Leopold v. U.S. Department of Justice

• Court: District Court, District of Columbia
• Decided: January 15, 2026
• Docket: Civil Action No. 2019-3192
• Status: Published

Opinion

UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA

JASON LEOPOLD, : : BUZZFEED INC., : : Plaintiffs, : Civil Action No.: 19-3192 (RC) : v. : Re Document Nos.: 54, 56 : DEPARTMENT OF JUSTICE, : : Defendant. :

MEMORANDUM OPINION

GRANTING DEFENDANT’S MOTION FOR SUMMARY JUDGMENT; DENYING PLAINTIFFS’ CROSS-

MOTION FOR SUMMARY JUDGMENT

I. INTRODUCTION

On March 20, 2025, this Court denied Defendant Department of Justice’s (“DOJ” or

“Department”) motion for summary judgment and Plaintiffs Jason Leopold’s and Buzzfeed

Inc.’s (together, “Plaintiffs”) cross-motion for summary judgment in this Freedom of

Information Act (“FOIA”) suit. See Mar. 20, 2025 Mem. Op. (“3d Mem. Op.”), ECF No. 62.

Through FOIA, Plaintiffs had requested a copy of the First Annual Follow-Up Review Report

and appendices (“Monitor Report” or “Report”), a thousand-page report issued confidentially by

an independent monitor in January 2015 evaluating HSBC’s 1 then-current anti-money laundering

(“AML”) and sanctions compliance program. See Compl. Ex. A, ECF No. 1-1. DOJ withheld

the Report in full pursuant to several FOIA exemptions, including Exemption 8, which shields

1 The Court uses “HSBC” to collectively refer to HSBC Holdings plc, the ultimate parent company; HSBC North America Holdings, Inc., a subsidiary of HSBC Holdings plc; and HSBC Bank USA, a subsidiary of HSBC North America Holdings, Inc. from disclosure materials “contained in or related to” certain reports prepared by or for agencies

that regulate or supervise financial institutions. 5 U.S.C. § 552(b)(8).

Plaintiffs filed suit under FOIA, seeking to compel disclosure of the Report. Following

three rounds of summary judgment, the Court’s last opinion in this case considered an

outstanding issue: whether disclosing any portion of a redacted Report would harm any of the

interests protected by Exemption 8. See 3d Mem. Op. at 1. In its briefing, DOJ argued that

supplemental declarations included with its motion for summary judgment offer detailed

descriptions of the harms it anticipates from disclosure. See Def.’s Mot. Summ. J. (“Def.’s

MSJ”) at 16–28, ECF No. 54-1. Plaintiffs countered that DOJ’s evidence is insufficient to justify

withholding the entire Report and that redactions would mitigate such harms. See Pls.’ Cross-

Mot. Summ. J (“Pls.’ Cross-MSJ”) at 15–26, ECF No. 56-1. The Court declined to rule in favor

of either party, finding that it would gain a better understanding of the factual disputes at issue by

conducting an in camera review of the redacted Monitor Report. See 3d Mem. Op. at 13.

Having now completed this review, the Court determines, for the reasons below, that DOJ has

satisfied its burden of showing foreseeable harm from the disclosure of every portion of the

Report. Accordingly, the Court grants DOJ’s motion for summary judgment and denies

Plaintiffs’ cross-motion for summary judgment.

II. FACTUAL AND PROCEDURAL BACKGROUND

Since Plaintiffs filed suit under FOIA in October 2019, this action has undergone

multiple rounds of court rulings. See Jan. 13, 2021 Mem. Op. (“1st Mem. Op.”), ECF No. 25;

Sept. 19, 2022 Mem. Op. (“2d Mem. Op.”), ECF No. 47; 3d Mem. Op. The facts and procedural

history of this case are detailed in these rulings. See generally id. Below, the Court summarizes

2 background information that is pertinent to the Court’s resolution of the parties’ third cross-

motions for summary judgment.

A. The Deferred Prosecution Agreement and Monitor Agreement

In 2012, the U.S. Attorney’s Office for the Eastern District of New York (“USAO-

EDNY”) and the Money Laundering and Asset Recovery Section (“MLARS”) of DOJ’s

Criminal Division filed a criminal information against HSBC and its subsidiaries, charging them

with failure to maintain an effective anti-money laundering (“AML”) program and conduct due

diligence on foreign correspondent bank accounts, in violation of the Bank Secrecy Act, and

facilitating financial transactions on behalf of sanctioned entities, in violation of the International

Emergency Economic Powers Act and the Trading with the Enemy Act. See United States v.

HSBC Bank USA, N.A. (“HSBC I”), No. 12-CR-763, 2013 WL 3306161, at *1 (E.D.N.Y. July 1,

2013). In addition to the criminal information, the government simultaneously filed a deferred

prosecution agreement (“DPA”) and a corporate compliance monitor agreement (“Monitor

Agreement”). See DPA, United States v. HSBC Bank USA, N.A., No. 12-CR-763 (E.D.N.Y.

Dec. 11, 2012), ECF No. 3-2; Monitor Agreement, United States v. HSBC Bank USA, N.A., No.

12-CR-763 (E.D.N.Y. Dec. 11, 2012), ECF No. 3-4. Judge John Gleeson of the United States

District Court for the Eastern District of New York, who oversaw the initial action, approved the

DPA. See HSBC I, 2013 WL 3306161, at *1. The government requested that the district court

hold the case in abeyance for five years, after which time the government would seek dismissal

of the criminal information if HSBC complied with the terms of the DPA. See id.

Under the DPA and Monitor Agreement, HSBC accepted responsibility for the charges,

committed to implementing remedial measures, and agreed to have an independent compliance

monitor (“Monitor”) evaluate “the effectiveness of [its] internal controls, policies and

3 procedures” relating to its AML and sanctions compliance program and surveil its

implementation of remedial measures. See DPA ¶¶ 2, 5, 9–13; Monitor Agreement ¶ 1. Michael

G. Cherkasky was appointed as Monitor. Kessler Decl. Ex. A at 15–17, Aff. of Michael G.

Cherkasky (“Cherkasky Aff.”) ¶ 1, ECF No. 15-8. Mr. Cherkasky was also selected to serve a

similar role under orders filed by the U.S. Board of Governors of the Federal Reserve System

(“Federal Reserve”) and the United Kingdom’s Financial Conduct Authority (“U.K. Regulator”),

which were pursuing regulatory actions against HSBC for the same conduct described in the

DPA. Id. ¶ 2. HSBC agreed to “cooperate fully” with the Monitor as he worked to fulfill his

mandate, including by granting the Monitor “access to all information, documents, records,

facilities and/or employees, as reasonably requested by the Monitor.” Monitor Agreement ¶ 2.

The Monitor was tasked with undertaking an initial review and preparing an initial report

detailing HSBC’s compliance with relevant legal obligations and its implementation of remedial

measures, followed by annual follow-up reviews and reports. Id. ¶¶ 3–4, 6. The reports were to

be submitted to HSBC, DOJ, the Federal Reserve, and the U.K. Regulator. Id. In view of the

“proprietary, financial, confidential, and competitive business information” likely to be included

in the reports, and because their “public disclosure . . . could discourage cooperation, impede

pending or potential government investigations and thus undermine the objectives of the

Monitorship,” the Monitor Agreement provided that “the reports and the contents thereof are

intended to remain and shall remain non-public . . . except to the extent that [DOJ] determines in

its sole discretion that disclosure would be in furtherance of [DOJ’s] discharge of its duties and

responsibilities or is otherwise required by law.” Id. ¶ 9.

4 B. The Monitor Report

The Monitor issued the First Annual Follow-Up Review Report in January 2015.

Cherkasky Aff. ¶ 4. The Report, which numbers over a thousand pages, sets forth the Monitor’s

“findings and assessment of the then-current state of HSBC Group’s AML and sanctions

compliance program.” Id. As further described by HSBC, the Report includes “phased reviews

of HSBC’s operations and implementation of that program within certain countries,” “thematic

reviews of HSBC’s AML and sanctions compliance program within its trade finance and private

banking business,” and assessments of “HSBC remediation efforts and program enhancements.”

Decl. of Benjamin Naftalis (“2d Naftalis Decl.”) ¶ 8, ECF No. 34-4. The Report includes six

appendices, corresponding to the Monitor’s review of HSBC’s operations in six countries

(“Country Review Reports”), one of which is the United States (“U.S. Country Report”). In the

Monitor’s words, the Report “identifies significant, current deficiencies” in HSBC’s compliance

program. Cherkasky Aff. ¶ 12.

In preparing the Report, the Monitor worked with foreign regulators to gain access to

“confidential client information” in multiple jurisdictions under the “presumption of

confidentiality.” Id. ¶ 9. The Report “reflects the Monitor’s review, analysis, and summary” of

this confidential information, much of which the Monitor “was only permitted to

access . . . because HSBC and the Monitor provided express assurances [of confidentiality] to

regulators in those jurisdictions.” 2d Naftalis Decl. ¶ 9; see also Cherkasky Aff. ¶ 9. The

Monitor additionally relied on the “full, open and candid cooperation from employees at all

levels” of HSBC. Cherkasky Aff. ¶ 11. The Report “contains substantial amounts

of . . . confidential commercial information, such as HSBC’s operations, strategies, business

5 decisions, non-public evaluations of HSBC’s mark standing or performance, and internal HSBC

technologies and proprietary methods.” 2d Naftalis Decl. ¶ 8.

C. DOJ’s Quarterly Reports

When Judge Gleeson approved the DPA, he ordered the government to file quarterly

reports with the district court “to keep it apprised of all significant developments in the

implementation of the DPA.” See HSBC I, 2013 WL 3306161, at *11. Through these quarterly

reports, which DOJ filed on the public docket, DOJ provided the district court and the public

with certain information about HSBC’s compliance with the DPA. See Decl. of Stephen Stich

Match (“Match Decl.”) Exs. 3–9, ECF No. 56-4.

In the quarterly report filed on April 1, 2014, for example, DOJ discussed deficiencies in

HSBC’s AML and sanctions compliance program that the Monitor identified in his initial

review, including with respect to “the reliability of the data [HSBC] gathers and maintains on its

customers,” “its methods of sharing such data among its affiliates,” and its “transaction

monitoring systems.” Match Decl. Ex. 5, Apr. 1, 2014 Quarterly Report at 2, ECF No. 56-4.

DOJ also summarized several recommendations made by the Monitor, including that “HSBC

Group develop global strategy and implementation plans . . . for integrated IT systems, data

sharing within HSBC Group, transaction monitoring pursuant to a minimal global standard, and

global sharing of information underlying Suspicious Activity Reports (‘SARs’) and other

intelligence relevant for financial crime,” that “HSBC Group develop a risk-based approach for

remediating customer files against the best available Know Your Customer (‘KYC’) / Customer

Due Diligence (‘CDD’) standard,” and that “HSBC Group’s Remuneration Committee have the

ability to apply a downward override of up to 100% of incentive awards for HSBC Group’s most

6 senior executives based on any failure to develop an effective AML and sanctions compliance

program.” Id. at 2–3.

A year later, after the Monitor had issued the first Monitor Report, DOJ filed a quarterly

report with the district court summarizing certain aspects of the Report. See Match Decl. Ex. 9,

Apr. 1, 2015 Quarterly Report, ECF No. 56-4. As summarized by DOJ, the Monitor found that

“HSBC Group ha[d] made progress in developing an effective AML and sanctions compliance

program,” although “progress ha[d] been too slow” in two areas: HSBC’s “corporate culture and

its compliance technology.” Id. at 2. As to corporate culture, the Monitor found that certain

HSBC senior managers had “inappropriately pushed back against adverse findings by the HSBC

Global Internal Audit team and HSBC Bank USA’s Compliance Testing and Control (‘CTAC’)

team,” causing a “final audit report to be more favorable to the business than it would otherwise

have been.” Id. at 3. In response to this situation, DOJ noted, HSBC leadership sought to

reassign and partially dock the bonuses of responsible individuals, and HSBC Group’s Chief

Executive issued a directive to senior employees instructing them to “respect Internal Audit’s

independent opinions.” Id. at 3–4. And as to compliance technology, DOJ noted the Monitor’s

belief that “HSBC Group’s compliance technology systems continue[d] to suffer from

fragmentation and lack of connectivity.” Id. at 4.

D. Monitor’s Affidavit, Judge Gleeson’s Order, and Second Circuit Opinion

Soon after the Monitor issued the Monitor Report, Judge Gleeson ordered the

government to file the Report with the district court. See Order (Apr. 28, 2015), United States v.

HSBC Bank USA, N.A., No. 12-CR-763 (E.D.N.Y. Apr. 28, 2015). DOJ requested that the

district court keep the Report under seal. See Cherkasky Aff. ¶ 6. In support of this request, the

Monitor submitted an affidavit (“Monitor’s Affidavit”) to the district court expressing his desire

7 that the Report remain confidential. See id. ¶ 12. The Monitor opined that confidentiality was in

the “best interests of an effective monitorship,” noting that public disclosure of the Report would

harm his relationship with foreign regulators and HSBC employees, whose collaboration he

relied on to perform his work, and would reveal deficiencies in HSBC’s operations that criminals

could exploit to launder funds or violate sanctions laws. See id. ¶¶ 10–12. However, the

Monitor “considered the possibility that the DOJ might file a version of the [Report] that has

sensitive information redacted” and reasoned that “a redacted report that d[id] not negatively

impact [his] work c[ould] be produced.” Id. ¶ 13. Nevertheless, the Monitor felt that a redacted

Report would lack “critical context” and not be “fully comprehensible.” Id.

Judge Gleeson initially kept the Report under seal. See Decl. of Margaret A. Moeser

(“Moeser Decl.”) ¶ 15, ECF No. 15-10. A few months later, however, he granted a third party’s

request to unseal the Monitor Report based on a First Amendment right of access claim. See

United States v. HSBC Bank USA, N.A. (“HSBC II”), No. 12-CR-763, 2016 WL 347670

(E.D.N.Y. Jan. 28, 2016), rev’d, 863 F.3d 125 (2d Cir. 2017). Judge Gleeson determined that,

because he continued to oversee the implementation of the DPA, the Monitor Report, which

informed that judicial function, was a “judicial document” subject to a right of public access. Id.

at *2–3. Judge Gleeson thus held that the Report should be released, but with “targeted

redactions” to preserve several interests that the government and HSBC advanced in keeping the

Report sealed. Id. at *5.

Judge Gleeson considered four such interests. First, the parties argued that the Report’s

disclosure could chill HSBC employees’ cooperation with the Monitor and thus undermine his

ability to assess HSBC’s compliance with the DPA. Id. Judge Gleeson concluded, however, that

this concern could be addressed by redacting identifying information about HSBC employees.

8 Id. Second, the parties contended that release of the Report “could give criminals a ‘road map’

to exploit weaknesses” in HSBC’s compliance programs. Id. at *6. Although Judge Gleeson

found much of the information in the Report to be generalized or otherwise unhelpful to potential

criminals, he nevertheless allowed redactions “to the extent that information detailing the

processes by which criminals could exploit HSBC exists in the Monitor’s Report.” Id. Third,

the government argued that unsealing the Report would undercut the effectiveness of monitors in

future cases because it could “impact the relationship between [DOJ] and financial

regulators . . . when independent monitors are imposed,” as regulators might reject a joint

monitorship if it could lead to a monitor’s work becoming public. Id. (citation omitted). Judge

Gleeson dismissed this argument, however, finding “the government’s interest in . . . its future

law enforcement efforts” to be “minimal.” Id. Fourth, the parties argued that disclosure would

damage the Monitor’s relationship with foreign regulators, as it would contravene assurances of

confidentiality that the Monitor had given to the foreign regulators and could prompt them to

restrict the Monitor’s work in their jurisdictions. Id. Judge Gleeson addressed this concern by

ordering that five of the six Country Review Reports—all except the U.S. Country Report—

remain under seal, and by allowing redactions of “country names and explicit references to

confidential material.” Id. Judge Gleeson ordered the parties to submit proposed redactions to

the Report in line with these considerations. Id. at *7.

Shortly thereafter, the parties filed notices of appeal. Judge Gleeson kept the Report

under seal while the parties submitted their proposed redactions and pending their appeal of his

order. See generally Order, United States v. HSBC Bank USA, N.A., No. 12-CR-763 (E.D.N.Y.

Mar. 9, 2016), ECF No. 70. On appeal, the Second Circuit reversed Judge Gleeson’s ruling,

finding that the Monitor Report was not a “judicial document” subject to a right of public access.

9 See United States v. HSBC Bank USA, N.A., 863 F.3d 125, 129 (2d Cir. 2017). Given this

finding, the Second Circuit did not address Judge Gleeson’s analysis regarding the extent to

which redactions would mitigate concerns from disclosure. See id. at 142 n.7. Even though the

Report was not a “judicial document,” the Second Circuit noted that the public was not

“necessarily without recourse” given that executive records could be requested through FOIA,

although it “offer[ed] no view on whether any of FOIA’s exemptions would apply.” Id.

E. The Present Case

In July 2019, Plaintiffs filed a FOIA request for the Monitor Report with the Executive

Office for U.S. Attorneys (“EOUSA”), which EOUSA denied pursuant to FOIA exemptions 4, 6,

7(A), 7(C), 7(D), and 8. See Compl. Ex. A; Decl. of Vinay J. Jolly (“Jolly Decl.”) ¶¶ 1, 8–25,

ECF No. 15-3. Plaintiffs initiated the present FOIA suit to compel disclosure of the Report, and

the parties filed initial cross-motions for summary judgment. In support of its motion, DOJ filed

sworn declarations from EOUSA, USAO-EDNY, MLARS, and HSBC attesting to the contents

of the Monitor Report and the applicability of various FOIA exemptions. See generally Jolly

Decl.; Decl. of David K. Kessler (“1st Kessler Decl.”), ECF No. 15-7; Moeser Decl.; Decl. of

Benjamin Naftalis (“1st Naftalis Decl.”) Ex. A, ECF No. 20-2. The Court found that Exemption

8, which protects from disclosure materials “contained in or related to examination, operating, or

condition reports” prepared by or for agencies that regulate or supervise financial institutions, 5

U.S.C. § 552(b)(8), applied to the Monitor Report. See 1st Mem. Op. at 20. Nevertheless, the

Court denied summary judgment to DOJ because it was not satisfied that DOJ had complied with

its obligation under FOIA to release any reasonably segregable, non-exempt information in the

Report. Id. at 22–24. Considering Judge Gleeson’s finding in HSBC II that concerns from

disclosure could be addressed through redactions, the Court instructed DOJ to conduct a line-by-

10 line review of the Report to determine whether any information in the Report—particularly the

specific portions that Judge Gleeson had concluded were appropriate for release—could be

reasonably segregated and released. Id. at 23–24.

Following the Court’s ruling, DOJ conducted a line-by-line review and determined that

no portion of the Report could be reasonably segregated and released because the Report in its

entirety fell within the scope of Exemption 8. See Decl. of David K. Kessler (“2d Kessler

Decl.”) ¶¶ 2–3, ECF No. 34-3. The parties once again cross-moved for summary judgment.

DOJ supported its motion with a declaration from USAO-EDNY detailing the Department’s

segregability analysis and another declaration from HSBC. See id.; 2d Naftalis Decl. The Court

granted DOJ’s second motion for summary judgment because it agreed with DOJ that Exemption

8 covered all portions of the Report, although the Court did not determine whether other FOIA

exemptions also applied. See 2d Mem. Op. at 24. Plaintiffs appealed the Court’s ruling.

On March 1, 2024, the D.C. Circuit vacated the Court’s grant of summary judgment to

DOJ and remanded the case to this Court for further proceedings. See Leopold v. Dep’t of Just.,

94 F.4th 33 (D.C. Cir. 2024). The D.C. Circuit observed that the FOIA Improvement Act of

2016 limited withholding pursuant to most FOIA exemptions, including Exemption 8, by

requiring an agency to show not only that a record falls under an exemption, but also that either

the agency “reasonably foresees that disclosure would harm an interest protected by an

exemption” or “disclosure is prohibited by law.” Id. at 36–37 (quoting 5 U.S.C.

§ 552(a)(8)(A)(i)). The D.C. Circuit found this Court’s summary judgment ruling insufficient

because it did not adequately consider whether any portion of the Monitor Report, although

covered by Exemption 8, could nevertheless be released without foreseeable harm to an interest

protected by the exemption. Id. Likewise, the D.C. Circuit noted that on the record before it, it

11 could not conclude that DOJ had met its “independent and meaningful burden” to “specifically

and thoughtfully” consider foreseeable harm from disclosure of otherwise-exempt portions of the

Report. Id. at 38 (quoting Reps. Comm. for Freedom of the Press v. FBI, 3 F.4th 350, 369, 372

(D.C. Cir. 2021)). On remand, the D.C. Circuit emphasized, DOJ must explain in detail how

harm would result from disclosure of every portion of the Monitor’s Report and address Judge

Gleeson’s findings regarding the sufficiency of redactions. Id. at 38–39.

Following the D.C. Circuit’s decision, the parties filed their third round of cross-motions

for summary judgment. On March 20, 2025, this Court denied the parties’ cross-motions,

finding that it would gain a better understanding of the parties’ factual disputes by conducting an

in camera review of the Monitor Report. See 3d Mem. Op. at 13–14. The Court ordered DOJ to

submit the Report, as redacted by Judge Gleeson, to allow the Court to compare the information

that Judge Gleeson redacted with that he found suitable to disclose. See id. The Court informed

the parties that after reviewing the Report, it would determine whether any part of it must be

disclosed pursuant to FOIA. See id.

III. LEGAL STANDARD

The Freedom of Information Act, enacted in 1966, “sets forth a policy of broad disclosure

of Government documents in order ‘to ensure an informed citizenry, vital to the functioning of a

democratic society.’” FBI v. Abramson, 456 U.S. 615, 621 (1982) (quoting NLRB v. Robbins

Tire & Rubber Co., 437 U.S. 214, 242 (1978)); see also Dep’t of Air Force v. Rose, 425 U.S.

352, 361 (1976) (explaining that FOIA is intended “to pierce the veil of administrative secrecy

and to open agency action to the light of public scrutiny” (citation omitted)). As such, FOIA

“mandates that an agency disclose records on request, unless they fall within one of nine

exemptions.” Milner v. Dep’t of Navy, 562 U.S. 562, 565 (2011). Since the enactment of the

12 FOIA Improvement Act of 2016, agencies must meet “additional, crosscutting obligations”

before withholding information pursuant to most FOIA exemptions. Hum. Rts. Def. Ctr. v.

United States Park Police, 126 F.4th 708, 713 (D.C. Cir. 2025). First, as noted above, an agency

must show that disclosing the information would foreseeably harm an exemption-protected

interest or be prohibited by law. See 5 U.S.C. § 552(a)(8)(A)(i). Second, the agency must

“consider whether partial disclosure of information is possible” and “take reasonable steps

necessary to segregate and release nonexempt information.” Id. § 552(a)(8)(A)(ii).

Under Rule 56 of the Federal Rules of Civil Procedure, summary judgment shall be

granted “if the movant shows that there is no genuine dispute as to any material fact and the

movant is entitled to judgment as a matter of law.” Fed. R. Civ. P. 56(a). “FOIA cases typically

and appropriately are decided on motions for summary judgment.” Defenders of Wildlife v. U.S.

Border Patrol, 623 F. Supp. 2d 83, 87 (D.D.C. 2009). “[T]he FOIA expressly places the burden

‘on the agency to sustain its action’ and directs the district courts to ‘determine the matter de

novo.’” U.S. Dep’t of Just. v. Reps. Comm. for Freedom of Press, 489 U.S. 749, 755 (1989)

(citing 5 U.S.C. § 552(a)(4)(B)). “An agency that has withheld responsive documents pursuant

to a FOIA exemption can carry its burden to prove the applicability of the claimed exemption by

affidavit,” provided that such affidavits “describe the justifications for nondisclosure with

reasonably specific detail, demonstrate that the information withheld logically falls within the

claimed exemption, and are not controverted by either contrary evidence in the record nor by

evidence of agency bad faith.” Larson v. Dep’t of State, 565 F.3d 857, 862 (D.C. Cir. 2009)

(quoting Miller v. Casey, 730 F.2d 773, 776 (D.C. Cir. 1984)). “Ultimately, an agency’s

justification for invoking a FOIA exemption is sufficient if it appears ‘logical’ or ‘plausible.’”

Id. (quoting Wolf v. CIA, 473 F.3d 370, 374–75 (D.C. Cir. 2007)).

13 IV. ANALYSIS

The Court has completed its in camera review of the redacted Monitor Report and,

accordingly, now considers whether any part of the Report must be disclosed pursuant to FOIA

in light of the parties’ arguments. As the Court noted in its last summary judgment opinion, the

parties have confirmed that Plaintiffs seek only the First Annual Follow-Up Review Report and

U.S. Country Report (together, “Monitor Report” or “Report”) as redacted by Judge Gleeson,

and Plaintiffs have additionally conceded that the entire Report falls under Exemption 8 of

FOIA. See 3d Mem. Op. at 7. Therefore, the sole remaining issue before the Court is whether

DOJ has satisfied its burden to show that disclosure of every aspect of the redacted Report would

harm an interest protected by Exemption 8.

In support of its present motion for summary judgment, DOJ submits sworn declarations

from Michael P. Grady, Chief of the Bank Integrity Unit of the Money Laundering and Asset

Recovery Section (“MLARS”) of DOJ’s Criminal Division; Richard Naylor, Associate Director

in the Division of Supervision and Regulation of the Federal Reserve; Judson O. Littleton,

outside counsel to HSBC; and Emad Aladhal, Director of Retail Banking at the United

Kingdom’s Financial Conduct Authority (“U.K. Regulator”). See Decl. of Michael P. Grady

(“Grady Decl.”), ECF No. 54-4; Decl. of Richard Naylor (“Naylor Decl.”), ECF No. 54-5; Decl.

of Judson O. Littleton (“Littleton Decl.”), ECF No. 54-6; Decl. of Emad Aladhal (“Aladhal

Decl.”), ECF No. 58-2. DOJ contends that these supplemental declarations provide detailed

descriptions of the harms it anticipates from disclosure and address why Judge Gleeson’s

redactions would not eliminate these harms. See Def.’s MSJ at 16–36. It therefore submits that

it has met its burden to show that it reasonably foresees harm from the release of every portion of

the redacted Monitor Report. See id. at 36.

14 DOJ invokes several interests justifying nondisclosure. First, it argues that disclosure of

the Report would threaten the security of HSBC and other financial institutions. See id. at 25–

28. Even as redacted by Judge Gleeson, DOJ asserts, the Monitor Report details key

vulnerabilities in HSBC’s systems, which, if exposed, could be exploited by criminals to conduct

financial crime and by other banks to gain a competitive advantage over HSBC. See id. Second,

DOJ contends that the Report’s release would impair financial regulators’ ability to carry out

their responsibilities to supervise financial institutions. See id. at 22–25. Because disclosure

would signal to banks that bank examination reports like the Monitor Report could become

public, DOJ explains, it would hinder future cooperation between banks and their examiners and

regulators and discourage candid communications about compliance deficiencies. See id. Third,

DOJ argues that disclosure would strain future monitors’ relationships with foreign regulators, as

it would undermine foreign regulators’ expectations that information shared with monitors and

their ensuing reports would remain confidential. 2 See id. at 19–22.

Plaintiffs dispute that DOJ’s evidence is sufficient to convince a rational factfinder that

disclosing the redacted Monitor Report would harm an interest protected by Exemption 8. See

Pls.’ Cross-MSJ at 17–34. Plaintiffs stress that this case concerns a bank that was aware of its

criminal conduct and had no leverage to refuse a DPA or monitorship, rendering implausible

2 DOJ further maintains that disclosing the Monitor Report would harm the prosecution of other financial institutions. See Def.’s MSJ at 17–19. This argument similarly invokes concerns that disclosure would chill cooperation between banks and their regulators and monitors, which would diminish the effectiveness of monitorships when used in conjunction with deferred prosecutions. See id. Additionally, DOJ argues that disclosure would harm future prosecutions because it would deter banks from agreeing to monitorships, which would constrain DOJ’s ability to assess banks’ compliance with legal obligations. See id. Plaintiffs counter that Exemption 8 of FOIA does not recognize an interest in facilitating the prosecution of financial institutions. See Pls.’ Cross-MSJ at 18. The Court need not resolve this issue, however. Plaintiffs concede that the other interests that DOJ invokes are protected by Exemption 8, and, as set forth below, the Court finds that such interests justify withholding the Report in full.

15 DOJ’s claims that HSBC—or other banks facing similar circumstances—would have refused to

cooperate or share information with the Monitor simply because parts of his ensuing Report

could later become public. See id. at 20–23. And although Plaintiffs accept that certain parts of

the Report could harm exemption-protected interests if released, they argue that Judge Gleeson’s

redactions are sufficient to protect against such harms. See generally id.

The Court concludes that DOJ has satisfied its burden of showing that the disclosure of

any portion of the Monitor Report, even as redacted by Judge Gleeson, would foreseeably harm

an interest protected by Exemption 8. Specifically, the Court finds that DOJ’s concern about

disclosure impairing the relationship between foreign regulators and monitors justifies

withholding the Report in full, and that several of DOJ’s other concerns independently justify

withholding certain sections of the Report. Below, the Court explains Exemption 8 and FOIA’s

foreseeable harm requirement before turning to the parties’ arguments.

A. Exemption 8

Exemption 8 of FOIA protects from disclosure materials that are “contained in or related

to examination, operating, or condition reports” prepared by or for agencies that regulate or

supervise financial institutions. 5 U.S.C. § 552(b)(8). Although FOIA exemptions are generally

construed narrowly, Congress “intentionally and unambiguously” crafted Exemption 8 with “a

particularly broad, all-inclusive definition.” Consumers Union of U.S., Inc. v. Heimann, 589

F.2d 531, 533 (D.C. Cir. 1978). In view of Exemption 8’s “unique breadth,” this Court

previously explained that the entire Monitor Report falls under Exemption 8, as either the Report

16 is itself an examination report or, at minimum, all information therein is “related to” an

examination report. 3 See 2d Mem. Op. at 15–16.

The D.C. Circuit has recognized that Congress drafted Exemption 8 with two main

purposes in mind. Congress’s “primary reason” for adopting Exemption 8 was “to ensure the

security of financial institutions.” Consumers Union of U.S., Inc. v. Heimann, 589 F.2d 531, 534

(D.C. Cir. 1978). In particular, “there was concern that disclosure of examination, operation, and

condition reports containing frank evaluations of the investigated banks might undermine public

confidence and cause unwarranted runs on banks.” Id. A “secondary purpose” in enacting

Exemption 8 was “to safeguard the relationship between the banks and their supervising

agencies.” Id. Specifically, “if details of the bank examinations were made freely available to

the public and to banking competitors, there was concern that banks would cooperate less than

fully with federal authorities.” Id.

1. Foreseeable Harm Requirement

Although the entire Monitor Report falls within the parameters of Exemption 8, DOJ

must nevertheless “release any reasonably segregable information within the [Report] that could

be disclosed without causing reasonably foreseeable harm to an interest that the exemption

protects.” Leopold, 94 F.4th at 33. As noted, Congress codified the foreseeable harm

3 As noted above, EOUSA initially withheld the Monitor Report pursuant to FOIA exemptions 4, 6, 7(A), 7(C), 7(D), and 8. See Jolly Decl. ¶¶ 1, 8–25. In prior rounds of summary judgment, the parties briefed the applicability of these exceptions. In its second summary judgment opinion, the Court found that because Exemption 8 sufficed to allow DOJ to withhold the Report in full, it did not need to determine whether other exemptions also applied. See 2d Mem. Op. at 24. In its present motion for summary judgment, DOJ thus briefs only Exemption 8, while “continu[ing] to assert” its prior arguments regarding other exemptions. See Def.’s MSJ at 6. Plaintiffs argue, however, that DOJ’s failure to brief the other exemptions at this juncture means that it has forfeited them. See Pls.’ Cross-MSJ at 12–15. The Court declines to address this argument given its renewed finding that Exemption 8 allows DOJ to withhold the redacted Monitor Report in full.

17 requirement as part of the “additional, crosscutting obligations” imposed on agencies through the

FOIA Improvement Act. Hum. Rts. Def. Ctr., 126 F.4th at 713. Under the Improvement Act,

DOJ bears the burden of showing, with respect to every portion of the Report it seeks to

withhold, that it “reasonably foresees that disclosure would harm an interest protected by an

exemption.” 5 U.S.C. § 552(a)(8)(A)(i)(I).

To meet the foreseeable harm standard, DOJ must “articulate both the nature of the harm

from release and the link between the specified harm and specific information contained in the

material withheld.” Reps. Comm., 3 F.4th at 369 (citation modified) (quoting H.R. Rep. No. 391,

114th Cong., 2d Sess. 9 (2016)). DOJ may not withhold information “merely because public

officials might be embarrassed by disclosure, because errors and failures might be revealed, or

because of speculative or abstract fears.” Jud. Watch, Inc. v. U.S. Dep't of Just., No. 17-cv-0832,

2019 WL 4644029, at *3 (D.D.C. Sept. 24, 2019) (quoting S. Rep. No. 114-4 (2016), as

reprinted in 2016 U.S.C.C.A.N. 321, 324). Nor may it rely on “general explanations” or “boiler

plate language” in articulating claims of foreseeable harm. Ctr. for Investigative Reporting v.

U.S. Customs & Border Prot., 436 F. Supp. 3d 90, 106 (D.D.C. 2019) (citation omitted). Rather,

“the agency has the burden to submit evidence and offer reasoning based on that evidence.”

Leopold, 94 F.4th at 38.

B. Foreseeable Harm Analysis

DOJ claims that it reasonably foresees that the release of the Monitor Report in any form,

even as redacted by Judge Gleeson, would harm Exemption 8’s primary and secondary purposes.

The Court considers the interests in “ensur[ing] the security of financial institutions” and in

“safeguard[ing] the relationship between the banks and their supervising agencies” in turn.

Consumers Union, 589 F.2d at 534.

18 1. Ensuring the Security of Financial Organizations

a. Exploitation by Bad Actors

DOJ contends that disclosure of the Monitor Report would threaten the security of HSBC

and other financial institutions by helping criminals exploit banks’ compliance deficiencies to

conduct financial crime and avoid scrutiny from banks, regulators, and law enforcement

authorities. Def.’s MSJ at 25–26. Even as redacted, HSBC declares, the Monitor Report

“contain[s] detailed descriptions of potential gaps in HSBC’s compliance processes and

technology.” Littleton Decl. ¶ 32. MLRAS “reasonably foresee[s] that criminals would use this

[unredacted] information to conduct financial crime.” Grady Decl. ¶ 24. Furthermore, “[n]either

the passage of time nor any remediation by HSBC allays [these] concerns,” because criminals

would infer that other financial institutions that have not taken remedial efforts likely suffer from

similar compliance deficiencies. Id. Plaintiffs discredit this security concern, noting that Judge

Gleeson found much of the information in the Monitor Report too “generalized” to help potential

criminals. See Pls.’ Cross-MSJ at 26–28. Regardless, Plaintiffs contend, DOJ’s arguments are

implausible because DOJ does not establish that HSBC or other banks currently suffer from the

deficiencies identified in the Report. See id.

The Court’s review of the Monitor Report leaves it with the impression that Judge

Gleeson’s redactions largely protect against the risk that potential criminals could exploit

security weaknesses identified in the Report. Although the Report describes significant

shortcomings in HSBC’s compliance program—at times in great detail—its unredacted portions

mostly refer to these shortcomings at a level of granularity that is unlikely to be helpful to bad

actors. Consider, for example, HSBC’s assertion that the redacted Report contains “[d]etailed

evaluations of HSBC’s data processes and compliance technology systems, including the

19 Monitor’s observations about the limitations of a particular kind of case management software,”

which would cause harm if released. Littleton Decl. ¶ 33(b). Although the Court agrees that the

redacted Report contains this information, the Court notes that the name of this software is

redacted. The Court struggles to see how potential criminals could seize upon the Monitor’s

observations about the limitations of an unnamed software to infiltrate financial institutions,

especially considering that the criminals would not know which financial institutions, if any,

currently use this software.

In the Court’s view, however, Judge Gleeson’s redactions do not fully remove all

information in the Report implicating this security risk. The Court identified scattered passages

in the Report containing unredacted descriptions of compliance practices and limitations that,

whether particularized or not, could conceivably tip off criminals to potentially common

compliance vulnerabilities in the financial industry. In this regard, the Court appreciates DOJ’s

point that “bits and pieces” of facts that are “not of obvious importance” in themselves—or

immediately helpful to financial criminals—might “aid in piecing together bits of other

information” that could expose banks’ security vulnerabilities to individuals with “a broad view

of the scene.” See Def.’s MSJ at 25 (quoting Ctr. for Nat’l Sec. Studs. v. Dep’t of Just., 331 F.3d

918, 928–29 (D.C. Cir. 2003)).

Nevertheless, the Court believes that additional, targeted redactions would eliminate

DOJ’s concern that bad actors could exploit information in the Monitor Report for malicious

ends. Moreover, Plaintiffs are correct that the redacted Report contains “mundane” parts that do

not implicate this concern, including “‘long sections’ summariz[ing] . . . ‘the processes that the

Monitor took to reach [his] findings.’” See Pls.’ Reply at 7, ECF No. 60 (quoting HSBC II, 2016

WL 347670, at *6 n.11). Accordingly, while DOJ’s concern that public release of the Monitor

20 Report could assist potential criminals is reasonable, this concern cannot justify withholding the

entire redacted Report.

b. Other Security Concerns

DOJ claims that security concerns implicated by disclosure of the Monitor Report are

“not limited to potential nefarious exploitation by criminals.” Def.’s MSJ at 26. As the Federal

Reserve avers, disclosure of “key and detailed vulnerabilities in HSBC’s systems” in the

redacted Report would allow HBSC’s competitors “to take advantage of real or perceived

weaknesses in HSBC’s operations,” thus harming HSBC’s competitive strength. Naylor Decl.

¶ 25. HSBC echoes this concern. See Littleton Decl. ¶ 7 (“The redacted versions of the Report

and the U.S. Country Report likewise contain substantial amounts of . . . information about

HSBC’s operations, strategies, business decisions, non-public evaluations of HSBC’s market

standing or performance, and internal HSBC technologies and proprietary methods.”). And

MLARS expresses a further concern that “an unfiltered recitation of [HSBC’s] affairs, albeit

historic, increases the risk to [HSBC’s] current security by undermining public confidence in the

[financial institution] or the financial system.” Grady Decl. ¶ 13.

As the D.C. Circuit has explained, the release of a monitor report “containing frank

evaluations” of a bank could threaten the bank’s security because it “might undermine public

confidence and cause unwarranted runs” on the bank. Consumers Union, 589 F.2d at 534. As

for the preservation of a bank’s competitive strength, the D.C. Circuit has not explicitly

recognized this interest as falling within Exemption 8’s umbrella of protection, although it has

observed that this exemption was generally drawn “to protect not simply each individual bank

but the integrity of financial institutions as an industry.” Gregory v. Fed. Deposit Ins. Corp., 631

F.2d 896, 898 (D.C. Cir. 1980). Judge Gleeson permitted HSBC to redact proprietary business

21 information that, if released, could advantage commercial competitors. See Order at 2 & n.2,

United States v. HSBC Bank USA, N.A., No. 12-CR-763 (E.D.N.Y. Mar. 9, 2016), ECF No. 70.

Plaintiffs suggest these redactions are covered by Exemption 4, which protects privileged or

confidential “trade secrets and commercial or financial information.” 5 U.S.C. § 552(b)(4); see

also Pls.’ Cross-MSJ at 29 n.12. Although Plaintiffs argue that DOJ has forfeited Exemption 4,

they nevertheless agree to “accept these redactions.” Pls.’ Cross-MSJ at 29 n.12.

Assuming the propriety of redactions related to DOJ’s additional security concerns, the

Court reiterates its prior holding that Judge Gleeson’s redactions are narrower than those

required to eliminate these concerns. See 2d Mem. Op. at 22. Specifically, the Monitor Report

is replete with unredacted descriptions of deficiencies in HSBC’s operations that would likely

harm the bank’s public image, even if such descriptions do not in themselves constitute

proprietary business information. See id. Nevertheless, the Court is unpersuaded that such

concerns justify withholding the entire redacted Report, or even large swaths of it. To the extent

DOJ argues that disclosure of HSBC’s compliance deficiencies from 2015 would presently

“undermin[e] public confidence” in the bank, see Grady Decl. ¶ 13, DOJ does not explain why

this risk remains a decade later, and after the government ultimately moved to dismiss the

criminal information against HSBC based on the bank’s compliance with the DPA. See Mot.

Dismiss, United States v. HSBC Bank USA, N.A., No. 12-CR-763 (E.D.N.Y. Dec. 12, 2017),

ECF No. 96. Furthermore, the Court finds that additional redactions could remove any

proprietary business information that Judge Gleeson may have overlooked. In any event, these

concerns also do not justify withholding “mundane” parts of the Report unrelated to the

substance of HSBC’s compliance deficiencies. See Pls.’ Reply at 7.

22 2. Safeguarding the Relationship Between Banks and Supervising Agencies

a. Candor and Cooperation

DOJ argues that even partial disclosure of the redacted Monitor Report would impair

regulators’ supervision of financial institutions by impeding cooperation and the free flow of

communications between banks and regulators, particularly in cases where monitorships are

imposed. See Def.’s MSJ at 22–25. As the Federal Reserve attests, a “full, complete, and

unvarnished flow of information from the financial institution and unfettered access to

employees and systems is critical to enable the Board effectively to perform its bank examination

and supervision functions through the use of independent consultants.” Naylor Decl. ¶ 22. The

U.K. Regulator concurs. See Aladhal Decl. ¶ 28. But if banks “believed that information given

to an [independent monitor] for purposes of gauging compliance . . . would be made public, they

would be far less cooperative and forthcoming in providing full and unfettered access to their

files, systems, and knowledgeable staff, especially information which could negatively impact

the financial institution’s operations and reputation.” Naylor Decl. ¶ 22; see also Aladhal Decl.

¶ 28; Littleton Decl. ¶ 24; Grady Decl. ¶ 22. Bank officers and employees would also be “less

forthcoming in providing full, complete, and accurate information . . . if they believed that the

information they provide and the resultant” bank examination reports could be disclosed. Naylor

Decl. ¶ 23; see also Littleton Decl. ¶ 29. And this concern would not be alleviated by redacting

identifying information from such reports. Because bank employees provide information to bank

examiners “with the expectation that it will be kept confidential,” the Federal Reserve declares

that “even employees whose identifying information is not disclosed would be reluctant to share

sensitive information regarding the bank and its operations if they believed [it] would be publicly

disclosed, causing harm to the financial institution.” Naylor Decl. ¶ 26.

23 Although Plaintiffs concede that the interests in candor and cooperation are protected by

Exemption 8, they find it implausible that disclosure of the redacted Monitor Report would

foreseeably harm these interests. See Pls.’ Cross-MSJ at 20. Plaintiffs note that in this case,

HSBC agreed in the Monitor Agreement to “cooperate fully” with the Monitor, including by

providing him “access to all information, documents, records, facilities and/or employees, as

reasonably requested by the Monitor.” See Monitor Agreement ¶ 2; Pls.’ Cross-MSJ at 20.

Likewise, Plaintiffs argue that it is speculative at best that bank officials and employees would be

reluctant to share sensitive information that might later become public, especially if these

individuals were assured anonymity. See Pls.’ Cross-MSJ at 21–22.

Plaintiffs’ contentions are not without substance. In Consumers Union, the D.C. Circuit

explained that Exemption 8’s “secondary purpose”—safeguarding the relationship between

banks and their regulators—derives from Congress’s concern that “banks would cooperate less

than fully with federal authorities” if details of “bank examinations were made freely available to

the public and to banking competitors.” 589 F.2d at 534. Nevertheless, Chief Judge J. Skelly

Wright questioned this proposition in a concurring opinion. Given the “considerable arsenal of

weapons” that the Comptroller of the Currency—a financial regulator and party in that case—

had at his disposal to compel banks to cooperate with bank examiners, Chief Judge Wright

expressed doubt “that confidentiality is necessary to maintain the smooth functioning of the

examination process and the cooperation of bank officials.” Id. at 541 (Wright, C.J.,

concurring). The Court believes that similar considerations are at play here. HSBC assented to a

monitorship as a condition to avoiding prosecution for crimes to which it confessed, and, as

Plaintiffs note, it agreed—on pain of prosecution—to “cooperate fully” with the Monitor. See

DPA ¶¶ 2, 5, 9–13; Monitor Agreement ¶ 2. Assuming similar circumstances in future cases, the

24 Court is doubtful that the prospect of even partial release of a bank examination report would

make financial institutions “far less” cooperative in granting monitors access to their files,

systems, and staff. See, e.g., Naylor Decl. ¶ 22.

Nevertheless, the Court is not entirely discounting Exemption 8’s secondary purpose

here. As DOJ observes, the D.C. Circuit has recognized the importance of frank and open

communications between banks and financial regulators to the “success of [regulators’]

supervision.” See Def.’s MSJ at 22–23 (quoting In re Subpoena Served upon Comptroller of

Currency, & Sec’y of Bd. of Governors of Fed. Rsrv. Sys., 967 F.2d 630, 633 (D.C. Cir. 1992)).

In In re Subpoena Served Upon Comptroller of Currency—a non-FOIA case concerning the

evidentiary privilege traditionally afforded to bank examination reports—the D.C. Circuit

emphasized that “[b]ank management must be open and forthcoming in response to the inquiries

of bank examiners,” which “simply could not [occur] as well if communications between the

bank and its regulators were not privileged.” 967 F.2d at 634. The Court concurs that a promise

of confidentiality should cause a bank official to be less “circumspect in releasing confidential

information,” particularly with respect to sensitive topics. Grady Decl. ¶ 13; see also Williams &

Connolly LLP v. Off. of the Comptroller of the Currency, 39 F. Supp. 3d 82, 93 (D.D.C. 2014)

(“[T]he Court is persuaded . . . that withholding the requested documents furthers one of

[Exemption 8’s] underlying purposes—it encourages banks to be candid and transparent with the

Comptroller.”).

As discussed, the Federal Reserve, U.K. Regulator, MLARS, and HSBC attest that bank

employees would be less forthcoming with monitors if they believed that information shared

with them could later become public, regardless of whether identifying information is redacted.

Contrary to Plaintiffs’ contentions, this concern is neither speculative nor implausible. As

25 MLRAS explains, bank officials “will not know at the time whether the information they provide

will be protected from disclosure from a court in the future,” and may additionally be concerned

that their identities could be discerned based solely on the information that they provided. Grady

Decl. ¶ 22. Furthermore, if an employee knows that certain information “could negatively

impact the financial institution’s operations and reputation,” Naylor Decl. ¶ 22, it is conceivable

that the employee—whether out of loyalty to the bank or fear of suffering negative

repercussions—would hesitate to share it. The point here is not that release of the Monitor

Report would cause bank employees to refuse to cooperate altogether in future monitorships. It

is that confidentiality concerns would cause them to become “more cautious and guarded” in

their responses, Aladhal Decl. ¶ 28, which would compromise “the quality, accuracy,

completeness, and free flow” of information provided to monitors, Naylor Decl. ¶ 22.

Because DOJ’s concern about candor appears “logical” and “plausible,” it justifies

withholding at least some portions of the Monitor Report. Larson, 565 F.3d at 862 (citation

omitted). The question remains, however, whether Judge Gleeson’s redactions—which removed

“identifying information about HSBC employees” from the Report but left in the “non-

identifying information” provided by the employees—are sufficient to eliminate this concern.

See HSBC II, 2016 WL 347670, at *5. On a general level, the Court finds that release of much

of the “non-identifying information” provided to the Monitor would implicate DOJ’s concern

about candor. Judge Gleeson declined to redact such information “given the high number of

individuals interviewed for the Report,” which “helps ensure their anonymity.” Id. at *5 n.9.

Nevertheless, the Court agrees with HSBC that certain unredacted portions of the Report contain

“references to specific individuals’ roles and functions, as well as quotes from specific

individuals’ interviews and emails,” which could enable identification of these individuals.

26 Littleton Decl. ¶ 43. Furthermore, Judge Gleeson’s singular focus on anonymity ignores that

bank officials might additionally be concerned about sharing information “negatively

impact[ing] the financial institution’s operations and reputation” that could later become public.

Naylor Decl. ¶ 22. Needless to say, such information comprises large portions of the Monitor

Report. As noted, even unredacted sections of the Report reveal—in general or specific terms—

deficiencies in HBSC’s systems and operations, including its AML and sanctions policies and

procedures; its compliance technology systems, training programs, and monitoring capabilities;

and its remediation efforts.

Given the Monitor’s dependence on information provided by HSBC to conduct his work,

see Cherkasky Aff. ¶ 3, the Court finds that DOJ’s concern about candor justifies withholding, at

a broad level, the Monitor’s unredacted findings and assessment regarding deficiencies in

HSBC’s systems and operations, to the extent these reflect information shared by HSBC

employees. The Court is convinced that preserving the confidentiality of this information is

necessary to encourage a high “level of cooperation and candor” from bank officials in future

monitorships and is therefore “in the interest of an effective monitorship.” Id. ¶ 11. However, as

with DOJ’s prior arguments, this concern does not justify withholding “mundane” portions of the

Monitor Report unrelated to the substance of the Monitor’s findings. See Pls.’ Reply at 7.

b. Cooperation with Foreign Regulators

DOJ next argues that disclosure of any part of the Monitor Report would discourage

foreign regulators from cooperating with monitors in the future. See Def.’s MSJ at 19–22.

“[W]hen the DOJ imposes a monitor on a global [financial institution],” MLARS explains, “the

monitor must also review operations in other countries, and must obtain approval from foreign

regulators to do so.” Grady Decl. ¶ 23. Furthermore, “[f]oreign regulators expect confidential

27 supervisory information from their regulation of [financial institutions] to be kept

confidential . . . and rely on that expectation of confidentiality in granting [financial institutions]

permission to share that information with monitors.” Id. ¶ 12. In the context of the Monitor

Report, DOJ maintains that “all interested parties,” including foreign regulators, “received

express assurances that the Monitor Report would remain confidential.” Def.’s Combined Opp’n

to Pls.’ Cross-MSJ and Reply (“Def.’s Reply”) at 8, ECF No. 58; see also Grady Decl. ¶ 27.

“[I]f any disclosure [of the Monitor Report] were permitted,” MLRAS attests that it “reasonably

expect[s] that certain foreign regulators would refuse to permit monitors to obtain supervisory or

regulatory information about the [financial institution’s] operations in those foreign nations,

would refuse to permit monitors to interview witnesses located in their jurisdictions, and would

limit the monitor’s investigation in other ways.” Id.; see also Aladhal Decl. ¶ 30.

The Court finds that DOJ has articulated a reasonable fear that disclosure of the redacted

Monitor Report would harm future monitors’ relationships with foreign regulators. As the Court

explained in its first summary judgment opinion, confidentiality is “‘the crux of a successful

monitorship,’ because without it, ‘domestic and foreign financial institution regulators, financial

institution employees, and others upon whom the monitors rely may be unwilling to cooperate

with the monitor.’” 1st Mem. Op. at 21 (quoting Moeser Decl. ¶¶ 9–10). Confidentiality

therefore “safeguard[s] the relationship between the banks and their supervising agencies.”

Consumers Union, 589 F.2d at 534. The Monitor’s experience in this case supports this notion.

As the Monitor explained in his affidavit to Judge Gleeson, “the presumption of confidentiality

[was] a critical component in obtaining foreign regulators’ agreement to access confidential

client information and to rely on it in preparing [his] reports.” Cherkasky Aff. ¶ 9. The Monitor

therefore anticipated, as DOJ does now with respect to future monitorships, that “the level of

28 support that [he] would receive from foreign banking regulators could decrease substantially” if

the Report were released. Id. ¶ 10.

Plaintiffs agree that the interest in promoting cooperation between monitors and foreign

regulators justifies withholding parts of the Monitor Report relating to foreign jurisdictions. See

Pls.’ Cross-MSJ at 23–24. However, they deem “far too speculative” DOJ’s argument that

foreseeable harm to this interest would result even from disclosure of parts of the Report lacking

foreign country information. See Pls.’ Reply at 12–13. Plaintiffs observe that the DOJ did not

promise “strict confidentiality” to HSBC with respect to the Monitor Report, given that DOJ

retained “sole discretion” under the Monitor Agreement to publish the Monitor Report. Monitor

Agreement ¶ 9. Plaintiffs further maintain that DOJ has not otherwise shown that foreign

regulators were promised “strict confidentiality.” Pls.’ Reply at 12–13. Thus, Plaintiffs argue,

disclosing a redacted Report would not break promises to foreign regulators or reduce their

willingness to cooperate with monitors. See id.

Plaintiffs’ arguments about the Monitor Agreement’s confidentiality provisions miss the

mark. Plaintiffs note that these provisions stated that the Monitor’s “reports and the contents

thereof [would] remain non-public . . . except to the extent that the Department determines in its

sole discretion that disclosure would be in furtherance of the Department’s discharge of its duties

and responsibilities or is otherwise required by law.” Monitor Agreement ¶ 9 (emphasis added).

However, DOJ has determined “in its sole discretion” that disclosure of the Monitor Report

would not be in furtherance of its duties and responsibilities. See Def.’s Reply at 9. Moreover, it

is up to this Court, not DOJ, to determine whether FOIA requires disclosure here. In any event,

as DOJ notes, neither the Federal Reserve nor any foreign regulator was a party to the Monitor

29 Agreement. Id. at 8. Therefore, the Monitor Agreement does not prove that foreign regulators

agreed that DOJ could release the Monitor Report if required to do so under FOIA.

In contrast, DOJ’s evidence does reasonably show that foreign regulators received

assurances of confidentiality, see, e.g., Aladhal Decl. ¶ 25, and, more importantly, that foreign

regulators expected that no portion of the Monitor Report would be released. Notably, MLARS

attests that the “settled expectations” of foreign regulators were that the Monitor Report “would

be kept confidential.” Grady Decl. ¶ 27. The U.K. Regulator confirms that it “understood that

not only the information that it shared but also the ensuing Report in its entirety would remain

confidential.” Aladhal Decl. ¶ 25. In light of these attestations, the Court agrees with DOJ that

the release of the Monitor Report in any form, even with foreign country information redacted,

would undermine foreign regulators’ expectations of confidentiality. See Grady Decl. ¶ 27; see

also SafeCard Servs., Inc. v. S.E.C., 926 F.2d 1197, 1200 (D.C. Cir. 1991) (“Agency affidavits

are accorded a presumption of good faith.”).

The Court further finds that DOJ has plausibly shown that foreign regulators could

restrict future monitors’ work in response to the release of any portion of the Monitor Report.

MLRAS attests that any disclosure of the Report would signal to foreign regulators “that monitor

reports may be disclosed in whole or in part,” and foreign regulators “w[ould] have no certainty

or control over what information a court may or may not protect from disclosure in the future.”

Grady Decl. ¶ 23. “In the absence of such certainty or control over what material may be

disclosed,” MLRAS warns, “foreign regulators will likely decline to permit [financial

institutions] to disclose information and otherwise cooperate with monitors in the future.” Id.

Further evidence supports MLARS’s belief that disclosure of any part of the Report

would inhibit future cooperation with foreign regulators. In this latest round of summary

30 judgment, DOJ has finally procured admissible evidence from a foreign regulator—a declaration

from the U.K. Regulator made under penalty of perjury under the laws of the United States—that

is probative on this point.4 The U.K. Regulator attests that U.K. law imposes a duty of

confidentiality on both itself and on “skilled persons,” such as monitors, which “enables firms to

provide sensitive information” to the U.K. Regulator and skilled persons regarding firms’

compliance with regulatory obligations. Aladhal Decl. ¶ 23. Although U.K. law allows the U.K.

Regulator to share such information with other regulators, this generally occurs “subject to an

agreement that the other person will keep the information confidential.” Id. ¶ 24. The U.K.

Regulator believes that public disclosure of the Monitor Report “would constitute a criminal

offence under UK law,” and, accordingly, attests that if it “perceive[s] there is a risk that an

outside party may seek to gain access to [confidential] information through foreign courts,” it

“itself may, give greater consideration to, or indeed refuse to, provide reports or confidential

information to overseas regulators (including those in the US).” Id. ¶ 30.

These declarations satisfy DOJ’s burden to “articulate both the nature of the harm from

release and the link between the specified harm and specific information contained in the

material withheld.” Reps. Comm., 3 F.4th at 369 (citation modified). As DOJ asserts, disclosure

of the Report in any form will undermine foreign regulators’ expectations that the United States

will keep future monitor reports entirely confidential, which could prompt them to refuse to

provide confidential information to U.S. regulators and monitors in the future. Without access to

this information, “monitors will be less likely to detect criminal activity at the [financial

4 DOJ cited other foreign regulators’ unsworn letters as additional evidence of concerns expressed by foreign regulators. See Def.’s MSJ at 20–21. The Court previously declined to consider such letters on hearsay grounds. See 1st Mem. Op. at 14–15. The Court declines to revisit this issue given that DOJ was able to procure a sworn letter from the U.K. Regulator.

31 institution] and less able to assess whether the [financial institution] is complying with”

regulatory and legal obligations. Grady Decl. ¶ 12. And because this harm could materialize

once any part of the Report is released, it is connected to the contents of the entire Report, even

its “mundane” sections.

Furthermore, DOJ’s asserted harm with respect to foreign regulators is reasonably

foreseeable. The Court is mindful that DOJ is not entitled to withhold the Monitor Report

“merely because public officials might be embarrassed by disclosure, because errors and failures

might be revealed, or because of speculative or abstract fears.” Jud. Watch, Inc., 2019 WL

4644029, at *3 (citation omitted). Having now reviewed the Report itself, however, the Court is

comfortable that there is not a hint that DOJ is seeking to withhold the Report to avoid exposing

embarrassing regulatory failures. Moreover, the U.K. Regulator’s attestations confirm that

DOJ’s concerns are neither speculative nor abstract. Like DOJ, the U.K. Regulator believes that

disclosure of any portion of the Report would undermine cooperation with international

regulators. Aladhal Decl. ¶ 33. Indeed, the U.K. Regulator attests that it may itself refuse to

provide confidential information to foreign regulators in the future if it foresees that third parties

could “seek to gain access” to that information through the courts. Id. ¶ 30. Based on the U.K.

Regulator’s experience, its concerns—and those of other foreign regulators—“extend beyond

their respective nations’ boundaries,” id. ¶ 32, and are thus not simply limited to information

related to foreign jurisdictions, as Plaintiffs contend, see Pls.’ Cross-MSJ at 31.

On the whole, the Court finds that DOJ has “specifically and thoughtfully” explained

why foreign regulators would impede the work of future monitors in response to the release of

any part of the Monitor Report. Leopold, 94 F.4th at 38 (quoting Reps. Comm., 3 F.4th at 372).

Accordingly, DOJ’s interest in maintaining future cooperation between foreign regulators and

32 domestic regulators, monitors, and financial institutions justifies withholding the redacted

Monitor Report in full.

C. Plaintiffs’ Evidence Does Not Justify Disclosure

In its opinion on appeal, the D.C. Circuit held that in view of Judge Gleeson’s conclusion

that a redacted Monitor Report could be released and the Monitor’s statement in his affidavit to

Judge Gleeson that “a redacted report that does not negatively impact [his] work c[ould] be

produced,” see Cherkasky Aff. ¶ 13, “a reasonable factfinder could conclude . . . that the Report

can be partially disclosed without harming Exemption 8 interests.” Leopold, 94 F.4th at 39.

Plaintiffs further argue in their present briefing that the fact that DOJ filed quarterly reports

about the Monitor Report on Judge Gleeson’s public docket “shows that it is possible to

produce . . . parts of the Monitor Report itself, without causing any of the harms DOJ posits.”

Pls.’ Reply at 18. In the Court’s last summary judgment opinion, it decided to resolve the factual

disputes raised by Plaintiffs’ evidence by reviewing the Monitor Report in camera. See 3d Mem.

Op. at 13. Having now completed its review, the Court finds Plaintiffs’ evidence insufficient to

refute DOJ’s claims of foreseeable harm or justify disclosure of the Report.

As the Court has now concluded, DOJ’s interest in promoting cooperation with foreign

regulators justifies withholding the Report in full, and several of DOJ’s other claimed interests

independently justify withholding certain parts of the Report. Neither Judge Gleeson’s opinion,

nor the Monitor’s Affidavit, nor DOJ’s quarterly reports change the Court’s conclusions. First,

although Judge Gleeson redacted “country names and explicit references to confidential

material” in the Report, see HSBC II, 2016 WL 347670, at *6, DOJ has shown that cooperation

with foreign regulators would foreseeably be harmed by the release of any part of the Report, not

just sections containing foreign country information.

33 Second, although the Monitor opined in his affidavit that a redacted Report could be

produced without negatively impacting his work, see Cherkasky Aff. ¶ 13, this opinion is

insufficient to rebut DOJ’s new evidence that no part of the Report can be released without

foreseeably chilling future cooperation between foreign regulators, monitors, and financial

institutions. The D.C. Circuit found this proposition insufficiently supported on the record

before it. Leopold, 94 F.4th at 38–39. However, DOJ has now obtained a sworn declaration

from the U.K. Regulator stating that its concerns about disclosure of the Report “extend beyond”

the United Kingdom and that release of the Report in any form could lead it to “indeed, refuse to

provide reports or confidential information to overseas regulators” in the future. See Aladhal

Decl. ¶¶ 30, 32. Although the Monitor reasoned that foreign regulators would be concerned

about the disclosure of confidential materials in an unredacted Report, see Cherkasky Aff. ¶ 9,

his Affidavit does not suggest that he considered that these concerns could extend to the

“disclosure of the Report in full or in part,” see Aladhal Decl. ¶ 32. As the Court has found, the

latter consideration can justify withholding the entire Monitor Report.

Third, the Court disagrees with Plaintiffs that DOJ’s decision to file quarterly reports

about the Monitor Report on Judge Gleeson’s public docket indicates that a redacted Monitor

Report could be disclosed without harm. Having reviewed the Report, the Court concurs with

DOJ that the Monitor Report is “different in kind” from the quarterly reports. See Def.’s Reply

at 11. The quarterly reports describe several of the Monitor’s findings and recommendations on

a general level, while the Monitor Report unsurprisingly provides additional context, citations,

and analysis at a high level of detail. Still, the Monitor Report includes an executive summary

that, like the quarterly reports, describes certain findings on a general level. However, the Court

agrees with DOJ that the publication of the quarterly reports does not implicate the same

34 confidentiality concerns that would arise from disclosure of any part of the Monitor Report. See

id. The key point is that the quarterly reports do not disclose the actual text of the Monitor

Report, so their disclosure would not undermine foreign regulators’ expectations that no part of

the Monitor Report be released.

* * *

Because DOJ has shown that cooperation and support from foreign regulators would

foreseeably decline if any part of the redacted Monitor Report is released, DOJ is entitled to

withhold the Report in full. The Court does not reach this decision lightly. Indeed, the Court

recognizes the strong interest of the public in scrutinizing the government’s efforts to bring

global financial institutions into compliance with applicable laws and regulations. Nevertheless,

the Court is persuaded that confidentiality can serve valuable purposes in the context of

monitorships and deferred prosecutions, and that the effectiveness of future monitorships would

foreseeably be impaired by the release of the Monitor Report. As the Monitor observed in this

case, without full cooperation from foreign regulators and HSBC employees, he would have had

less information with which to assess HSBC’s operations and formulate recommendations on

improving the bank’s AML and sanctions compliance program—and this “would not [have been]

to the benefit of the public or the Bank.” Cherkasky Aff. ¶ 11.

V. CONCLUSION

For the foregoing reasons, Defendant’s Motion for Summary Judgment (ECF No. 54) is

GRANTED and Plaintiffs’ Cross-Motion for Summary Judgment (ECF No. 56) is DENIED.

The First Annual Follow-Up Review Report and appendices can be withheld in their entireties.

An order consistent with this Memorandum Opinion is separately and contemporaneously issued.

Dated: January 15, 2026 RUDOLPH CONTRERAS United States District Judge