EXHIBIT B¶
IN THE UNITED STATES DISTRICT COURT FOR THE SOUTHERN DISTRICT OF NEW YORK¶
GOVERNMENT OF THE UNITED STATES ) Case Number 1:22-CV-10904 (JSR) VIRGIN ISLANDS ) ) PLAINTIFF, ) ) V. ) ) JPMORGAN CHASE BANK, N.A. ) ) DEFENDANT ) ) ) JPMORGAN CHASE BANK, N.A. ) ) THIRD-PARTY PLAINTIFF, ) JAMES EDWARD STALEY ) ) THIRD-PARTY DEFENDANT. ) )¶
EXPERT OPINION REPORT OF JONATHAN J. RUSCH¶
B. Other Relief¶
7.18 In addition to the damages set forth above, in my experience as a compliance professional, the compliance deficiencies described in this report may best be addressed and JPMorgan’s future compliance assured if JPMorgan were directed to provide the Court, within sixty days of the date of the verdict on this case, with (1) a root-cause analysis of the facts and circumstances that led JPMorgan to benefit financially from Epstein’s sex-trafficking operation from at least 2006 to 2013, and to fail to maintain an effective BSAJAML compliance program from at least 2002 to 2021 that led to JPMorgan’s violation of 18 U.S.C. §1591, and (2) a statement of the remediation measures and actions that JPMorgan has taken and proposes to take to prevent further such violations of 18 U.S.C. §159I and to ensure that its BSA/AML compliance program will be effective with respect to human trafficking in the future, after responses and further recommendations from the Plaintiffs. Both private-sector and Justice Department guidance on corporate compliance make clear that an adequate and honest root-cause analysis of compliance misconduct is essential “to understand both what contributed to the misconduct and the degree of remediation needed to prevent similar events in the future.”643 As the Wolfsberg Group indicated in a 2023 guidance document, financial institutions responding to an adverse event such as a compliance failure need to address, among other issues, an assessment of any control failings, how and when the adverse event was escalated, the adverse financial and non-financial impacts of the event and the remaining risk exposures, and the remediation actions that are or were required and taken.’ Both components — the root-cause analysis and a remediation plan (including a detailed action plan for implementation), coupled with monitoring and validation of the efficacy of corrective actions — would be essential for the success of this relief.”¶
{sup}643 See,.e.g.. EVALUATION OF CORPORATE COMPLIANCE PROGRAMS, supra note 229, at 15. See, e.g., id. 14, 16, 18-19; JONATHAN T. MARKS, ROOT CAUSE ANALYSIS: A CRMCAL ETHICS AND COMPLIANCE PRACTICE, Baker Tilly (2020), https://prismic-io.s3.amazonaws.com/baker-tillv-www/5190c367-d913-4018-b7e9 leb4141d3f18 Root+cause+analysis whitepaperpdf; Nancy Derr-Castiglione. “Why?” is the spade of root cause analysis, BANKING EXCHANGE. February 6, 2018, https://m.bankingexchange.com/sections/common-sense-compliancentemt7352 why-is-the-spade-of-root-cause-analysis.¶
{sup}644 WOLFSBERG GROUP. WOLFSBERG ANTI-BRIBERY AND CORRUPTION COMPLIANCE PROGRAMME GUIDANCE 17 (2023). https://wb-db.basel.institute/assets/2b55cdOe-b471-482a-ae28-te390ab516et7Wolfsberu%20ABC%20Guidance.pdt¶
{sup}645 See Clayton Norris. Kathryn Reimann. and Tina Shaver. Root Cause Analysis and Remediation. BANK COMPLIANCE, March-April 2021, hups://magazines.aba.condbemag/march april 2021fMobilePagedAnicle.action?artieleld=1660250anieleld1660254.¶