# EDGAR Filing Document

**Accession Number:** 0000824468
**File Stem:** 0000824468-23-000001
**Filing Date:** 2023-2
**Character Count:** 209592
**Document Hash:** 9244dde3e12201440e1e30b4caf7f3fb
**Contains OCR:** False
**Source Format:** 

## Filing Content

## Filing Summary
**0000824468-23-000001.hdr.sgml**: 20230302

**ACCESSION NUMBER**: 0000824468-23-000001

**CONFORMED SUBMISSION TYPE**: SBSE/A

**PUBLIC DOCUMENT COUNT**: 12

**FILED AS OF DATE**: 20230227

**DATE AS OF CHANGE**: 20230302

**FILER**: 

**COMPANY DATA:**
- **COMPANY CONFORMED NAME:** CREDIT SUISSE AG/
- **CENTRAL INDEX KEY:** 0000824468
- **IRS NUMBER:** 135015677

**FILING VALUES:**
- **FORM TYPE:** SBSE/A
- **SEC ACT:** 1934 Act
- **SEC FILE NUMBER:** 026-00191
- **FILM NUMBER:** 23696735

**BUSINESS ADDRESS:**
- **STREET 1:** PARADEPLATZ 8
- **CITY:** ZURICH
- **STATE:** V8
- **ZIP:** CH 8001
- **BUSINESS PHONE:** 41 44333 2751

**MAIL ADDRESS:**
- **STREET 1:** PARADEPLATZ 8
- **CITY:** ZURICH
- **STATE:** V8
- **ZIP:** CH 8001

**FORMER COMPANY:**
- **FORMER CONFORMED NAME:** CREDIT SUISSE/
- **DATE OF NAME CHANGE:** 20050629

**FORMER COMPANY:**
- **FORMER CONFORMED NAME:** CREDIT SUISSE FIRST BOSTON/
- **DATE OF NAME CHANGE:** 19970211

**FORMER COMPANY:**
- **FORMER CONFORMED NAME:** CREDIT SUISSE
- **DATE OF NAME CHANGE:** 19921119

### Attached PDF Documents

**Attachment 1:** `05-19-2014-Information.pdf`

Case 1:14-cr-00188-RBS Document 1 Filed 05/19/14 Page 1 of 4 PageID# 1

FILED

# IN THE UNITED STATES DISTRICT COURT FOR THE
EASTERN DISTRICT OF VIRGINIA

Alexandria Division

UNITED STATES OF AMERICA

v.

CREDIT SUISSE AG,

Defendant.

2014 MAY 19 P 4:03
CLERK US DISTRICT COURT
ALEXANDRIA, VIRGINIA

CRIMINAL NO. 1:14-CR-1:14CR2188 RBS

Count 1: 18 U.S.C. § 371
(Conspiracy)

# INFORMATION

# COUNT ONE
(Conspiracy)

THE UNITED STATES ATTORNEY CHARGES THAT:

1. For decades prior to and through in or about 2009, the exact dates being unknown to the United States Attorney, in the Eastern District of Virginia and elsewhere, the defendant

# CREDIT SUISSE AG

and its subsidiaries Credit Suisse Fides and Clariden Leu Ltd. (collectively “the defendant” or “CREDIT SUISSE”) did unlawfully, voluntarily, intentionally, and knowingly conspire, combine, confederate, and agree together with others both known and unknown to the United States Attorney to commit the following offense against the United States: to willfully aid, assist in, procure, counsel, and advise the preparation and presentation of false income tax returns and other documents to the Internal Revenue Service of the Treasury Department, in violation of Title 26, United States Code, Section 7206(2).

M 02
W

Case 1:14-cr-00188-RBS Document 1 Filed 05/19/14 Page 2 of 4 PageID# 2

## Manner and Means of the Conspiracy

2. Among the manner and means by which the Defendant, CREDIT SUISSE, and its conspirators would and did carry out the conspiracy were the following:

a. assisting clients in using sham entities as nominee beneficial owners of the undeclared accounts;
b. soliciting IRS forms that falsely stated under penalties of perjury that the sham entities beneficially owned the assets in the accounts;
c. failing to maintain in the United States records related to the accounts;
d. destroying account records sent to the United States for client review;
e. using CREDIT SUISSE managers and employees as unregistered investment advisors on undeclared accounts;
f. facilitating withdrawals of funds from the undeclared accounts by either providing hand-delivered cash in the United States or using CREDIT SUISSE's correspondent bank accounts in the United States;
g. structuring transfers of funds to evade currency transaction reporting requirements; and
h. providing offshore credit and debit cards to repatriate funds in the undeclared accounts.

## Overt Acts

3. In furtherance of the conspiracy, and to effect the object thereof, the following overt acts were committed in the Eastern District of Virginia, and elsewhere:

2

MD

Case 1:14-cr-00188-RBS Document 1 Filed 05/19/14 Page 3 of 4 PageID# 3

# CLIENT 1

a. In or about August 2006, in Zurich, Switzerland, Client 1, a naturalized U.S. citizen residing in Charlottesville, Virginia, opened an undeclared account at CREDIT SUISSE in Switzerland.
b. On or about August 16, 2006, Client 1 departed from Dulles International Airport, in the Eastern District of Virginia, on a flight bound for Zurich, Switzerland, to meet with a CREDIT SUISSE banker in Zurich, Switzerland, to discuss the undeclared account.
c. On or about April 15, 2007, Client 1 filed with the IRS a false and fraudulent U.S. Individual Income Tax Return, Form 1040, for tax year 2006 that failed to report the undeclared account and related income.

# CLIENT 2

d. In or about 1988, Client 2, a U.S. citizen and resident of Elizabeth, New Jersey, inherited an undeclared account at CREDIT SUISSE in Basel, Switzerland.
e. In or about July 2002, on the advice of a CREDIT SUISSE banker, Client 2 transferred the contents of the inherited undeclared account into a new undeclared account, opened in the name of Client 2, at CREDIT SUISSE.

f. In or about May 2004, a CREDIT SUISSE banker met with Client 2 at a hotel in New York, New York, to review statements for Client 2's undeclared account and to discuss investment strategy.

g. On or about April 15, 2006, Client 2 filed with the IRS a false and fraudulent U.S. Individual Income Tax Return, Form 1040, for tax year 2005 that failed to report the undeclared account and related income.

3

MDA

Case 1:14-cr-00188-RBS Document 1 Filed 05/19/14 Page 4 of 4 PageID# 4

h. In or about August 2009, Client 2 met with a CREDIT SUISSE banker in Zurich, Switzerland, to close the undeclared account at which time the banker suggested that, rather than repatriate the funds to the U.S., the client transfer the account to another Swiss bank.

(All in violation of Title 18, United States Code, Section 371.)

DANA J. BOENTE
United States Attorney

KATHRYN KENEALLY
Assistant Attorney General
Tax Division

5-19-2014
Mark D. Lytle
Assistant U.S. Attorney

5-19-2014
Mark F. Daly
Senior Litigation Counsel
Nanette L. Davis
Assistant Chief

4

MDY
W

**Attachment 2:** `05-19-2014-PleaAgreement.pdf`

Case 1:14-cr-00188-RBS Document 13 Filed 05/19/14 Page 1 of 14 PageID# 19

# IN THE UNITED STATES DISTRICT COURT FOR THE
EASTERN DISTRICT OF VIRGINIA

Alexandria Division[{"box_2d": [128, 192, 786, 311], "label": "text", "caption": "UNITED STATES OF AMERICA
v.
CREDIT SUISSE AG,
Defendant.
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)"

![img-0.jpeg](img-0.jpeg)

# PLEA AGREEMENT

Dana J. Boente, United States Attorney for the Eastern District of Virginia; Mark D. Lytle, Assistant United States Attorney; Kathryn Keneally, Assistant Attorney General, Tax Division, U.S. Department of Justice; Mark F. Daly and Nanette L. Davis, Trial Attorneys, Tax Division, U.S. Department of Justice; the defendant, Credit Suisse AG; and the defendant's counsel have entered into an agreement pursuant to Rule 11 of the Federal Rules of Criminal Procedure. The terms of the agreement are as follows:

# 1. Offense and Maximum Penalties

The defendant agrees to plead guilty to a one count information charging the defendant with conspiracy to commit offenses against the United States, to wit, violations of Title 26, United States Code, Section 7206(2), the aiding, assisting, procuring, counseling, and advising of the preparation and presentation of false income tax returns to the Internal Revenue Service of the Treasury Department, in violation of Title 18, United States Code, Section 371. The maximum penalties for the offense are: a maximum possible fine of $500,000, twice the gross gain derived from the offense, or twice the gross loss, whichever is greatest; full restitution; a term of probation of no more than five (5) years; and a special assessment.

CMW

Case 1:14-cr-00188-RBS Document 13 Filed 05/19/14 Page 2 of 14 PageID# 20

# 2. Factual Basis for the Plea

The defendant will plead guilty because the defendant is in fact guilty of the charged offense. The defendant admits the facts set forth in the Statement of Facts filed with this plea agreement and agrees that those facts establish guilt of the offense charged beyond a reasonable doubt. The Statement of Facts, which is hereby incorporated into this plea agreement, constitutes a stipulation of facts for purposes of Section 1B1.2(a) of the Sentencing Guidelines.

# 3. Assistance and Advice of Counsel

The defendant is satisfied that the defendant's attorney has rendered effective assistance. The defendant understands that by entering into this agreement, defendant surrenders certain rights as provided in this agreement. The defendant understands that the rights of criminal defendants include the following:

A. the right to plead not guilty and to persist in that plea;
B. the right to a jury trial;
C. the right to be represented by counsel - and if necessary have the court appoint counsel - at trial and at every other stage of the proceedings; and
D. the right at trial to confront and cross-examine adverse witnesses, to be protected from compelled self-incrimination, to testify and present evidence, and to compel the attendance of witnesses.

# 4. Sentencing Guidelines

The parties agree to take the following positions at sentencing under the United States Sentencing Guidelines:

2

Case 1:14-cr-00188-RBS Document 13 Filed 05/19/14 Page 3 of 14 PageID# 21

A. The parties agree that the Guideline Manual in effect as of the date of sentencing should be used in determining Credit Suisse AG’s sentence. *See* U.S.S.G. § 1B1.11(a);

B. The parties agree that the base fine is $666,500,000, which is the estimated pecuniary loss from the offense. *See* U.S.S.G. §§ 8C2.3 and 8C2.4(a);

C. Pursuant to U.S.S.G. § 8C2.5, the culpability score is ten (10) determined as follows:

(1) Base culpability score is five (5) pursuant to U.S.S.G. § 8C2.5(a); and

(2) Add five (5) points pursuant to U.S.S.G. § 8C2.5(b)(1)(A), in that the organization had 5,000 or more employees, and an individual within the high-level personnel of the unit participated in or condoned the offense and/or tolerance of the offense by substantial authority personnel was pervasive throughout the organization;

D. Pursuant to U.S.S.G. § 8C2.6, the appropriate multiplier range associated with a culpability score of ten (10) is 2.0 to 4.0; and

E. Thus, the Guideline Fine Range is $1,333,000,000 to $2,666,000,000. *See* U.S.S.G. §§ 8C2.7(a), (b); 18 U.S.C. §§ 3571(c) and (d).

## 5. Restitution

Defendant agrees that restitution is mandatory pursuant to 18 U.S.C. §3663A. Defendant agrees to the entry of a Restitution Order for the full amount of the victim’s losses. Pursuant to 18 U.S.C. § 3663A(c)(2), the defendant agrees that an offense listed in § 3663A(c)(1) gave rise to this plea agreement and as such, victims of the conduct described in the charging instrument, statement of facts or any related or similar conduct shall be entitled to restitution. The Government is currently aware that the following victim has suffered the following losses:

3

Case 1:14-cr-00188-RBS Document 13 Filed 05/19/14 Page 4 of 14 PageID# 22

Victim Name/Address

Amount of Restitution

IRS - RACS

Attn.: Mail Stop 6261, Restitution
333 West Pershing Avenue
Kansas City, MO 64108

$666,500,000

The parties agree that restitution shall be paid directly to the Internal Revenue Service, pursuant to payment instructions provided to Credit Suisse AG. If the Court orders the defendant to pay restitution to the IRS for the failure to pay tax, either directly as part of the sentence or as a condition of supervised release, the IRS will use the restitution order as the basis for a civil assessment. See 26 U.S.C. § 6201(a)(4). The defendant does not have the right to challenge the amount of this assessment. See 26 U.S.C. § 6201(a)(4)(C). Neither the existence of a restitution payment schedule nor the defendant’s timely payment of restitution according to that schedule will preclude the IRS from administrative collection of the restitution-based assessment, including levy and distraint under 26 U.S.C. § 6331.

6. Special Assessment

Before sentencing in this case, the defendant agrees to pay a mandatory special assessment of Four Hundred dollars ($400.00) per count of conviction, pursuant to 18 U.S.C. § 3013.

7. Agreed Disposition

A. The Office of the U.S. Attorney for the Eastern District of Virginia and the Tax Division, Department of Justice (collectively, “the United States”) and Credit Suisse AG agree pursuant to Fed. R. Crim. P. 11(c)(1)(C) that the following sentence, which comprises a Two Billion dollar ($2,000,000,000) resolution with the Department of Justice as detailed below, is the appropriate disposition of the Information:

4

Case 1:14-cr-00188-RBS Document 13 Filed 05/19/14 Page 5 of 14 PageID# 23

1. a criminal fine in the amount of One Billion, Three Hundred Thirty-Three Million, Five Hundred Thousand dollars ($1,333,500,000), less a credit of One Hundred Ninety-Six Million, Five Hundred Eleven Thousand, Fourteen Dollars ($196,511,014) for Credit Suisse Group AG's payment to the U.S. Securities and Exchange Commission pursuant to its order of February 21, 2014 in Administrative Proceeding File No. 3-15763, for a final payment of One Billion, One Hundred Thirty-Six Million, Nine Hundred Eighty-Eight Thousand, Nine Hundred Eighty-Six Dollars ($1,136,988,986), to be paid within one week of the date of sentencing;
2. a mandatory special assessment of $400, which shall be paid to the Clerk of Court on or before the date of sentencing; and
3. restitution to the U.S. Internal Revenue Service in the amount of Six Hundred Sixty-Six Million, Five Hundred Thousand dollars ($666,500,000), to be paid within one week of sentencing.

In light of the fine, restitution, and other payments to be paid by Credit Suisse AG to the United States and federal and state regulatory authorities, the United States will forgo the payment of additional penalties available under the relevant statutes, rules, and regulations.

B. Credit Suisse AG further agrees to lawfully undertake the following:

1. Credit Suisse AG must promptly disclose all evidence and information described in Sections II.D.1. and II.D.2 of the Program for Non-Prosecution Agreements or Non-Target Letters for Swiss Banks and in the format requested by the United States;
2. Credit Suisse AG will provide, at its own expense, fair and accurate translations of any foreign language documents produced by Credit Suisse AG to the Government either directly or through the Swiss Federal Tax Administration;

5

Case 1:14-cr-00188-RBS Document 13 Filed 05/19/14 Page 6 of 14 PageID# 24

3. Credit Suisse AG will provide testimony or information, including testimony and information necessary to identify or establish the original location, authenticity, or other basis for admission into evidence of documents or physical evidence in any criminal or other proceeding as requested by the Government, including but not limited to the conduct set forth in the Statement of Facts;

4. Credit Suisse AG will provide all necessary information for the United States to draft treaty requests to seek account records and other information, and will collect and maintain all records that are potentially responsive to such treaty requests to facilitate prompt responses;

5. Credit Suisse AG will close any and all accounts of recalcitrant account holders, as defined in Section 1471(d)(6) of the Internal Revenue Code; will implement procedures to prevent its employees from assisting recalcitrant account holders to engage in acts of further concealment in connection with closing any account or transferring any funds; and will not open any U.S. Related Accounts (as defined in paragraph I.B.9 of the Program for Non-Prosecution Agreements or Non-Target Letters for Swiss Banks, without regard to the dollar limit or the applicable time period) except on conditions that ensure that the account will be declared to the United States and will be subject to disclosure by Credit Suisse AG; and

6. Credit Suisse AG agrees that no portion of the fine or other payments made pursuant to this plea agreement will serve as a basis for Credit Suisse AG to claim, assert, or apply for, either directly or indirectly, any tax deduction, any tax credit, or any other offset against any U.S. federal, state, or local tax or taxable income.

C. The United States specifically may, at its sole option, be released from its commitments under this plea agreement, including, but not limited to, its agreement that this

6

Case 1:14-cr-00188-RBS Document 13 Filed 05/19/14 Page 7 of 14 PageID# 25

paragraph constitutes the appropriate disposition of this case, if at any time between its execution of this plea agreement and sentencing, Credit Suisse AG:

1. Fails to truthfully admit its conduct in the offense of conviction;
2. Falsely denies, or frivolously contests, relevant conduct for which Credit

Suisse AG is accountable under U.S.S.G. § 1B1.3;

3. Gives false or misleading testimony in any proceeding relating to the criminal conduct charged in this case and any relevant conduct for which Credit Suisse AG is accountable under U.S.S.G. § 1B1.3;
4. Engages in acts which form a basis for finding that Credit Suisse AG has obstructed or impeded the administration of justice under U.S.S.G. § 3C1.1; or
5. Attempts to withdraw its plea.

D. Credit Suisse AG expressly understands and acknowledges that it may not withdraw its plea of guilty, unless the Court rejects this plea agreement under Fed. R. Crim. P. 11(c)(5).

E. Credit Suisse AG agrees that it shall not, through its attorneys, agents, officers, or employees, make any statement, in litigation or otherwise, contradicting the Statement of Facts or Credit Suisse AG's representations set forth in this plea agreement; provided, however, that the restrictions set forth in this paragraph are not intended to and shall not apply to any current or former Credit Suisse AG employee, or any other individual or entity, in the course of any criminal, regulatory, or civil case, investigation, or other proceeding initiated by the Government or any other governmental agency or authority against an individual or entity, whether in the United States or any other jurisdiction, provided that the individual or entity is not authorized to speak on behalf of Credit Suisse AG. Any contradictory statement by Credit Suisse AG shall

7

Case 1:14-cr-00188-RBS Document 13 Filed 05/19/14 Page 8 of 14 PageID# 26

constitute a breach of this plea agreement, and trigger the provisions of sub-paragraphs 12a-12c. The decision as to whether any contradictory statement will be imputed to Credit Suisse AG for the purpose of determining whether Credit Suisse AG has breached this plea agreement shall be at the sole discretion of the United States. Upon a determination by the United States that a contradictory statement has been made by Credit Suisse AG, the United States shall promptly notify Credit Suisse AG in writing of the contradictory statement, and Credit Suisse AG may avoid a breach of this plea agreement by repudiating the statement both to the recipient of the statement and to the United States within 72 hours after receipt of notice by the United States. Credit Suisse AG consents to the public release by the United States, in its sole discretion, of any repudiation.

# **8. Waiver of Appeal, FOIA and Privacy Act Rights**

The defendant also understands that Title 18, United States Code, Section 3742 affords a defendant the right to appeal the sentence imposed. Nonetheless, the defendant knowingly waives the right to appeal the conviction and any sentence agreed to by the parties, as set out in paragraph 7, even if the District Court rejects one or more positions advocated by the parties with regard to the application of the U.S. Sentencing Guidelines, on the grounds set forth in Title 18, United States Code, Section 3742 or on any ground whatsoever, in exchange for the concessions made by the United States in this plea agreement. The defendant reserves its right pursuant to Title 18, United States Code, Section 3742(c)(1) to appeal any sentence imposed that is greater than the sentence set forth in this agreement. This agreement does not affect the rights or obligations of the United States as set forth in Title 18, United States Code, Section 3742(b) and (c). The defendant also hereby waives all rights, whether asserted directly or by a representative, to request or receive from any department or agency of the United States any

8

*[Handwritten signatures and initials]*

Case 1:14-cr-00188-RBS Document 13 Filed 05/19/14 Page 9 of 14 PageID# 27

records pertaining to the investigation or prosecution of this case, including without limitation any records that may be sought under the Freedom of Information Act, Title 5, United States Code, Section 552, or the Privacy Act, Title 5, United States Code, Section 552a.

# **9. Scope of the Agreement**

The United States will not further criminally prosecute the defendant for the specific conduct described in the Information or Statement of Facts. This agreement not to further prosecute Credit Suisse AG is expressly contingent on:

A. The guilty plea of Credit Suisse AG being accepted by the Court and not withdrawn; and

B. Credit Suisse AG’s performance of all of its material obligations as set forth in this plea agreement. If Credit Suisse AG’s guilty plea is not accepted by the Court or is withdrawn for any reason, or if Credit Suisse AG should fail to perform a material obligation under this plea agreement, this agreement not to further prosecute shall be null and void.

This plea agreement shall bind defendant, subsidiaries, affiliated entities, assignees, and its successor corporation if any, and any other person or entity that assumes the obligations contained herein. No change in name, change in corporate or individual control, business reorganization, change in ownership, merger, change of legal status, sale or purchase of assets, divestiture of assets, or similar action shall alter defendant’s obligations under this Agreement. Defendant shall not engage in any action to seek to avoid the obligations set forth in this Agreement.

This plea agreement does not affect the right of the United States to prosecute any individual, including but not limited to present and former officers, directors, employees, and

9

M 187  
MD  
Caw  
All

Case 1:14-cr-00188-RBS Document 13 Filed 05/19/14 Page 10 of 14 PageID# 28

agents of Credit Suisse AG and any related entity, in connection with the conduct encompassed by this plea agreement and accompanying Information and/or Statement of Facts.

### 10. Fed. R. Crim. P. 11(c)(l)(C) Agreement

Credit Suisse AG's plea will be tendered pursuant to Fed. R. Crim. P. 11(c)(l)(C). Credit Suisse AG cannot withdraw its plea of guilty unless the sentencing judge rejects this plea agreement or fails to impose a sentence consistent herewith. If the sentencing judge rejects this plea agreement or fails to impose a sentence consistent herewith, this plea agreement shall be null and void at the option of either the United States or Credit Suisse AG.

### 11. Civil and Administrative Liability

By entering into this plea agreement, the United States does not compromise any civil liability, including but not limited to any tax liability, which Credit Suisse AG may have incurred or may incur as a result of its conduct and its plea of guilty to the attached Information.

### 12. Breach of Plea Agreement

This plea agreement is effective when signed by the defendant, the defendant's attorney, an attorney for the Office of the U.S. Attorney for the Eastern District of Virginia, and an attorney for the Tax Division, Department of Justice. The defendant agrees to entry of this plea agreement at the date and time scheduled with the Court by the United States (in consultation with the defendant's attorney). If the defendant fails to comply with any provision of this plea agreement, or commits or attempts to commit any additional federal, state or local crimes, then:

A. The United States will be released from its obligations under this plea agreement by notifying Credit Suisse AG, through counsel or otherwise, in writing. The defendant, however, may not withdraw the guilty plea entered pursuant to this agreement;

B. The defendant will be subject to prosecution for any federal criminal violation, including, but not limited to, perjury and obstruction of justice, that is not time-barred by the

10

CAW
AN

Case 1:14-cr-00188-RBS Document 13 Filed 05/19/14 Page 11 of 14 PageID# 29

applicable statute of limitations on the date this agreement is signed. Notwithstanding the subsequent expiration of the statute of limitations, in any such prosecution, the defendant agrees to waive any statute-of-limitations defense as provided for in the tolling agreement executed by the parties on May 19, 2014; and

C. Any prosecution, including the prosecution that is the subject of this agreement, may be premised upon any information provided, or statements made, by the defendant, and all such information, statements, and leads derived therefrom may be used against the defendant. The defendant waives any right to claim that statements made before or after the date of this agreement, including the Statement of Facts accompanying this agreement or adopted by the defendant and any other statements made pursuant to this or any other agreement with the United States, should be excluded or suppressed under Fed. R. Evid. 410, Fed. R. Crim. P. 11(f), the Sentencing Guidelines, or any other provision of the Constitution or federal law.

Any alleged breach of this agreement by either party shall be determined by the Court in an appropriate proceeding at which the defendant's disclosures and documentary evidence shall be admissible and at which the moving party shall be required to establish a breach of the plea agreement by a preponderance of the evidence.

### 13. Who Is Bound By Agreement

With respect to matters set forth in Paragraph 9, this plea agreement is binding on Credit Suisse AG and the Office of the United States Attorney for the Eastern District of Virginia and the Tax Division of the Department of Justice. Credit Suisse AG understands that this plea agreement does not bind any state or local prosecutorial authorities.

11

CAW
ML

Case 1:14-cr-00188-RBS Document 13 Filed 05/19/14 Page 12 of 14 PageID# 30

#### 14. Corporate Authorization

Credit Suisse AG shall provide to the U.S. Attorney and the Court a certified copy of a resolution of the Board of Directors of Credit Suisse AG, affirming that the Board of Directors has authority to enter into the plea agreement and has (1) reviewed the Information in this case and the proposed plea agreement or has been advised of the contents thereof; (2) consulted with legal counsel in connection with the matter; (3) voted to enter into the proposed plea agreement; (4) voted to authorize Credit Suisse AG to plead guilty to the charge specified in the Information; and (5) voted to authorize the corporate officer identified below to execute the plea agreement and all other documents necessary to carry out the provisions of the plea agreement. A copy of the resolution is attached as Exhibit A. Credit Suisse AG agrees that a duly authorized corporate officer for Credit Suisse AG shall appear on behalf of Credit Suisse AG and enter the guilty plea and will also appear for the imposition of sentence.

#### 15. Nature of the Agreement and Modifications

This written agreement constitutes the complete plea agreement between the United States, the defendant, and the defendant's counsel. The defendant and the defendant's attorney acknowledge that no threats, promises, or representations have been made, nor agreements reached, other than those set forth in writing in this plea agreement, to cause the defendant to

12

ms
wS
caw
JRL

Case 1:14-cr-00188-RBS Document 13 Filed 05/19/14 Page 13 of 14 PageID# 31

plead guilty. Any modification of this plea agreement shall be valid only as set forth in writing in a supplemental or revised plea agreement signed by all parties.

DANA J. BOENTE
United States Attorney

KATHRYN KENEALLY
Assistant Attorney General
Tax Division

5-19-2014  
Mark D. Lytle  
Assistant U.S. Attorney

Mark F. Daly  
Senior Litigation Counsel  
Nanette L. Davis  
Assistant Chief

13

![img-0.jpeg](img-0.jpeg)

Case 1:14-cr-00188-RBS Document 13 Filed 05/19/14 Page 14 of 14 PageID# 32

Defendant's Signature: The Board of Directors has authorized me to execute this plea agreement on behalf of Credit Suisse AG. The Board has read this plea agreement, the attached criminal Information and Statement of Facts in their entirety, or has been advised of the contents thereof, and has discussed them fully in consultation with Credit Suisse AG's attorneys. I am further authorized to acknowledge on behalf of Credit Suisse AG that these documents fully set forth Credit Suisse AG's agreement with the United States, and that no additional promises or representations have been made to Credit Suisse AG by any officials of the United States in connection with the disposition of this matter, other than those set forth in these documents.

Date: 5/19/14 Credit Suisse AG

Defense Counsel Signature: We are counsel for Credit Suisse AG in this case. We have fully explained to the defendant the defendant's rights with respect to the pending Information. Further, we have reviewed Title 18, United States Code, Section 3553 and the Sentencing Guidelines Manual, and we have fully explained to the defendant the provisions that may apply in this case. We have carefully reviewed every part of this plea agreement with the defendant. To our knowledge, the defendant's decision to enter into this agreement is an informed and voluntary one.

Date: 5/19/14
Christopher A. Wray
Andrew C. Hruska
Michael R. Pauzé
William F. Johnson
Counsel for the Defendant

14

![img-1.jpeg](img-1.jpeg)

**Attachment 3:** `05-19-2014-StatementofFacts.pdf`

Case 1:14-cr-00188-RBS Document 14 Filed 05/19/14 Page 1 of 16 PageID# 36

# IN THE UNITED STATES DISTRICT COURT FOR THE
EASTERN DISTRICT OF VIRGINIA

![img-0.jpeg](img-0.jpeg)

Alexandria Division

UNITED STATES OF AMERICA

v.

CREDIT SUISSE AG,

Defendant.

CRIMINAL NO. 1:14-CR-188

# STATEMENT OF FACTS

The parties stipulate that the allegations in Count One of the Information and the following facts are true and correct, and that had the matter gone to trial the United States would have proven them beyond a reasonable doubt:

1. CREDIT SUISSE AG, a corporation organized under the laws of Switzerland, directly and through its parent, subsidiaries and affiliates, operates a global financial services business in more than 50 countries with over 45,000 employees, including 9,000 U.S. employees. In the United States, CREDIT SUISSE operates as a Financial Holding Company regulated by the Federal Reserve. CREDIT SUISSE offers private banking and wealth management services to over two million clients, focusing on ultra-high-net-worth and high-net-worth individual clients around the globe, including U.S. citizens, legal permanent residents, and resident aliens, located within the Eastern District of Virginia and elsewhere.

2. Clariden Leu Ltd. ("Clariden Leu") was a private Swiss bank and one of CREDIT SUISSE's wholly owned subsidiaries. It offered private banking and wealth management services that paralleled and often competed with the private wealth management services offered by CREDIT SUISSE. CREDIT SUISSE formed Clariden Leu on January 26, 2007, by merging four private banks that CREDIT SUISSE wholly owned, Clariden Bank, Bank Leu, Bank Hofmann, and BGP Banca di Gestione Patrimoniale, with Credit Suisse Fides, the securities dealer that CREDIT SUISSE wholly owned. Clariden Leu was one of the largest private banks in Switzerland and ultimately managed more than 100 billion Swiss francs. CREDIT SUISSE merged with Clariden Leu on April 2, 2012, acquiring all of Clariden Leu's assets and liabilities and assuming all of its rights and obligations.

3. Unless otherwise specifically noted herein, CREDIT SUISSE AG, its parent, and Switzerland-based subsidiaries and affiliates, including Clariden Leu, collectively will be called "CREDIT SUISSE."

M 87 /cm/
VS /AL

Case 1:14-cr-00188-RBS Document 14 Filed 05/19/14 Page 2 of 16 PageID# 37

## U.S. INCOME TAX & REPORTING OBLIGATIONS

4. U.S. citizens, resident aliens, and legal permanent residents have an obligation to report all income earned from foreign bank accounts on their tax returns and to pay the taxes due on that income. For the tax year 1976 forward, U.S. citizens, resident aliens, and legal permanent residents had an obligation to report to the Internal Revenue Service (“IRS”) on the Schedule B of a U.S. Individual Income Tax Return, Form 1040, whether that individual had a financial interest in, or signature authority over, a financial account in a foreign country in a particular year by checking “Yes” or “No” in the appropriate box and identifying the country where the account was maintained.
5. From in or about 1970 forward, U.S. citizens, resident aliens, and legal permanent residents who had a financial interest in, or signature authority over, one or more financial accounts in a foreign country with an aggregate value of more than $10,000 at any time during a particular year were required to file with the Department of the Treasury a Report of Foreign Bank and Financial Accounts, Form TD F 90-22.1 (the “FBAR”). The FBAR for the applicable year was due by June 30 of the following year.
6. An “undeclared account” was a financial account owned by an individual subject to U.S. tax and maintained in a foreign country that had not been reported by the individual account owner to the U.S. government on an income tax return and an FBAR.
7. From in or about the 1930s until the present, Switzerland has maintained laws that ensure the secrecy of client relationships at Swiss banks. Swiss law prohibits the disclosure of identifying information without the client’s authorization, especially to foreign government investigators. These are Swiss criminal laws punished by imprisonment. Because of the secrecy guarantee that they created, these Swiss criminal provisions enabled U.S. clients to conceal their Swiss bank accounts from U.S. authorities.

## OVERVIEW OF THE ILLEGAL U.S. CROSS-BORDER BUSINESS

8. For decades prior to and through in or about 2009, in the Eastern District of Virginia and elsewhere, CREDIT SUISSE did unlawfully, voluntarily, intentionally, and knowingly conspire, combine, confederate, and agree together with others to commit the following offense against the United States: to willfully aid, assist in, procure, counsel, and advise the preparation and presentation of false income tax returns and other documents to the Internal Revenue Service of the Treasury Department, in violation of Title 26, United States Code, Section 7206(2), all in violation of Title 18, United States Code, Section 371.
9. For decades prior to and through in or about 2009, CREDIT SUISSE operated an illegal cross-border banking business that knowingly and willfully aided and assisted thousands of U.S. clients in opening and maintaining undeclared accounts and

2

MJB / CMU
VS / AN

Case 1:14-cr-00188-RBS Document 14 Filed 05/19/14 Page 3 of 16 PageID# 38

concealing their offshore assets and income from the IRS. CREDIT SUISSE, through certain of its managers, employees, and others, solicited U.S. clients to open undeclared accounts because Swiss bank secrecy would permit them to conceal the U.S. clients' ownership of accounts at CREDIT SUISSE. CREDIT SUISSE used a variety of means to assist U.S. clients in concealing their CREDIT SUISSE undeclared accounts, including by:

- • assisting clients in using sham entities as nominee beneficial owners of the undeclared accounts;
- • soliciting IRS forms that falsely stated under penalties of perjury that the sham entities beneficially owned the assets in the accounts;
- • failing to maintain in the United States records related to the accounts;
- • destroying account records sent to the United States for client review;
- • using CREDIT SUISSE managers and employees as unregistered investment advisors on undeclared accounts;
- • facilitating withdrawals of funds from the undeclared accounts by either providing hand-delivered cash in the United States or using CREDIT SUISSE's correspondent bank accounts in the United States;
- • structuring transfers of funds to evade currency transaction reporting requirements; and
- • providing offshore credit and debit cards to repatriate funds in the undeclared accounts.10. Private bankers (referred to as Relationship Managers or RMs) served as the primary contact for U.S. clients with undeclared accounts at CREDIT SUISSE. Managers (including Supervisory RMs) and RMs (collectively hereafter 'managers') in the illegal U.S. cross-border business actively assisted or otherwise facilitated thousands of U.S. individual taxpayers in establishing and maintaining undeclared accounts in a manner designed to conceal the U.S. taxpayers' ownership or beneficial interest in said accounts. CREDIT SUISSE maintained correspondent bank accounts in the United States through which CREDIT SUISSE managers and others conducted financial transactions in furtherance of its illegal cross-border business.11. As of 2006, CREDIT SUISSE had approximately 22,000 U.S. client accounts with total aggregate assets under management of approximately \$10 billion, which included both declared and undeclared accounts. CREDIT SUISSE maintained undeclared accounts for U.S. clients in different units throughout the bank, but primarily serviced them from various desks located in Zurich and Geneva, Switzerland, including a desk at the Zurich airport. CREDIT SUISSE's Switzerland-based North America

3

Case 1:14-cr-00188-RBS Document 14 Filed 05/19/14 Page 4 of 16 PageID# 39

International desk, internally referred to as “SALN,” employed about 15-20 Swiss-based RMs focused on U.S. resident clients.

12. From in or about 1999 to in or about 2009, certain managers, with the assistance of the Representative Officer, used CREDIT SUISSE’s Representative Office in New York, New York to assist U.S. clients filing false and fraudulent U.S. tax reporting documents, including income tax returns.

13. In or about 2005, CREDIT SUISSE made a filing with the Federal Reserve Bank of New York that concealed these managers’ conduct in support of the tax evasion scheme by stating that its policies required that if the Representative Officer were asked about opening accounts, he “must decline the Customer’s request . . . [i]f the client indicates that he/she intends to avoid paying taxes,” as “[i]t is the policy of Credit Suisse not to provide assistance in the evasion of taxes.” Likewise, in or about 2007, CREDIT SUISSE made another filing with the Federal Reserve that stated that, under CREDIT SUISSE policy for the Representative Office, “employees must not engage in activity that could be viewed as knowingly assisting a client in . . . misleading local or foreign authorities or any tax authority by means of incomplete or missing information.”

14. Approximately 430 CREDIT SUISSE non-SALN RMs employed on other desks or at other Swiss-based offices of CREDIT SUISSE also serviced the accounts of U.S. clients, including declared and undeclared accounts. From at least 2002 through 2008, CREDIT SUISSE non-SALN RMs serviced up to 4,800 U.S. client accounts consisting of up to approximately $3 billion in securities assets under management, which included accounts maintained by clients who had not declared them to the IRS as required by law.

15. Prior to the 2007 merger referenced in paragraph 2, the individual private banks had an individual or group of individuals that serviced undeclared U.S. accounts. After the merger, those individuals or their successors continued to service those accounts and were not consolidated into one group at Clariden Leu. Clariden Leu employed approximately 240 RMs who serviced U.S. accounts (including declared and undeclared) and were not part of a dedicated U.S. desk. Prior to the merger of Clariden Leu into CREDIT SUISSE, Clariden Leu RMs serviced approximately 1,500 U.S. client accounts consisting of up to approximately $2 billion in securities assets under management, which included accounts maintained by clients who had not declared them to the IRS as required by law.

16. Managers engaged in the illegal U.S. cross-border business without appropriate registration with the Securities and Exchange Commission in part to provide broker-dealer and investment adviser services to U.S. clients with undeclared accounts.

17. During the relevant period, Swiss-based CREDIT SUISSE managers regularly traveled to the United States to meet with U.S. clients, including clients with undeclared accounts. Certain of these trips involved visits with dozens of existing U.S. clients,

4

mby /cm/ AR

Case 1:14-cr-00188-RBS Document 14 Filed 05/19/14 Page 5 of 16 PageID# 40

including clients located in the Eastern District of Virginia, and prospective U.S. clients. These managers traveled to the United States one to three times per year, in trips that generally varied in duration from one to two weeks, often meeting with several clients per day.

18. In addition, while in Switzerland, these managers communicated via telephone, fax, mail and/or email with certain of their clients in the United States about their account relationships. These communications include the provision of investment advice and the receipt of securities transaction orders.

19. U.S. clients often visited their CREDIT SUISSE RMs in Switzerland and otherwise communicated with their RMs from outside the United States.

20. Due in part to the assistance of CREDIT SUISSE and its personnel, and with the knowledge that Swiss banking secrecy laws would prevent CREDIT SUISSE from disclosing their identities to the IRS, numerous U.S. clients of CREDIT SUISSE filed false and fraudulent U.S. Individual Income Tax Returns, Forms 1040, which failed to report their respective interests in their undeclared accounts and the related income. Certain U.S. clients also failed to file and otherwise report their undeclared accounts on FBARs.

### THE USE OF SHAM ENTITIES

21. From in or about 1910 to at least in or about 1997, CREDIT SUISSE operated a wholly owned subsidiary that, among other things, formed, managed, and maintained structures for clients with accounts at CREDIT SUISSE or Clariden Leu. This subsidiary was known variously as Credit Suisse Fides Trust, Fides Holding, Fides Trust AG, Fides Trust SA, Fides Trust Ltd., and/or Credit Suisse Fides (collectively "Fides").

22. CREDIT SUISSE aided and assisted U.S. clients with undeclared accounts at CREDIT SUISSE to evade their income taxes by placing their assets into accounts held in the names of structures formed, maintained, and managed by Fides. The structures included but were not limited to foundations, trusts, and offshore companies. By the operation of Swiss bank secrecy laws, the U.S. client's ownership would not be disclosed to U.S. authorities. Because CREDIT SUISSE owned and controlled Fides, a U.S. client with an undeclared account at CREDIT SUISSE knew that he or she would retain ultimate control over the assets in the undeclared account.

23. In or about the mid-1990's, the IRS commenced a series of investigations against individuals and entities that promoted income tax evasion through the use of offshore trusts and corporations. As a result, in order to further conceal U.S. undeclared accounts, in or about 1997, the executive management of Fides prompted Josef Dörig, an employee of Fides, to form his own trust company. The management proposed to spin off to Dörig's new company the existing "mandates" (the formal power to act on behalf of the structure) that Fides held for structures linked to U.S. clients' undeclared

5

CRW
AP

Case 1:14-cr-00188-RBS Document 14 Filed 05/19/14 Page 6 of 16 PageID# 41

accounts. Further, on an ongoing basis, the executive management of Fides proposed to refer to Dörig's spin-off company U.S. clients with undeclared accounts at CREDIT SUISSE who wished, or were advised, to transfer their undeclared assets to new accounts in the names of structures.

24. On or about December 20, 1997, Fides and Dörig Partner AG, the company formed by Dörig to execute the scheme, entered into a contract to receive the mandates for structures linked to U.S. clients with undeclared accounts.

25. Although Fides no longer held the mandates for the structures linked to U.S. clients with undeclared accounts at CREDIT SUISSE, CREDIT SUISSE did not cause Dörig to close the undeclared accounts and transfer the assets elsewhere. To the contrary, the contract between Fides and Dörig Partner required Dörig Partner to make its best efforts to keep the existing undeclared assets at CREDIT SUISSE. Further, for any referral that Dörig received from CREDIT SUISSE for the creation of a structure for holding undeclared assets, Dörig Partner had to make its best efforts to ensure that the undeclared assets owned by the U.S. person would be held in an account in the name of the new structure at CREDIT SUISSE.

26. In spinning off the mandates for structures linked to undeclared accounts held by U.S. persons, CREDIT SUISSE sought to create the appearance that the structures were legitimate entities operating independently of both CREDIT SUISSE as well as the U.S. person who owned the assets in the undeclared account. Through the spin-off, CREDIT SUISSE sought to shield the corporate entities as well as "its past or present employees to the utmost extent possible." The protection objective was the protection from the U.S. government's crackdown on tax evasion through the use of offshore structures.

27. Despite the formal spin-off, the U.S. person who beneficially owned the assets in the undeclared account continued to exercise direct control over the assets in the undeclared account by communicating directly with the manager of the undeclared account. Further, managers at CREDIT SUISSE represented to individuals with undeclared accounts that Dörig Partner would not take any action as to the undeclared account without the permission of the CREDIT SUISSE manager. Further, CREDIT SUISSE promoted the use of structures for tax evasion purposes by providing information to U.S. clients explaining the secrecy protections of Swiss law and the concealment afforded by use of the structures.

28. CREDIT SUISSE managers coordinated with affiliated trust company providers. From in or about 1997 through in or about 2008, managers at CREDIT SUISSE referred U.S. clients to Dörig Partner, including clients with undeclared accounts. Further, CREDIT SUISSE through SALN entered into a contract with Beda Singenberger, a Zurich-based owner of the trust company SINCO Treuhand, to provide similar trust services. The Geneva desk of SALN maintained a relationship with a law firm in Geneva that also provided structures to CREDIT SUISSE clients, including U.S. clients with undeclared accounts.

6

M 87 /CAW
M

Case 1:14-cr-00188-RBS Document 14 Filed 05/19/14 Page 7 of 16 PageID# 42

29. From in or about 1997 through in or about 2007, CREDIT SUISSE RMs and Josef Dörig periodically traveled together to the United States to provide services to existing clients with undeclared accounts and to meet with prospective clients. From at least in or about 2005 through in or about 2008, Beda Singenberger routinely advised CREDIT SUISSE managers and Roger Schaerer, the Officer of CREDIT SUISSE's Representative Office in New York City, of Singenberger's itinerary for his trips to the United States to meet with clients, including clients with undeclared accounts at CREDIT SUISSE.

30. Although CREDIT SUISSE maintained relationships with external trust companies to provide structures to U.S. persons with undeclared accounts, from in or about 1997 to in or about 2009, Credit Suisse Trust AG, CREDIT SUISSE's wholly owned subsidiary, in the Bahamas, the Isle of Jersey, Liechtenstein, and elsewhere, also managed structures linked to undeclared accounts held by U.S. clients at CREDIT SUISSE.

# CREDIT SUISSE SUBVERTED THE QI AGREEMENT

31. Effective in or about January 2001, CREDIT SUISSE entered into a Qualified Intermediary Agreement ("QI Agreement") with the IRS. The Qualified Intermediary ("QI") regime provided a comprehensive framework for U.S. information reporting and tax withholding by a non-U.S. financial institution regarding U.S. securities. The QI Agreement was designed to help ensure that non-U.S. persons were subject to the proper U.S. withholding tax rates and that U.S. persons were properly paying U.S. tax, in each case, with respect to U.S. securities held in an account with the QI. QI agreements were subject to a "documentation transition period" announced by the IRS in Notice 2001-4 (Jan. 8, 2001) that gave QIs until the end of 2002 to achieve "substantial compliance" with the provisions of the QI Agreement. The QI Agreement expressly recognizes that a non-U.S. financial institution such as CREDIT SUISSE may be prohibited by foreign law, such as Swiss law, from disclosing an account holder's name or other identifying information. In general, a QI subject to such foreign-law restrictions must request that its U.S. clients either (a) grant the QI authority to disclose the client's identity or disclose himself by mandating the QI to provide an IRS Form W-9 completed by the account holder, or (b) grant the QI authority to sell all U.S. securities of the account holder (in the case of accounts opened before January 1, 2001) or to exclude all U.S. securities from the account (in the case of accounts opened on or after January 1, 2001). Following the effective date of the QI Agreement, a sale of U.S. securities, if any, held by a U.S. person who chose not to provide a QI with an IRS Form W-9 was subject to tax information reporting on an anonymous basis and backup withholding.

32. As a consequence of CREDIT SUISSE's entering into a QI Agreement with the IRS, certain managers suggested that U.S. clients with undeclared accounts transfer their assets to newly created accounts held in the names of sham offshore entities. In connection with those newly created accounts, CREDIT SUISSE managers knowingly

7

Case 1:14-cr-00188-RBS Document 14 Filed 05/19/14 Page 8 of 16 PageID# 43

accepted and included in CREDIT SUISSE's account records IRS Forms W-8BEN (or CREDIT SUISSE's substitute forms) provided by the directors of the offshore companies which represented under penalty of perjury that such companies were the beneficial owners, for U.S. federal income tax purposes, of the assets in the CREDIT SUISSE accounts. In certain cases, the IRS Forms W-8BEN (or CREDIT SUISSE's substitute forms) were false or misleading in that the U.S. taxpayer who owned the offshore company actually directed and controlled the management and disposition of the assets in the company accounts and/or otherwise functioned as the beneficial owner of such assets in disregard of the formalities of the purported corporate ownership.

33. Certain managers of CREDIT SUISSE caused CREDIT SUISSE to make false statements and provided misleading information to the IRS regarding CREDIT SUISSE's compliance with the terms of the QI Agreement.

# ADDITIONAL METHODS AND MEANS OF CONCEALMENT

34. CREDIT SUISSE assisted U.S. clients in repatriating their offshore funds by providing credit or debit cards linked to the undeclared accounts, including cards issued by American Express, Visa, and Maestro. In some instances, the managers mailed or caused to be mailed the credit or debit cards directly to the clients in the United States.

35. Certain CREDIT SUISSE managers and others assisted U.S. clients to execute forms that directed CREDIT SUISSE not to acquire U.S. securities in their accounts, which would require disclosure of their identities to the IRS. The managers also assisted U.S. clients who inherited undeclared accounts at CREDIT SUISSE in opening new undeclared accounts and transfer into those accounts the funds from the inherited accounts.

36. Certain CREDIT SUISSE managers provided cash in the United States to U.S. clients as withdrawals from their undeclared accounts at CREDIT SUISSE in Switzerland. Certain CREDIT SUISSE managers solicited cash deposits in the United States from U.S. clients with undeclared accounts at CREDIT SUISSE in Switzerland. Certain CREDIT SUISSE managers advised U.S. clients to structure, and caused U.S. clients to structure withdrawals from their undeclared accounts in amounts less than $10,000 in an attempt to conceal the transactions from U.S. authorities.

37. Certain CREDIT SUISSE managers also assisted U.S. clients to close their undeclared accounts at CREDIT SUISSE and convert marketable securities into other assets that were stored at CREDIT SUISSE and elsewhere.

38. Certain CREDIT SUISSE managers met with U.S. clients outside of the United States, including in Switzerland and the Bahamas, to provide banking services and investment advice related to their undeclared accounts.

39. Certain CREDIT SUISSE managers advised U.S. clients to not maintain account records related to their undeclared accounts in the United States. Certain CREDIT

8

Case 1:14-cr-00188-RBS Document 14 Filed 05/19/14 Page 9 of 16 PageID# 44

SUISSE managers, along with certain affiliated asset management firms, caused CREDIT SUISSE to retain, in Switzerland, account records related to the U.S. clients' undeclared accounts. Certain CREDIT SUISSE managers had statements and other account records of undeclared accounts maintained by U.S. clients at CREDIT SUISSE sent by e-mail and facsimile from Switzerland to the Representative Office in New York, New York, so that U.S. clients with undeclared accounts could review the documents. CREDIT SUISSE personnel destroyed those documents following the clients' review, in conformance with Swiss data secrecy restrictions and to further conceal the U.S. clients' undeclared accounts.

## CREDIT SUISSE SIMULTANEOUSLY OPERATED LEGAL AND ILLEGAL CROSS-BORDER BUSINESSES

40. At least as early as on or about November 6, 2000, executives of CREDIT SUISSE's private banking unit discussed creating a "new model for servicing offshore U.S. clients" that involved a new, fully registered, tax compliant broker-dealer and investment advisor. As part of this new model, U.S. taxpayers with accounts would be issued Forms 1099 reporting their investment income. This model was flawed in that it only attempted to centralize and legalize services to clients who had provided Forms W-9. The vast majority of U.S. undeclared accountholders at CREDIT SUISSE had not provided a Form W-9 to CREDIT SUISSE.

41. This new legal entity was created in or about mid-2002 and named Credit Suisse Private Advisors ("CSPA"). Only clients who had submitted Forms W-9 were expected to be transferred to CSPA. At that time, CREDIT SUISSE did not mandate that all U.S. accountholders, regardless of whether a Form W-9 was on file, transfer their accounts to CSPA and become fully tax compliant. CREDIT SUISSE set a minimum account balance threshold of $1 million in order to be transferred into CSPA; thus, some accounts were not transferred to CSPA because of the eligibility requirements set by CREDIT SUISSE.

42. CSPA ran in parallel to the illegal cross-border business at CREDIT SUISSE. Indeed, the head of CSPA reported to the head of SALN, who managed the team dedicated to servicing U.S. clients, many of whom had undeclared accounts. Separately, although approximately 6,000 non-W-9 U.S. clients were expected to be centralized at the SALN desk, CREDIT SUISSE did not mandate that those clients become tax compliant.

43. By 2006, CREDIT SUISSE had made little progress in the transfer of the W-9 U.S. clients to CSPA or the centralization of non-W-9 U.S. clients with SALN. By in or about September 2006, less than 20% of the W-9 U.S. clients (comprising approximately $500 million in assets under management) had agreed to be transferred. Furthermore, the transfer and consolidation exercise of undeclared accounts in SALN was behind plan; only 60% of assets under management belonging to non-W-9 U.S. clients had been transferred.

9

MD / CM / AM

Case 1:14-cr-00188-RBS Document 14 Filed 05/19/14 Page 10 of 16 PageID# 45

44. In or about 2006, CREDIT SUISSE began another set of initiatives to attempt to either move W-9 clients to CSPA or close the accounts, and to transfer non-W-9 clients to SALN. As with the 2002 initiatives, these efforts failed due in part to managers' resistance and CREDIT SUISSE's failure to overcome that resistance. Rather than close the accounts of those who had not agreed to be transferred to CSPA, CREDIT SUISSE continued to maintain their accounts for a period of years.

45. CREDIT SUISSE operated CSPA from in or about mid-2002 until in or about 2011. The CSPA initiative ultimately failed as a business, in part due to U.S. clients' unwillingness to pay a premium for accounts in Switzerland if their accounts were declared and tax compliant. Moreover, CREDIT SUISSE executives did not take any of three steps that could have ensured compliance with U.S. law: (1) mandating that managers transfer all U.S. accounts to CSPA, which would include declared and undeclared accounts; (2) creating incentives for managers to do so; and (3) penalizing managers who failed to or refused to transfer their clients to CSPA.

46. CREDIT SUISSE did not require all of its W-9 accounts to transfer their assets to CSPA out of concern that the bank would have an outflow of assets and managers would leave the bank.

### CREDIT SUISSE'S INEFFECTUAL POLICIES, TRAINING, AND AUDITS

47. CREDIT SUISSE's promulgation of policies and compliance training regarding U.S. undeclared accountholders was ineffective in eliminating the illegal cross-border business. For example, on or about November 26, 2002, CREDIT SUISSE enacted a directive governing relationships with U.S. clients (the "U.S. persons directive") that included restrictions governing communications with U.S. persons and travel to the U.S. and also included a prohibition on providing investment advice in the United States. In addition, CREDIT SUISSE enacted a directive governing foreign travel by managers, in order to provide guidelines to managers for conducting the U.S. cross-border business to ensure, among other things, "uniform adherence to the restrictions applicable under US law to bank relationships with US Persons and US Taxpayers." Despite these directives and training, managers continued to travel to the U.S. and communicate with U.S. clients in managing their undeclared accounts.

48. In addition, CREDIT SUISSE also conducted ineffectual internal audits to ensure compliance with the directives and policies regarding U.S. clients. First, while CREDIT SUISSE audited SALN with respect to the U.S. persons and travel directives, it did not audit for tax compliance of U.S. linked client accounts.

49. Second, CREDIT SUISSE did not audit other areas of the bank that serviced U.S. clients' accounts for tax compliance, despite the fact that the majority of the undeclared accounts were serviced outside of SALN.

50. Third, the internal audits of SALN conducted by CREDIT SUISSE in 2001, 2003, 2006, and 2009 did not identify the rampant violations of U.S. tax law and CREDIT

10

M 82 / CAW
S / AN

Case 1:14-cr-00188-RBS Document 14 Filed 05/19/14 Page 11 of 16 PageID# 46

SUISSE's own policies that had occurred. The 2001, 2003 and 2009 audits either found "no issues" or "minor issues," despite the fact that some of the travel reports provided to internal auditors reflected visits with prospective U.S. clients and the receipt of new money from those clients was estimated to have a potential value of millions of U.S. dollars. CREDIT SUISSE's 2006 internal audit of SALN preliminarily raised concerns that certain SALN managers may have violated the U.S. persons directive during business trips to the United States because CREDIT SUISSE's internal auditors had received reports that reflected that certain SALN managers had met with prospective U.S. clients and had obtained new assets on business trips to the United States. The internal auditors were also subsequently provided with travel reports that were edited by some SALN employees to omit any mention of conduct that violated the U.S. persons directive. Following meetings between internal auditors and the head of SALN, the preliminary findings were excluded from the final audit report.

51. In or about 2006, CREDIT SUISSE also initiated the "Cross-Border+ (Plus) Project" (the "CB+ Project"). An impetus for the CB+ Project was the March 2006 arrest of several CREDIT SUISSE bankers in Brazil, including the head of CREDIT SUISSE's private banking unit in Brazil, for conducting business in violation of Brazil's laws. The CB+ Project included a review of CREDIT SUISSE's policies regarding the U.S. cross-border business. However, it did not investigate the actual practices of managers in the illegal cross-border business. CREDIT SUISSE's attempts to strengthen its cross-border business policies did not stop private bankers from opening and servicing undeclared accounts for U.S. clients.

52. CREDIT SUISSE did not develop and implement an effective system of supervisory and compliance controls over the managers in the U.S. cross-border business to prevent and detect violations of CREDIT SUISSE policies regarding the proper handling of accounts for offshore companies beneficially owned by U.S. persons. CREDIT SUISSE failed to effectively monitor and control the activities of certain managers in the U.S. cross-border business. As a result, some managers at Clariden Leu came to believe that a certain degree of non-compliance with CREDIT SUISSE policy was acceptable in connection with operating the U.S. cross-border business. In addition, some managers at CREDIT SUISSE came to believe that they could successfully avoid the restrictions contained in CREDIT SUISSE's policy regarding its cross-border business.

53. Despite the above-described policies prohibiting certain contacts with U.S. persons, CREDIT SUISSE did not capture and record instances when managers in the U.S. cross-border business may have violated U.S. laws. As a result, CREDIT SUISSE did not effectively monitor such activity and thus was not able to determine whether or not such activity may have required tax information reporting and backup withholding for certain payments made to the accounts of such clients. Consequently, certain managers continued to engage in behavior that violated not only CREDIT SUISSE's directives and policies, but also the U.S. federal tax laws.

11

mby / cm
AS / AL

Case 1:14-cr-00188-RBS Document 14 Filed 05/19/14 Page 12 of 16 PageID# 47

### CREDIT SUISSE'S FLAWED EXIT OF THE ILLEGAL CROSS-BORDER BUSINESS

54. In or about January 2008, another Swiss bank, UBS AG ("UBS"), publicly announced that it would no longer allow new U.S. clients seeking securities-related services; rather, it would only allow U.S. clients seeking banking services to open accounts.

55. In or about May 2008, CREDIT SUISSE's U.S. persons policy was revised to provide that "RMs may travel to the US to visit existing clients only if the visit is initiated by the client, is for a purely and exclusively social nature and no discussion is had relating to securities or investments. As a prerequisite for such travel, the RM must complete a US Cross-Border training session and follow the procedures for obtaining the relevant travel approval. Visits to prospective clients are not permitted."

56. Following a much-publicized U.S. Department of Justice criminal tax investigation, in or about July 2008, UBS formally announced that it would cease providing banking services to U.S. clients through its non-U.S. regulated entities.

57. Following UBS's July 2008 announcement, CREDIT SUISSE circulated a legal and compliance alert that prohibited inflows of funds into existing or newly opened accounts from UBS and another Swiss bank that had come under fire for helping U.S. citizens shelter assets from the IRS and evade taxes. The alert also required accounts for non-U.S. domiciled companies with a U.S. taxpayer beneficial owner to demonstrate U.S. tax compliance and be opened with a U.S.-licensed arm of CREDIT SUISSE.

58. Within days of the news regarding UBS, CREDIT SUISSE's management began an enhanced examination of CREDIT SUISSE's U.S. cross-border business. The examination was internally referred to as the "US Project." As a result of this analysis, in or about late 2008, CREDIT SUISSE's management decided to terminate accounts of U.S. domiciliary companies with U.S. beneficial owners who could not establish tax compliance. In or about Spring 2009, CREDIT SUISSE stopped opening new U.S. client accounts for U.S. residents and existing U.S. resident clients were offered a choice: transfer to CSPA (or another U.S.-licensed affiliate of CREDIT SUISSE) and, if they were not already tax compliant, become tax compliant or leave the bank.

59. Starting in or about 2009, CREDIT SUISSE engaged in a flawed process of verifying tax compliance of U.S. accounts in order to allow these accounts to remain at CREDIT SUISSE, although the process improved over time. For example, it relied only on database searches and did not individually review accounts of managers who may have handled U.S. undeclared accounts. Further, when CREDIT SUISSE identified U.S. accounts that may have been undeclared, it did not interview the managers who had serviced the accounts to determine how the account had remained undetected after CREDIT SUISSE began its internal investigation by outside counsel. During the internal investigation, which began in early 2011, after identifying U.S. linked accounts in its systems, the bank engaged in a manual review of account files to

12

CAW

Case 1:14-cr-00188-RBS Document 14 Filed 05/19/14 Page 13 of 16 PageID# 48

determine whether the client was a U.S. person, and engaged an independent accounting firm to review the completeness of the bank's review.

60. CREDIT SUISSE permitted the managers who oversaw the undeclared accounts to determine how to close the accounts. As a result, certain managers assisted clients in continuing to conceal their accounts from the IRS through, for example, changing beneficiaries to non-U.S. persons. For those accounts that could not be maintained by CREDIT SUISSE, certain managers assisted their U.S. clients in identifying other offshore financial institutions in Switzerland and elsewhere that would accept accounts held by U.S. persons, which further aided the clients in concealing their accounts from the IRS. Finally, certain CREDIT SUISSE managers discouraged U.S. clients from disclosing their undeclared accounts to the IRS through the Voluntary Disclosure Program. Other managers encouraged U.S. clients to disclose undeclared accounts to the IRS.

61. Although CREDIT SUISSE had either transferred or terminated the majority of its relationships with U.S. clients by in or about 2010, CREDIT SUISSE continued to identify U.S. customer accounts for closure until in or about 2013, including dormant and recalcitrant accounts with illiquid assets.

62. Clariden Leu engaged in a similar exit program starting in or about 2008, but did not create a CSPA-type compliant entity. Rather, Clariden Leu required U.S. clients to either demonstrate tax compliance or terminate the relationship. However, the integration of Clariden Leu into Credit Suisse AG beginning in April 2012 revealed certain flaws in Clariden Leu's exit program: when undeclared accounts previously handled by Clariden Leu managers were reassigned to CREDIT SUISSE managers, they immediately identified that the owners of these Clariden Leu accounts were U.S. persons and sought to close the accounts.

63. CREDIT SUISSE did not put in place a new management team to handle the exit process, although the process was supervised by a broad cross-disciplinary team from both the business and control functions.

### CREDIT SUISSE'S INTERNAL INVESTIGATION AND FAILURE TO PRESERVE CERTAIN DOCUMENTS

64. CREDIT SUISSE did not begin its internal investigation until early 2011 and did not preserve certain evidence of the criminal wrongdoing.

65. In February 2009, UBS signed a Deferred Prosecution Agreement regarding its illegal cross-border business. UBS agreed to a Statement of Facts that described the operations of its illegal cross-border business, which bore substantial similarities to CREDIT SUISSE's operation of its illegal cross-border business.

66. In October 2009, CREDIT SUISSE representatives met with the Senate Permanent Subcommittee on Investigations and the Tax Division of the U.S. Department of

13

m 82 /cm/ in

Case 1:14-cr-00188-RBS Document 14 Filed 05/19/14 Page 14 of 16 PageID# 49

Justice to notify them that CREDIT SUISSE was executing its exit process for U.S. clients with Swiss accounts. CREDIT SUISSE made a second presentation on the exit process to the Tax Division in or about March 2010.

67. In December 2010, the Tax Division of the U.S. Department of Justice informed CREDIT SUISSE that the Department of Justice had begun a criminal investigation of CREDIT SUISSE and that the investigation had uncovered evidence of tax law violations by managers at SALN.

68. In response to its notice of the initiation of the Department of Justice's criminal investigation, CREDIT SUISSE began a formal internal investigation in January 2011, focused initially on SALN.

69. By the time CREDIT SUISSE began to fully engage in its internal investigation, certain culpable individuals had left the bank's employ. CREDIT SUISSE had failed to interview a number of the culpable individuals prior to their departures, and CREDIT SUISSE did not have access to those individuals after their departures. CREDIT SUISSE conceded that it was unable to fully uncover what transpired at Clariden Leu and its predecessors, in part because of the delays.

70. In addition, CREDIT SUISSE and Clariden Leu failed to implement adequate document and e-mail retention policies, in that the bank did not retain e-mails of employees who departed before August 2010, although it had been retaining U.S. account records and e-mail of all current employees. CREDIT SUISSE and Clariden Leu did not issue an order to preserve all e-mails related to the cross-border business until in August 2010. Clariden Leu did not implement a comprehensive litigation hold on documents until July 2011, after the return of the superseding indictment that charged Andreas Bachmann, among others. CREDIT SUISSE has taken steps to recover as many documents in Switzerland from that earlier period as possible.

71. One effect of these policies and actions was that certain documents and e-mails in Switzerland were not preserved, despite CREDIT SUISSE's management's awareness of various U.S. criminal tax investigations.

14

m87
w/
AL

Case 1:14-cr-00188-RBS Document 14 Filed 05/19/14 Page 15 of 16 PageID# 50

72. CREDIT SUISSE's delays and failure to take these actions limited the information available to the internal investigation, and as a result, encumbered the scope and progress of the criminal investigation being conducted by U.S. law enforcement authorities.

73. The acts taken by the defendant, Credit Suisse AG, in furtherance of the offense charged in this case, including the acts described above, were done willfully and knowingly with the specific intent to violate the law. The defendant acknowledges that the foregoing statement of facts does not describe all of the defendant's conduct relating to the offense charged in this case nor does it identify all of the persons with whom the defendant may have engaged in illegal activities.

Respectfully submitted,

DANA J. BOENTE
United States Attorney

KATHRYN KENEALLY
Assistant Attorney General
Tax Division

5-19-2014  
Mark D. Lytle  
Assistant U.S. Attorney

5-19-2014  
Mark F. Daly  
Senior Litigation Counsel  
Nanette L. Davis  
Assistant Chief

15

![img-0.jpeg](img-0.jpeg)

Case 1:14-cr-00188-RBS Document 14 Filed 05/19/14 Page 16 of 16 PageID# 51

After consulting with its attorney and pursuant to the plea agreement entered into this day between the defendant, Credit Suisse AG, and the United States, I, the designated corporate representative authorized by the Board of Directors, hereby stipulate that the above Statement of Facts is true and accurate, and that had the matter proceeded to trial, the United States would have proved the same beyond a reasonable doubt.

Date: 5/19/14 Credit Suisse AG

We are Credit Suisse AG's attorneys. We have carefully reviewed the above Statement of Facts with the Board of Directors. To our knowledge, the Board of Directors' decision to stipulate to these facts is an informed and voluntary one.

Date: 5/19/14 Christopher A. Wray
Andrew C. Hruska
Michael R. Pauzé
Counsel for the Defendant

16

![img-1.jpeg](img-1.jpeg)

**Attachment 4:** `05-19-2014WaiverofIndictment.pdf`

Case 1:14-cr-00188-RBS Document 12 Filed 05/19/14 Page 1 of 1 PageID# 18

![img-0.jpeg](img-0.jpeg)

# IN THE UNITED STATES DISTRICT COURT FOR THE
EASTERN DISTRICT OF VIRGINIA

Alexandria Division

UNITED STATES OF AMERICA
v.
CREDIT SUISSE AG,
Defendant.

CRIMINAL NO. 1:14-CR-188

# WAIVER OF AN INDICTMENT

I, Alan Reifenberg, acting on behalf of Credit Suisse AG, understand that Credit Suisse
AG has been accused of an offense punishable by imprisonment for more than one year. I was
advised in open court of Credit Suisse AG's rights and the nature of the proposed charge against
Credit Suisse AG.

After receiving this advice, Credit Suisse AG waives its right to prosecution by
indictment and consents to prosecution by information.

Date: 5/19/14

Corporate Representative's Signature

Alan Reifenberg
Printed Name of Corporate Representative

Signature of defendant's attorney
EDMUND P. PAWOTA
Christopher A. Wray
Printed name of defendant's attorney

/s/
Rebecca Beach Smith
Chief United States District Judge

MDZ
CS
CRW
AR
BPP

**Attachment 5:** `CSAG_Additional_Information.pdf`

The contents of Credit Suisse AG's/Credit Suisse International's Disclosure Reporting Pages ('DRPs') have primarily been drawn from DRPs previously filed by Credit Suisse Securities (USA) LLC ('CSSU') in its capacity as an SEC-registered broker-dealer, as CSSU and Credit Suisse AG are both under common control with CS Group AG. CSSU's DRPs date back to 1986, and thus Credit Suisse AG's disclosures will also begin in 1986. In addition, CSSU and CS Capital LLC's regulatory matter and civil matter DRPs are already available in the CRD system, and thus only one DRP will be filed for those two entities in each category. Please contact Alfred Nunn (phone number +1-212-538-6648 or alfred.nunn@credit-suisse.com) if any additional disclosures for Credit Suisse AG and its affiliated entities are necessary.'

Please note that when a date is not available for a date field in the form, a value of 1/1/1900 has been inserted as a placeholder.

**Attachment 6:** `CSAG-Opin-SECNonresidentSBSD.pdf`

# CLEARY GOTTLIEB STEEN & HAMILTON LLP

NEW YORK
WASHINGTON, D.C.
PARIS
BRUSSELS
FRANKFURT
COLOGNE
MOSCOW

2 London Wall Place
London EC2Y 5AU
T: +44 20 7614 2200
F: +44 20 7600 1698
clearygottlieb.com

ROME
MILAN
HONG KONG
BEIJING
BUENOS AIRES
SÃO PAULO
ABU DHABI
SEOUL

October 27, 2021

To:

Credit Suisse AG, London Branch
One Cabot Square,
London E14 4QJ
United Kingdom

With a copy to:

United States Securities and Exchange Commission
SEC Headquarters
100 F Street
NE Washington, DC 20549-1090
United States of America

Re: SEC Registration as a Non-resident Security-based Swap Dealer

We have acted as special English counsel to Credit Suisse AG, London Branch (the “Firm”), a credit institution regulated by the United Kingdom (“UK”) Financial Conduct Authority (“FCA”) and the UK Prudential Regulation Authority (“PRA”) in connection with the Firm’s application to register with the United States (“U.S.”) Securities and Exchange Commission (“SEC” or the “Commission”) as a non-resident security-based swap (“SBS”) dealer (“SBSD”). In connection with such registration, we have been asked to analyze the following questions:

- (a) whether the Firm can, as a matter of English law, provide the SEC with prompt access to its UK Books and Records (as defined below);
- (b) whether the Firm can, as a matter of English law, submit to on-site inspection and examination by the SEC of its UK Books and Records in the UK; and
- (c) whether the Firm would be in breach of English law by submitting to on-site inspections and examination of its U.S. Books and Records (as defined below) by the SEC in the U.S.

This legal opinion is provided in order to satisfy the requirement in 17 C.F.R. § 15Fb2-4(c)(1)(ii).

Cleary Gottlieb Steen & Hamilton LLP is a Limited Liability Partnership registered in England and Wales Number OC310280. It is authorised and regulated by the Solicitors Regulation Authority. A list of the members and their professional qualifications is open to inspection at the registered office, 2 London Wall Place, London EC2Y 5AU. Cleary Gottlieb Steen & Hamilton LLP or an affiliated entity has an office in each of the cities listed above.

For the purposes of this opinion letter:

“Covered Books and Records” are only those books and records that relate to the “U.S. business” (as defined in 17 C.F.R. § 240.3a71-3(a)(8)) of the Firm when acting as a non-resident SBSD, i.e., records that relate to an SBS transaction that is either:

(i) entered into, or offered to be entered into, by or on behalf of the Firm with a U.S. person (other than an SBS conducted through a foreign branch of such U.S. person); or

(ii) arranged, negotiated, or executed by personnel of the Firm located in a U.S. branch or office, or by personnel of an agent of the Firm located in a U.S. branch or office.

Additionally, books and records pertaining to SBS transactions entered into prior to the date that the Firm submits an application for registration are not Covered Books and Records.

On the basis that the Firm has a “prudential regulator” within the meaning of Section 3(a)(74) of the Securities Exchange Act of 1934 (15 U.S.C. § 78c(a)(74)), this opinion letter does not cover financial records necessary to assess compliance by the Firm with SEC capital and margin requirements.

“Relevant Books and Records” means the UK Books and Records and the U.S. Books and Records.

“UK Books and Records” are only those Covered Books and Records that are physically held or electronically stored in the UK.

“U.S. Books and Records” are only those Covered Books and Records that are physically held or electronically stored in the United States.

In arriving at our opinions below, we have reviewed:

(a) the Memorandum of Understanding signed between the FCA, the PRA and the SEC on July 30, 2021 (the “MoU”);1

(b) the administrative arrangement for the transfer of personal data between the SEC and the FCA signed on 29 April 2020 (the “Administrative Arrangement”);2

(c) the letter from the UK Information Commissioner’s Office (the “ICO”) to the SEC dated September 11, 2020 (the “ICO Letter”);3 and

1 Memorandum of Understanding Concerning Consultation, Cooperation and the Exchange of Information Related to the Supervision and Oversight of Certain Cross-Border Over-the-Counter Derivatives Entities In Connection with the Use of Substituted Compliance by Such Entities, signed on 30 July 2021, available at https://www.fca.org.uk/publication/mou/sec-fca-boe-mou-2021.pdf.

2 Available at: https://www.sec.gov/files/FCA-SEC-AA-FINAL.pdf.

3 Available at: https://ico.org.uk/media/for-organisations/documents/2619110/sec-letter-20200911.pdf.

2

(d) the SEC order granting conditional substituted compliance in connection with certain requirements applicable to non-U.S. security-based swap dealers and major security-based swap participants subject to regulation in the United Kingdom, dated July 30, 20214.

In addition, we have made such investigations of law as we have deemed appropriate as a basis for the opinions expressed below.

# I. ASSUMPTIONS

In rendering our opinion statements below, we have assumed and not independently verified:

(a) the Firm has a “prudential regulator” within the meaning of Section 3(a)(74) of the Securities Exchange Act of 1934 (15 U.S.C. § 78c(a)(74));

(b) the SEC’s requests for the Relevant Books and Records (as defined below) and on-site inspection and examination will be intra vires;

(c) the SEC will restrict its requests for, and use of, any information in the Relevant Books and Records or obtained in the course of its on-site inspection and examination, to only such information that it may lawfully request and process for (and that is strictly necessary for) its own legitimate regulatory purposes in respect of the Firm’s activities as a non-resident SBSD;

(d) the SEC will limit its requests in respect of personal data (as defined in Article 4(1) UK GDPR, “personal data”) included in the Relevant Books and Records to targeted requests based upon a risk-based assessment in respect of specific customers, employees and accounts5;

(e) the SEC will maintain any information, data and documents obtained from the Firm in a secure manner and in compliance with all applicable U.S. laws of confidentiality and not share onwards any personal data obtained from the Firm other than in accordance with a lawful request of the U.S. Congress or a properly issued subpoena, or to other regulators who have demonstrated a need for the information and provided assurances of confidentiality;

(f) the Relevant Books and Records have been collected and maintained, and are and will be held, in accordance with the Data Protection Laws (as defined below) and English employment law relating to the processing of personal data of employees; in particular, the Firm and any relevant affiliates, as the case may be, have complied with all transparency requirements in respect of its processing of personal data by means of providing sufficiently detailed notices and information to its customers and employees and is otherwise complying

4 Available at: https://www.sec.gov/rules/other/2021/34-92529.pdf

5 The ICO Letter states that the SEC has informed the ICO that: “it is the SEC’s practice to limit the type and amount of personal data it requests during examinations to targeted requests based on risk and related to specific clients and accounts, and employees. The requested information may include some limited criminal records data and ‘special category data’ under the GDPR”.

3

with Data Protection Laws and employment law requirements relating to the processing of personal data of employees;

(g) the Firm or its relevant associated persons (including affiliates), as the case may be, have obtained all required consents and approvals of any affected persons required for the disclosure of the respective information in the UK Books and Records or the U.S. Books and Records, as the case may be, to, or to allow on-site inspection and examination by, the SEC, in each case to the extent, as considered in this opinion letter, such consent or approval, as the case may be, is able to be validly given and such consent or approval has not been revoked;

(h) where the Firm is acting as controller (as defined in Article 4(7) UK GDPR, “controller”) with respect to any element of the Relevant Books and Records that constitutes personal data, the Firm will comply in all respects with all provisions of the Data Protection Laws and the Guidelines that are relevant in order for at least one of the conditions for transfer of data to a third country pursuant to Article 49 UK GDPR to be available to it; and where transfers of personal data are made to the SEC in the absence of an adequacy decision pursuant to Article 45(3) UK GDPR$^{6}$, such disclosure will be necessary for important reasons of public interest (under Article 49(1)(d) UK GDPR) in accordance with the ICO Letter;$^{7}$

(i) the Firm has neither permitted the private use of the Firm’s business e-mail accounts nor the use of private email accounts for business purposes by its employees, or the Firm has policies in place that regulate such use with sufficient separation;

(j) the Firm does not include the information described in 17 C.F.R. §§ 240.18a-5(b)(8)(i)(A) through (H) or 240.18a-5(a)(10)(i)(A) through (H), as the case may be, in questionnaires or applications for employment executed by an associated person who is not a U.S. person (as defined in 17 C.F.R. §240.3a71-3(a)(4)(i)(A)), unless the Firm is required to obtain such information under applicable law in the jurisdiction in which the associated person is employed or located or obtains such information in conducting a background check that is customary for the Firm in that jurisdiction and the creation or maintenance of records reflecting that information would not result in a violation of applicable law in the jurisdiction in which the associated person is employed or located; provided that the Firm does not know, or in the exercise of reasonable care should have known, of the statutory disqualification of such associated person;

$^{6}$ As supplemented by Section 17A UK DPA 2018.

$^{7}$ The ICO Letter provides support for the view that the Firm’s compliance with an SEC disclosure request might, on a case-by-case basis and subject to the qualifications in the ICO Letter, be considered by the ICO to be in the UK public interest since such disclosure helps to: (i) prevent UK financial crimes from being committed and (ii) prevent the commission in the U.S. of conduct that would amount to a UK financial crime. In the ICO’s assessment in the ICO Letter, the Financial Services and Markets Act 2000 (the “FSMA”) further demonstrates that there is a “UK public interest in UK-based firms not being used for the purposes of conduct overseas that would constitute a financial crime if committed in the UK.” In addition, compliance with the SEC’s request for disclosure and examination helps the Firm comply with Principle 11 of the FCA Handbook and the PRA’s Fundamental Rule 7, which require FCA- and PRA-regulated firms to deal with regulators worldwide in an open and cooperative way. The ICO Letter therefore supports the view that the relevant data transfers could be considered necessary for important reasons of public interest. However, the ICO Letter also makes clear the importance of complying with other UK GDPR obligations. In addition to relying on Article 49(1)(d) (if it can do so), the Firm also has to demonstrate a lawful basis under Article 6 UK GDPR for every instance it makes a disclosure or permits examination of the Relevant Books and Records by the SEC.

4

(k) the Firm will keep the U.S. Books and Records in accordance with any applicable SEC requirements;

(l) the MoU is in full force and effect and no notice of termination has been sent pursuant to Article XI thereof;

(m) the FCA, the PRA and the SEC (as applicable) will comply in all respects with all provisions of the UK MOU and Administrative Arrangement; and

(n) neither the contractual arrangements with its customers or within its own organisation (including any standard contractual clauses or other intragroup data transfer mechanism or protocol) nor any orders by, or other arrangements with, its regulators or other supervisory authorities (including the FCA or the PRA) prohibit the Firm from providing the SEC with prompt access to the UK Books and Records or to submit to on-site inspection and examination of the Relevant Books and Records by the SEC.

## II. OPINION STATEMENTS

Based upon the foregoing and subject to the assumptions in this letter and the following discussion and qualifications, it is our opinion that:

(a) the Firm can, as a matter of English law, provide the SEC with prompt access to its UK Books and Records;

(b) the Firm can, as a matter of English law, submit to on-site inspection and examination by the SEC of its UK Books and Records in the UK; and

(c) the Firm can, as a matter of English law, submit to on-site inspection and examination by the SEC of its U.S. Books and Records in the United States.

## III. DISCUSSION

### 1. Data Protection Law

The UK data protection regime is largely derived from European Union (“EU”) privacy and data protection laws retained in successor UK legislation after the UK’s withdrawal from the EU.

The primary law regulating the processing of personal data in the EU is the General Data Protection Regulation 2016/679 (the “GDPR”). The GDPR forms part of the UK’s “retained EU law” under (and as defined in) the European Union (Withdrawal) Act 2018 (“EUWA”). The UK version of the GDPR operates under the EUWA as amended by Schedule 1 to the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019 (SI 2019/419) (“UK GDPR”), and sits alongside the UK Data Protection Act 2018 (“DPA 2018”), which contains provisions that serve to supplement (and in some cases, derogate from) the UK GDPR.

The UK GDPR and the DPA 2018 (together, the “Data Protection Laws”) will apply to the Firm’s disclosure of the Relevant Books and Records to the SEC to the extent that these comprise or contain personal data. Personal data is any data relating to an identified or identifiable living individual and may include information concerning the Firm’s employees, counterparties and customers.

5

As described in the ICO Letter, the UK GDPR “provides a range of transfer tools and gateways”8 that permit in certain circumstances the transfer of personal data from entities, acting as controller or processor, in the UK such as the Firm to public authorities such as the SEC in the absence of an adequacy decision pursuant to Article 45(3) UK GDPR.9 For instance, Article 46(1) UK GDPR provides that a UK-based entity may transfer personal data to a third country if the entity has provided “appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available”. Furthermore, Article 49 UK GDPR provides that in the absence of an adequacy decision pursuant to Article 45(3) UK GDPR, or of appropriate safeguards pursuant to Article 46, a transfer or a set of transfers of personal data to a third country may take place based on one of the derogations enumerated in Article 49 UK GDPR, provided that all the conditions of such a derogation are met. Such conditions include:

(a) the data subject has explicitly consented to the proposed transfer, after having been informed of the possible risks of such transfers for the data subject due to the absence of an adequacy decision and appropriate safeguards;

(b) the transfer is necessary for the performance of a contract between the data subject and the controller or the implementation of pre-contractual measures taken at the data subject's request;

(c) the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the controller and another natural or legal person;

(d) the transfer is necessary for important reasons of public interest; and

(e) in case none of the above conditions are applicable, if the transfer is not repetitive, concerns only a limited number of data subjects, is necessary for the purposes of compelling legitimate interests pursued by the controller which are not overridden by the interests or rights and freedoms of the data subject, and the controller has assessed all the circumstances surrounding the data transfer and has on the basis of that assessment provided suitable safeguards with regard to the protection of personal data. The controller shall, in addition to providing the information referred to in Articles 13 and 14 UK GDPR, inform the data subject of the transfer and of the compelling legitimate interests pursued.

In addition, the European Data Protection Board (“EDPB”) has issued guidelines as to the scope and interpretation of Article 49 GDPR on derogations in the context of transfers of personal data to third countries (the “Guidelines”).10

Given the absence as of the date hereof of an adequacy decision pursuant to Article 45(3) UK GDPR with respect to the United States, the Firm can provide access to the SEC to, and submit to onsite inspection by the SEC with respect to, elements of

8 ICO Letter, page 3.

9 According to Article 44 UK GDPR, any transfer of personal data to third countries or international organizations must, in addition to complying with Chapter V UK GDPR, also meet the conditions of the other provisions of the UK GDPR

10 EDPB’s Guidelines 2/2018 on derogations of Article 49 under Regulation 2016/679, adopted on 25 May 25 2018, available at: https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_2_2018_derogations_en.pdf.

6

Relevant Books and Records that constitute personal data only if the conditions of Article 46(1) UK GDPR or Article 49 UK GDPR (as interpreted by the Guidelines) are satisfied.

It will be the responsibility of the Firm as data controller to assess, on a case-by-case basis (as and when the SEC requires disclosure of or access to Relevant Books and Records that may contain personal data), which of the provisions of the Data Protection Laws may be relied on for the lawful disclosure to the SEC of personal data comprising or contained in the Relevant Books and Records. On the basis of and in reliance on the ICO’s position set out in the ICO Letter, in accordance with which the Firm may be able to rely on the derogation under Article 49(1)(d) UK GDPR to justify the transfer to the SEC of Relevant Books and Records containing personal data, we are of the view that, subject to our assumption in item (h) and the other assumptions and qualifications in this opinion letter, the provision of prompt access to and the submission to on-site inspection and examination of, the Relevant Books and Records, as the case may be, do not conflict with the applicable Data Protection Laws.

## 2. Duty of Confidentiality

Over the years, the English courts have recognized that confidential information may be subject to certain duties of confidentiality, including a general duty of confidentiality, and specific duties applying to banks and employers.$^{11}$

### a. Scope of duties

According to the case, *Coco v AN Clark (Engineers) Ltd* [1968] F.S.R. 415, two requirements are needed for the information to be protected under the general duty of confidentiality. Firstly, the information must have the “*necessary quality of confidence*”.$^{12}$ Secondly, the information must have been given in a situation which imposed an obligation of confidence.

(i) The necessary quality of confidence is defined as information which is not “*public property and public knowledge*”.$^{13}$ Given the information contained in the Relevant Books and Records is not publically available, it is likely to possess the requisite quality of confidence to the extent that the information relates to the Firm’s customers or employees and is not information owned by or relating to the Firm itself.

(ii) The information must have been communicated in a situation where an obligation of confidence was either expressly or impliedly imposed.$^{14}$ The court will consider whether the recipient of the information knew, or ought to have known, that there was a duty of confidentiality in relation to that information. Such duty confidentiality can be imposed by contract, implied by the circumstances of the disclosure, or implied by a special relationship between the parties.

$^{11}$ The following discussion is without prejudice to the discussion of the Data Protection Laws above.

$^{12}$ Megarry J in the *Coco v AN Clark (Engineers) Ltd* at 419 used the formulation first used by Lord Greene, M.R. in *Saltman Engineering Co Ltd v Campbell Engineering Co Ltd* [1948] 65 RPC 203, [1963] 3 All ER 413.

$^{13}$ *Saltman Engineering Co Ltd v Campbell Engineering Co Ltd* at 415.

$^{14}$ Megarry J in *Coco v AN Clark (Engineers) Ltd* at 420.

7

If aspects of the information contained in the Relevant Books and Records relate to either customers or employees, this would likely imply that the Firm, as the recipient, either knew or ought to have known that the information was to be treated confidentially.

Under the banker’s duty of confidence established by *Tournier v National Provincial and Union Bank of England* [1924] 1 KB 461 (“Tournier”), banks, such as the Firm, must keep its customer’s affairs private. The scope of the banker’s duty of confidentiality is wide, and extends “at least to all the transactions that go through the account, and to the securities, if any, given in respect of the account”, “beyond the point when the account is closed, or cease[s] to be an active account”,15 and encompasses intra-bank disclosures within the same corporate group.16

In contrast, an employer’s duty of confidence17 is limited: the Firm will only be restricted in its use of information held in relation to its employees “where there is no reasonable and proper cause for the employer[’]s conduct and only then if the conduct is calculated to destroy or seriously damage the relationship of trust and confidence.”18

b. Exceptions

To bring a successful claim for breach of confidentiality, the legal or natural person to whom the duty of confidentiality is owed (the “Rights Holder”) must demonstrate that there has been an unauthorized use of confidential information to their detriment.19

Where Relevant Books and Records contain customer information, the Firm will only be able to disclose Relevant Books and Records containing confidential information in un-redacted form via one of the following exceptions established in *Tournier*:

(a) where the disclosure is made by the express or implied consent of the customer;
(b) under compulsion of law;
(c) where the disclosure is in the public interest; or
(d) where it is in the interests of the bank to make disclosure.

The general and employer’s duties of confidentiality are also subject to the exceptions in (a)20 to (c) above.

15 *Tournier* at 485.

16 *Bank of Tokyo Ltd v Karoon* [1987] 1 AC 45 at 54.

17 *Prout v British Gas Plc and Another* [1992] F.S.R. 478 at 482.

18 *Malik v Bank of Credit and Commerce International SA* [1998] A.C 20 at 53.

19 Megarry J in *Coco v AN Clark (Engineers) Ltd* at 421.

20 The availability of the exception in (a) in relation to the general duty of confidentiality was confirmed by *Arnold J in Primary Group (UK) Ltd v The Royal Bank of Scotland Plc* [2014] R.P.C. 26 at 246.

8

# i. *Consent*

Disclosure of confidential information is permissible where the Rights Holder has given their consent to the disclosure of their confidential information.

There is likely to be a high bar to meet when relying on implied consent. In *Turner v Royal Bank of Scotland Plc* [1999] 2 All E.R, it was decided that established market practice of sharing of customer information between banks did not amount to implied consent of the customer as the customer was not aware of this practice. To amount to implied consent, the practice under which disclosure is made must be “*notorious, certain and reasonable*”.$^{21}$

The ability to rely on implied consent in relation to customers will partly depend on what information is provided to customers when the Firm provides services in SBSs. If no information about the jurisdiction or regulators involved is provided, then the Firm would be placing reliance on the customer’s own understanding of regulatory obligations on banks, the U.S. nexus and the SEC’s role in these services, which may not necessarily be present. However, if customers are provided detailed information, such as the Firm’s cross-border activity in SBSs with the United States and oversight by the SEC, then the Firm is more likely to be able to rely on implied consent.

# ii. *Compulsion of law*

Disclosure of confidential information may be permitted when required by statutory law or court order.

However, this exception, as it relates to statutory obligations, is likely only available where the compulsion stems from UK statute$^{22}$ and, despite the existence of UK statutory provisions requiring the disclosure of information that would otherwise be confidential,$^{23}$ none are directly applicable to this situation.

Likewise, a U.S. court order is unlikely to be sufficient for this exception. *X AG and others v A bank* [1983] 2 All ER at 475 held that a subpoena requiring disclosure issued by a foreign court did not qualify as compulsion by law on the basis that “*[t]he fact is that confidentiality is not rendered illegal by a subpoena requiring disclosure, which is to be contrasted with some form of legislation to that end.*”

Finally, given that the MoU between the FCA, the PRA and the SEC lacks the authority of statute, it should not be relied upon by the Firm for the purpose of this exception.

$^{21}$ Sir Richard Scott VC at 670 quoting from *Chitty on Contracts* (27th edn, 1994), vol I, para 13-014.

$^{22}$ In *A and Others v B Bank (Governor and Company of the Bank of England intervening)* [1992] 3 WLR 705 it was held that there would be no breach of confidentiality where disclosure was ordered by a United Kingdom regulator (the Bank of England) who would then pass the information over to a foreign regulator (the U.S. Federal Reserve Board). However, it was the United Kingdom regulator’s compelling power under the Banking Act 1987, not that of the U.S. Federal Reserve Board, which was decisive.

$^{23}$ For example, under certain circumstances, a person may be required to produce documents or otherwise disclose information in accordance with the FCA’s and PRA’s powers under Part XI of the FSMA. In addition, under s.330 of the Proceeds of Crime Act 2002 it is an offence for someone in the regulated sector not to disclose knowledge or suspicion of money laundering activities as required by the legislation.

9

# iii. *Public interest*

The public interest exception requires a balance to be struck between the rights of the Rights Holders and the public interest in the SEC obtaining that confidential information.$^{24}$ The test to be applied involves considering whether in all the circumstances, it is in the public interest that the duty of confidence should be overridden.$^{25}$

Disclosure in the public interest has been narrowly construed by the English courts, and the burden is for the Firm to justify disclosure of confidential information.$^{26}$ In *Tournier*, it was suggested that national security concerns,$^{27}$ and disclosure in the interest of preventing fraud or crime would meet this criterion.$^{28}$

However, it has been held that public interest in effective regulation and supervision of banking institutions$^{29}$ outweighs the public interest in maintaining confidentiality, even without statutory compulsion.$^{30}$ In such instances, the weight of the claim for disclosure is greater when considering limited disclosure, such as to a relevant authority acting under its own duties of confidence, as opposed to public dissemination of information.$^{31}$

Disclosure to the SEC may aid the SEC’s supervisory mandate. This would likely be sufficient to establish a public interest in disclosure, as compliance with SEC Rules (i) helps to prevent UK financial crimes from being committed; and (ii) helps to prevent the commission in the U.S. of conduct that would amount to a UK financial crime. In addition, compliance with a request from the SEC for disclosure or examination helps the Firm comply with its obligations under the FCA’s Principle 11 and the PRA’s Fundamental Rule 7, as applicable, which require the Firm to “deal with its regulators$^{32}$ in an open and cooperative way...”.

For these reasons, it is likely that the Firm would be able to rely on this exception to the duties of confidence in permitting the SEC to access and examine its Relevant Books and Records.

$^{24}$ *AG v Guardian Newspapers (No 2) and Others* [1990] 1 A.C. 109 (known as *Spycatcher*) at 268.

$^{25}$ *Prince of Wales v Associated Newspapers Ltd (CA)* [2007] 3 WLR at 68.

$^{26}$ *Price Waterhouse v BCCI Holdings (Luxembourg) SA* [1992] BCLC 583 at 597.

$^{27}$ *Tournier* at 481 and 486.

$^{28}$ *Tournier* at 486.

$^{29}$ In *Pharaon v Bank of Credit and Commerce International SA* [1998] 4 All E.R. 455, it was held that a bank could comply with a foreign subpoena without breaching the duty of confidentiality on the basis of the public interest exception (this contrasts with the exception for compulsion of law, as discussed above).

$^{30}$ *Price Waterhouse v BCCI Holdings (Luxembourg) SA* [1992] BCLC 583 at 596 and 601. Although this case concerned disclosure by accountants, the court’s analysis applies equally to the duty of confidentiality owed by a bank.

$^{31}$ *AG v Guardian Newspapers (No 2) and Others* at 268.

$^{32}$ This is considered to include non-UK regulators (see the FCA’s Principles for Businesses (PRIN) 1.1.6G, which sets out that “Principle 11 (Relations with regulators) applies to world-wide activities; in considering whether to take regulatory action under Principle 11 in relation to cooperation with an overseas regulator, the FCA will have regard to the extent of, and limits to, the duties owed by the firm or other person to that regulator.”)

10

# iv. *In the bank's interest*

In certain cases, confidential information that is subject to the banker’s duty of confidentiality may be disclosed where it is in the interests of the bank. This exception is not available for information that is subject to the general duty of confidentiality alone. However, we consider that this exception is available to information that is subject to both such duties, leaving only information that does not relate to customers (*e.g.*, information relating to employees) beyond the scope of this exception.

Although it is in the Firm’s interest to comply with the SEC’s requests, the case law indicates that a high bar exists to satisfy this exception. The qualification will most obviously cover the situation where a bank commences proceedings against its customer to recover an unpaid loan or overdraft facility and the bank has to disclose the extent of the customer’s liabilities in its claim.$^{33}$ However, in *XAG and others v A Bank*, Leggatt J held that it was not clearly in the defendant bank’s own interests to comply with a subpoena from New York, as the bank could not establish as a matter of fact that it would face any serious detriment for its failure to comply.$^{34}$ Accordingly, the bank’s own interest exception will be construed narrowly and the court will assess whether the bank’s own interests are genuinely threatened by non-disclosure.

In relation to the SEC’s requests, failure to comply may result in enforcement action and potentially the Firm’s inability to conduct SBS business in U.S. markets. Therefore, it is arguable that the Firm may face serious detriment for a failure to comply with the SEC’s requests.

However, to rely on this exception, the Firm must also balance its interests in complying with the SEC’s disclosure request against the competing interest of its customers in the banker’s duty of confidence being maintained, and the Firm must satisfy itself that those interests do not outweigh its own. This would require an assessment on a case-by-case basis. As each customer’s circumstances differ, this exception may not provide a consistent basis on which to provide information to the SEC in comparison to the public interest exception above.

In conclusion, as explored above, it is unlikely that the compulsion of law exception will be applicable. In relation to the banker’s duty of confidentiality, it may not be possible to rely on disclosure in the bank’s interest in all cases. However, the Firm should be able to rely on the public interest and, where available, consent exceptions to the duties of confidence in permitting the SEC to access and examine its Relevant Books and Records.

#### IV. QUALIFICATIONS

The opinion statements above are subject to the qualifications set out below:

(a) This opinion letter relates exclusively to (i) the access provided to the SEC to the UK Books and Records in respect of which, for purposes of the Data Protection Laws, the Firm is a data controller, and that are subject to English law; and (ii) on-site inspection and examination by the SEC of the UK Books and Records on the premises of the

$^{33}$ See *Tournier* at 473.

$^{34}$ *XAG and others v A bank* at 475.

11

Firm in the UK and the U.S. Books and Records on the premises of the Firm in the United States, as the case may be.

(b) This opinion letter is confined to legal matters, and we express no opinion as to any factual matters.

(c) This opinion letter may therefore only be relied upon under the condition that this opinion letter shall be governed by English law and construed in accordance with English rules of construction and that issues of interpretation of this opinion must be brought before an English court.

(d) The opinion statements set out above are limited to English law. We do not express any opinion as to, and have not made any investigation of, any law other than English law in force as at the date hereof and as applied according to published case law.

(e) The opinion statements set out above are based upon the ICO Letter and our understanding that the SEC, in its preliminary view, has been provided “*with adequate assurances*” by the FCA and the PRA that “*no law or policy would impede the ability of any entity that is directly supervised by the authority and that may register with the Commission to provide prompt access to the Commission to such entity’s books and records or to submit to onsite inspection or examination by the Commission*”$^{35}$. The opinion statements set out above are predicated on the ICO not significantly changing its proposed regulatory approach to the matters set out in the ICO Letter following the end of the transition period after the UK’s withdrawal from the EU.$^{36}$

(f) The opinion statements to the effect that the Firm “can”, as a matter of English law, take certain actions is not an expression of any opinion or a confirmation that it may (lawfully) do so in any given instance where the opportunity, or request, or requirement to do so arises. It is a fundamental part of this opinion that the Data Protection Laws stipulate certain legal bases on which such action *may* be taken, but the lawfulness of actually taking such action is subject to the scope and qualifications of the relevant legal basis (such as, in the case of processing on the bases of Articles 6(1)(e) and 6(1)(f) UK GDPR, a right of data subjects to object to the relevant processing$^{37}$) and other applicable provisions of the Data Protection Laws,$^{38}$ as set out in this opinion letter. Whether the requirements of (and qualifications to) the legal basis to be relied upon in a specific case are actually fulfilled, must be determined on a case-by-case basis by the Firm (as and when the SEC requires disclosure

$^{35}$ See Federal Register / Vol. 86, No. 149 / Friday, August 6, 2021 / Notices, p. 6 available at https://www.govinfo.gov/content/pkg/FR-2021-08-06/pdf/2021-16657.pdf.

$^{36}$ The ICO states to the SEC in the ICO Letter: “*The UK has left the European Union and is currently in a transition period when EU laws, including GDPR, continue to apply. At the end of this transition period on 1 January 2021 the UK GDPR will apply, which will contain very similar provisions. We do not anticipate any significant change to our approach to the application of the UK GDPR to the transfers of personal data by SEC regulated UK firms to you.*”

$^{37}$ UK GDPR Article 21(1).

$^{38}$ For instance, in the ICO Letter, the ICO states that: “*We would not find there to be a breach of the GDPR transfer rules if the firm provided evidence that it had carefully considered and appropriately applied the Art. 49.1(d) ‘public interest’ derogation.*” (emphasis added). The opinions expressed in this letter regarding Article 49(1)(d) are accordingly subject to the Firm’s compliance with these ICO requirements.

12

of or access to Relevant Books and Records that may contain personal data) after due and careful consideration.

(g) The opinions expressed herein are rendered on and as of the date hereof, and we assume no obligation to advise you (or any other person who may rely on this opinion letter in accordance with the paragraph above), or undertake any investigations, as to any legal developments or factual matters arising subsequent to the date hereof that might affect the opinions expressed herein. We acknowledge that SEC rules require a non-resident SBSD to re-certify within ninety days after any changes in the legal or regulatory framework that would impact the ability of the SBSD to provide, or the manner in which it would provide, prompt access to its books and records, or would impact the ability of the SEC to inspect and examine the SBSD. Upon such change of law, the SBSD will be required to submit a revised opinion describing how, as a matter of English law, the SBSD will continue to meet its obligations.

(h) The MoU is not a legally binding agreement and therefore that the SEC, the FCA and the PRA are not under a legal obligation to comply with its provisions.

## V. RELIANCE

This opinion letter is being furnished solely for the benefit of the Firm and is not to be relied on by, or furnished to, any other person or used, circulated, quoted or otherwise referred to for any other purpose, except that the Firm may submit this opinion letter to the SEC as part of its application to register as a non-resident SBSD. In authorizing the Firm to make this opinion letter available to the SEC for such purposes, we are not undertaking or assuming any duty or obligation to the SEC or establishing any lawyer-client relationship with it.

This opinion letter is limited to the matters expressly stated herein and does not extend to, and is not to be read as extended by implication to, any other matters.

Very truly yours,

CLEARY GOTTLIEB STEEN & HAMILTON LLP

By:

Sunil Gadhia, a Partner

13

**Attachment 7:** `Opinion_IrishCounsel.pdf`

# ARTHUR COX

TO: Maria Chiodi - Credit Suisse AG
FROM: Robert Cain, Olivia Mullooly and Aaron Tangney - Arthur Cox LLP
COPY: United States Securities and Exchange Commission, SEC Headquarters, 100 F Street, NE Washington, DC 20549-1090, United States of America
DATE: 2 November 2021
SUBJECT: Irish Law Opinion on Credit Suisse AG's proposed Securities and Exchange Commission Registration as a Non-resident Security-based Swap Dealer

1. Introduction

1.1 We are acting as Irish counsel to Credit Suisse AG ("Bank") - including its Dublin branch Credit Suisse AG, Dublin Branch ("Irish Branch")1 - in connection with the Bank's application to register with the United States of America ("U.S.") Securities and Exchange Commission ("SEC") as a non-resident security-based swap ("SBS") dealer ("SBSD").

1.2 In connection with the proposed registration the Bank as a SBSD, we have been asked to provide an Irish law opinion ("Opinion") in respect of the following questions:

(a) Whether the Bank can, as a matter of Irish law, provide the SEC with prompt access to its Irish Books and Records (as defined further below);

(b) Whether the Bank can, as a matter of Irish law, submit to on-site inspection and examination by the SEC of its Irish Books and Records in Ireland; and

(c) Whether the Bank would be in breach of Irish law by submitting to on-site inspections and examination of its Irish Books and Records (as defined below) in Ireland by the SEC.

1.3 This Opinion is being provided in order to satisfy the requirement in 17 C.F.R. § 15Fb2-4(c)(1)(ii).

1.4 For the purposes of preparing our Opinion, we have reviewed the IOSCO Multilateral Memorandum of Understanding concerning consultation and cooperation and the exchange of information ("IOSCO MoU").2

1.5 In addition, we have made such investigations of law as we have deemed appropriate as a basis for the Opinion.

2. Definitions

2.1 For the purposes of this Opinion, the following definitions apply:

(a) "Covered Books and Records" means only those books and records that:

(i) relate to the "U.S. business" (as defined in 17 C.F.R. § 240.3a71-3(a)(8)) of the Bank when acting as a non-resident SBSD, i.e., records that relate to an SBS transaction that is either:

1 Credit Suisse AG, Dublin Branch is licensed by the Central Bank of Ireland as a third country branch under Section 9A of the Central Bank Act 1971.

2 The IOSCO MoU is available here: https://www.iosco.org/about/?subsection=mmou

Page 2

(A) entered into, or offered to be entered into, by or on behalf of the Bank with a U.S. person (other than an SBS conducted through a foreign branch of such U.S. person); or

(B) arranged, negotiated, or executed by personnel of the Bank located in a U.S. branch or office, or by personnel of an agent of the Bank located in a U.S. branch or office; or

(ii) constitute financial records necessary for the SEC to assess the Bank's compliance with the SEC's margin and capital requirements, if applicable.

Additionally, books and records pertaining to SBS transactions entered into prior to the date that the Bank submits an application for registration are not Covered Books and Records.

On the basis that the Bank has a "prudential regulator" within the meaning of Section 3(a)(74) of the Securities Exchange Act of 1934 (15 U.S.C. § 78c(a)(74)), this Opinion does not cover financial records necessary to assess compliance by the Bank with SEC capital and margin requirements;

(b) "Irish Books and Records" means only those Covered Books and Records that are physically held or electronically stored in Ireland;

(c) "U.S. Books and Records" means only those Covered Books and Records that are physically held or electronically stored in the U.S; and

(d) "Relevant Books and Records" means, together, the Irish Books and Records and the U.S. Books and Records.

# 3. Assumptions

3.1 In providing our Opinion, we have assumed and not independently verified the following:

(a) The Bank has a "prudential regulator" within the meaning of Section 3(a)(74) of the Securities Exchange Act of 1934 (15 U.S.C. § 78c(a)(74));

(b) The SEC's requests for the Relevant Books and Records and on-site inspection and examination will be intra vires;

(c) The SEC will restrict its requests for, and use of, any information in the Relevant Books and Records or obtained in the course of its on-site inspection and examination, to only such information that it may lawfully request and process for (and that is strictly necessary for) its own legitimate regulatory purposes in respect of the Bank's activities as a non-resident SBSD;

(d) The SEC will limit its requests in respect of personal data (as defined in Article 4(1) GDPR, "personal data") included in the Relevant Books and Records to targeted requests based upon a risk-based assessment in respect of specific customers, employees and accounts having regard to the purpose(s) for their collection and that the personal data disclosed in response to these requests will be limited to what is necessary for such purposes (which are necessary for important reasons of public interest recognised in EU or Member State law to which the Bank is subject);

(e) The SEC will maintain any information, data and documents obtained from the Bank in a secure manner and in compliance with all applicable U.S. laws of confidentiality

Page 3

and not share onwards any personal data obtained from the Bank other than in accordance with a lawful request of the U.S. Congress or a properly issued subpoena, or to other regulators who have demonstrated a need for the information and provided assurances of confidentiality and that the SEC will, save where prohibited by the relevant US law or order, inform the Bank of any such requests to the extent they relate to the Irish Books and Records.3

(f) In the context of the activities of the Irish Branch, the Relevant Books and Records have been collected and maintained, and are and will be held, in accordance with the Data Protection Laws (as defined below) and Irish employment law; in particular, the Bank, and any relevant affiliates as the case may be, have complied with all transparency requirements in respect of its processing of personal data by means of providing sufficiently detailed notices and information to its customers and employees (including with respect to the transfer of personal data from the Irish Books and Records to the SEC and the purposes for same) and is otherwise complying with Data Protection Laws and employment law requirements;

(g) The Bank and its relevant associated persons (including affiliates) as the case may be have obtained all required consents and approvals of any affected persons (e.g., customers and employees) required for the disclosure of the respective information in the Irish Books and Records or the U.S. Books and Records, as the case may be, to, or to allow on-site inspection and examination by, the SEC, in each case to the extent, as considered in this Opinion, such consent or approval, as the case may be, is able to be validly given and such consent or approval has not been revoked;

(h) Where the Bank is acting as controller (as defined in Article 4(7) GDPR, “controller”) with respect to any element of the Irish Books and Records that constitutes personal data, the Bank will comply in all respects with all provisions of the Data Protection Laws and the guidelines that are relevant in order for at least one of the conditions for transfer of data from the European Union to a third country pursuant to Article 49 GDPR to be available to it; and where transfers of personal data are made to the SEC in the absence of an adequacy decision pursuant to Article 45(3) GDPR (assuming the personal data in question is transferred directly to the SEC and not to any other jurisdictions or disclosed to the SEC in the course of an on-site inspection in Ireland for its removal to the United States), such disclosure will be necessary for important reasons of public interest (under Article 49(1)(d) GDPR) having regard to the letter from the UK data protection regulator, the Information Commissioner’s Office (“ICO”) to the SEC dated September 11, 2020 (“ICO Letter”)45 and that these important reasons of public interest are recognised

3 This is in line with the CJEU decisions in Schrems last year and the EDPB recommendations on supplementary measures for data transfers under Article 46. Given that reliance on Article 49(1)(d) is open to challenge, it would help to show that the Bank had imposed any possible additional protections with these recommendations in mind.

4 https://ico.org.uk/media/for-organisations/documents/2619110/sec-letter-20200911.pdf.

5 We note that the ICO Letter provides support for the view that the Bank’s compliance with an SEC disclosure request might, on a case-by-case basis and subject to the qualifications in the ICO Letter, be considered by the ICO to be in the UK public interest since such disclosure helps to: (i) prevent UK financial crimes from being committed and (ii) prevent the commission in the U.S. of conduct that would amount to a UK financial crime. While the reliance on “important grounds of public interest” has not been established in Irish statute or caselaw as it relates to routine co-operation between a financial institution and its regulatory body and noting that the ICO Letter cannot be relied upon in the context of the activities of the Irish branch, on the assumption that the above objectives identified by the ICO would equally apply to any disclosures that the Irish Branch would make, the ICO Letter does provide some objective support for the view that the relevant data transfers could be considered necessary for important reasons of public interest in the event that there was a challenge to the legal basis for the transfer of personal data from the EU to the US. However, the ICO Letter also makes clear the importance of complying with other UK GDPR obligations (which apply equally in the EU GDPR). In addition to relying on Article 49(1)(d) (if it can do so), the Bank also has to demonstrate a lawful basis under Article 6 and Article 9

Page 4

in EU or Irish law to which the Bank is subject, for example laws relating to the prevention of money laundering and terrorist financing;

(i) The Bank has neither permitted the private use of the Bank's business e-mail accounts nor the use of private email accounts for business purposes by its employees, or the Bank has policies in place that regulate such use with sufficient separation;

(j) The Bank does not include the information described in 17 C.F.R. §§ 240.18a-5(b)(8)(i)(A) through (H) or 240.18a-5(a)(10)(i)(A) through (H), as the case may be, in questionnaires or applications for employment executed by an associated person who is not a U.S. person (as defined in 17 C.F.R. §240.3a71-3(a)(4)(i)(A)), unless the Bank is required to obtain such information under applicable law in the jurisdiction in which the associated person is employed or located or obtains such information in conducting a background check that is customary for the Bank in that jurisdiction and the creation or maintenance of records reflecting that information would not result in a violation of applicable law in the jurisdiction in which the associated person is employed or located; provided that the Bank does not know, or in the exercise of reasonable care should have known, of the statutory disqualification of such associated person;

(k) The Bank will keep the U.S. Books and Records in the United States in accordance with any applicable SEC requirements;

(l) The IOSCO MoU is in full force and effect and no notice of termination has been served by the Central Bank of Ireland ("Central Bank") or the SEC under Clause 16 of the IOSCO MoU;

(m) The Central Bank and the SEC (as applicable) will comply in all respects with all provisions of the IOSCO MoU; and

(n) Neither the contractual arrangements with its customers or within its own organisation (including any standard contractual clauses or other intragroup data transfer mechanism or protocol) nor any orders by, or other arrangements with, its regulators or other supervisory authorities (including the Central Bank) prohibit the Bank from providing the SEC with prompt access to the Irish Books and Records or to submit to on-site inspection and examination of the Relevant Books and Records by the SEC.

# 4. Opinion

4.1 Based upon the foregoing, and subject to the assumptions in this Opinion (as outlined in Section 3 above) and subject to the further legal analysis and qualifications (as outlined in Sections 5 and 6 below), it is our Opinion that:

(a) The Bank can, as a matter of Irish law, provide the SEC with prompt access to its Irish Books and Records;

(b) The Bank can, as a matter of Irish law, submit to on-site inspection and examination by the SEC of its Irish Books and Records in Ireland (and prior approval is not required to be obtained from the Central Bank or any other regulator (by the SEC or

GDPR (and Article 10 GDPR and Section 55 of the Data Protection Acts 1988 to 2018 for any data relating to criminal convictions or offences) for every instance it makes a disclosure or permits examination of the Relevant Books and Records by the SEC.

Page 5

the Bank) in advance of the SEC carrying out an on-site inspection and examination); and

(c) The Bank can, as a matter of Irish law, submit to on-site inspection and examination by the SEC of its US Books and Records in the United States

# 5. Further Legal Analysis

# 5.1 Data Protection Law

(a) The primary law regulating the processing of personal data in Ireland is the General Data Protection Regulation 2016/679 (“GDPR”) which is supplemented by the Data Protection Acts 1988 to 2018 (“Data Protection Laws”). The Data Protection Laws shall apply to the Bank’s disclosure of the Relevant Books and Records to the SEC to the extent that these contain personal data and are processed in the context of the activities of the Irish Branch. Personal data is any data relating to an identified or identifiable living individual and may include information concerning the Bank’s employees, counterparties and customers.

(b) In order for the Bank to disclose personal data to the SEC, it must be able to rely on one of the grounds set out in Article 6 of the GDPR (and Article 9 to the extent it relates to special category personal data or Article 10 GDPR and Section 55 of the Data Protection Acts 1988 to 2018 for the disclosure of any data relating to criminal offences or convictions). Provided the scope of disclosure to the SEC is necessary and proportionate by reference to the SEC’s regulatory functions and limited to what is necessary for these purposes, the Bank should be able to rely on Article 6(1)(f) being that the disclosure and co-operation with the SEC (such as in the interests of preventing financial crime or terrorist financing) is in its or the SEC’s legitimate interests provided the rights of the individuals in question do not override those interests. To the extent any special category personal data is requested and the Bank is satisfied this is necessary and proportionate, this is governed by Article 9 and Section 45 and 47 of the Data Protection Acts 1988 to 2018. The Bank would need to be satisfied that the disclosure is necessary for the purposes of establishing, exercising or defending legal rights in the course of its engagement with the SEC or in the course of legal proceedings with SEC. Any personal data relating to criminal convictions and offences may similarly only be processed under Section 55 of the Data Protection Acts 1988 and 2018 on the same grounds. Alternatively, processing “under the control of official authority” is permitted under Section 55(2) includes processing “in the exercise of a regulatory... function” but it is likely this would only apply to functions being exercised under Irish or EU law and not to US regulatory functions. A further alternative ground is Section 55(2)(c) where the Bank is satisfied that the disclosure is necessary in order to protect the public against harm arising from dishonesty, unfitness or incompetence of persons who were or are authorised to carry on a profession or other activity.

(c) Article 45 to 49 of the GDPR provides various grounds that permit in certain circumstances the transfer of personal data from entities, acting as controller or processor, in the EU such as the Bank (in the context of the activities of the Irish Branch) to public authorities such as the SEC in the absence of an adequacy decision pursuant to Article 45(3) UK GDPR.6 For instance, Article 46(1) GDPR provides that a EU-based entity may transfer personal data to a third country if the entity has

6 According to Article 44 GDPR, any transfer of personal data to third countries or international organisations must, in addition to complying with Chapter V GDPR, also meet the conditions of the other provisions of the GDPR.

Page 6

provided “appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available”. Furthermore, Article 49 GDPR provides that in the absence of an adequacy decision pursuant to Article 45(3) GDPR, or of appropriate safeguards pursuant to Article 46, a transfer or a set of transfers of personal data to a third country may take place based on one of the derogations enumerated in Article 49 GDPR, provided that all the conditions of such a derogation are met. Such conditions include:

(i) The data subject has explicitly consented to the proposed transfer, after having been informed of the possible risks of such transfers for the data subject due to the absence of an adequacy decision and appropriate safeguards;

(ii) The transfer is necessary for the performance of a contract between the data subject and the controller or the implementation of pre-contractual measures taken at the data subject’s request;

(iii) The transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the controller and another natural or legal person;

(iv) The transfer is necessary for important reasons of public interest; and

(v) In case none of the above conditions are applicable, if the transfer is not repetitive, concerns only a limited number of data subjects, is necessary for the purposes of compelling legitimate interests pursued by the controller which are not overridden by the interests or rights and freedoms of the data subject, and the controller has assessed all the circumstances surrounding the data transfer and has on the basis of that assessment provided suitable safeguards with regard to the protection of personal data. The controller shall, in addition to providing the information referred to in Articles 13 and 14 GDPR, inform the data subject of the transfer and of the compelling legitimate interests pursued.

(d) In addition, the European Data Protection Board (“EDPB”) has issued guidelines as to the scope and interpretation of Article 49 GDPR on derogations in the context of transfers of personal data to third countries (“Guidelines”).7

(e) Given the absence as of the date hereof of an adequacy decision pursuant to Article 45(3) GDPR with respect to the United States, the Bank can provide access to the SEC to, and submit to onsite inspection by the SEC with respect to, elements of Relevant Books and Records that constitute personal data only if the conditions of Article 46(1) GDPR or Article 49 GDPR (as interpreted by the Guidelines) are satisfied.

5.2 It will be the responsibility of the Bank as data controller to assess, on a case-by-case basis (as and when the SEC requires disclosure of or access to Relevant Books and Records that may contain personal data), which of the provisions of the Data Protection Laws may be relied on for the lawful disclosure to the SEC of personal data comprising or contained in the Relevant Books and Records. On the basis of the ICO’s position set out in the ICO Letter, in accordance with which the Bank may be able to rely on in the event of any

7 EDPB’s Guidelines 2/2018 on derogations of Article 49 under Regulation 2016/679, adopted on 25 May 25 2018, available at: https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_2_2018_derogations_en.pdf

Page 7

challenge to the derogation under Article 49(1)(d) GDPR to justify the transfer to the SEC of Relevant Books and Records containing personal data, we are of the view that, subject to our assumption in item (h) and the other assumptions and qualifications in this opinion letter, the provision of prompt access to and the submission to on-site inspection and examination of, the Relevant Books and Records, as the case may be, do not conflict with the applicable Data Protection Laws.

### 5.3 Duty of Confidentiality

- (a) Irish common law (i.e. the law derived from Irish case law rather than statute, i.e. decisions of the Irish courts) has upheld a duty of confidentiality.
- (b) The leading Irish case which deals with the duty of commercial confidentiality is the (Irish) Supreme Court case of *House of Spring Gardens Limited & Ors. v. Point Blank Ltd*$^{8}$. The Supreme Court held that a duty of confidentiality exists where, having regard to the degree of skill, time and labour involved in compiling the information:
  - (i) The nature of the relationship of the parties imports or implies a duty of confidentiality; and
  - (ii) The commercial information itself is commercially confidential.
- (c) The leading English case in the area, *Coco -v- A N Clark (Engineers) Ltd*$^{9}$ reached a similar conclusion. English developments in the law of confidentiality post-*Coco -v- A N Clark (Engineers) Ltd* have been strongly influenced by the provisions of the European Convention on Human Rights. Such protections as are already provided in the case of *House of Spring Gardens Limited & Ors. v. Point Blank Ltd* were undoubtedly be bolstered by Ireland's subsequent adoption of the European Convention of Human Rights and in particular the Protocol to the Convention for the Protection of Human Rights and Fundamental Freedoms which notes at Article 1 that:

  *'Every natural or legal person is entitled to the peaceful enjoyment of his possessions. No one shall be deprived of his possessions except in the public interest and subject to the conditions provided for by law and by the general principles of international law.'*
- (d) In this context, the term 'possessions' includes confidential information and the need to have 'peaceful enjoyment' of such confidential information clearly strengthens the existing common law right to confidentiality.
- (e) Therefore, in a relationship between a bank and its customer, there is clear support in Irish law for duties of confidentiality to be upheld (see sub-paragraph (f) below on bank secrecy).
- (f) In addition to the common law duty in respect of commercial confidentiality, Irish law also imposes a common law derived (the law is derived from case law rather than statute, i.e. decisions of the Irish courts) '*duty of confidentiality*' in relation to a bank's dealings with its clients (i.e. bank secrecy requirements). This duty of confidentiality implies a term into a contract between a bank and its client that the

$^{8}$ [1984] 1 I.R. 611.

$^{9}$ [1969] RPC 41.

Page 8

bank will not disclose to third parties any information acquired by the bank during, or by reason of, its business relationship with its client.

(g) The common law duty of confidentiality, which was first recognised in the English law (UK) case of *Tournier v National Provincial and Union Bank of England*$^{10}$ and is followed by the Irish courts in the (Irish) Supreme Court case *National Irish Bank Limited v Radio Telefís Éireann*$^{11}$, prohibits the disclosure of confidential client information to third parties. The duty of confidentiality applies to all bank-client relationships irrespective of the type of client and it applies to all information obtained by the bank from the client or in the course of the client-bank relationship. However, there are four exceptions to the prohibition namely:
- (i) Where the bank is compelled by law to disclose the information;$^{12}$
- (ii) Where there is a duty to the public to disclose$^{13}$;
- (iii) Where the interests of the bank require disclosure$^{14}$; and
- (iv) Where disclosure is made with the express or implied consent of the client.$^{15}$
(h) The duty of confidentiality extends to all information concerning a client that is in the possession of the bank, including information that is not secret (i.e. unavailable from other sources). The duty covers information that the bank has obtained from a source other than the client and it continues after the bank-client relationship has ended.
(i) The common law obligations in respect of bank secrecy are applicable where the governing law of the contract between the bank and a client is Irish law, irrespective of the location of the client (or the bank). However, the Irish courts may impose a duty of confidentiality if it concludes that the bank-client relationship is governed by, or subject to, Irish law (notwithstanding that the contract may provide that it is governed by a law other than Irish law, such as, for example, Swiss law, English law or New York law), for example, if the bank-client relationship in question is centred in Ireland.
(j) As such, where the contract is governed by Irish law, disclosure of client information by a bank to:
- (i) Another entity within the same banking group; or
- (ii) A third party outside of the group,

are not permitted unless one or more of the four exemptions (at (i) to (v) above) applies. With respect to paragraph 5.3(g)(i) above, it is not clear whether or not the 'compulsion by law' exception would be available where the Bank is under a legal

$^{10}$ [1924] 1 KB 46.

$^{11}$ [1998] 2 I.R. 465.

$^{12}$ See sub-paragraph (j) below

$^{13}$ See sub-paragraph (k) below.

$^{14}$ See sub-paragraph (l) below.

$^{15}$ See sub-paragraph (m) below.

Page 9

duty to disclose confidential information pursuant to a statutory requirement under the law of another jurisdiction (for example, under U.S. law), as no Irish case has commented, or made a determination, on this point. The Supreme Court decision in *Walsh v National Irish Bank Ltd* [2013] IESC 2, in our view, leaves the door open to the Irish courts possibly allowing the compulsion by law exception to be relied on by an Irish bank in respect of disclosures made under disclosure/reporting obligations pursuant to the law of another jurisdiction in certain circumstances (albeit it is not clear, as noted above). In the event that an Irish court, in the future, hears proceedings regarding a potential conflict between a reporting / disclosure obligation under a foreign law and the Irish duty of confidentiality, previous Irish cases potentially provide some insight into the elements that the court may take into consideration (e.g. extra-territorial effect of the foreign legislation, the policy of international comity and the particular facts and circumstances of the case) when determining whether or not the compulsion by law exception is available in such circumstances. Finally, given that the IOSCO MoU between the Central Bank of Ireland and the SEC lacks the authority of statute, it should not be expressly relied upon by the Bank for the purpose of this exception.

(k) With respect to 5.3(g)(ii) above, the Irish High Court considered the balance between the duty of confidentiality and the public interest in *Irish National Irish Bank v. RTE*$^{16}$ but refused to set out boundaries of the exemption other than to note:

*“It seems to me that disclosure of confidential information will almost always be justified in the public interest where it is a disclosure of information as to the commission or the intended commission of serious crime because the commission of such crime is an attack upon the State and the citizens of the State and such disclosure will always be in the public interest. While the disclosure of serious crime will always be in the public interest there is also a range of other activities (which are not necessarily criminal) the disclosure of which may also justify a breach of confidence on the grounds that its disclosure is also in the public interest. It would, I believe, be unwise to attempt to define the boundaries of the so-called exception of public interest and I refrain from doing so other than to observe (as Ungood-Thomas J. did in *Beloff v. Pressdram Limited* 1973 1AER 241 at page 260) that:-*

*“Misdeeds of a serious nature and importance to the country”*

will justify disclosure on the grounds that such disclosure is invariably in the public interest. In *Lion Laboratories Limited -v- Evans* 1984 2 AER 417 Stephenson L. J. expressed the principle thus (at page 423):-

*“Some things are required to be disclosed in the public interest, in which case no confidence can be prayed in aid and to keep them secret and (inequity) is merely an instance of a just cause and excuse for breaking confidence.”*

While the above is an indication that the Irish courts will construe the public interest exemption very narrowly, the above comments are obiter and therefore are not established precedent in Ireland. In *Tournier*, it was suggested that disclosure in the interest of preventing fraud or crime would meet this criterion.$^{17}$ While this suggestion has been pleaded in *Delaney -v- Allied Irish Banks PLC & ors*$^{18}$, the court

$^{16}$ [1998] IEHC 46; [1998] 2 IR 465

$^{17}$ *Tournier* at 486.

$^{18}$ [2016] IECA 5

Page 10

in that instance did not determine the issue on the grounds it was unnecessary to do so for the purposes of the case under consideration. Therefore, in the absence of definitive binding judgment in Ireland on the extent of the public interest exemption, the Bank will be need to demonstrate, in the event of a challenge, that the circumstances of the disclosure to the SEC constitute a disclosure in the public interest. The ICO Letter is, in our view, likely to be of assistance in this regard.

(l) With respect to paragraph 5.3(g)(iii) above, in certain cases, confidential information that is subject to the banker's duty of confidentiality may be disclosed where it is in the interests of the bank. This exception is not available for information that is subject to the general duty of confidentiality alone. However, we consider that this exception is available to information that is subject to both such duties, leaving only information that does not relate to customers (e.g., information relating to employees) beyond the scope of this exception.

Although it is in the Bank's interest to comply with the SEC's requests, there is no Irish case law specifically on this point and UK case law (which would be persuasive in an Irish court) indicates that a high bar exists to satisfy this exception. The qualification will most obviously cover the situation where a bank commences proceedings against its customer to recover an unpaid loan or overdraft facility and the bank has to disclose the extent of the customer's liabilities in its claim.19 However, in the UK case of X AG and others v A Bank, Leggatt J held that it was not clearly in the defendant bank's own interests to comply with a subpoena from New York, as the bank could not establish as a matter of fact that it would face any serious detriment for its failure to comply.20 Accordingly, the Bank's own interest exception will be construed narrowly and the court will assess whether the Bank's own interests are genuinely threatened by non-disclosure.

In relation to the SEC's requests, failure to comply may result in the Bank's inability to conduct SBS business in U.S. markets. Therefore, it is arguable that the Bank may face serious detriment for a failure to comply with the SEC's requests.

However, to rely on this exception, the Bank must also balance its interests in complying with the SEC's disclosure request against the competing interest of its customers in the banker's duty of confidence being maintained, and the Bank must satisfy itself that those interests do not outweigh its own. This would require an assessment on a case-by-case basis. As each customer's circumstances differ, this exception may not provide a consistent basis on which to provide information to the SEC in comparison to the public interest exception above.

(m) The duty of confidentiality can be lifted by obtaining consent from the client to disclosure of the information. Such consent can be express (i.e. consent in writing) or implied (i.e. other than by a written consent). However, this would not extend to the disclosure of personal data (see below). Our strong recommendation would be that the Bank rely, where possible and as reflected in its client documentation, on consent from clients to disclosures to the SEC. It should review and, if necessary, update its client documentation if required to provide for express client consent.

(n) In conclusion, as explored above, it is unlikely that the compulsion of law exception will be applicable in this case. In relation to the banker's duty of confidentiality, it

19 See Tournier at 473.

20 X AG and others v A bank at 475.

Page 11

may not be possible to rely on disclosure in the bank's interest in all cases. However, the Bank should be able to rely on the public interest exception to the duties of confidence in permitting the SEC to access and examine its Relevant Books and Records to the extent they relate to the activities of the Irish Branch. However it should be noted that consent as a basis to disclose personal data is unlikely to be appropriate in a regulatory context given that consent to the processing of personal data must be freely given, informed, specific and revocable under Article 7 of the GDPR.

# 6. Qualifications

6.1 Our Opinion is subject to the following qualifications:

(a) This Opinion relates exclusively to: (i) the access provided to the SEC to the Irish Books and Records in respect of which, for purposes of the Data Protection Laws, the Bank is an independent data controller with respect to the activities of the Irish Branch, and that are subject to Irish law and whose disclosure is not prohibited by any other law or duty of confidence applicable to the Bank; and (ii) on-site inspection and examination by the SEC of the Irish Books and Records at the Irish Branch in Ireland and the U.S. Books and Records at the Bank in the U.S., as the case may be.

(b) This Opinion is confined to legal matters, and we express no Opinion as to any factual matters.

(c) This Opinion may therefore only be relied upon under the condition that this Opinion shall be governed by Irish law and construed in accordance with Irish rules of construction and that issues of interpretation of this Opinion must be brought before an Irish court.

(d) The Opinion set out above are limited to Irish law. We do not express any opinion as to, and have not made any investigation of, any law other than Irish law in force as at the date hereof and as applied according to published case law.

(e) The Opinion set out above has been informed by the ICO Letter. This Opinion is predicated on the assumption that the view of the ICO, while not binding on the Irish Data Protection Commission, would be persuasive and on the assumption that the ICO does not significantly change its proposed regulatory approach to the matters set out in the ICO Letter.

(f) The Opinion statements to the effect that the Bank "can", as a matter of Irish law, take certain actions is not an expression of any opinion or a confirmation that it may (lawfully) do so in any given instance where the opportunity, or request, or requirement to do so arises. It is a fundamental part of this opinion that the Data Protection Laws stipulate certain legal bases on which such action may be taken, but the lawfulness of actually taking such action is subject to the scope and qualifications of the relevant legal basis (such as, in the case of processing on the bases of Articles 6(1)(e) and 6(1)(f) GDPR, a right of data subjects to object to the relevant processing21) and other applicable provisions of the Data Protection Laws,22

21 UK GDPR Article 21(1).

22 For instance, in the ICO Letter, the ICO states that: "We would not find there to be a breach of the GDPR transfer rules if the firm provided evidence that it had carefully considered and appropriately applied the Art. 49.1(d) 'public interest' derogation." (emphasis

Page 12

as set out in this Opinion. The justification for whether such legal basis has been made out, and the extent of (and qualifications to) its application to the relevant personal data to which the relevant action relates, must be determined on a case-by-case basis by the Bank (as and when the SEC requires disclosure of or access to Relevant Books and Records that may contain personal data in the context of the activities of the Irish Branch) after due and careful consideration.23

(g) The Opinion is rendered on and as of the date hereof, and we assume no obligation to advise you (or any other person who may rely on this Opinion in accordance with the paragraph above), or undertake any investigations, as to any legal developments or factual matters arising subsequent to the date hereof that might affect the Opinion. To that end, we acknowledge that SEC rules require a non-resident SBSD to re-certify within ninety days after any changes in the legal or regulatory framework that would impact the ability of the SBSD to provide, or the manner in which it would provide, prompt access to its books and records, or would impact the ability of the SEC to inspect and examine the SBSD. Upon such change of law, the SBSD is required to submit a revised opinion describing how, as a matter of Irish law, the SBSD will continue to meet its obligations.

(h) The IOSCO MoU is not a legally binding agreement and therefore that the SEC and the Central Bank are not under a legal obligation to comply with its provisions.

# 7. Reliance

7.1 This Opinion is being furnished solely for the benefit of the Bank and is not to be relied on by, or furnished to, any other person or used, circulated, quoted or otherwise referred to for any other purpose, except that the Bank may submit this Opinion to the SEC as part of its application to register as a non-resident SBSD. In authorising the Bank to make this Opinion available to the SEC for such purposes, we are not undertaking or assuming any duty or obligation to the SEC or establishing any lawyer-client relationship with it.

7.2 This Opinion is limited to the matters expressly stated herein and does not extend to, and is not to be read as extended by implication to, any other matters.

Yours faithfully

ARTHUR COX LLP

added). The opinions expressed in this letter regarding Article 49(1)(d) are accordingly subject to the Bank's compliance with these ICO requirements.

**Attachment 8:** `SW_Swis1.pdf`

Schellenberg Wittmer

Schellenberg Wittmer Ltd
Attorneys at Law
Löwenstrasse 19
P.O. Box 2201
8021 Zurich / Switzerland
T +41 44 215 5252
F +41 44 215 5200
www.swlegal.ch

By courier

Securities and Exchange Commission
100 F Street, NE
Washington, DC 20549- 1090
United States of America

Dr. Olivier Favre
Partner / Attorney at Law, LL.M.
D +41 44 215 3426
olivier.favre@swlegal.ch

Dr. Martin Lanz
Partner / Attorney at Law
D +41 44 215 5277
martin.lanz@swlegal.ch

Listed in the Cantonal Attorney Registry

With a copy to

UBS AG
Credit Suisse AG

(together the "Addressees" and each an "Addressee")

Date October 26, 2021
Reference 210054/SW-06336441/OFA

SBSD SEC Registration

Ladies and Gentlemen

We, Schellenberg Wittmer Ltd, are acting as special Swiss counsel to each of UBS AG and Credit Suisse AG (each a Bank) in connection with their applications for substituted compliance as non-US security-based swap (SBS) dealers (SBSDs) with the United States Securities and Exchange Commission (SEC).

1. Background

We have been requested to provide an opinion in connection with certain issues of Swiss law based on the facts described hereinafter with respect to:

(i) access by or on behalf of the SEC to the books and records relating to the "U.S. business" (as defined in SEC Rule 3a71-3(a)(8)1) of the Bank as a nonresident SBSD,2 i.e., records that relate to an SBS transaction that is either (a) entered into, or offered to be entered into, by or on behalf of a Bank, with a U.S. person (other than a transaction conducted through a foreign branch of that person);3 or

1 17 C.F.R. § 240.3a71-3(a)(8), available at https://ecfr.io/Title-17/Section-240.3a71-3.

2 See Cross-Border Application of Certain [SBS] Requirements, 85 Fed. Reg. 6270, 6296 (Feb. 4, 2020), available at: https://www.govinfo.gov/content/pkg/FR-2020-02-04/pdf/2019-27760.pdf (the "SEC Guidance").

3 See 17 C.F.R. § 240.3a71-3(a)(8)(i)(A), available at https://ecfr.io/Title-17/Section-240.3a71-3. A "U.S. person" means any person that is "(i) a natural person resident in the U.S.; (ii) a partnership, corporation, trust, investment vehicle, or other legal person organized, incorporated, or established under the laws of the United States or

(b) arranged, negotiated, or executed by personnel of the Bank located in a U.S. branch or office, or by personnel of an agent of the Bank located in a U.S. branch or office4 (the SBS Business, such books and records related to the SBS Business the Books and Records); and

(ii) any on-site inspections and examinations by the SEC of the Books and Records taking place in Switzerland in relation to the SBS Business.

This legal opinion is provided in order to satisfy the requirement in SEC Rule 3a71-6(c)(2)(ii)5 for the Banks to provide an opinion of counsel in connection with their application for substituted compliance.

As regards Books and Records that are relevant for the purposes of this legal opinion, they are held by each Bank as follows:

(i) some Books and Records are physically held or electronically stored in Switzerland (the Swiss Books and Records); and
(ii) some Books and Records are physically held or electronically stored in the United States (the US Books and Records).

# 2. Questions

Against this background we have been asked to analyze the following questions:

A. Can the Bank, as a matter of Swiss law, provide the SEC with prompt access to the Swiss Books and Records?
B. Can the Bank, as a matter of Swiss law, submit to on-site inspection and examination by the SEC in relation to the Swiss Books and Records?
C. Does the Bank breach Swiss law by submitting to on-site inspections and the examination of its US Books and Records by the SEC in the US?

# 3. Scope

This legal opinion is limited to matters of Swiss law arising in the context of (a) the access by the SEC to Swiss Books and Records, (b) the on-site inspections and examinations of

having its principal place of business in the United States; (iii) an account (whether discretionary or non-discretionary) of a U.S. person; or (iv) an estate of a decedent who was a resident of the United States at the time of death." 17 C.F.R. § 240.3a71-3(a)(4), available at https://ecfr.io/Title-17/Section-240.3a71-3. A "foreign branch" means "any branch of a U.S. bank if: (i) the branch is located outside of the United States; (ii) the branch operates for valid business reasons; and (iii) the branch is engaged in the business of banking and is subject to substantive banking regulation in the jurisdiction where located." 17 C.F.R. § 240.3a71-3(a)(2), available at https://ecfr.io/Title-17/Section-240.3a71-3. An "SBS conducted through a foreign branch" means an SBS that is "arranged, negotiated, and executed by a U.S. person through a foreign branch of such U.S. person if: (A) the foreign branch is the counterparty to such security-based swap transaction; and (B) the security-based swap transaction is arranged, negotiated, and executed on behalf of the foreign branch solely by persons located outside the United States." 17 C.F.R. § 240.3a71-3(a)(3)(i), available at https://ecfr.io/Title-17/Section-240.3a71-3.

4 See 17 C.F.R. § 240.3a71-3(a)(8)(i)(B), available at https://ecfr.io/Title-17/Section-240.3a71-3.

5 17 C.F.R. § 240.3a71-6(c)(2)(ii), available at https://ecfr.io/Title-17/Section-240.3a71-6.

such Swiss Books and Records by the SEC taking place in Switzerland and/or (c) the on-site inspections and examinations of US Books and Records by the SEC taking place in the US.

On the basis that each Bank has a "prudential regulator", this opinion does not cover financial records necessary to assess compliance with SEC margin and capital requirements.

#### 4. Documents reviewed

For the purposes of this opinion, we have examined the following documents:

- (i) a memorandum of understanding (MOU) between the SEC and the Swiss Financial Market Supervisory Authority (FINMA) concerning consultation, cooperation and the exchange of information related to the supervision and oversight of certain cross-border over-the-counter derivatives entities in connection with the use of substituted compliance by such entities dated August 8, 2021;
- (ii) a waiver issued by FINMA (the FINMA Waiver) dated August 5, 2021 concerning the transmission of, or access to, the Swiss Books and Records as required by the SEC;
- (iii) a permission issued by FINMA (the FINMA Permission) dated August 5, 2021 concerning the on-site inspection and examination by the SEC in relation to the Swiss Books and Records; and
- (iv) a Memorandum by the Federal Data Protection and Information Commissioner (FDPIC) dated June 25, 2021 concerning Swiss Firm Data Processing and Sharing of Information with the U.S. Securities and Exchange Commission (the FDPIC Memorandum).

For the purposes of this opinion, we have reviewed no documents other than those mentioned in section 4.

#### 5. Assumptions

In giving our opinion, we have assumed the following:

- 5.1 The SBS Business consists of SBS transactions that are either (i) entered into, or offered to be entered into, by or on behalf of a Bank, with a U.S. person (other than a transaction conducted through a foreign branch of that person) or (ii) arranged, negotiated, or executed by personnel of the Bank located in a U.S. branch or office, or by personnel of an agent of the Bank located in a U.S. branch or office, in each case that are booked with a non-Swiss office of the Bank.
- 5.2 The SBS Business forms part of the Covered Activities as defined in the MOU (the Covered Activities).

5.3 The Swiss Books and Records are held with the Bank or a material group company of the Bank in the sense of article 2bis para. 1 lit. b Swiss Federal Banking Act of November 8, 1934 (the **Banking Act**).

5.4 The access to, the transmission of and the on-site inspections and examinations of the Books and Records are regarding clients forming part of the SBS Business (the **Relevant Clients**) and employees of the Bank based in Switzerland (the **Relevant Employees**).

5.5 The Relevant Clients are investment banking clients and the Books and Record are therefore not linked to the asset management, securities trading or deposit business for individual clients.

5.6 The Relevant Clients and Relevant Employees have been appropriately informed of the disclosure of the information to the SEC and have waived their rights that could conflict with the disclosure of information to the SEC, including without limitation such rights resulting from bank-client confidentiality, the applicable data protection rules, the employment relationships or applicable employment laws, as applicable, provided that, to the extent any such waivers are required under Swiss law for lawfully providing or making available the information to the SEC, (i) such waivers are validly given under Swiss law (including without limitation under Swiss civil law) or, if they are not governed by Swiss law, the applicable foreign law, and (ii) in respect of Relevant Employees, to the extent that such waiver may not validly be given, the disclosure of information is justified by the necessity to perform the contract with the Relevant Employees, an overriding private interest of the Bank or by an overriding public interest (each as further set out in the FDPIC Memorandum).

5.7 The disclosure of information and any on-site inspections and examinations are limited to information which is necessarily required for the supervisory and enforcement activity of the SEC, as required by the applicable data protection rules or, as applicable, as determined by FINMA.

5.8 Any processing of data by the Bank forming part of the Books and Records occurs in compliance with Swiss data protection rules, to the extent applicable (as further set out in the FDPIC Memorandum).

5.9 The access to, the transmission of and the on-site inspections and examinations of the Books and Records are exercised by the SEC and not by or on behalf of any other foreign authorities.

5.10 As regards the access to, and the transmission of, the Swiss Books and Records to the SEC and the on-site inspections and examinations of the Swiss Books and Records by the SEC, the SEC and/or the persons and/or organizations directly or indirectly active on behalf of the SEC in this respect (i) are bound by official or professional secrecy, notwithstanding provisions on the public nature of proceedings and the notification of the general public about such proceedings, (ii) will use the Swiss Books and Records

exclusively for the lawful supervision (including enforcement) of financial institutions and financial markets under U.S. laws and regulations and (iii) will not forward the Swiss Books and Records to other authorities, courts or bodies for any purpose other than as stated under (ii).

5.11 The access to, the transmission of and the on-site inspections and examinations of the Books and Records are taking place in compliance with the FINMA Waiver and/or the FINMA Permission and/or the MOU, to the extent needed.

5.12 Any on-site inspections and examinations of the US Books and Records occurs in the United States and, as ensured by the Bank, without the involvement of employees or other representatives or agents of the Bank or of a Bank group company located in Switzerland.

5.13 The Bank will keep US Books and Records in the United States in accordance with the SEC rules.

5.14 Information which is not covered by the FINMA Waiver (the **FINMA Waiver Carve Out**) and that may not be provided as Firm Information as defined in the MOU (the **Firm Information**) to the SEC under the MOU, may be delivered to the SEC by FINMA via administrative assistance channels or may be delivered to the SEC by a Bank directly in the absence of an objection of FINMA.

5.15 The FINMA Waiver, the FINMA Permission and the MOU are unconditionally given and in place, to the extent needed.

**6. Question A: Can the Bank, as a matter of Swiss law, provide the SEC with prompt access to the Swiss Books and Records?**

**6.1 Blocking Statute of article 271 para. 1 of the Swiss Criminal Code**

6.1.1 Definition

Article 271 para. 1 of the Swiss criminal code of December 21, 1937 (CC) (*Unlawful activities on behalf of a foreign state*) protects Swiss territorial sovereignty and primarily aims at preventing foreign countries or parties to foreign proceedings from circumventing international conventions on judicial assistance.

6.1.2 Applicable to "Official Acts"

Pursuant to article 271 para. 1 CC, the actions conducted for a foreign state must have the characteristics of an official act to fall under this prohibition. The determination whether an action qualifies as an official act is solely based on Swiss law and not on foreign or international law. Article 271 para. 1 CC may, thus, even apply in cases where a foreign state would not consider its interests or its sovereignty affected. In this regard, the Swiss Federal Supreme Court held that any action, which "according to its nature" under Swiss law lies within the competence of a public authority, is reserved to the powers of the Swiss

public authorities and must not be executed on Swiss territory without prior authorization by the competent Swiss authority.6

The gathering, compiling and establishing of means of evidence (e.g. documents, witness statements, depositions, databases) for use in foreign court proceedings (whether civil, penal or administrative) is, in Switzerland, considered to be an official act within the meaning of article 271 para. 1 CC and may only be performed by Swiss authorities. Also, any direct service of subpoenas, summons and other court orders or official documents from a foreign state to a person or entity in Switzerland may violate article 271 para. 1 CC.

What constitutes "official acts" for these purposes is therefore interpreted extensively and includes also actions that - if executed lawfully - could in principle be executed by a foreign public authority or public official on Swiss territory but the legal requirements or procedures for such action have not been complied with (i.e. judicial assistance procedures).

6.1.3 Disclosure permitted by Swiss law

The prohibition of article 271 para. 1 CC will not apply if the disclosure is permitted by Swiss law, including but not limited to any permitted transmission of information pursuant to article 42c of the Financial Market Supervision Act of June 22, 2007 (FINMASA).

6.2 Article 42c para. 1 FINMASA

6.2.1 Definition

Pursuant to article 42c para. 1 FINMASA, supervised persons may transmit non-public information to the foreign financial market supervisory authorities responsible for them and to other foreign entities responsible for supervision provided:

(a) the conditions set out in article 42 para. 2 FINMASA are fulfilled; and
(b) the rights of clients and third parties are preserved.

Article 42c FINMASA only applies when information is transmitted from Switzerland to another country, i.e. across national borders and not when representatives of the foreign authority or entity are in Switzerland.7 In such other event, article 43 FINMASA applies (see section 7 below).

The purpose of article 42c para. 1 FINMASA is a carve out from article 271 para. 1 CC.8

Article 42c FINMASA intends to allow, subject to certain requirements (see section 6.2.4 and 6.2.5 below), supervised parties to transmit non-public information to a foreign

6 See for example decision 114 IV 131 of the Swiss Federal Supreme Court.

7 FINMA Circular 2017/6 Direct transmission of December 8, 2016, n. 4.

8 Explanatory Report to the Financial Market Infrastructure Act (FMIA) of September 3, 2014, p. 7620.

financial market supervisory authority without an authorization allowing the transfer of such information that would otherwise be required.9

6.2.2 Supervised persons

As regards its personal scope, article 42c para. 1 FINMASA applies to all persons and entities supervised by FINMA pursuant to article 3 FINMASA.10

The Bank, as a Swiss legal entity subject to prudential supervision by FINMA as a bank under the Banking Act, qualifies as a "supervised person" in the sense of article 42c FINMASA and therefore falls into its personal scope.

6.2.3 Transmission to foreign financial market supervisory authority

In the case at hand, the Swiss Books and Records shall be transmitted to the SEC.

As competent regulator under the US Securities Exchange Act of 1934 and the Securities Act of 1933, the SEC qualifies as a "foreign financial market supervisory authority" in the sense of article 42c FINMASA.

6.2.4 Article 42c para. 1 lit. a FINMASA

a. Requirements of article 42 para. 2 FINMASA

Pursuant to article 42c para. 1 lit. a FINMASA, the requirements set out in article 42 para. 2 FINMASA must be met in order to exercise the rights of direct transmission.

Pursuant to article 42 para. 2 FINMASA, FINMA may transmit non-public information to foreign financial market supervisory authorities only if:

(a) this information is used exclusively to implement financial market law, or it is forwarded for these purposes to other authorities, courts or bodies (speciality requirement); and
(b) the requesting authorities are bound by official or professional secrecy, notwithstanding provisions on the public nature of proceedings and the notification of the general public about such proceedings (confidentiality requirement).

In order to facilitate the work of supervised persons and to allow them to apply article 42c para. 1 lit. a FINMASA independently and uniformly, FINMA publishes a list of foreign financial market supervisory authorities to which FINMA has provided administrative assistance in the past. If an authority appears on the list, supervised persons may generally assume that the requirements of specialty and confidentiality under article 42 para. 2 FINMASA are met without further checks.11

9 Such authorization would be required by the competent Federal Department (Departement) and Federal Chancellery (Bundeskanzlei) under article 31 para. 1 of the Ordinance on the Organization of the Government and the Administration of 25 November 1998 (OOGA).

10 FINMA Circular 2017/6 Direct transmission of December 8, 2016, n. 2.

11 FINMA Circular 2017/6 Direct transmission of December 8, 2016, n. 21

However, further assurances may be required, where (i) the requesting authority does not state the purpose for which information shall be used (which would not be relevant in the present circumstances where it is understood that the SEC makes the request in the context of the SBS Business) or (ii) there is a reason to suspect that requesting authority will not adhere to confidentiality or (iii) that it will not only use it in the context of enforcing financial market laws or that it will forward it to other authorities, courts or bodies for other purposes.12 Such assurance may be provided e.g. by a confirmation from the foreign authority or entity or with a written opinion from a local lawyer specialising in financial market law or an international law firm.13

b. SEC satisfying article 42 para. 2 FINMASA

The SEC is listed by FINMA as a foreign financial market supervisory authority to which it has provided administrative assistance in the past.14

Furthermore, the purpose of the transmission of information is the ongoing oversight of the SBS Business and the Bank's compliance with the applicable US law.

On this basis and on the assumptions that the SEC (i) is bound by official or professional secrecy, notwithstanding provisions on the public nature of proceedings and the notification of the general public about such proceedings, (ii) will use the Swiss Books and Records exclusively for the lawful supervision (including enforcement) of financial institutions and financial markets under US laws and regulations and (iii) will not forward the Swiss Books and Records to other authorities, courts or bodies for any purpose other than as stated under (ii), the SEC meets the requirements of article 42 para. 2 FINMASA.

The FINMA Waiver and the MOU may be considered as evidence that FINMA came to the same conclusion.

6.2.5 Article 42c para. 1 lit. b FINMASA

a. Preservation of the rights of the clients and third parties

Article 42c FINMASA does not constitute a carve-out from business and bank-client confidentiality obligations, data protection regulations and rights resulting from employment relationships.15 Such rights of clients and third parties must therefore be complied with when applying article 42c FINMASA (article 42c para. 1 lit. b FINMASA).

12 FINMA Circular 2017/6 Direct transmission of December 8, 2016, n. 24 et seq.

13 FINMA Circular 2017/6 Direct transmission of December 8, 2016, n. 26.

14 See <https://finma.ch/de/ueberwachung/branchenuebergreifende-themen/direktuebermittlung/>.

15 FINMA Circular 2017/6 Direct transmission of December 8, 2016, n. 30; BSK FINMASA-du Pasquier/Menoud, Art. 42c N 30.

For these purposes,

- "Clients" are the natural persons and legal entities whom FINMASA and the financial market law intend to protect, in particular creditors and investors (article 5 FINMASA);16
- "Third parties" are all other natural persons and legal entities that are mentioned in the information to be transmitted or can be identified from it, including employees of supervised parties, authorised representatives and beneficial owners.17

Neither the statutory rules of the FINMASA nor FINMA define how the rights of clients and third parties should be complied with in this context. The measures to be taken therefore depend on the specific case and the relevant provisions of the Swiss privacy, data protection and employment laws.

b. Banking secrecy

To the extent that Relevant Clients have provided a valid consent to the disclosures to the SEC, the question does not arise whether the access to the Swiss Books and Records could constitute a breach of any Swiss banking secrecy obligations.

c. Data protection

According to article 6 para. 2 Federal Act on Data Protection of June 19, 1992 (FADP) personal data may - under certain conditions, such as a consent, contractual clauses or overriding public interests - be transmitted to a country without, from the perspective of the FADP, an adequate level of data protection. The US falls into such category (see section 2.4 FDPIC Memorandum).

Pursuant to article 6 para. 2 lit. b and article 4 para. 5 FADP, consent is valid only if given in the specific case voluntarily on the provision of adequate information ("informed consent"). Additionally, consent must be given expressly in the case of processing of sensitive personal data or personality profiles (article 4 para. 5 FADP). Such consent is voluntarily given and valid, even though the Bank would not have been prepared to enter into a contract if the customer had not consented (see section 2.4.2 FDPIC Memorandum).

Alternatively, personal data may also be disclosed abroad if the processing is directly connected with the conclusion or the performance of a contract and the personal data is that of a contractual party (article 6 para. 2 lit. c FADP; see also section 2.4.3 FDPIC Memorandum). According to the FDPIC, in respect of the Relevant Clients, the transfer of customer data to the SEC can be based on article 6 para. 2 lit. c FADP provided that, in the individual case, there are not any overweighing interests of the data subject that would not allow the disclosure.

16 FINMA Circular 2017/6 Direct transmission of December 8, 2016, n. 16.

17 FINMA Circular 2017/6 Direct transmission of December 8, 2016, n. 17.

Personal data may also be disclosed abroad if disclosure is essential in the specific case in order to safeguard an overriding public interest (article 6 para. 2 lit. d FADP). According to Swiss doctrine, an overriding public interest may exist in the event that a company is required by foreign law to disclose business records, for example in the context of supervision by a foreign regulatory authority. On the basis of these conditions, the FDPIC therefore assumes that a transfer of personal data to the SEC is, in principle, justified by an overriding public interest (see section 2.4.5 FDPIC Memorandum). This can be based on article 6 para. 2 lit. d FADP, provided that, in the individual case, there are not any overweighing interests of the data subject that would not allow the disclosure.

We understand that in case the transfer of Swiss Books and Records in the ordinary course of business is leading to an investigation of an individual, this would not be prohibited disclosures under the meaning of “overweighing interests of the data subject.” Otherwise no information could be transmitted, as it cannot be excluded that some information of the data subjects may theoretically lead to an investigation.

Even if a cross-border transfer is compatible with article 6 FADP, the fundamental data protection principles mentioned in articles 4, 5 and 7 FADP must still be observed when processing, including transferring, personal data (see section 2.5 FDPIC Memorandum).

#### d. Employment law

As regards the Relevant Employees, the question may arise whether a consent to the disclosure to the SEC is valid from an employment law perspective. While such consent should be valid from the perspective of being an inherent condition to the performance of their roles with respect to the SBS Business, we cannot exclude that the consent would be invalidated on the basis that the relevant employees have no choice to withhold the consent (see section 2.4.4 FDPIC Memorandum). In such event, an alternative legal basis would be needed to provide access to the Swiss Books and Records to the SEC.

Article 328b of the Swiss Code of Obligations of 30 March 1911 (**CO**) states that the employer may handle data concerning the employee only to the extent that such data concern the employee’s suitability for his employment or are necessary for the performance of the employment contract.

We share the opinion of the FDPIC that a disclosure of employee data to the SEC should be viewed as necessary for the performance of the employment contract, in which case data processing is compatible with article 328b CO (see section 2.4.4 FDPIC Memorandum). As an alternative legal basis, the disclosure may be justified by overriding public interests (see section 2.4.4 FDPIC Memorandum). We do not have further caveats to raise in this respect other than the points set out in the FDPIC Memorandum.

### 6.3 Obligation to notify FINMA

Pursuant to article 42c para. 3 FINMASA, the transmission of information qualified as being of substantial importance in accordance with article 29 para. 2 FINMASA must be reported to FINMA prior to making any such transmission.

Such information may either be subject to such reporting to FINMA regardless of the transmission under article 42c FINMASA or the transmission abroad is itself of substantial importance.$^{18}$

Pursuant to the FINMA Circular 2017/6, any information subject to the obligation of article 42c para. 3 FINMASA may not be transmitted abroad before FINMA provided a response.$^{19}$

FINMA informs the supervised party usually within five working days as to whether it requires the use of administrative assistance channels (see section 6.4 below) instead of allowing the supervised entity to proceed with the direct transmission.$^{20}$ Also, note that FINMA may say that it only refrains from requiring the use of administrative assistance channels (see section 6.4 below) subject to certain conditions. However, please note that FINMA requested in its practice the use of administrative assistance channels only in exceptional circumstances.

If a supervised party intends to transmit information to a foreign authority or entity, FINMA may, in a general manner, waive the need for future transmissions to be reported to it prior to a transmission of such information either on its own initiative or on request.$^{21}$

Such a waiver has been given by FINMA with the FINMA Waiver (please also see section 6.4 below) and FINMA confirmed the validity and the scope of the FINMA Waiver in article II para. 25.b. and article IV para. 43 of the MOU. According to the FINMA Waiver, FINMA agreed that the Bank may report to FINMA simultaneously with the transmission to the SEC, and is not obliged to wait for FINMA's response.

When receiving a notice under article 42c para. 3 FINMASA, FINMA does not verify whether the conditions for transmission under article 42c para. 1 FINMASA are met, in particular whether the rights of clients and third parties are preserved. The supervised party is responsible for complying with these requirements.$^{22}$

### 6.4 Administrative assistance channels

Pursuant to article 42c para. 4 FINMASA, FINMA may require the use of administrative assistance channels instead of allowing the supervised entity to proceed with the direct

$^{18}$ FINMA Circular 2017/6 Direct transmission of December 8, 2016, n. 44 et seq.

$^{19}$ FINMA Circular 2017/6 Direct transmission of December 8, 2016, n. 72 et seq.

$^{20}$ FINMA Circular 2017/6 Direct transmission of December 8, 2016, n. 71.

$^{21}$ FINMA Circular 2017/6 Direct transmission of December 8, 2016, n. 69.

$^{22}$ FINMA Circular 2017/6 Direct transmission of December 8, 2016, n. 74.

transmission. FINMA may for instance use these powers for a specific communication that came to FINMA's attention as result of the notice under article 42c para. 3 FINMASA.23

The FINMASA does not specify any specific conditions on the basis of which FINMA may use such powers. However, according to the FINMA Waiver, as applicable pursuant to the MOU, FINMA waived its rights to require the use of administrative assistance channels in accordance with article 42c para. 4 FINMASA with regard to information in connection with the SBS Business of the Bank, with the exception of the information forming part of the FINMA Waiver Carve Out, on the conditions that:

(1) the information is used exclusively for the lawful supervision (including enforcement) of financial institutions and financial markets under US laws and regulations, or is forwarded to other authorities, courts or bodies for this purpose;
(2) the SEC is bound by official or professional secrecy, notwithstanding provisions on the public nature of proceedings and the notification of the general public about such proceedings; and
(3) the rights of clients and third parties resulting from bank client confidentiality, data protection laws or employment laws are preserved.

FINMA reiterated in article II. para. 25.a. of the MOU that Covered Firms as defined in the MOU (the Covered Firms) are authorized to transmit information relating to their Covered Activities to the SEC in writing or orally in line with the requirements (1) to (3) above. This also applies to each Bank as a Covered Firm falling into the scope of the MOU.

## 6.5 Supervisory privilege

Pursuant to article 42c para. 5 FINMASA and separately from article 42c para. 4 FINMASA, FINMA may make the transmission, publication or forwarding of files it is involved in in the context of its supervision subject to its approval if this is required for completing its supervisory roles and such approval does not conflict with overriding private or public interests. However, this "supervisory privilege" is limited to correspondence and communications between FINMA and the supervised entity.24

Based on this provision, FINMA may in particular require its consent prior to the disclosure of any correspondence with FINMA, minutes of meetings with FINMA, FINMA audit reports or orders. We understand that the "supervisory privilege" is limited to the information according to the FINMA Waiver Carve Out.

However, the MOU overrides these FINMA powers as follows:

23 Explanatory Report to the Financial Market Infrastructure Act (FMIA) of September 3, 2014, p. 7620.

24 Urs Zulauf, Titel Kooperation oder Obstruktion? - 20 Jahre Amtshilfe im Finanzmarktrecht vom Börsengesetz zum FINFRAG, GesKR 215, p. 350 f.; Monsch/von der Crone, SZW 2015, p. 663.

(i) In the MOU, FINMA agrees to provide Firm Information to the SEC on an ongoing basis without the need for further assistance at the points in time as specified in the MOU (see article III. para. 34 MOU).

(ii) FINMA further states that it also intends to provide Firm Information to the SEC upon request (see article III. para. 35 MOU).

We understand that such information may also be delivered to the SEC by a Bank directly in the absence of an objection by FINMA.

## 6.6 Conclusion

Based on the above and subject to the qualifications set forth herein (see section 9 below), we are of the opinion that the Bank can, as a matter of Swiss law, provide the SEC with prompt access to the Swiss Books and Records.

## 7. Question B: Can the Bank, as a matter of Swiss law, submit to on-site inspection and examination by the SEC in relation to the Swiss Books and Records?

### 7.1 Blocking Statute of article 271 para. 1 of the Swiss Criminal Code

Reference is made to section 6.1 above.

### 7.2 Requirements of on-site inspections or examinations

#### 7.2.1 Definition

Pursuant to article 43 para. 2 FINMASA, FINMA may permit foreign financial market supervisory authorities to carry out direct audits of supervised parties provided:

- (a) these authorities are responsible for the supervision of the audited supervised party as part of home country supervision (*home regulators*) or are responsible for supervising the activity of the audited supervised party in their territory (*host regulators*); and
- (b) the conditions for administrative assistance set out in article 42 para. 2 FINMASA are met.

#### 7.2.2 FINMA permission requirement

As a result of the sovereignty of the Swiss Confederation and in line with the principles of international law, foreign financial market supervisory authorities may not carry out direct audits of supervised parties in the absence the FINMA permission as set out above.25 FINMA is free to determine the form in which it grants this permission. Such permission may also be given informally. Furthermore, the foreign authority is not a "party" to the proceedings concerning the approval of an on-site inspection in Switzerland. In general, there is no entitlement on the part of the foreign authorities or the supervised persons in Switzerland to the granting of such authorisation.

25 BSK FINMASA-Rayroux/Mehmetaj, Art. 43 N 8.

By issuing the FINMA Permission, FINMA has given its permission to on-site visits and examinations to the SEC.

FINMA confirmed for Covered Firms and their Covered Activities the validity and the scope of the FINMA Permission in article V para. 46 of the MOU. This also applies to each Bank as a Covered Firm falling into the scope of the MOU.

### 7.2.3 Access by foreign authorities

A '*foreign financial market supervisory authority*' pursuant to article 42c para. 1 FINMASA (please see 6.2 above) also qualifies as such in the sense of article 43 para. 2 FINMASA. While article 43 para. 2 FINMASA does not explicitly mention '*other foreign bodies entrusted with supervision*', an on-site inspection and examination could also be conducted by third parties which are appointed by a foreign financial market supervisory authority or which are appointed by the supervised institution at the request of a foreign financial market supervisory authority to investigate a particular issue.$^{26}$

Where the foreign authority is a host regulator, it must have a specific connection to an activity carried out by the supervised entity to be examined in the territory of such foreign authority.$^{27}$

### 7.2.4 Requirements of article 42 para. 2 FINMASA

The on-site inspections and examinations must meet the conditions set out in article 42 para. 2 FINMASA (see section 6.2.4 above).

### 7.2.5 Information required for supervisory activity

Pursuant to article 43 para. 3 FINMASA, information may be collected through on-site inspections and examinations only if the collection of such information is *required* for the supervisory activity of the foreign financial market supervisory authority. This includes in particular the information stated in article 43 para. 3 FINMASA, which is a non-exhaustive list.

Information which is not necessarily required for the supervisory activity of the SEC, as determined by FINMA, would not be covered by article 43 para. 3 FINMASA. Client information would usually fall into this category, unless it is at the same time relevant for the supervision of the FINMA supervised firm. However, the client may agree to the sharing of the relevant information.

Therefore, where the client has - as a pre-requisite to be able to deal with the Bank - consented to the sharing of relevant information with the competent foreign supervisory authority, the information may be provided on this basis also as part of article 43 para. 3

$^{26}$ FINMA Guidelines regarding on-site visits of March 3, 2017 (the Art. 43 FINMASA FINMA Guidelines), clause 2.2.

$^{27}$ Art. 43 FINMASA FINMA Guidelines, Scope of Application.

FINMASA, subject to the limitations resulting from the FINMA Permission (as stated in section 7.3 below).

### 7.3 Form of on-site inspections or examinations

According to the FINMA Permission and article V para. 46 of the MOU, FINMA grants the SEC a permission to conduct on-site inspections and examinations in relation to the Swiss Books and Records and to conduct informal interviews with employees of the Bank in connection with the SBS Business, to the extent necessary for the SEC's supervision of the SBS Business.

Except in cases of emergency, the SEC will have to notify FINMA two weeks in advance of a planned on-site inspection and examination. Both authorities should consult on the intended timeframe for, and the purpose and scope of, the on-site inspection and examination.

As specified in the FINMA Permission, on conclusion of each review of files or meeting with the Bank's personnel during an on-site inspection and examination, the SEC's examination staff may take personal notes from the premises of the bank. These personal notes may not include client identifying information linked to the asset management, securities trading or deposit business for individual clients (article 43 para. 3$^{bis}$ FINMASA). However, such personal notes may include client identifying information concerning other clients, e.g., the Bank's commercial customers, corporate finance customers, business and investment banking customers as well as interbank transactions, provided that the rights of these clients are preserved. The SEC's staff may not take copies of any documents shown to them during the on-site inspection and examination that contain non-public information from the Bank's premises. These documents must be left at the premises of the Bank. If the SEC wishes to obtain such documents, the SEC may request their transmission either from FINMA or from the Bank.

FINMA reiterated for Covered Firms, including each Bank, the conditions for on-site visits and examinations in article V para. 47 et seq. of the MOU. FINMA intends to transmit upon request of the SEC to the SEC relevant reports, or information in reports regarding inspections, examinations or compliance reviews it may have undertaken regarding the Covered Firm with respect to Covered Activities that are relevant to the SEC's on-site visit. FINMA may, at its discretion, or at the request of the SEC or of the Covered Firm, accompany the SEC during the on-site visit and assist in the on-site visit.

Article V para. 48 of the MOU further specifies that the SEC, following an on-site inspection or examination, will have to inform FINMA about any findings of the on-site inspection or examination and provide a copy of the letter or report issued by SEC to the Covered Firm summarizing the findings from the on-site inspection or examination.

Also, according to Article V para. 49 of the MOU, FINMA will notify the SEC in advance of any on-site visits FINMA plans to do in Switzerland in instances FINMA believes the on-

site visit would be relevant to the SEC for fulfilling its supervisory mandate in relation to the Covered Firm and the Covered Activities. The SEC may, upon request and subject to the consent of FINMA, accompany FINMA during the parts of the on-site visit where the main focus is on the Covered Activities.

### 7.4 Protection of client interests

Pursuant to article 43 para. 3$^{bis}$ FINMASA, if during on-site visits in Switzerland foreign financial market supervisory authorities wish to consult information linked directly or indirectly to the asset management, securities trading or deposit business for individual clients, FINMA shall collect this information itself and transmit it to the requesting authorities through the administrative assistance process (also referred to as 'private banking carve-out').

The purpose of this private banking carve-out is to protect the privacy of Swiss or foreign clients managed by the supervised institution in Switzerland in the context of a long-standing bank-client relationship involving also the personal assets of the client. The carve-out aims at ensuring that the right of appeal of clients (who had not previously consented to the disclosure of their information to a foreign supervisory authority) is safeguarded. In contrast, where the client had consented to the disclosure in advance as in case of SBS transactions, the carve-out would de facto not apply.

However, the carve-out of article 43 para. 3$^{bis}$ FINMASA does not apply to the investment banking or commercial banking business.

### 7.5 Conclusion

Based on the above and subject to the qualifications set forth herein (see section 9 below), we are of the opinion that the Bank can, as a matter of Swiss law, submit to on-site inspection and examination by the SEC in relation to the Swiss Books and Records.

### 8. Question C: Can the Bank, as a matter of Swiss law, submit to on-site inspection and examination by the SEC in relation to its US Books and Records?

#### 8.1 Blocking Statute of article 271 para. 1 of the Swiss Criminal Code

Based on the assumption that any on-site inspections and examinations of the US Books and Records occurs in the United States and, as ensured by the Bank, without the involvement of employees or other representatives or agents of the Bank or of a Bank group company located in Switzerland, there is no action taking place on Swiss territory. On this basis, the on-site inspection and examination by the SEC in relation to its US Books and Records does not constitute a potential offence on Swiss territory and is therefore outside of the scope of application of article 271 para. 1 CC.

## **8.2 Conclusion**

Based on the above and subject to the qualifications set forth herein (see section 9 below), we are of the opinion that the Bank can, as a matter of Swiss law, submit to on-site inspection and examination by the SEC in relation to its US Books and Records.

## **9. Qualifications**

The opinions set forth herein in section 0, 7.5 and 8.2 are subject to the following qualifications:

9.1 The opinions expressed herein are limited to the laws of Switzerland as in force on the date hereof and as currently applied and construed by the courts of Switzerland. In the absence of statutory or established case law, we base our opinion on our independent professional judgement. We have not investigated and do not express or imply any opinion herein concerning any other laws, including without limitation with respect to the law of the place of booking of the SBS.

9.2 The exercise of discretion or the giving of an opinion by a third party or the reliance by any such party (in particular FINMA) on certain circumstances may not be valid unless such discretion is exercised reasonably or such opinion or reliance is based on reasonable grounds.

9.3 No opinion is expressed as to the accuracy of the facts set out or referred to in the documents reviewed or the factual background assumed therein.

9.4 Legal terms or concepts expressed in English in this opinion or in the MOU may not be identical to the concepts described by the same English terms as they exist under the laws of other jurisdictions.

We express no opinion on matters of fact and we assume no obligation to advise the Addressee of any changes of factual or legal matters relevant to this legal opinion that may be brought to our attention after the date hereof. This legal opinion is strictly limited to the matters stated in it and to the confirmations set forth in sections 6, 7 and 8 and does not apply by implication to any other matters.

This opinion is furnished to the Addressee in connection with the SBSD registration of the Bank.

This opinion is governed by and construed in accordance with Swiss law. By relying on this opinion, the Addressee agrees that all disputes arising out of or relating to this opinion shall be subject to the exclusive jurisdiction of the competent courts of the city of Zurich (city district no. 1), Switzerland.

Yours sincerely

**SCHELLENBERG WITTMER LTD**

Olivier Favre

Martin Lanz

## Appendix 1

### Financial Market Supervision Act of June 22, 2007

#### **'Article 29 Duty to provide information and to report**

1 The supervised persons and entities, their audit companies and auditors as well as persons or companies that are qualified investors or that have a substantial participation in the supervised persons and entities must provide FINMA with all information and documents that it requires to carry out its tasks.

2 The supervised persons and entities and the audit companies that conduct audits of them must also immediately report to FINMA any incident that is of substantial importance to the supervision.'

#### **'Article 42 Administrative assistance**

1 In order to implement the financial market acts, FINMA may ask foreign financial market supervisory authorities to provide information.

2 It may transmit non-public information to foreign financial market supervisory authorities only if:

a. this information is used exclusively to implement financial market law, or is forwarded to other authorities, courts or bodies for this purpose;

b. the requesting authorities are bound by official or professional secrecy, notwithstanding provisions on the public nature of proceedings and the notification of the general public about such proceedings.

3 Paragraphs 1 and 2 apply by analogy to the exchange of information between FINMA and foreign authorities, courts and bodies involved in the restructuring and resolution of authorised parties.

4 The administrative assistance shall be carried out swiftly. FINMA shall observe the principle of proportionality. The transmission of information concerning persons who are manifestly uninvolved in the matter being investigated is not permitted.

5 FINMA may, in agreement with the Federal Office of Justice, authorise the forwarding of information to prosecution authorities for purposes other than those mentioned in paragraph 2 letter a, provided that mutual legal assistance in criminal matters is not excluded.'

# " Article 42c Transmission of information by supervised parties

1 Supervised parties may transmit non-public information to the foreign financial market supervisory authorities responsible for them and to other foreign entities responsible for supervision provided:

a. the conditions set out in Article 42 paragraph 2 are fulfilled;
b. the rights of clients and third parties are preserved.

2 Furthermore, they may transmit non-public information related to the transactions of clients and supervised parties to foreign authorities and to entities acting on the authorities' behalf if the rights of clients and third parties are preserved.

3 The transmission of information that is of substantial importance in accordance with Article 29 paragraph 2 must be reported to FINMA beforehand.

4 FINMA may reserve administrative assistance channels."

5 It may make the transmission, publication or forwarding of files in the context of supervision subject to its approval if this is in the interest of its task fulfilment and is not in conflict with overriding private or public interests."

# " Article 43 Cross-border audits

1 In order to implement the financial market acts, FINMA may itself carry out direct audits of supervised persons and entities abroad or have such audits carried out by audit agents.

2 It may permit foreign financial market supervisory authorities to carry out direct audits of supervised parties provided:

a. these authorities are responsible for the supervision of the audited supervised party as part of home country supervision or are responsible for supervising the activity of the audited supervised party in their territory; and
b. the conditions for administrative assistance set out in Article 42 paragraph 2 are fulfilled.

3 Information may be collected through cross-border direct audits only if it is required for the supervisory activity of the foreign financial market supervisory authority. This includes in particular information on whether an institution throughout its group structure:

a. is appropriately organised;
b. records, limits and monitors in an appropriate manner the risks inherent in its business operations;
c. is managed by persons who guarantee proper business conduct;
d. fulfils the own funds and risk diversification regulations on a consolidated basis; and
e. properly complies with its reporting duties vis-à-vis the supervisory authorities.

3bis If during direct audits in Switzerland foreign financial market supervisory authorities wish to consult information linked directly or indirectly to the asset management, securities trading or deposit business for individual clients, FINMA shall collect this information itself and transmit it to the requesting authorities. The same applies to information which directly or indirectly relates to individual investors in collective investment schemes. Article 42a applies.

3ter FINMA may, for the purposes detailed in paragraph 3, allow the foreign financial market supervisory authority which is responsible for the consolidated supervision of the audited supervised party to consult a limited number of individual client dossiers. The dossiers must be selected randomly on the basis of predefined criteria.

4 FINMA may accompany the foreign authorities responsible for financial market supervision on their direct audits in Switzerland or arrange for them to be accompanied by an audit company or an audit agent. The supervised persons and entities concerned may request such accompaniment.

5 Establishments organised under Swiss law must provide the foreign financial market supervisory authorities and FINMA with the information required to carry out the direct audits or the information that FINMA requires to provide the administrative assistance, and must permit the inspection of their books.

6 Establishments are defined as:

a. subsidiaries, branch offices and representative offices of supervised persons and entities or of foreign institutions; and
b. other companies, provided their activity is included by a financial market supervisory authority in the consolidated supervision."

# Swiss criminal code of December 21, 1937

# " Article 271

1. Any person who carries out activities on behalf of a foreign state on Swiss territory without lawful authority, where such activities are the responsibility of a public authority or public official, any person who carries out such activities for a foreign party or organisation, any person who facilitates such activities,

shall be liable to a custodial sentence not exceeding three years or to a monetary penalty, or in serious cases to a custodial sentence of not less than one year.

2. Any person who abducts another by using violence, false pretences or threats and takes him abroad in order to hand him over to a foreign authority, party or other organisation or to expose him to a danger to life or limb shall be liable to a custodial sentence of not less than one year.

3. *Any person who makes preparations for such an abduction shall be liable to a custodial sentence or to a monetary penalty.*

\* \* \* \* \*

**Attachment 9:** `ScheduleDOtherBusinessNames.pdf`

# **1. Schedule D of FORM SBSE, Page 1: Section I: Other Business Names**

| Use Schedule D Page 1 to report details for items listed below. This is an [X] INITIAL [ ] AMENDED detail filing for the Form SBSE items checked below: |  |  |  |
| --- | --- | --- | --- |
| Section I: Other Business Names |  |  |  |
| (Check if applicable) [X] Item 1C (2) |  |  |  |
| List each of the 'other' names and the state(s) or country (ies) in which they are used. |  |  |  |
| 1. Name: Credit Suisse AG, Cayman Islands Branch | State/Country: Cayman Islands | 2. Name Credit Suisse AG, Dublin Branch | State/Country: Ireland |
| 3. Name: Credit Suisse AG, Singapore Branch | State/Country: Singapore | 4. Name Credit Suisse AG, London Branch | State/Country: United Kingdom |
| 5. Name Credit Suisse AG, Nassau Branch | State/Country: Bahamas | 6. Name Credit Suisse AG, New York Branch | State/Country: United States of America |
| 7. Name Credit Suisse AG, Toronto Branch | State/Country: Canada | 8. Name Credit Suisse AG, Milan Branch | State/Country: Italy |
| 9. Name Credit Suisse AG, Hong Kong Branch | State/Country: Hong Kong | 10. Name Credit Suisse AG, Mumbai Branch | State/Country: India |
| 11. Name Credit Suisse AG, Shanghai Branch | State/Country: China | 12. Name Credit Suisse AG, Seoul Branch | State/Country: South Korea |
| 13. Name Credit Suisse AG, Tokyo Branch | State/Country: Japan | 14. Name Credit Suisse AG, Sydney Branch | State/Country: Australia |
| 15. Name Credit Suisse AG, Taipei Securities Branch | State/Country: Taiwan | 16. Name Credit Suisse AG, Sucursal en España | State/Country: Spain |
| 17. Name Credit Suisse AG, Guernsey Branch | State/Country: Guernsey | 18. Name Credit Suisse AG, Luxembourg Branch | State/Country: Luxembourg |
| 19. Name Credit Suisse AG, Bahrain Branch | State/Country: Bahrain | 20. Name Credit Suisse AG (DIFC Branch) | State/Country: United Arab Emirates |
| 21. Name Credit Suisse AG, Riyadh Branch | State/Country: Saudi Arabia | 22. Name | State/Country: |

**Attachment 10:** `ScheduleEOtherLocations.pdf`

# **1. Schedule E of FORM SBSE, Other Business Locations**

| ☑ Add | ☐ Delete | ☐ Amendment |
| --- | --- | --- |
| Effective Date: 02/18/2020 | 4. | Street: |
| Street: KING FAHAD ROAD |  | P.O. Box (if applicable), Suite, Floor: |
| P.O. Box (if applicable), Suite, Floor: P.O.BOX 5000 |  | City, State/Country, Zip Code +4/Postal Code: |
| City, State/Country, Zip Code +4/Postal Code: RIYADH, SAUDI ARABIA, 12361-6858 | 5. | Institution Name: |
| Responsible Associated Person: | MOHAMMED HIJAZI |  |

**Attachment 11:** `summaryofchanges02272023p.pdf`

Summary of Submission changes - February 27, 2023

Removal of Head of Investment Banking to reflect Executive Board changes