alerts reviewed (40%) had insufficient supporting
evidence/documentation to support the clearing conclusion. In one case, an
inappropriate method was used to clear the alert, whereby the Analyst
searched the name of the customer company, rather than searching for the
name that matched in the alert. In two (2) alerts, the results of Requests for
Information (RFI) responses were inconclusive.
Transaction monitoring operational testing identified that five (5) of the ten
(10) alerts reviewed (50%) lacked sufficient commentary to explain why
review analysis concluded that the observed activity was not questionable
or unusual. Testing also identified that eight (8) of the ten (10) alerts
reviewed (80%) had insufficient supporting evidence/documentation to
support the clearing conclusion.
The narratives of each of the sixteen (16) 2019 year-to-date QARs
demonstrated weaknesses when compared with the guidance provided by
FinCEN for preparing a complete and sufficient SAR narrative.5 In general,
the Company’s narratives lack the fundamental three section structure that
includes an introduction, body and conclusion. The Company’s current
narratives make it difficult to discern how the suspicious activity came to
light. Additionally, the narratives tend to lack a detailed explanation of the
activity witnessed by the company through its visibility into the customer’s
attached accounts that would provide context for the reported behavior and
whether the actual transaction behavior matches expected behavior.
5
https://www.fincen.gov/sites/default/files/shared/sarnarrcompletguidfinal_112003.pdf
12 | P a g e
Version: FINAL
Release Date: November 4, 2019
Classification: Treliant, LLC - Highly Confidential
A00090
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 96 of 162
Low Risk Findings
Issue #: 5
Risk Assessment
Control Category:
Risk Assessment,
KYC, CRR
The audit team reviewed the design of the Company’s BSA/AML and
OFAC Risk Assessment and CRR methodologies. Based on the review,
Treliant noted a number of weaknesses and potential enhancement
opportunities for assessing the Company’s BSA/AML and OFAC risks,
including:
Issue Rating:
Low Risk
Repeat Issue:
No
●
●
●
●
The 667 clients with “Not Known” entity type representing 0.4% of
the population, were the only High Risk entity type, which indicates
that the customer legal entity type within the risk assessment does
not provide sufficiently granular risk classification. All possible
legal entity types should be graded on a continuum from lower to
moderate to high to very high risk, for example. Typically, higher
risk is associated with private vs. public companies due to lower
levels of transparency; also LLCs formed in low UBO transparency
states could be deemed high risk (i.e. Delaware, Wyoming, Nevada,
Oregon, etc.).
As the AML Risk Assessment methodology assigns a risk rating to
each two-digit North American Industry Classification System
(NAICS) codes within Kabbage’s existing customer portfolio as of
a point in time, the methodology does not appear to
comprehensively identify higher risk for money laundering
industries across all industry types. Additionally, higher risk
businesses may not be adequately identified using the 2-digit
NAICS code, which does not provide sufficient granularity relative
to FFIEC Examination Manual and other regulatory guidance. For
example, identification of cash-intensive businesses may require 4digit NAICS codes for appropriate identification.
Customer inherent risk does not utilize additional available
customer attributes which could assist in identification of higher
customer inherent risk:
o customer tenure;
o suspicious activity red flags (e.g., number of QARs, 314(a)
matches, OFAC matches, etc.);
o international activity (e.g., logins from foreign IP
addresses, especially those in higher risk jurisdictions); and
o customers with international affiliations (e.g. international
parent companies, resident or non-resident alien UBOs or
business representatives, particularly from higher risk
jurisdictions).
Although Kabbage’s assessment of inherent product and service
risk appears in alignment with regulatory guidance, without
sufficient commentary and reference the estimation of risk could be
considered subjective and qualitative. A product and services
matrix that assesses each offered Kabbage product and service for
inherent risk based on various risk factors (ability for pre-payment,
allowed loan payment transaction types, product use limitations)
and that assigns a simplified product risk scoring methodology, for
13 | P a g e
Version: FINAL
Release Date: November 4, 2019
Classification: Treliant, LLC - Highly Confidential
A00091
Case 25-52372-CTG
●
●
●
Doc 97-1
Filed 04/09/26
Page 97 of 162
example, and also weighting risk through point-in-time or average
outstanding loan balances could assist Kabbage to better quantify
its risk exposure.
Although not specifically mandated by guidance, products and
services risk can also consider transaction types and transaction
values and volumes. For Kabbage, transactional exposure could at
the highest level be segmented into debits (loan funding) and credits
(loan payments by recurring ACH, non-recurring ACH, fees by
non-recurring ACH, etc.) which can then be assigned specific
transaction type risk to provide greater granularity of inherent
transaction risk.
Additional use of metrics could assist Kabbage in estimation of
directionality of risk (i.e., year-over-year changes).
For the Transaction Geographic risk factor, there is no scoring band
used to derive the risk designation as is the methodology with the
Customer Geography risk factor. Without sufficient commentary
and reference, the risk designation could be considered subjective
and qualitative.
With respect to control effectiveness, the Company appears to make
adjustments to the control effectiveness ratings when control weaknesses
are identified (e.g., through testing and independent reviews). However, the
absence of objective scoring granularity within the Control Effectiveness
Scoring Bands can lead to discrepancies. For example, there are two
control categories (BSA/AML Risk Governance and QA, and Independent
Testing) that are rated as “Strong”, but there were identified deficiencies
within the control environment that included items such as Compliance
reporting to the Board, staffing assessment, tailored training, QA sampling
methodology and procedural enhancements that could have potentially
impacted the control ratings, but are were not fully rationalized. The control
assessment methodology could also be strengthened to provide greater
granularity for instances where Management has reported that a
finding/issue has been remediated, but the remediation has not yet been fully
validated by a review function.
Issue #: 6
Training
Control Category:
Training
The audit team reviewed the design and effectiveness of the Company’s
BSA/AML and OFAC training program, citing these observations:
Issue Rating:
Low Risk
●
Repeat Issue: No
●
Sample testing of May 2018 new hires identified seven (7) of
nineteen (19), or 37%, assignments were completed outside of the
Policy mandated 90-day timeframe.
Kabbage currently does not assign the OFAC specific online course
to all employees, only employees within Compliance and Risk. The
other courses assigned to all employees (i.e., Customer Information
Program, AML for Customer Service and BSA for Customer
Service) do not address OFAC. It is common practice for all
employees to receive, at minimum, an OFAC exposure course
14 | P a g e
Version: FINAL
Release Date: November 4, 2019
Classification: Treliant, LLC - Highly Confidential
A00092
Case 25-52372-CTG
●
Doc 97-1
Filed 04/09/26
Page 98 of 162
which provides the purpose of economic and trade sanctions, and
the relevancy to all U.S. Persons.
Several technical discrepancies were noted in Kabbage’s training
documentation:
o Compliance Training Policy lists a course for “PATRIOT
Act” that was not assigned to Kabbage personnel.
o Compliance Management System document status that new
employee training is stated as “during the first two weeks”
which needs to be updated to “30 days”.
Issue #: 7
Prohibited Customers
Control Category:
KYC/KYB/CRR
The audit team reviewed the loans originated in June 2019. A visual
inspection of the customer names produced a number customers that appear
to be outside the Company’s risk appetite (i.e., financial services, nonprofits and firearms). Additionally, the Company’s Policy is unclear as to
whether the prohibition of firearms customers is limited manufacture or also
includes sales.
Issue Rating:
Low Risk
Repeat Issue: No
Potential out-of-appetite customers:
Financial Services - 16
Non-Profit - 7
Firearms - 12
The Company was continuing to research the identified customers at the
time this report was submitted.
Observations6
Observation #: 1
Management Reporting (Key Performance and Key Risk Indicators)
Control Category:
Governance
The audit team reviewed the Compliance reporting developed for
Management and Board review. The current metrics could be enhanced to
meet common standards for KPIs and KRIs for tracking changes to a
company’s risk profile and out-of-control conditions in the operational
workflow. Relatedly, the Company does not currently define any risk
appetite or risk tolerance thresholds that would identify an out-of-control
condition.
Previously cited:
Yes: Promontory Risk
Assessment 5.2.1.3
Target remediation
date:
November 13, 2019
Notably absent are metrics related to the number of transaction monitoring
alerts, number of OFAC alerts, number of high risk customers, including
6
Observations are offered where prior findings or observations remediation is in progress but is still identified as a target for attention, discrepancies
were noted within the review but do not represent an immediate and/or significant impact on the control environment, and opportunities of the
Company to make further enhancements to existing policy, procedure, and process. Observations do not require a formal Company Remediation
Effort.
15 | P a g e
Version: FINAL
Release Date: November 4, 2019
Classification: Treliant, LLC - Highly Confidential
A00093
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 99 of 162
any long term trending (e.g., 12 to 13 months) for these types of metrics that
may be useful in determining any seasonal or cyclical patterns.
The 2018 Risk Assessment recommended that the Company enhance the
Board reporting contents to include, “Risk-based issues (e.g. changes in risk
distribution of the Company’s customer base and volume of high-risk
customers; major changes in transaction monitoring alert volumes; any
OFAC hits)”
Observation #: 2
Control Category:
Transaction Monitoring
Previously cited:
Yes, Promontory Risk
Assessment 5.2.3
Target remediation
date:
September 31, 2019
Observation #: 3
Control Category:
OFAC
Previously cited:
No
Target remediation
date:
N/A
Observation #: 4
Treliant concurs with and reiterates this recommendation.
Transaction Monitoring Scenarios
The audit team reviewed each of the sixteen (16) QARs that were escalated
during the review period, and only one (1) could be readily identified as
originated from one of the transaction monitoring scenarios. The remainder
primarily originated through external identification (e.g., fraud victim
contact, subpoena, police report). The 2018 Risk Assessment recommended
that the Company establish a process for ongoing development, testing,
calibration, and validation of detection scenarios/rules, including a process
to evaluate and develop new scenarios as needed based on changes to or
expansions of product scope/design; and ongoing periodic review of the
efficiency and efficacy of existing scenarios/rules. Treliant concurs with and
reiterates this recommendation.
Management has provided a draft of the revised rules set. The set includes
new rules for overpayments, which adds to the Company’s identification of
lending related red flags.
Sanctions Filter
The 2018 Risk Assessment stated that “Kabbage’s has not yet performed a
formal validation or calibration of its OFAC name screening tool to ensure
the data feeds into the tool and algorithms, including confidence levels and
fuzzy logic, are appropriately set up and effectively identify potential
sanctions matches”. Treliant confirmed that there is no on-going monitoring
of the performance of the screening filter. Treliant recommends that, at a
minimum, the Sanctions screening system be tested to confirm that exact
and strong aliases from the OFAC Sanctions List are interdicted.
Additionally, Kabbage confirmed in the interviews that it did not screen the
merchant names that were part of transactions, when the transaction was
executed on Alibaba.com (for example). The rationale being that it is
Alibaba’s and the financial institution’s (making the payments)
responsibility to screen merchants. Treliant asked if the merchant names
were captured within Kabbage in any of the data stores. Should vendor
names be captured, Treliant recommends that the vendor names be screened
to avoid the possibility of capturing a potential SDN name and not screening
the name.
Access Mitigation
Control Category:
16 | P a g e
Version: FINAL
Release Date: November 4, 2019
Classification: Treliant, LLC - Highly Confidential
A00094
Case 25-52372-CTG
OFAC
Previously cited:
No
Target remediation
date:
N/A
Doc 97-1
Filed 04/09/26
Page 100 of 162
Per the 2018 Risk Assessment and interviews with Kabbage, the audit team
confirmed that Kabbage currently maintains a list of 26 countries (including
broad and narrowly sanctioned countries) that are blocked from accessing
the Kabbage website through Internet Protocol controls. However, it was
unclear that the controls provided services or lists to further protect the
potential use of Kabbage (e.g., via VPNs) from sanctioned countries.
Treliant recommends that Kabbage investigate available technical tools to
further protect unauthorized use from sanctioned countries.
17 | P a g e
Version: FINAL
Release Date: November 4, 2019
Classification: Treliant, LLC - Highly Confidential
A00095
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 101 of 162
Appendix
Appendix A: List of Documents Reviewed
#
Document Name
1
#1 lmProduct Matrix 2019-06-06 - PFG.xlsx
2
#1 Product Matrix (LM 6.5.19).docx
3
#11 Know Your Customer Procedures (FINAL 3.1.19).docx
4
#12 Customer Risk Rating Procedures (FINAL 1.11.19).docx
5
#13 Transaction_Monitoring_Procedures (FINAL 6.23.18).docx
6
#13 Transaction_Monitoring_Procedures (FINAL 6.23.18)_PASSWORD.txt
7
#14 attestation Board meeting 7.24.19.pdf
8
#14 Compliance slide from Board deck 7.24.19.png
9
#14 Compliance Slides Board Meeting.docx
10
#14 KBG Summary of Policy Changes for Board (FINAL 7.19.19) .pptx
11
#1-Company Summary-Profile.docx
12
#2 KBG - 2018 BSA AML and OFAC Risk Assessment (Board Reviewed 7.24.19).docx
13
#22 Kabbage - Code of Conduct KBG Board Approved 20190424.docx
14
#23 Bangalore Code of Conduct and Ethics.csv
15
#23 US Code of Conduct.csv
16
#25, 32 Compliance SLAs from Celtic.docx
17
#27 resolutions appointing CCO, BSA AML officer .pdf
18
#30 Customer Risk Rating Procedures (FINAL 1.11.19).docx
19
#4 Kabbage - 2018 BSA AML and OFAC Risk Assessment (Board Reviewed 7.24.19).docx
20
#4 Kabbage - Commercial Credit Policy v6.0 (KBG Board Approved 4.24.19).docx
21
#44 Start Date Report.xlsx
22
#44 Termination Report.xlsx
23
#45 BSA_AML_training_attendance_ 12.12.2018.pdf
24
#46 BSA AML OFAC Webinars attended.docx
25
#48 Board Annual Compliance Training 2018.pptx
26
#49 BSA AML Board Training Attendance Tracker.png
18 | P a g e
Version: FINAL
Release Date: November 4, 2019
Classification: Treliant, LLC - Highly Confidential
A00096
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 102 of 162
#
Document Name
27
#5 Org Charts (Risk, BSA AML OFAC).docx
28
#50 2018 Enterprise BSA_AML & OFAC RA Remediation Plan (AH 8.6.19).xlsx
29
#50 2018 Enterprise BSA_AML & OFAC RA Remediation Plan UPDATED 9.12.19) (1).xlsx
30
#50 2018 Enterprise BSA_AML & OFAC RA Remediation Plan UPDATED 9.12.19).xlsx
31
#51 Complaint Log 2019 August.xlsx
32
#51 Compliance Issues Log 2019 Q1.xlsx
33
#7 Enterprise BSA_AML and OFAC Policy (KBG Board Approved 7.24.19).docx
34
#8 Kabbage - BSA AML Program Manual (FINAL 7.3.18).docx
35
#9 Compliance Training Policy Ready for Approval 20190812.docx
36
2. Transaction_Monitoring_Procedures (FINAL 3.18.19).docx
37
2018 FINAL course completion 11.20.2018.xlsx
38
2019 Karrot Celtic Bank CRA.xlsx
39
2019 Karrot Celtic Delinquent Accounts.xlsx
40
2019 May Celtic Bank CRA.xlsx
41
2019 May Celtic Bank Loans Taken By Fuelman Customers.xlsx
42
2019 May Celtic Charged Off Accounts.xlsx
43
2019 May Celtic Delinquent Accounts.xlsx
44
2019 May Celtic Loans Taken By Celtic Customers.xlsx
45
2019-06-04 FinCEN 314a Business List - PROCESSED 2019-06-05.xlsx
46
2019-06-04 FinCEN 314a Personal List - PROCESSED 2019-06-05.xlsx
47
2019-06-18 FinCEN 314a Business List - PROCESSED 2019-06-18.xlsx
48
2019-06-18 FinCEN 314a Personal List - PROCESSED 2019-06-18.xlsx
49
22-Kabbage Vendor Management Policy - KBG Board Approved 20190424.docx
50
35-Kabbage Credit Process Overview - 20190401.pdf
51
A Callen Aspen Bank Account.png
52
AAA Plumbing Services QAR.xlsx
53
Active Employees (19).xlsx
54
Alibaba apply-now(no-biz-info).pdf
19 | P a g e
Version: FINAL
Release Date: November 4, 2019
Classification: Treliant, LLC - Highly Confidential
A00097
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 103 of 162
#
Document Name
55
Alibaba checkout-start-terms.pdf
56
Alibaba First Amendment to Collaboration Agreement.pdf
57
Alibaba userprofile-activity-payments-services.pdf
58
Alibaba_Kabbage - Collaboration Agreement (Executed) (June 20 18).pdf
59
All OFAC tickets June 2019.xlsx
60
approval email of BSA AML Policy from CCO (1).png
61
approval email of BSA AML Policy from CCO.png
62
AR Vapes - Please_DocuSign_AR_VapesMN187k121218.pdf
63
AR Vapes - snip 1.jpg
64
AR Vapes - snip 2.PNG
65
AR Vapes - snip 3.PNG
66
AR Vapes - snip 4.PNG
67
Audit Committee 080515 Minutes and Charter_Signed.pdf
68
Catalog- 2019 Course Catalog for Banking (1).pdf
69
Catalog- 2019 Course Catalog for Banking.pdf
70
Celtic Bank CRA 2019 April.xlsx
71
Celtic Bank CRA 2019 June.xlsx
72
Celtic Bank Loans Taken By Fuelman Customers 2019 April.xlsx
73
Celtic Bank Loans Taken By Fuelman Customers 2019 June.xlsx
74
Celtic Charged Off Accounts 2019 April.xlsx
75
Celtic Charged Off Accounts 2019 June.xlsx
76
Celtic Delinquent Accounts 2019 April.xlsx
77
Celtic Delinquent Accounts 2019 June.xlsx
78
Celtic Loans Taken By Celtic Customers 2019 April.xlsx
79
Celtic Loans Taken By Celtic Customers 2019 June.xlsx
80
CelticClosedAccounts_2019-04.xlsx
81
CelticClosedAccounts_2019-05.xlsx
82
CelticClosedAccounts_2019-06.xlsx
20 | P a g e
Version: FINAL
Release Date: November 4, 2019
Classification: Treliant, LLC - Highly Confidential
A00098
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 104 of 162
#
Document Name
83
CelticDeclinedAccounts_2019-04.xlsx
84
CelticDeclinedAccounts_2019-05.xlsx
85
CelticDeclinedAccounts_2019-06.xlsx
86
CelticNewAccounts_2019-04.xlsx
87
CelticNewAccounts_2019-05.xlsx
88
CelticNewAccounts_2019-06.xlsx
89
Chronology of Events Torozyan Final 20180716.docx
90
Code of Conduct updated 9.20.19.xlsx
91
Complaint Log 2019 April.xlsx
92
Complaint Log 2019 June.xlsx
93
Complaint Log 2019 May.xlsx
94
Compliance Issues Log 2019 July.xlsx
95
FL Publix QAR .xlsx
96
FL Publix QAR 20190517.xlsx
97
Fraud Procedure Doc Q1 2018 (2).docx
98
Fraud_Report_Aug_2019 (1).xlsx
99
Fraud_Report_June_2019 (2).xlsx
100
Hakala Brothers Kabbage Group Inc. wire 001.jpg
101
Hakala Brothers Kabbage wiring instructions 001.jpg
102
High risk customers screenshots 9.23.19.docx
103
Industry Dropdown.png
104
June loans _ $10k screenshots.docx
105
June originations screenshots (SH 9.23.19).docx
106
Kabbage - 2018 Treliant BSA-AML Audit Remediation (1.3.19) copy.xlsx
107
Kabbage - BSA_AML & OFAC Program Manual (FINAL 9.4.19).docx
108
Kabbage - Compliance Management System KBG Board Approved 10.24.18.docx
109
Kabbage - Proposed Revisions to TM & CRR Rules (8.1.19).docx
110
Kabbage AML Training Discussion Deck FINAL #45.pptx
21 | P a g e
Version: FINAL
Release Date: November 4, 2019
Classification: Treliant, LLC - Highly Confidential
A00099
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 105 of 162
#
Document Name
111
Kabbage Application Wizard May 2019.pptx
112
Kabbage Brand Fraud Summary.docx
113
Kabbage Card - Program Terms and Conditions (FINAL Nov 2017)(v2).pdf
114
Kabbage Inc. Mail - GIACT.pdf
115
Kabbage Payments - June.xlsx
116
Kabbage_2019 BSA-AML-OFAC_GQ (SH 9.11.19).docx
117
Kabbage_2019 BSA-AML-OFAC_Observation Vetting (9.25.19).docx
118
Kabbage_2019 BSA-AML-OFAC_Risk Assessment Questions (AH Cmts 9.19.19).docx
119
Kabbage_WorldPay Fifth Third PFMA_20181023_signed.pdf
120
Karrot Celtic Bank CRA 2019 April.xlsx
121
Karrot Celtic Bank CRA 2019 June.xlsx
122
Karrot Celtic Delinquent Accounts 2019 April.xlsx
123
Karrot Celtic Delinquent Accounts 2019 June.xlsx
124
KarrotCelticClosedAccounts_2019-04.xlsx
125
KarrotCelticClosedAccounts_2019-05.xlsx
126
KarrotCelticClosedAccounts_2019-06.xlsx
127
KarrotCelticDeclinedAccounts_2019-04.xlsx
128
KarrotCelticDeclinedAccounts_2019-05.xlsx
129
KarrotCelticDeclinedAccounts_2019-06.xlsx
130
KarrotCelticNewAccounts_2019-04.xlsx
131
KarrotCelticNewAccounts_2019-05.xlsx
132
KarrotCelticNewAccounts_2019-06.xlsx
133
KBG 2019 BSA-AML-OFAC_Training _ #3_2019-09-17.docx
134
KBG Training _ #2 (SH 9.12.19).docx
135
KBG_2019 BSA-AML-OFAC_General Questions #1 (FINAL 9.20.19).docx
136
KBG_2019 BSA-AML-OFAC_Population __2019-09-17 (1).docx
137
KBG_2019 BSA-AML-OFAC_Population __2019-09-17 (2).docx
138
Key for June originations screenshots 9.23.19.pdf
22 | P a g e
Version: FINAL
Release Date: November 4, 2019
Classification: Treliant, LLC - Highly Confidential
A00100
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
#
Document Name
139
KYB_KYC Refresh Overview & High Level Plan .pptx
140
KYC-KYB Checklist (FINAL 1.11.2019).docx
141
Latesha Johnson QAR.xlsx
142
Linda Smith Pay Pal Credentials.png
143
Linda Smith QAR Docs.pdf
144
Monthly Total Ticket # (October 2018- end of July 2019).xlsx
145
OFAC screenshots for Treliant (2).docx
146
OFAC screenshots for Treliant.docx
147
Pay with Kabbage New Product Risk Assessment.docx
148
Payments Demo Videos-20190919.zip
149
Payments Roadmap 1 of 2 .png
150
Payments Roadmap 2 of 2 .png
151
Paypal QAR Report Amended 20190213.xlsx
152
Paypal QAR Report.xlsx
153
Paypal QAR v3 (2.21.19).xlsx
154
police report & affidavit.pdf
155
Police Report.pdf
156
policereport.pdf
157
Population Samples.xlsx
158
Potential_OFAC_Hits_BatchID_68900.pdf
159
Potential_OFAC_Hits_BatchID_68902.pdf
160
Q1 2019 Quarterly Monitoring Final 20190726.xlsx
161
QAR Armenia Rev 20181204.xlsx
162
QAR Callen.xlsx
163
QAR Fealy.xlsx
164
QAR Kabbage Brand Fraud Amend 20190415.xlsx
165
QAR Kabbage Brand Fraud.xlsx
166
QAR Motwani.xlsx
Page 106 of 162
23 | P a g e
Version: FINAL
Release Date: November 4, 2019
Classification: Treliant, LLC - Highly Confidential
A00101
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 107 of 162
#
Document Name
167
QAR Narrative - Aladjadjan Celtic.docx
168
QAR Zoya Torozyan 20180813.xlsx
169
QAR Zoya Torozyan.xlsx
170
QAR-Aladjadjian Celtic.xlsx
171
QAR-Edward Bailey 20190305.xlsx
172
QAR-Linda Smith.xlsx
173
QAR-Multiple Apps 20190403 Ammended 20190414.xlsx
174
QAR-Multiple Apps 20190403.xlsx
175
QAR-Twice as Nice-Amended 20190516.xlsx
176
QAR-Twice is Nice.xlsx
177
Resolution appointing BSA AML OFAC officer.png
178
Samer Abdel Hamid QAR.xlsx
179
Semi-annual testing Q1,2 2019.xlsx
180
Slides from new hire orientation with notes.pptx
181
STEPHEN ORTHOPEDIC SPORT CENTER.pdf
182
Strategic Referral Partners All that still have a contract & when we signed them.xlsx
183
TM alert screenshots for Treliant.docx
184
Transaction Monitoring Rules for Payments (EM 8.27.19).png
185
Treliant - BSA AML Doc Request (8.23.19).xlsx
186
Treliant BSA-AML Audit Remediation (3.19.19).xlsx
187
Treliant Training Questions_2019-09-11.docx
188
Treliant_Sample Request (2).xlsx
189
Updated Treliant samples 9.19.19.xlsx
24 | P a g e
Version: FINAL
Release Date: November 4, 2019
Classification: Treliant, LLC - Highly Confidential
A00102
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 108 of 162
Appendix B: List of Meetings and Walkthroughs
#
Date of
Meeting
Meeting Details
Overview
1
8/26/2019
Azba Habib, BSA/AML Officer
Credit and Fraud Management
2
8/26/2019
1:00 PM
Kaustav Das, Head of Fraud
Siddharth Shah, Risk Analyst
3
8/26/2019
2:30 PM
Account Review
4
8/26/2019
3:00 PM
Compliance Program
5
8/26/2019
4:00 PM
6
8/27/2019
1:00 PM
Compliance Program Operations
7
8/27/2019
1:30 PM
Account Review (Continued from 8/26/2019)
Courtney Kirkpatrick, Risk Analyst
Scott Askins, Chief Compliance Officer
Payment Offering Overview
Nan Siler, Head of Payment Operation
Liz Maiellaro, Corporate Counsel
Kris Nelson, Compliance Analyst
Courtney Kirkpatrick, Risk Analyst
Technology (OFAC)
8
9/13/2019
1:30 PM
Azba Habib, BSA/AML Officer
Sunita Hall, Compliance Analyst
Technology (OFAC) (Continued from 9/13/2019)
9
9/20/2019
9:30 AM
Azba Habib, BSA/AML Officer
Sunita Hall, Compliance Analyst
C. Brooks, Program Manager
C. Hill, Head of Solutions Architecture
25 | P a g e
Version: FINAL
Release Date: November 4, 2019
Classification: Treliant, LLC - Highly Confidential
A00103
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
EXHIBIT 6
Page 109 of 162
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 110 of 162
March 25, 2020
Board of Directors Update
CONFIDENTIAL
A00104
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 111 of 162
Objectives
•
•
Recap immediate responses to this crisis
o
OpEx efforts
o
Lending efforts
o
Government efforts
Discussions/Decisions
o
Lending go forward
o
ABS/ Credit Warehouse / Macquarie (corp facility)
o
Major decision points/potential scenarios
CONFIDENTIAL I 2
A00105
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 112 of 162
A00106
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 113 of 162
A00107
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 114 of 162
We are aggressively reducing operating expenses
Category
Marketing
Description
Estimated savings*
Halted all non-partner customer acquisition spend
Partner spend currently severely curtailed with
reduction in lending risk appetite
Will be reduced further if lending further curtailed
$50-SSmm
•
•
•
Total OPEX
reductions:
$95-110mm
Vendor
Management
Compensation
$5-10mm
•
Terminating non-essential vendor spend
Active discussions to reduce or spread current
payments due, through extending payment terms
and/or receiving price concessions
Optimizing weekly vendor payment cycle
•
•
Immediate freeze on all hiring, including backfills
Significant RIF
$40-$45mm
•
•
* Relative to balance of year budget
Estimated
2020 OPEX
remaining:
$50-65mm
5
A00108
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 115 of 162
A00109
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 116 of 162
We are managing our book aggressively: taking immediate
actions to reduce exposure and overall risk profile
Action Taken
Description
Reduce Existing
Customer
Exposure
•
•
•
•
New Customer
Underwriting
Criteria
•
Identify Cash
Flow Shortfall
•
•
•
(in progress)
Manage down exposure in inactive/ never
borrowed population
Enforce stricter adherence to data connectivity
Revenue
Significant tightening of credit box (i.e., RCM
Tiers 1-5 only) and strategy
Significant tightening of credit box (i.e., NCM
Tiers 1-4 only; blocking high-risk industries)
and strategy
Identify business revenue fall off
Data-driven "quick ratio"
Leverage suite of deep learning models, (e.g.,
balance/ revenue/ shortfall forecasts,
transaction-only risk model)
Summary Portfolio Impact
Pre-Crisis (3112) Post-Action (3/19)
Eligible
customers 1
125K
38K
Total credit
limit
$3.78
$1.08
Open to buy
$2.58
$752MM
Same-day
qualification
rate 4
33%
22%
1) Eligible customers defined as customers who are NOT delinquent/ closed/ charged-off/ EPP, do not have any No Cash Access flags, and have a credit limit> O; includes inactive/ never borrowed customers
7
2) Same-day qualification rate defined as applications that are verified and qualified in the same day; pre-crisis time period = 3/1-3/12; post-action time period = 3/13-3/23
A00110
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 117 of 162
For loans outstanding, we are helping our customers
manage through this time of payment hardship
Tactics to extend payment terms
SMBs across industries
and geographies are
being impacted by this
crisis
For SM Bs that contact us,
we extend payment terms
to bridge until receipt of
government aid or the
end of quarantine
Payment Deferral
3 or 7 day deferral
Skip-a-Pay
Autopay Off unti I
following due date
Extended Payment
Plan {EPP)
Hardship program for
delinquent accounts to
extend payments up to
60 months
Refinancing
Refinance current
obligations into new loan
(launching this week)
8
A00111
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 118 of 162
u,
.....,
0
'+--
'1--
..,
w
Cl)
C:
E
C:
...
Cl)
>
0
(!)
A00112
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 119 of 162
We have worked aggressively to empower Kabbage
to be a vehicle to deliver crisis funding to SMBs
What is the challenge our country faces?
Why Kabbage?
•
•
Our fully automated platform is one of a
handful that can scale quickly to get relief
dollars to SMBs
•
Key capabilities include:
•
Providing relief to SMBs is a 2 part
problem:
o
Allocation of relief funding
o
Disbursement relief funding to SMBs
Once relief funding is allocated, disbursing
funds is a monumental challenge
o
Fully automated, 10 minute
onboarding
Technology and automation must be
used to reach our 31 M SMBs
o
Fully automated underwriting
o
Automated disbursement and
repayment mechanisms
o
o
Traditional Fl infracture alone cannot
handle the volume of SMBs
CONFIDENTIAL
10
A00113
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 120 of 162
Current language in the Coronavirus Stimulus Bill (not yet
passed) enables the Kabbage Platform to help in this crisis
Key takeaways from current bill
• $3498 in government-guaranteed SBA
Small Business Interruption Loans
appropriated
o
Program through 6/30
o
6 month deferral of all payments
o
4% rate cap; 10 year max term
o
Loan forgiveness will be available
with documented funds usage
• Private institutions are lenders; Treasury
can also define non-bank lenders (i.e.,
could include Kabbage)
o
1-5% servicing fee to be paid
Implications for Kabbage
• Lending via platform partnerships
o
Use our tech to facilitate lending for
banks with balance sheets that can
be rapidly deployed
o
Current thinking: pursue 1-2 large
anchor partners and offer standard
"plug and play" for smaller banks
• Direct lending
o
Requires definition of Treasury
guidelines (likely weeks away)
o
Will need to procure alternate
source of funding
CONFIDENTIAL
11
A00114
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 121 of 162
i==
z
-'
<C
UJ
z
Cl
0
u
u::
A00115
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 122 of 162
A00116
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 123 of 162
Overview of 2 facilities used to fund loans
ABS Series 2019-1
Warehouse Facility -- 2019-A
Key facts
•
$1 B receivables; $900MM debt
•
Matures 3/2022; legal final maturity 3/2024
Key facts
•
$181 MM receivables; $165MM debt
•
Matures 6/2023; legal final maturity 6/2024
Key triggers of Rapid Amortization
•
Asset performance based triggers breached
•
Borrowing base deficiency, e.g., if:
o
We stop lending and
o
Too many receivables move from bucket 2
Key triggers of Rapid Amortization
•
Asset performance based triggers breached
•
Financial covenants are breached
•
to bucket 3, etc.
KBG insolvency
Key implications of Rapid Amortization
•
Kabbage earns no revenue on loans in facility
•
Kabbage cannot fund new loans including re-fi
•
Losses in the receivables beyond the first 5%
passed on to the investors
Key triggers of Event of Default
•
Borrowing base deficiency, e.g., if:
o
We stop lending and
o
Too many receivables move from bucket 2
to bucket 3, etc.
Key implications of above:
•
Kabbage earns no revenue on loans in facility
•
Kabbage cannot fund new loans including re-fi
•
Losses in the receivables beyond the first 5%
passed on to the investors
14
A00117
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 124 of 162
Corporate Facility -- Macquarie: Scenarios and Remedies
($50MM drawn; matures October 2021; 1mL +6.25%)
Scenarios
Consequence
Macquarie's Remedies
1) ABS - Rapid Amortization Event
EOD under corporate facility; Macquarie is last in
line after the ABS noteholders
1) Sell the ABS residual interest to a 3rd party likely no buyer in this environment
2) Wait to get paid until after the ABS noteholders
3) Demand KBG to full amount; if KBG doesn't pay,
start a BK petition as long as it is able to get 2 other
creditors to join - KBG doesn't have any other
creditors other than trade creditors
4) File a lawsuit against KBG
2) ABS - Event of Default
Same as Scenario 1
Same as Scenario 1
3) Corporate Facility - declare an EOD based on a
MAE before ABS hits a Rapid Amortization Event
EOD under corporate facility
1) Receive monthly servicing fee and excess
spread in ABS while exploring below options
2) Same as Scenario 1
4) Corporate Facility - Macquarie reduces the value
of the residual before ABS hits a Rapid
Amortization Event
Borrowing base deficiency in corporate facility
(50% of the residual value); last value of residual
was $237MM, needs to drop below $1 00MM to
breach borrowing base
1) Receive monthly servicing fee and excess
spread in ABS to cure borrowing base deficiency
CONFIDENTIAL
15
A00118
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 125 of 162
Liquidity - Facility Amortization Scenario
Af}0/2020
3/31/2(1~
16,862,.407
Portfolio cash Contribution/(Burn)
$
Macquarie Interest
OpeJ</Capex
Claas Product Cash Usage
Potetntial March sho rtfal l of payments
s
s
s (14,533,796) S
$
s
s (6,000,000)
$
200,000
ill.QJJ.J!2()_
illJJ1._Q21'_
$
(330,000) $
(8,424,384) $
(500,000) $
200,000
$
(330,000) S
(6,152,825) S
(1,412,500) $
Tota l Cash Contribution/(Burn)
s
(3,671,389) $
(9,0S4,384) $ (S7,695,325) $
Ending Liquidity
$
55,511,706
46,457,321
➔
➔
s
200,000 $
200,000
9{30/202Q
$
200,000
10/31/~Q_ZQ
$
200,000
ll/_l_lfl_QlQi
'),.1/30/2QlQ
s
200,000
s
200,000
s
$
s
s
s
s
(5,080,214) $
(1,412,500) $
(5,222,347) $
(412,500) $
(5,191,901) $
(412 ,500) $
(5,192,251) S
(412,500) $
(5,465,018) $
(2,412,500) $
(5,465,193) S
(2,412,500) $
(5,465,368)
(2 ,412,500)
(6,292,714) $
(5,434,847) $
(5,404,401) $
(S,404,751) $
(7,677,518) $
(7,677,693) $
(7,677,868)
s (50,000,000)
Macquarie payoff
$
200,000
8/31/2()_21'_
7/31/2029.
$ (11,238,004) $ (17,530,717) $ (22,965,564 ) $ (28,3 69,965) S (33,774,716) $ (41,452,234) $ (49,129,927) $ (56,807,794)
Assumptions:
•
Cease originations; early amortization begins April 1. Servicing income continues for 19-A and sold loans
•
Opex curtailed to $2.Smm in compensation, $2.Smm in technology and other, no marketing
•
Payments/Checking continue, K Card 2.0 delayed to Q420. Cash usage associated with capital requirements for
assumed growth in those products
•
Cash on hand sufficient to fund operations until Macquarie pay down; new capital required at time of pay down
•
March ending cash position assumes sufficient ability to pledge all remaining eligible collateral prior to amortization
No new lending reflected in forecast; new loans would be sold or throttled appropriately until credit facilities re-established
16
A00119
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 126 of 162
i==
z
-'
<C
UJ
z
Cl
0
u
u::
A00120
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 127 of 162
We believe that we should let 2019-1 and 2019-A hit
a Rapid Amortization trigger/EOD trigger respectively
Option
Immediate implications
•
•
Halts lending
•
Kabbage is not subjected to any
credit losses above 5% and 0.5%
cash reserve account
•
Continue to lend at minimal levels to
maintain facility requirements
•
Restricted amount of EPPs and more
than once skip-a-pay even if we get an
amendment consent from Kroll
•
Risks
•
Triggers Macquarie Corporate Facility EOD
~ must either renegotiate terms or cover
$50MM repayment
•
Halts 97% of revenue; would likely need to
raise equity
•
High likelihood we breach some trigger in
30-60 days anyway
~97% of our receivables and
related revenue are trapped
0
B2-B3 roll rates likely to spike
0
Higher than allowed customer relief
program receivables will need to be
funded via equity
0
Lend more to maintain facilities
Buys time for a recovery
•
Would likely need to raise equity
18
A00121
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 128 of 162
We are assessing four potential paths forward
(assuming packaging of assets, separate out ABS/WH)
•
Ensure we have enough capital through 2020 (9 months) - rv$57m
o
Points of consideration
■
Through Q12021 (rv$18mm more)
■
Negotiate with Macquarie or seek buyout of facility
■
Assumes no revenue (could restart lending, etc., government upside)
■
Amount/ Valuation TBD
•
Sell company (conversation with Amex thus far, others to follow)
•
Pre-package BK with DIP financing
•
Work with Silver Lake, TPG, or others to conduct roll-up (call with SL Friday)
19
A00122
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 129 of 162
What would Kabbage look like on the other side?
April
Summer
(post quarantine)
May
Beyond
0-------0--------0-------0--►
Checking alpha/beta
Payments/Checking
Charge card launch
Scale up all products
Government funding
disbursement
package: same day
settlement
Intelligent lending
when the market is
ready
. in !ock-step
mcludmg LOC, as a
true platform
~
Insights: help get your
business running again
("/) Kabbal!" ln,igho,
("/) Kabbage·
(Ill Kabba!!"
0..,..PA~- My Account •3456
(blt .. ct ~~·•"-1'
u,.uu,
$1 1.12:u,
The n ♦Jrt 2 wffks look criti Qot
'!'6uwdlJJ•~d,,:,pb<ii-tho:, ~.000 )">,I
l'>Mdloo"~,...,i,10"""~
flMlf«_,.,.
C
~,..,_...., 7
H ,311.31
Tu nu ,ctlons
P,t,wllftt -
r{IOffp',~
[
~-..,_,
S.-ll.Xlf!O
1"2.20Cl • S<ll,IH0 1
":~
--
20
A00123
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 130 of 162
i==
z
-'
<C
UJ
z
Cl
0
u
u::
A00124
Page 131 of 162
Filed 04/09/26
Doc 97-1
Case 25-52372-CTG
C:
0
C:
0
·.:: u,
ca ..,
E
0
... 'I--
~ ~
Cl)
C: ...
C:
-
~ E
Cl)
C:
0
·.t::: ...
-c >
-c 0
<:C (!)
A00125
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 132 of 162
Executive Summary: .A lleviating Our S1
m all :B usiness Crisis is
Essential to Averting Ec,o n,o,mic ,C ,olllapse
Our 30.8 million small and medium businesses (51,18s), employ 47% of our workforce and account for 40% of payroll. Th ey are critical to our eco nomy
0% have less than 27 days cash buffer on hand, 1 meaning w e must act quickly if w e are going to keep them afloat
he operational complexity of moving money to 30.8 m illion SMBs is massive, and w e must use our country's best-in-class capabilities to enable it
Banks today are equipped to work wi1h t he 92 thou sand umed ium'' SMBs
ey have existing relationships with these entities: relationship managers personally know the companies and their leadership; they have alrea
manually gathered and assessed their paperwork; connections exist to mo ve money to their accounts
However, banks, which rely o n m anual prooes.ses, do not have the ability to serve the tail of 30.7 million small and m icrobusinesses.
Technology and automation must be core to the solution , which must include :
Program onboarding that takes minutes (not days) and includes business v erification to w eed out fraudsters
Underwriting: use of data to determine the amount of relief funding for which a business qualifies with no human rev iew ne
Funding disbursement: movement of money to a qualified Sr.1 B in 1 business day using the Automated Clearing House (ACH )
Monitoring and reporting on funding: loan performance; ongoing fraud monitoring; reporting on fundin g usage (e.g. , confirm usage for payroll)
- A groupoffintech companies has the capabi lities and sea.le to hand le this right now, these companies have developed and refined these
c.apabilities over the last 10 years, rapidly deploying billions of dollars to millions of SMBs
o over-simplify, if the government can fund an account with relief dollars, in a matter of days, these fintechs could connect to this governmentfunded account and quickly and safely move this money to the SMBs in nee
Empow ering fintechs to help quickly in this time of crisis requires the following:
!lowing qualified non-banks to aid small businesses through the SBA 7(a) program
isaster Assistance Programs
P)
llo,•1ingqu alified non-banks to aid small businesses by servicing as an onboarding conduit to SB
Forming federa l or state-lev el SPVs to allow fintech firms to batch fund 51,18s from SPVs under s
erwriting guideline
e need to move quickly to help our Sr.lBs. They will be hit first and most severely in this crisis, and with ea
ay, more will not survive
1 C:hb.!v ci.n'S .re IIC !VTI~ ah:l.r;-s al ~a.r.fo,.-s ,1 ~ caJdpay WI al . ; : ; ~ ~.n:ic •..-a-a . !5 :!°iOA'51D~ (c:ni:JJlud.15 .i
SQJ,lC
A00126
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 133 of 162
We are aggressively working to empower Kabbage to
be a vehicle to deliver crisis funding to SMBs
(additional details)
Multiple policy workstreams
•
•
•
•
Short term SMB stabilization: Kabbage onboards
for SBA programs and 'Treasury Interruption
Loans" - working on regulatory guidance with
Treasury, SBA, and NEC
Medium-term response: Kabbage originates SBA
guaranteed loans and 'Treasury Interruption
Loans" pending rulemaking from Treasury and
SBA
Long term recovery: Kabbage back to BAU but
now arranging partnerships with existing 7(a)
lenders
Spearheading a coordinated industry-wide effort
to present a unified voice
How you can help
•
Help us get the 1 page executive summary
(appendix) in front of Secretary Mnuchin; his office
will control implementation of SMB relief funding
•
Help us think through financial ops proposals with
Treasury/ SBA in the near future
•
Continue to support Kabbage's policy team in DC
•
Use your media presence to:
o
Highlight how urgently SMBs need access to
emergency capital
o
Highlight how a flntech-driven approach is
necessary to operationalize a response
CONFIDENTIAL
24
A00127
Page 134 of 162
Filed 04/09/26
Doc 97-1
Case 25-52372-CTG
C)
Cl)
C:
·-c
0
..,E
u,
ca
CJ
Cl)
...
0
'I--
Cl)
>
·-0 ·-c
C.
-0
'I--
Cl)
Cl)
t:
0
a. -c
A00128
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 135 of 162
Delinquency/ Loss Forecast Methodology: Outstanding
Portfolio
• Leveraged historical early delinquency trends and performance observed in disaster
areas
• Specifically, we look at the amount of principal dollars moving from our current/
non-delinquent balance into our first delinquency bucket (i.e., Bucket 0) - typically a
strong indicator of losses observed
• These baseline 0-1 roll rates are then subjected to a multiplier based on the expected
impact of COVI D-19 across industries
• We applied a uniform flow through rate (moving into later stages of delinquency, B1 + ),
as we have observed little variance in historical observations during shock events
26
A00129
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 136 of 162
Estimating Early Delinquency: Disaster Baseline
• Based on performance during disaster events, we quantified both the severity and duration of
previous "shock" to early delinquency roll rate (i.e., Principal Dollar Bucket 0-1 Roll Rate)
• Chronology divided into three distinct
periods:
Event Period
Duration of event and build
to peak
Peak / Peak Duration Period
Heightened delinquency
beyond event
Recovery Period
Beginning from Peak End to
recovery to "BAU"
delinquency levels of
portfolio
Baseline Disaster Chronology
BO-Bl
Rate
10.00%
9.00%
8.00%
Eve nt
Sta rt
Eve nt
End
Peak Start/
End
BAU
-
Affected Ar eas
-
Non-Affected Areas
7.00%
6.00%
5.00%
4. 00%
3.00%
2.00%
1.00%
0.00%
27
A00130
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 137 of 162
Estimating Early Delinquency: Modeling Timeline
.
• Previous disasters had an "event period" of 22 days - built the delinquency outlook to extend the
timeframe to account for a significantly longer event duration
o
A longer event causes:
■
Higher peak rates and longer peak periods
■
Longer recovery period given longer duration of event itself
• Assumed 88-day event period for COVID - timelines below outline impact to delinquency outlook:
Event Start
Event End
Peak Start<3 >/ End
Full Recovery
(to)
(tzz)
(t94)
(t,sz)
Disaster( 1)
Event Start
Peak Start< 3 >
Peak End< 4 >
Full Recovery< 4 ><5 >
(to)
(t94)
(t,60)
(t374)
4x Duration of Event
COVID-19(2)
Event End
(tss)
Notes:
(1) The disaster dataset analyzed was performance during hurricanes Harvey and Irma. The Event Start is classified as the day the hurricanes formed and Event End is the day the second hurricane dissipated.
(2) COVID-19 scenario assumes an Event Start of March 16th, 2020 and a quarantine/Event End on June 12th, 2020.
(3) The Peak Start of early delinquency remains the same number of days after the Event Start for both the COVID-19 and Disaster scenarios. It is assumed that this is the point where early delinquency will hit a terminal "peak" value. As some
industries hit their peaks earlier than others due to fewer days of cash on hand, this date represents the day that all industries will be at their peak and is the full portfolio peak.
(4) The length of the peak and recovery are both functions of the duration of the event. Additional days from the Event Start to the Event End add to days from Peak Start to Peak End, which add to the days from Peak End to full recovery.
(5) Peak End to Full Recovery in COVID-19 is a linear decline for the entire portfolio back to previously forecasted early delinquency values.
28
A00131
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 138 of 162
Estimating Early Delinquency: Impact By Industry
• Using industry-level cash on hand data, we built an assumption as to when industries reach peak
delinquency
o
In a shorter event, industries with less cash on hand reach their peak delinquency quicker,
due to faster cash shortfall
o
In a longer event, all industries reach their peak delinquencies closer together due to
sustained nature of shock
• Calculated the peak change in delinquency rates based on the expected duration of an event vs. the
duration of the historical disaster set
JPM Days Cas h
Industry
Accomodat ion and Food
Services
Fi nance/lnsu ranee/Real
Estate/Rental and Leasing
At Hand
16
47
Sce nario
Mar-20
Apr-20
May-20
Jun-20
Jul-20
Aug-20
Sep-20
Oct-20
Nov-20
Dec-20
Peak Date
Previous Base lin e
4.05%
3.53%
3.93%
3.60%
4.04%
3.61%
3.70%
4.13%
3.91%
4.03%
N/A
22 Day Event
5.94%
7.05%
7.84%
6.70%
6.09%
4.18%
3.70%
4.13%
3.91%
4.03%
4/17/2020
88 Day Event
6.80%
10.73%
17.45%
17.94%
20.1 0%
17.21%
14.78%
13.20%
9.47%
6.53%
6/12/2020
Prev ious Base li ne
3.36%
2.93%
3.26%
2.99%
3.35%
2.99%
3.07%
3.43%
3.24%
3.35%
N/A
22 Day Event
3.90%
4.33%
5.89%
5.56%
5.05%
3.47%
3.07%
3.43%
3.24%
3.35%
6/18/2020
88 Day Event
5.50%
8.52%
13.76%
14.89%
16.68%
14.29%
12.26%
10.95%
7.86%
5.42%
6/18/2020
Notes:
(1) In a 22 day event, AaFS peaks much quicker than an 88 day event as the industry has fewer days of cash on hand, while FIRERaL peaks at the same day in both scenarios as it is the industry with most cash on hand.
(2) In an 88 day event, both industries reach significantly higher peaks, as the "shock'' of the event adds greater magnitude.
(3) The peak magnitude of events is calculated based on the number of days in an event and is calculated as a multiplier. The multiplier is then applied to the previous portfolio baseline rate.
29
A00132
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 139 of 162
Key Inputs Into Delinquency/ Loss Forecast
•
Based on this logic, we determine the monthly Bucket 0-1 principal roll rates by industry:
Current Balance Distribution (02/29)
3/31/2020 4/30/20l0 5/31/2020 6/30/2020 7/31/2020 8/31/2020 9/30/2020 10/31/2020 11/30/2020 12/31/2020
Accom od ati on and Fo od Services
4.54 %
17.94%
20.10%
17.21%
14.78%
13 .20%
9.47%
6.53%
Agricul t ure/Mini ng/Util ities
0.70%
12.93%
14.49%
12.41%
10.65%
9.51%
6.82%
4.71%
14. 31%
9.05%
6.49%
4.48%
11.41%
8.18%
5 .65%
Arts/Entertainment/Recreati o n
2.16%
14.92%
16.72%
Construction
15.05%
17.08%
19.13%
16.38%
Educat ional Services
1.lo"Ai
12.0 7%
13 .52%
11.58%
Finance/Insurance/Real Estate/Re nt al and Leasing
5.99%
14.89%
16.68%
14. 29%
Food & Beverage Stores
1.21%
Health Care and Social As.sistance
17.51%
20.06%
15.00%
17.18%
5.40%
15.63%
17.90%
In fo rmati on
2.93 %
12.30%
13 .78%
11.80%
Ma nufactu ring
4.67"/4
15.51%
17.37%
14.88%
%
Oth er Services
9.78%
17.51%
19 .62%
16.80%
14.42%
12.88%
9.24%
6.38%
Professi ona l and Busin ess Services
22.37"/4
14.12%
15.82%
13 .55%
11.63%
10.39%
7.45%
5 .14%
17.28%
19.36%
Ret ai l Trade
13.39%
12.71%
9.12%
Transportat ion and W arehousing
5.10%
24.5 7%
27.53%
23 .57%
20.23%
18.07%
12.96%
8.94%
Wh olesal e Trade
4.34%
14.81%
16.59%
14. 20%
12.19%
10.89%
7.81%
5 .39%
16.58%
6.29%
~
Event Period
Peak Period
• Subsequent delinquency roll rates are held constant at the following values, as
we did not identify variance by industry to 1+ roll rates in historical "disaster"
events - represents a 63% flow through rate to charge-off (post-Bucket 1):
Recovery Period
Subsequent Roll Rate
%
1 to z: 85 :()~ :
2 t o 3, 88.7%
3 t o 4 : 92 .1% :
4 to S
St o 6
6 t o C/0
30
A00133
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 140 of 162
Loss Expectation
• Starting Principal Balance as of 02/29 {Bucket 0)
$1.2B
• Avg. Term Outstanding= 8.7 Months 1
• Total Charge-Off Dollars= $393MM (vs. $136MM in normal/ budgeted delinquency forecast)
Industry
Accomodat io n and Food Services
Agricu lture/Mi ni ng/Utilit ies
Arts/ Enterta inment/Recreation
Construction
Educationa l Services
Fin a nce/I nsu ra nce/Rea l Est at e/ Re ntal a nd Leasing
Food & Beverage Stores
Hea lth Care and Social Ass istance
Informat ion
Manufacturing
Other Services
Profess iona l and Busin ess Services
Reta il Trade
Tra nsportation and Ware housing
Wh o lesa le Trade
Total
Starting Balance (as of 02/29)
54,291, 251
8,194,406
25,344,462
176, 236,102
14,801,218
81,919,927
14,196,608
63, 251,453
34, 303,723
54, 695,116
114,525, 354
261, 959,666
156,873,122
59, 769, 676
50,881, 371
1,171, 243,455
Principa l Charge-Off A5 % of Starting Ba lance Principal Charge-Off
35.99%
28.54%
31.84%
34.64%
27.18%
31. 25%
32.55%
35.80%
27.49%
32.66%
35.24%
30.53%
35.21%
43.27%
31. 62%
33.53%
19,538, 714
2,339,087
8,070,558
61,050, 303
4,022,918
25,598, 261
4, 620, 362
22, 646, 310
9,4 28, 962
17,865, 920
40, 358, 775
79, 986, 036
55, 241,037
25,860, 257
16,089,462
392,716,963
Based on when 100% of outstanding balances today are scheduled to be paid off (based on maturity date, weighted by duration); includes EPP balances, which makes up approx. 5% of
total balance
31
A00134
Page 141 of 162
Filed 04/09/26
Doc 97-1
Case 25-52372-CTG
l
..,
.c
Cl)
C
C:
0
C:
·-..,0
...
ca
E
0
'1--
Cl)
C:
c:
--ca u,
··-..,0 ·..,
·- -c
·-c
CJ
~ .f
A00135
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 142 of 162
ABS Series 2019-1: Key Facts
Outstanding Debt
$900MM
Scheduled Maturity
15-Mar-22
Legal Final Maturity
Mar-24
Rating Agency
Ratings
Over-Collateralization/First Loss Piece
Monthly Excess Spread (includes Servicing Fee)
Receivables in the transaction
Kroll
Rapid Amortization Events:
1)
Asset performance based triggers are breached
2)
Asset deficiency or borrowing base deficiency happens and remains uncorrected for 3
BO - will happen when receivables move from bucket 2 to bucket 3 or if any of the
receivables because of concentration limits fall out of the borrowing base and we don't have
cash or new receivables to put them in the transaction
AA,A,BBB,BB,B
3)
A servicer default occurs
4)
KBG insolvency occurs
5)
An Event of Default occurs
6)
Failure to make any payments or deposit money when due within 5 BO
7)
Breach of any reps and warranties across different documents
5%
$10-12MM
$1B
CONFIDENTIAL
33
A00136
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 143 of 162
ABS Series 2019-1: Rapid Amortization Event
Process and Impact
•
If we stop new originations, we will be unable to meet the borrowing base requirements under 2) and hit a rapid amortization
•
Rapid Amortization can start as early as we breach the borrowing base; first investor payment could happen on April 15th if we breach before
•
Once a Rapid Amortization Event is declared by Kabbage, all cash collections from the customers are trapped in the SPV and are used to pay
the noteholders first; Kabbage will still have to service the receivables till March 2024 and also produce monthly servicer reports
•
During this time, Kabbage doesn't receive any servicing fees
•
Also, no borrowing base needs to be maintained which means, we don't have to cure the delinquencies and as a result, no liquidity drag
•
The 5% risk retention or the first loss piece will likely need to be recorded as an expected loss
•
If noteholders are not paid in full by the legal final maturity date, an Event of Default occurs and noteholders have the ability to sell the
remaining collateral in the SPV
•
Interaction with the corporate facility is outlined separately
Risks
•
As open to buy line for customers is shut down, credit losses are likely to increase even further, causing a large portion of noteholders to incur
principal loss
•
Future ability of capital markets access is severely impaired
•
While the transaction is non-recourse to Kabbage and we have sufficient risk factors coverage, noteholders may find reasons to take legal
actions against Kabbage, especially if they have incurred principal losses: potential breach of reps and warranties, breach of contractual
provisions especially servicing
•
Therefore, offering products such as re-financing or offering relief programs to the customer beyond the limits in the transaction could lead to a
litigation risk that KBG as a servicer is not acting to maximize recoveries or in accordance with the transaction documents
•
There is an option to enter into a servicer default which will transfer servicing to the back-up servicer but this provides another opportunity for
the noteholders to take legal action against Kabbage for breaching contractual obligations in the servicing agreement
CONFIDENTIAL
34
A00137
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 144 of 162
Warehouse Facility -- 2019-A: Key Facts
Outstanding Debt
$165MM
Scheduled Maturity
15-June-23
1)
Asset performance based triggers are breached
Legal Final Maturity
June-24
2)
Breach of any financial covenant
Kroll
3)
A servicer default occurs
A
4)
An Event of Default occurs
5%
5)
Reduction of Class A rating to below 'A'
Rating Agency
Ratings (Class A only)
Over-Collateralization/First Loss Piece
Monthly Excess Spread
Rapid Amortization Events:
$1-2MM
Events of Default:
Receivables in the transaction
Class A Lender
Class B Lender
$181MM
1)
Borrowing base deficiency is not cured within 2BD
2)
And others
20 Gates
Atalaya Capital
CONFIDENTIAL
35
A00138
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 145 of 162
Warehouse Facility -- 2019-A: Event of Default
Process and Impact
lfwe stop new originations, we will be unable to meet the borrowing base requirements and hit an EOD vs a rapid amortization
•
•
The lenders will need to send a notice to KBG that a Facility Termination Date has occurred
•
All cash collections from the customers are trapped in the SPV and are used to pay the lenders first; Kabbage will still have to service the
receivables till June 2024 and also produce monthly servicer reports unless the lenders exercise their remedy outlined below
•
During this time, Kabbage receives monthly servicing fees
•
Also, no borrowing base needs to be maintained which means, we don't have to cure the delinquencies and as a result, no liquidity drag
•
The 5% first loss piece will likely need to be recorded as an expected loss
•
The remedies available to the lenders will allow them to:
o
Sell the receivables in the SPV to a 3rd party, which in this market is probably impossible for them to do
o
Direct the SMB customers to make payments to a dedicated account in the name of the lenders - highly impractical for them to do as
they don't have the resources or the expertise to this
We will negotiate with the lenders to let the receivables cash flow be used to pay them down vs exercising their remedy
•
Risks
•
•
•
•
•
As open to buy line for customers is shut down, credit losses are likely to increase even further, causing some lenders to incur principal loss
While the transaction is non-recourse to Kabbage and we have sufficient risk factors coverage, lenders may find reasons to take legal actions
against Kabbage, especially if they have incurred principal losses: potential breach of reps and warranties, breach of contractual provisions
especially servicing
Therefore, offering products such as re-financing or offering relief programs to the customer beyond the limits in the transaction could lead to a
litigation risk that KBG as a servicer is not acting to maximize recoveries or in accordance with the transaction documents
There is an option to enter into a servicer default which will transfer servicing to the back-up servicer but this provides another opportunity for
the lenders to take legal action against Kabbage for breaching contractual obligations in the servicing agreement
CONFIDENTIAL
36
We expect that the possibility of any litigation action by the lenders is very low.
A00139
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
EXHIBIT 7
Page 146 of 162
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 147 of 162
March 30, 2020
The Honorable Steven Mnuchin
Secretary of the Treasury
U.S. Department of the Treasury
1500 Pennsylvania Avenue NW
Washington, D.C. 20220
The Honorable Jovita Carranza
Administrator
U.S. Small Business Administration
409 3rd Street SW
Washington, D.C. 20416
Dear Secretary Mnuchin and Administrator Carranza:
We write to request your immediate and sustained attention and commitment to
implementing the Keeping American Workers Paid and Employed Act, which President Trump
signed into law on March 27, 2020, as part of the Coronavirus Aid, Relief, and Economic Security
Act, known as the CARES Act (Public Law 116-136). The Keeping American Workers Paid and
Employed Act provides $377 billion in immediate and meaningful relief to small businesses so that
they can remain operational despite economic losses caused by the COVID-19 pandemic. This
includes the Paycheck Protection Program – a new loan guarantee program created under the Small
Business Administration’s (SBA’s) 7(a) program that is intended to assure employees of covered
small businesses not only a paycheck in the near-term, but also the longer term assurance that their
job will still be there for them.
It is critical that this relief is disbursed to small businesses as quickly as possible to help
ensure that no small businesses are forced to choose between solvency and retaining their
employees during this uncertain time. To that end, we urge the Treasury Department and the SBA
to quickly issue publicly-available, comprehensive guidance to lenders and businesses on the
assistance available, including the Paycheck Protection Program, emergency Economic Injury
Disaster Loan grants, and debt relief provisions. We also ask that you continue to expeditiously
upgrade and update the SBA website so that it is simple for borrowers to find links to the programs
authorized under the CARES Act, identify Paycheck Protection Program lenders, and apply for the
paycheck and grant assistance.
As all of government works to stop the spread of COVID-19, it is incumbent upon
Congress and your agencies to work together to ensure that workers and small businesses have
every opportunity afforded by this law to provide for and enjoy the dignity of work, which is
second only to the immediate health and safety of Americans, and the need for workers and
families to continue to receive income to pay their bills.
A00140
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 148 of 162
Thank you for your immediate attention to these matters. We stand ready to assist your
efforts to implement the Keeping American Workers Paid and Employed Act. Thank you for your
efforts.
Sincerely,
___________________________
Marco Rubio
Chairman
Senate Committee on Small Business
and Entrepreneurship
____________________________
Benjamin L. Cardin
Ranking Member
Senate Committee on Small Business
and Entrepreneurship
___________________________
Susan Collins
Chairman
Senate Special Committee on Aging
____________________________
Jeanne Shaheen
Member
Senate Committee on Small Business
and Entrepreneurship
A00141
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
EXHIBIT 8
Page 149 of 162
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 150 of 162
PAYCHECK PROTECTION PROGRAM (PPP) INFORMATION SHEET:
BORROWERS
The Paycheck Protection Program (“PPP”) authorizes up to $349 billion in forgivable loans to
small businesses to pay their employees during the COVID-19 crisis. All loan terms will be the
same for everyone.
The loan amounts will be forgiven as long as:
The loan proceeds are used to cover payroll costs, and most mortgage interest, rent, and
utility costs over the 8 week period after the loan is made; and
Employee and compensation levels are maintained.
Payroll costs are capped at $100,000 on an annualized basis for each employee. Due to likely
high subscription, it is anticipated that not more than 25% of the forgiven amount may be for
non-payroll costs.
Loan payments will be deferred for 6 months.
When can I apply?
Starting April 3, 2020, small businesses and sole proprietorships can apply for and
receive loans to cover their payroll and other certain expenses through existing SBA
lenders.
Starting April 10, 2020, independent contractors and self-employed individuals can
apply for and receive loans to cover their payroll and other certain expenses through
existing SBA lenders.
Other regulated lenders will be available to make these loans as soon as they are
approved and enrolled in the program.
Where can I apply? You can apply through any existing SBA lender or through any federally
insured depository institution, federally insured credit union, and Farm Credit System institution
that is participating. Other regulated lenders will be available to make these loans once they are
approved and enrolled in the program. You should consult with your local lender as to whether it
is participating. Visit www.sba.gov for a list of SBA lenders.
Who can apply? All businesses – including nonprofits, veterans organizations, Tribal business
concerns, sole proprietorships, self-employed individuals, and independent contractors – with
500 or fewer employees can apply. Businesses in certain industries can have more than 500
employees if they meet applicable SBA employee-based size standards for those industries (click
HERE for additional detail).
For this program, the SBA’s affiliation standards are waived for small businesses (1) in the hotel
and food services industries (click HERE for NAICS code 72 to confirm); or (2) that are
franchises in the SBA’s Franchise Directory (click HERE to check); or (3) that receive financial
assistance from small business investment companies licensed by the SBA. Additional guidance
may be released as appropriate.
A00142
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 151 of 162
What do I need to apply? You will need to complete the Paycheck Protection Program loan
application and submit the application with the required documentation to an approved lender
that is available to process your application by June 30, 2020. Click HERE for the application.
What other documents will I need to include in my application? You will need to provide
your lender with payroll documentation.
Do I need to first look for other funds before applying to this program? No. We are waiving
the usual SBA requirement that you try to obtain some or all of the loan funds from other sources
(i.e., we are waiving the Credit Elsewhere requirement).
How long will this program last? Although the program is open until June 30, 2020, we
encourage you to apply as quickly as you can because there is a funding cap and lenders need
time to process your loan.
How many loans can I take out under this program? Only one.
What can I use these loans for? You should use the proceeds from these loans on your:
Payroll costs, including benefits;
Interest on mortgage obligations, incurred before February 15, 2020;
Rent, under lease agreements in force before February 15, 2020; and
Utilities, for which service began before February 15, 2020.
What counts as payroll costs? Payroll costs include:
Salary, wages, commissions, or tips (capped at $100,000 on an annualized basis for each
employee);
Employee benefits including costs for vacation, parental, family, medical, or sick leave;
allowance for separation or dismissal; payments required for the provisions of group
health care benefits including insurance premiums; and payment of any retirement
benefit;
State and local taxes assessed on compensation; and
For a sole proprietor or independent contractor: wages, commissions, income, or net
earnings from self-employment, capped at $100,000 on an annualized basis for each
employee.
How large can my loan be? Loans can be for up to two months of your average monthly
payroll costs from the last year plus an additional 25% of that amount. That amount is subject to
a $10 million cap. If you are a seasonal or new business, you will use different applicable time
periods for your calculation. Payroll costs will be capped at $100,000 annualized for each
employee.
How much of my loan will be forgiven? You will owe money when your loan is due if you use
the loan amount for anything other than payroll costs, mortgage interest, rent, and utilities
payments over the 8 weeks after getting the loan. Due to likely high subscription, it is anticipated
that not more than 25% of the forgiven amount may be for non-payroll costs.
You will also owe money if you do not maintain your staff and payroll.
A00143
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 152 of 162
Number of Staff: Your loan forgiveness will be reduced if you decrease your full-time
employee headcount.
Level of Payroll: Your loan forgiveness will also be reduced if you decrease salaries and
wages by more than 25% for any employee that made less than $100,000 annualized in
2019.
Re-Hiring: You have until June 30, 2020 to restore your full-time employment and
salary levels for any changes made between February 15, 2020 and April 26, 2020.
How can I request loan forgiveness? You can submit a request to the lender that is servicing
the loan. The request will include documents that verify the number of full-time equivalent
employees and pay rates, as well as the payments on eligible mortgage, lease, and utility
obligations. You must certify that the documents are true and that you used the forgiveness
amount to keep employees and make eligible mortgage interest, rent, and utility payments. The
lender must make a decision on the forgiveness within 60 days.
What is my interest rate? 0.50% fixed rate.
When do I need to start paying interest on my loan? All payments are deferred for 6 months;
however, interest will continue to accrue over this period.
When is my loan due? In 2 years.
Can I pay my loan earlier than 2 years? Yes. There are no prepayment penalties or fees.
Do I need to pledge any collateral for these loans? No. No collateral is required.
Do I need to personally guarantee this loan? No. There is no personal guarantee requirement.
***However, if the proceeds are used for fraudulent purposes, the U.S. government will pursue
criminal charges against you.***
What do I need to certify? As part of your application, you need to certify in good faith that:
Current economic uncertainty makes the loan necessary to support your ongoing
operations.
The funds will be used to retain workers and maintain payroll or to make mortgage,
lease, and utility payments.
You have not and will not receive another loan under this program.
You will provide to the lender documentation that verifies the number of full-time
equivalent employees on payroll and the dollar amounts of payroll costs, covered
mortgage interest payments, covered rent payments, and covered utilities for the eight
weeks after getting this loan.
Loan forgiveness will be provided for the sum of documented payroll costs, covered
mortgage interest payments, covered rent payments, and covered utilities. Due to likely
high subscription, it is anticipated that not more than 25% of the forgiven amount may
be for non-payroll costs.
All the information you provided in your application and in all supporting documents
and forms is true and accurate. Knowingly making a false statement to get a loan under
this program is punishable by law.
A00144
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 153 of 162
You acknowledge that the lender will calculate the eligible loan amount using the tax
documents you submitted. You affirm that the tax documents are identical to those you
submitted to the IRS. And you also understand, acknowledge, and agree that the lender
can share the tax information with the SBA’s authorized representatives, including
authorized representatives of the SBA Office of Inspector General, for the purpose of
compliance with SBA Loan Program Requirements and all SBA reviews.
A00145
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
EXHIBIT 9
Page 154 of 162
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 155 of 162
PAYCHECK PROTECTION PROGRAM (PPP) INFORMATION SHEET
LENDERS
Who is eligible to lend? All existing SBA-certified lenders will be given delegated authority
to speedily process PPP loans.
All federally insured depository institutions, federally insured credit unions, and Farm Credit
System institutions are eligible to participate in this program.
•
New lenders that are federally insured depository institutions, federally insured credit
unions, or Farm Credit System institutions will need to submit their application to
DelegatedAuthority@sba.gov to apply.
Non-bank and non-insured depository institution lenders can also begin making loans as
soon as they are approved and enrolled in the program.
•
New lenders that are non-bank or non-insured depository institution lenders will
need to submit their application to NFRLApplicationForPPP@sba.gov to apply.
Are these loans guaranteed by the SBA? Yes, the SBA guarantees 100% of the
outstanding balance, and that guarantee is backed by the full faith and credit of the United
States.
Are there guarantee fees? The SBA waives all SBA guaranty fees, including the upfront
and annual servicing fees.
What underwriting is required? As explained in the PPP Interim Final Rule, you will need
to confirm receipt of borrower certifications; confirm receipt of information demonstrating
that a borrower had employees for whom the borrower paid salaries and payroll taxes on or
around February 15, 2020; confirm the dollar amount of average monthly payroll costs; and
follow applicable Bank Secrecy Act requirements. Lenders are permitted to rely on borrower
certifications and representations as explained in the PPP Interim Final Rule and FAQ
guidance.
How will lenders be compensated? Processing fees will be based on the balance of the
financing outstanding at the time of final disbursement. SBA will pay lenders fees for
processing PPP loans in the following amounts:
•
•
•
Five (5) percent for loans of not more than $350,000;
Three (3) percent for loans of more than $350,000 and less than $2,000,000; and
One (1) percent for loans of at least $2,000,000.
Lenders may not collect any fees from the applicant.
Who can be an agent? An agent is an authorized representative and can be:
•
•
•
•
•
An attorney;
An accountant;
A consultant;
Someone who prepares an applicant’s application for financial assistance and is
employed and compensated by the applicant;
Someone who assists a lender with originating, disbursing, servicing, liquidating, or
A00146
Case 25-52372-CTG
•
•
Doc 97-1
Filed 04/09/26
Page 156 of 162
litigating SBA loans;
A loan broker; or
Any other individual or entity representing an applicant by conducting business with the
SBA.
How will agents be compensated? Agent fees will be paid out of lender fees. The lender will
pay the agent. Agents may not collect any fees from the applicant. The total amount that an
agent may collect from the lender for assistance in preparing an application for a PPP loan
(including referral to the lender) may not exceed:
•
•
•
One (1) percent for loans of not more than $350,000;
0.50 percent for loans of more than $350,000 and less than $2 million; and
0.25 percent for loans of at least $2 million.
Can these loans be sold in the secondary market? PPP loans can be sold in the
secondary market. The SBA will not collect any fee for any guarantee sold into the
secondary market.
Please refer to the PPP Interim Final Rule and FAQ guidance for the most comprehensive and
up-to-date guidance on this program.
A00147
Case 25-52372-CTG
Doc 97-1
Filed 04/09/26
Page 157 of 162
EXHIBIT 10
Case 25-52372-CTG
fghgijkÿmnoniÿpq
Doc 97-1
Filed 04/09/26
Page 158 of 162
rstuÿvhfwÿxsyysz{ÿs{ÿ|}~~{ÿ}yyÿx s{~ÿstyÿy~~kÿxpÿ{ÿ~ÿx~s{ÿ{~~~{t~ÿ ysst~ÿqzsystsz
5ÿ1c898ÿV3`873ÿ1Yÿ73ÿd873ÿ773ÿ1Z362370363Xÿ1Vÿ1ÿe1V
0123ÿÿ567893ÿ369ÿÿ87ÿÿ881ÿ8ÿ23639ÿ2 ÿ83 ÿ 87 ÿ363ÿ
!"#$%&ÿ(%)*ÿ%+%*%ÿ,-.,/
)012ÿ345/ÿ6077089ÿ09ÿ%:;<=;9>?ÿ*:@77
6AB09;BBÿ!@C01@7ÿ!7;@<;DEÿ*6ÿ@9D
F<;@BA<?ÿ6;=09ÿG9C<;>;D;91;DÿHAI70>.
H<0J@1;ÿK8I070L@1089ÿ%M8<1ÿ18ÿ&0B1<0IA1;
NA9DB
50OPQRSPÿTÿU11V8ÿW63837ÿR62Xÿ88ÿ1Y
73ÿ871689ÿ161Z86ÿ58ÿ[383Yÿÿ911289
39687ÿ\5[]ÿ597ÿ5ÿ528876716ÿ^1Z87ÿ___
W`8 3ÿ1ÿ568ÿaÿabab
uttoggzgtsy~gininggnighfwsyysz{~}~~{}yy s{~styy~~t~~s{{~~~{t~ ysst~n
A00148
mg
Case 25-52372-CTG
defeghiÿklmlgÿno
Doc 97-1
Filed 04/09/26
Page 159 of 162
pqrsÿtfduÿvqwwqxyÿqyÿz{|}~|yÿ{wwÿvqy|ÿqrwÿw|}|iÿvnÿyÿ}|}ÿv|~qyÿy}|||yr|ÿwq}qr|ÿoxqwqrqx
0123456785ÿÿ ÿÿÿÿÿÿÿ! "#ÿ$%ÿ&%
"ÿ' ÿ()ÿ*!$&'(+ÿ$%ÿ(,$ÿ$"ÿ-#"ÿ!""."ÿ"ÿ")ÿ(")
(#ÿ/ÿ0 ÿ")ÿ" ÿ"ÿÿ(,$ÿ"ÿ")ÿ1"ÿ"#ÿ"ÿ"
2ÿ 2."ÿ3 ÿÿ2"4ÿ"ÿÿÿÿÿ#ÿ"ÿ2
ÿÿ""ÿ)ÿ/
ÿ!$&'(ÿ$ÿ"2ÿ"ÿÿ5678ÿ2ÿ")4ÿÿ"/ÿÿ"ÿ
#ÿ9ÿÿÿÿÿ"ÿ2ÿÿ)ÿ"ÿ"ÿ
2ÿ"ÿ4ÿÿ 4ÿ )/
:ÿÿ29#"ÿ"ÿÿÿÿ"ÿ"ÿ2ÿ
" ÿ""ÿ;4)/ÿ<ÿ"ÿÿÿ ÿÿ"ÿÿÿ 99 "ÿ
"ÿ2ÿ=ÿÿ""%ÿ"ÿ %ÿ"ÿ2ÿÿÿÿ"ÿ2
"ÿ"ÿÿ )ÿ#%>ÿ"ÿ$"ÿ!""."/ÿ:(ÿÿÿ"#
?ÿ""ÿÿÿ)ÿ""ÿ"ÿ2ÿ"ÿ")ÿ"ÿÿ4%ÿÿ
ÿÿÿ)ÿ"ÿ ÿÿ"4ÿÿ"/ÿ@ÿ"ÿ ÿ
ÿÿ"ÿ ÿ"ÿ6Aÿÿ"ÿ2ÿ"ÿÿ )%ÿÿ"
)ÿ"ÿ ÿÿ2ÿÿÿÿÿ"ÿ ÿ/>
:ÿ"ÿ#ÿ"ÿ2ÿB2ÿÿ"ÿÿ#ÿÿ4ÿÿ")
"ÿ"ÿ#"ÿÿ4ÿ 4ÿ )%>ÿ"ÿ(")ÿ0/ÿ:")ÿ"ÿ
("ÿ,ÿ$"ÿCÿÿ"#ÿÿ"ÿÿ"ÿÿ2)ÿ$ÿ6ÿÿ"
2ÿ"ÿÿÿ"ÿ""ÿ(,$ÿD*"+ÿ%ÿ2"4%ÿÿÿ%ÿ")ÿÿ"ÿ"%
"ÿ2ÿ"#ÿÿÿ"ÿ")/ÿÿ"ÿÿ2ÿ#ÿ"ÿÿ"ÿÿÿ"ÿÿ
4ÿ )ÿÿÿ") ÿ"ÿÿ"ÿÿC/>
ÿÿ"ÿ"ÿÿÿ"ÿ2ÿÿÿ") ÿ"ÿÿ2
"ÿC/ÿEÿÿ#ÿ"ÿ""ÿÿ2ÿ ÿ ""
;%ÿ"ÿ""%ÿÿ(,$ÿÿ=ÿ"ÿÿ"ÿFAAGÿ""ÿÿ(,$/ÿ$ÿ"
")ÿÿ2ÿÿÿCÿ /ÿ0 ÿ ")%ÿÿ(,$ÿÿ#ÿÿ ÿ
ÿ"ÿ ÿ"ÿ"ÿÿÿ #ÿÿÿÿ4ÿÿ") ÿ %ÿ%ÿ%
"ÿ "ÿ/
7HIÿJKLMHIMNÿJOPQIMQRPSÿJOPTOKUÿRVÿVWIMRXRMKYYLÿZIVRTSIZÿQPÿHIYWÿVUKYYÿ[\VRSIVVIVÿNIIW
QHIROÿ]PONXPOMIÿIUWYPLIZ^ÿ_RVRQÿ2`1^TPabcPOPSKaRO\V ÿXPOÿUPOIÿRSXPOUKQRPSÿPSÿQHI
srrmee~xe}rqw|eglgle}elgefduqwwqxy|{|}~|y{wwqy|qrww|}|r}|}|~qyy}|||yr|wq}qr|l
A00149
ge
Case 25-52372-CTG
STUTVWXÿZ[\[Vÿ]^
Doc 97-1
Filed 04/09/26
Page 160 of 162
_àbÿcUSdÿef̀f̀ghÿ̀hÿijklmkhnoÿpjqffÿersh̀kssÿtquàqfÿtfkqlkvXÿpe]ÿqhvÿwlkqsrloÿekmh̀ÿxhulknkvkhakvÿyrzf̀n{yl`|qakÿ^gzf̀`}qàg~
01234536ÿ08953 9 ÿ089 81
ÿÿÿÿÿÿÿ!ÿ"ÿ#$ÿ%&'ÿ()()'ÿ*ÿ+*ÿ!
ÿÿ!+ÿ,-.ÿ+*ÿ/ÿ0/ÿ1)'ÿ()()$
291 ÿ3584ÿ5ÿ69 7 9 4
8ÿ/****9ÿ:ÿ*ÿ/****'ÿ!/,ÿ-"*'ÿ;*ÿ<*'
ÿ!!*'ÿ*ÿ**'ÿ*"-+,ÿ,,/*'ÿ,ÿ,,
!!*'ÿÿ&))ÿÿ"ÿ+*'ÿÿÿÿÿÿ/ÿ"ÿ+*ÿ*
+ÿÿ=>:ÿ*ÿÿ*<ÿ*,,ÿ"ÿ!ÿ,/**
?@/ÿÿ/ÿ/ÿÿA%)ÿ
Bÿ"**ÿ"ÿ!,*ÿ/*,ÿ"ÿ+ÿ!**ÿ,ÿÿ,*,ÿ/***
ÿ@**ÿÿÿCÿD*ÿ"ÿÿ,ÿ"ÿÿÿE,/ÿÿD+ÿ
*/*!'ÿÿ*ÿ!,ÿÿÿÿÿ(&Fÿ"ÿÿ"ÿ/ÿ+ÿÿ"
-+ÿ!**G
:ÿ*ÿ/,ÿ*ÿÿÿÿÿ"ÿ,!ÿ"/*9
H*ÿÿ"ÿ%F
?/+ÿ"ÿ(ÿ+*
#*ÿ+ÿ,",ÿ"ÿ*@ÿ*
%))Fÿ/ÿ+ÿ=>:
Iÿ!
Iÿ*ÿ/*
Iÿÿÿ,ÿ"*ÿ+ÿÿ=>:
=>:J*ÿ/!ÿ!*ÿÿÿ*ÿ"ÿÿ**ÿ"ÿ**ÿDÿ+ÿÿ:!+ÿ*!ÿ
K*,J*ÿ8!+ÿL!ÿÿ@,/*+ÿ,ÿ!ÿÿ"!+ÿ,***,
/****ÿ.!,ÿ+ÿÿM/*ÿEMN;HL-%OGÿ,!$ÿ=!ÿ?!ÿ%P'ÿ=>:ÿ*ÿD
ÿ"ÿ**9
L!,ÿÿ**ÿ,ÿ*ÿÿ"ÿ8!!ÿHQ/+ÿL**ÿBÿ***!
%-+ÿ,"ÿÿ8!!ÿHQ/+ÿL**ÿB*ÿ,,ÿ,/ÿÿMN;HL-%O
:/!ÿ,"ÿ"ÿ/*ÿ,**ÿ*ÿ"ÿ*ÿ,ÿ/****ÿ/
()()ÿ
Rÿ"ÿ**ÿ/ÿ()()
baaus\TTszqmg|TqlànfkTV[V[TqulT[VTUSd{zf̀f̀gh{kjklmkhno{sjqff{zrsh̀kss{nquàqf{nfkqlkv{szq{alkqsrlo{zkmh̀{rhulknkvkhakv{urzf̀n{ul`|qak{[
A00150
UT
Case 25-52372-CTG
YZ[Z\]^ÿ̀aba\ÿcd
Doc 97-1
Filed 04/09/26
Page 161 of 162
efghÿi[Yjÿkfllfmnÿfnÿopqrsqntuÿvpwllÿkxyfnqyyÿzw{fgwlÿzlqwrq|^ÿvkcÿwn|ÿ}rqwyxruÿkqsfnÿ~n{rqtq|qngq|ÿxlftrfwgqÿdmflfwgfm
9 2ÿ 7747543 ÿ74ÿ741ÿ574275ÿ75ÿ ÿ 251ÿ27ÿÿ3 51 1
ÿ
ÿ
1ÿ7522
ÿ"#$$ÿ%&'()*''
+,"()('-.#-(/)
ÿ041 12314 7
012345ÿ27ÿ278
+5/&-ÿ%+
7522ÿ
67275
787 5ÿ1152
819 477
ÿ7
6114:8ÿ21
?@*)ÿA/B*.)"*)C4117ÿ7ÿD574275ÿ2
87ÿC14ÿ2
+5/&-ÿ-;*ÿ'(-*
21ÿ8
04<ÿ87<
65=5ÿ87<
05ÿ531
1 2<
> 14
?B*.'(A;D581274ÿE1514
7<
(A)ÿ&@
0111ÿ574275
732ÿ387 5ÿ
1152Fÿ519 ÿ142Fÿ5
8474ÿ3821
GÿIJKILMNOPÿMÿQORSIQOKÿTIOUK
VW
XD0ÿ71W
hgg{ybZZ ywsmZwrgftlqZ\a\aZw{rZa\Z[Yjfllfmnqpqrsqntuypwllxyfnqyytw{fgwltlqwrq|ywgrqwyxruqsfnxn{rqtq|qngq|{xlft{rfwgqa
A00151
YZ
Case 25-52372-CTG
EFGFHIJÿLMNMHÿOP
Doc 97-1
Filed 04/09/26
Page 162 of 162
QRSTÿUGEVÿWRXXRYZÿRZÿ[\]^_]Z`aÿb\cXXÿWdeRZ]eeÿfcgRScXÿfX]c^]hJÿbWOÿcZhÿi^]ced^aÿW]_RZÿjZg^]`]h]ZS]hÿkdlXR̀mk^RncS]ÿPYlRXRocSRYp
0123ÿ5676ÿ89 28
928ÿ635ÿ5632
527ÿ635ÿ129632
2679389
2638ÿ635ÿ611268
0 5863
65ÿ635ÿ52377ÿ72
729 829
9
!"#$%&'#(ÿ*+ÿ!,-ÿ
(./'0$
19 ÿ396793ÿ2
93ÿ2ÿ825ÿ3
6 95632ÿ27ÿ9
22872ÿ16ÿ19
34!4ÿ!./00ÿ,"$'5($$ÿ-6.'5'$*&/*'+5
789ÿ:5ÿ7;ÿ
683793;ÿ<=ÿ>87?@
A88BA>CBDC>>
TSSgeNFFqqqrelcr_YnFc^SR̀X]FHMHMFcg^FMHFGEVmlRXXRYZm]\]^_]Z`ame\cXXmldeRZ]eem`cgRScXm`X]c^]hmelcmS^]ced^aml]_RZmdZg^]`]h]ZS]hmgdlXR̀mg^RncS]mM
A00152
sFsFile and source
- File
- CASE_DEB_25-52372_KServicing-v-Frohwein_doc97-2_JOINT-APPENDIX-EX01-10_2026-04-09.pdf
- Size
- 8,444,221 bytes
- SHA-256
- 59c9fdcf2f460f550e56b6f460b47c1c9e4f76fb21ead98ec473d16c0aaf2684
- Original
- No public link identified.