To: Zack Bunimovich, AMLUK Reviews, Jesse-J Cruz, James Gladwin,

Kareen Johnson, Daniel-A Klyashtorny, Nina Tona, [Xavi]er Avila,

Davide-A Sferrazza

Subject: RE: Escalation: ONB 1135648 / LKYCGB 160049 / Southern Financi[al]

• Case Numbers:

- ONB-1135648 -- Onboarding case number

- LKYCGB-160049 -- London KYC Global Banking case number

• Personnel on this escalation chain:

- Zack Bunimovich -- KYC analyst

- Jesse-J Cruz -- KYC reviewer

- James Gladwin -- KYC reviewer

- Kareen Johnson -- Compliance

- Daniel-A Klyashtorny -- Compliance

- Nina Tona -- KYC/Compliance lead

- Xavier Avila -- Senior compliance

- Davide-A Sferrazza -- Compliance

- Martin Zeman -- KYC compliance

- Ian Salters -- AMLUK Reviews

- Simon Nall -- Compliance

- Devshiji Odedra -- Compliance

- Ricky-x P[atel] -- Compliance

- Nicholas Hislo[p] -- Compliance

- This reveals the escalation was specifically about the account opening process, meaning the original onboarding was being questioned.

• EFTA01362904 (p.0): Second major escalation email with the same distribution list, confirming this was a multi-round escalation that was not quickly resolved.

Concurrent: Southern Financial KYC Documentation Requests

- Personnel: Liam Osullivan, Davide-A Sferrazza, Joshua Shoshan

- This reveals that the KYC review extended to the credit derivatives and convertible bonds portfolio, meaning compliance was aware of the complex financial instruments being traded.

"KYC is not happening" -- Internal Admission

- A blunt internal admission that the KYC process had stalled or was being blocked.

Southern Financial "Reboot"

- After the stalled KYC process, there was an attempt to "reboot" the Southern Financial compliance review, suggesting the original process had failed.

Phase 4: The KYC Breach Declaration (April 2018)

April 16, 2018, 11:56 AM -- KYC Breach Formally Identified

The breach was formally declared on April 16, 2018 at 11:56 AM via an email chain with the subject line:

KYC Breach_SOUTHFINANMD_Southe[rn] Financial, LLC_FFT Location [I]

April 16, 2018 -- Initial Breach Email Chain

The full email subject, recovered from EFTA01362996 (confidence 0.99):

Cc: Joe Aglione, Ian Salters, Nina T[ona], [Pankaj-A C]hopra,

NCAOTC Derivatives, Alka Gopala

Subject: RE: KYC Breach_SOUTHFTNANMD_Southe[r]n Financial, LLC_FFT Loca[tion]

April 16, 2018, 5:44 PM -- Continued Breach Discussion

• Xavier Avila was actively engaged in the breach discussion on the same day.

April 16, 2018, 7:34 PM -- Evening Email Chain

April 17, 2018, 2:53 AM -- Overnight Escalation

• The breach discussion continued through the night with a 2:53 AM email, suggesting international (London) compliance involvement was engaged.

April 17, 2018, 8:10 AM -- Morning Follow-Up

• Morning follow-up on the breach, with the full distribution list reconfirmed.

April 17, 2018, 9:44 AM -- Continued Discussion

• The breach chain continued with additional discussion.

Phase 5: Post-Breach -- Continued Account Servicing (April-December 2018)

Critical Finding: Trading and Account Activity Continued

Despite the formal KYC breach declaration on April 16, 2018, the following evidence demonstrates continued account servicing:

• EFTA01415223 (05/16/18): Southern Financial LLC - D - $396,015.00

• EFTA01415265 (05/15/18): Southern Financial LLC - D - $396,015.00 + second entry $2,029,601.20

• EFTA01415119 (06/07/18): Southern Financial LLC - D - $396,015.00

• EFTA01381246 (06/21/18): Southern Financial LLC - D - $532,186.86

• EFTA01415125 (06/25/18): Southern Financial LLC - D - $426,615 + $532,186.86

• EFTA01415196 (07/20/18): Southern Financial LLC - D - $533,630.09

• EFTA01415140 (07/25/18): Southern Financial LLC - D - $376,315.00 + $533,630.09

• EFTA01381149 (08/17/18): Jeffrey Epstein - N - $1,243,515.74; Southern Financial LLC - D - $376,315.00

• EFTA01413971 (08/28/18): Southern Financial LLC - D - $1,376,315.00 + $534,440.04

• EFTA01427866 (10/18/18): Southern Financial LLC - D - $1,187,706.86

These are Large, Zero and Negative Balances reports generated under RM CODE 82289, confirming the accounts remained fully operational for at least six months after the breach declaration.

2018 Account Planning -- Business as Usual

• A formal 2018 account planning document was created for Southern Financial, indicating the bank was actively planning future business with the entity even as the KYC breach remained unresolved.

2018 Periodic Review

- Personnel: Liam Osullivan, Bradley Gillin, Stewart Oldfield, Mayur Rathod

• A periodic review of the Southern Financial accounts was conducted in 2018, involving senior relationship managers.

KYC Case Reviews Continued to Stall

• KYC Case #01946825 appears across multiple documents (EFTA01370862, EFTA01381143, EFTA01387493, EFTA01387913, EFTA01388105, EFTA01388543, EFTA01388738), indicating an open, unresolved case that persisted.

• KYC Case #01977698 (EFTA01379999, EFTA01388746) -- Another open case.

• KYC Case #01977695 (EFTA01379613, EFTA01381381, EFTA01387857) -- Yet another.

KYC Rejection

• A KYC case was formally rejected, but this did not result in immediate account closure.

• Confirmation that KYC cases were being rejected but the relationship continued.

September 2018 -- Trade Activity Continues

• Trading activity continued through September 2018.

REASSIGN NEEDED -- Compliance Shuffling

- ONB-1010155 -- A second onboarding case number for Southern Financial, different from ONB-1135648

- The "REASSIGN NEEDED" designation across 21 pages of email chain indicates the compliance case was being shuffled between personnel, a classic marker of institutional avoidance.

Phase 6: Account Closure (Late 2018 - Early 2019)

December 2018 -- Accounts Begin Closing

• EFTA01432198 (RM CODE 82289, 01/14/19): Last known balance report shows Southern Financial LLC still active with balance of $0.00 alongside other Epstein entities (Gratitude America $2,232,836.20; Zorro Management $255,511.05; The Haze Trust $8,789,938.49; Butterfly Trust $357,146.85)

February 2019 -- Final Wind-Down

• EFTA01432142 (02/06/19): Southern Financial LLC - D - $2,924,080.14

• This extraordinarily large balance in February 2019 suggests a final settlement or position unwind.

CIB Offboard List

• Evidence that the client was eventually placed on the Corporate & Investment Banking offboard list.

Phase 7: Regulatory Action (2020)

• On July 7, 2020, the New York State Department of Financial Services (NYDFS) imposed a $150 million fine on Deutsche Bank for, among other failures, its relationship with Jeffrey Epstein. The Consent Order documented that DB had failed to properly monitor the Epstein relationship and had processed hundreds of millions of dollars in suspicious transactions.

KEY PERSONNEL ANALYSIS

The Breach Email Chain (April 16-17, 2018)

Supporting Personnel

DOCUMENT INVENTORY: KYC BREACH CHAIN

Core KYC Breach Emails (Subject: "KYC Breach_SOUTHFINANMD_Southern Financial, LLC_FFT Location")

Escalation Chain Documents (ONB-1135648 / LKYCGB-160049)

ANALYTICAL CONCLUSIONS

1. The KYC Breach Was Known for Years Before Formal Declaration

The evidence shows a pattern of incremental awareness:

• May 2013: First AML/KYC alert generated

• June-September 2013: Multiple RDC alerts on Jeffrey Epstein and Richard Kahn

• 2016: Formal escalation of ONB-1135648 / LKYCGB-160049 involving 15+ compliance personnel

• April 16, 2018: Formal KYC breach declared

The gap between the 2016 escalation and the 2018 formal breach declaration represents approximately two years of institutional delay. The internal admission that "kyc is not happening" (EFTA01362456) and the "Southern Financial reboot" (EFTA01369369) confirm that the compliance process was stalled and restarted, rather than acted upon.

2. DB Continued Servicing Accounts After Breach Identification

The financial records under RM CODE 82289 demonstrate uninterrupted account activity from April 2018 through at least January 2019:

• Monthly balance reports continued without interruption

• Southern Financial maintained balances ranging from $289,515 to $2,924,080

• The Haze Trust (another Epstein entity) maintained balances exceeding $49 million

• Trading activity (credit derivatives, trade details) continued through at least September 2018

• A 2018 Account Planning document was created, indicating forward-looking business development

This represents a minimum 8-9 month period of continued banking services after the KYC breach was formally declared.

3. The Compliance Apparatus Was Structurally Overwhelmed

The evidence reveals:

• At least 3 separate KYC case numbers (01946825, 01977698, 01977695) were open simultaneously

• 2 separate onboarding case numbers (ONB-1135648, ONB-1010155) existed for the same entity

• Multiple REASSIGN NEEDED flags across 21 pages indicate case shuffling

• The "GM KCP Bible - Action Plan" email thread (10+ documents) suggests compliance was creating procedural documentation rather than taking action

• The "KYC Priority List" (EFTA01358471) indicates Southern Financial was one of many problematic accounts being triaged rather than resolved

4. NCAOTC Derivatives Involvement Indicates Revenue Motivation

The presence of NCAOTC Derivatives (Non-Cleared/OTC Derivatives) personnel (Alka Gopala, Pankaj-A Chopra) on the breach notification chain indicates that the KYC breach had implications for revenue-generating derivatives trading. The Brazil sovereign CDS with USD 10mm notional (EFTA01368602) demonstrates that Southern Financial was not merely a deposit account but an active derivatives counterparty generating significant fees and market exposure.

5. The Timeline Demonstrates Systemic Failure, Not Isolated Error

6. Failure by Design or Negligence?

The evidence supports a conclusion of systemic institutional negligence with elements of willful blindness, rather than a deliberate conspiracy to enable Epstein. Specifically:

• The sheer number of compliance personnel involved (25+) demonstrates that the system was aware of the problems

• Multiple escalation chains, case numbers, and reassignments indicate bureaucratic dysfunction rather than suppression

• The "KYC is not happening" and "reboot" references suggest frustration within compliance ranks

• The account was opened despite pre-existing RDC alerts

• Compliance escalations were repeatedly delayed, reassigned, and restarted over a period of years

• The KYC breach declaration did not trigger immediate account suspension or closure

• Revenue-generating derivatives trading continued after the breach

• A 2018 Account Planning document was created, indicating the business side was planning to grow the relationship even as compliance had declared a breach

• The "SF [I]" coded references (60+ documents) across compliance discussions suggest the Southern Financial issue was a well-known, ongoing concern that became normalized within the institution

APPENDIX A: Key Email Addresses Recovered

APPENDIX B: Epstein Entity Account Balances at DB (RM CODE 82289)

From EFTA01381246 (06/21/18) -- representative snapshot:

APPENDIX C: EFTA Document Range Summary

APPENDIX D: DS9/DS11 REVISIT FINDINGS (2026-02-12)

DS9 full-text search reveals substantial new evidence supplementing the DS10-based analysis above. The following corrections and additions apply:

Correction 1: Derivatives Termination Timeline

DS9 reveals (EFTA00169436) that the ISDA Master Agreement and GMRA contracts for Southern Financial LLC (PLM 640310/739190) and Southern Trust Company Inc (PLM 640330/752070) were being terminated in November 2016 -- approximately 17 months before the April 2018 KYC breach. The derivatives book was wound down before the KYC breach, while deposit accounts and other activity continued.

Correction 2: Revenue Estimate

The civil complaint against Deutsche Bank (EFTA00161958, 163 pages) states that "Deutsche Bank estimated that it would earn between $2,000,000 to $4,000,000 annually" from the Epstein relationship.

Correction 3: Total Assets Under Management

The original report estimated ~$53M based on single-date balance snapshots. DS9 provides (EFTA00165748) the total figure: $220,000,000 in "Total Assets within Bank" for the "Southern Financial Relationship" as of April 8, 2014. An internal email (EFTA00128826) states: "Jeffrey Epstein is worth roughly $[1]B and currently has about $230MM here at the bank and we are expecting at least another $100MM from him within the next few months... he is a very important client."

Addition 1: FBI Witness Interviews

• EFTA00128765 (15 pages): FBI FD-302 interview of Amanda Kirby (8/10/2021), Paul Morris's relationship coordinator. Kirby "felt uncomfortable from day one of EPSTEIN being onboarded as a client," described Morris as "insecure and a back-handed manipulator," confirmed KYC for Epstein was "high risk" and that she identified a trust beneficiary as a co-conspirator but the account was opened anyway.

• EFTA00128968 (5 pages): FBI FD-302 interview of Cherie Quigley (10/10/2019), AML monitoring officer using the PRIME system. Quigley admitted: "Looking back, maybe a SAR should have been filed on EPSTEIN."

Addition 2: Paul Morris -- Prince Andrew Dismissal

Addition 3: 13.7 Million Ruble Wire to Moscow

Addition 4: Key New Personnel

Addition 5: NYDFS Consent Order

Addition 6: Civil RICO Allegations