Leopold v. U.S. Department of Justice

Opinion

UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA

JASON LEOPOLD, :

:

BUZZFEED INC., :

:

Plaintiffs, : Civil Action No.: 19-3192 (RC)

:

v. : Re Document Nos.: 54, 56 :

DEPARTMENT OF JUSTICE, :

:

Defendant. :

MEMORANDUM OPINION

GRANTING DEFENDANT’S MOTION FOR SUMMARY JUDGMENT; DENYING PLAINTIFFS’ CROSS-

MOTION FOR SUMMARY JUDGMENT I. INTRODUCTION

On March 20, 2025, this Court denied Defendant Department of Justice’s (“DOJ” or “Department”) motion for summary judgment and Plaintiffs Jason Leopold’s and Buzzfeed Inc.’s (together, “Plaintiffs”) cross-motion for summary judgment in this Freedom of Information Act (“FOIA”) suit. See Mar. 20, 2025 Mem. Op. (“3d Mem. Op.”), ECF No. 62. Through FOIA, Plaintiffs had requested a copy of the First Annual Follow-Up Review Report and appendices (“Monitor Report” or “Report”), a thousand-page report issued confidentially by an independent monitor in January 2015 evaluating HSBC’s 1 then-current anti-money laundering (“AML”) and sanctions compliance program. See Compl. Ex. A, ECF No. 1-1. DOJ withheld the Report in full pursuant to several FOIA exemptions, including Exemption 8, which shields

1 The Court uses “HSBC” to collectively refer to HSBC Holdings plc, the ultimate parent company; HSBC North America Holdings, Inc., a subsidiary of HSBC Holdings plc; and HSBC Bank USA, a subsidiary of HSBC North America Holdings, Inc.

from disclosure materials “contained in or related to” certain reports prepared by or for agencies that regulate or supervise financial institutions. 5 U.S.C. § 552(b)(8).

Plaintiffs filed suit under FOIA, seeking to compel disclosure of the Report. Following three rounds of summary judgment, the Court’s last opinion in this case considered an outstanding issue: whether disclosing any portion of a redacted Report would harm any of the interests protected by Exemption 8. See 3d Mem. Op. at 1. In its briefing, DOJ argued that supplemental declarations included with its motion for summary judgment offer detailed descriptions of the harms it anticipates from disclosure. See Def.’s Mot. Summ. J. (“Def.’s MSJ”) at 16–28, ECF No. 54-1. Plaintiffs countered that DOJ’s evidence is insufficient to justify withholding the entire Report and that redactions would mitigate such harms. See Pls.’ Cross- Mot. Summ. J (“Pls.’ Cross-MSJ”) at 15–26, ECF No. 56-1. The Court declined to rule in favor of either party, finding that it would gain a better understanding of the factual disputes at issue by conducting an in camera review of the redacted Monitor Report. See 3d Mem. Op. at 13. Having now completed this review, the Court determines, for the reasons below, that DOJ has satisfied its burden of showing foreseeable harm from the disclosure of every portion of the Report. Accordingly, the Court grants DOJ’s motion for summary judgment and denies Plaintiffs’ cross-motion for summary judgment.

II. FACTUAL AND PROCEDURAL BACKGROUND Since Plaintiffs filed suit under FOIA in October 2019, this action has undergone multiple rounds of court rulings. See Jan. 13, 2021 Mem. Op. (“1st Mem. Op.”), ECF No. 25; Sept. 19, 2022 Mem. Op. (“2d Mem. Op.”), ECF No. 47; 3d Mem. Op. The facts and procedural history of this case are detailed in these rulings. See generally id. Below, the Court summarizes

3

background information that is pertinent to the Court’s resolution of the parties’ third cross- motions for summary judgment.

A. The Deferred Prosecution Agreement and Monitor Agreement In 2012, the U.S. Attorney’s Office for the Eastern District of New York (“USAO-

EDNY”) and the Money Laundering and Asset Recovery Section (“MLARS”) of DOJ’s Criminal Division filed a criminal information against HSBC and its subsidiaries, charging them with failure to maintain an effective anti-money laundering (“AML”) program and conduct due diligence on foreign correspondent bank accounts, in violation of the Bank Secrecy Act, and facilitating financial transactions on behalf of sanctioned entities, in violation of the International Emergency Economic Powers Act and the Trading with the Enemy Act. See United States v. HSBC Bank USA, N.A. (“HSBC I”), No. 12-CR-763, 2013 WL 3306161, at *1 (E.D.N.Y. July 1, 2013). In addition to the criminal information, the government simultaneously filed a deferred prosecution agreement (“DPA”) and a corporate compliance monitor agreement (“Monitor Agreement”). See DPA, United States v. HSBC Bank USA, N.A., No. 12-CR-763 (E.D.N.Y. Dec. 11, 2012), ECF No. 3-2; Monitor Agreement, United States v. HSBC Bank USA, N.A., No. 12-CR-763 (E.D.N.Y. Dec. 11, 2012), ECF No. 3-4. Judge John Gleeson of the United States District Court for the Eastern District of New York, who oversaw the initial action, approved the DPA. See HSBC I, 2013 WL 3306161, at *1. The government requested that the district court hold the case in abeyance for five years, after which time the government would seek dismissal of the criminal information if HSBC complied with the terms of the DPA. See id.

Under the DPA and Monitor Agreement, HSBC accepted responsibility for the charges, committed to implementing remedial measures, and agreed to have an independent compliance monitor (“Monitor”) evaluate “the effectiveness of [its] internal controls, policies and

4

procedures” relating to its AML and sanctions compliance program and surveil its implementation of remedial measures. See DPA ¶¶ 2, 5, 9–13; Monitor Agreement ¶ 1. Michael G. Cherkasky was appointed as Monitor. Kessler Decl. Ex. A at 15–17, Aff. of Michael G. Cherkasky (“Cherkasky Aff.”) ¶ 1, ECF No. 15-8. Mr. Cherkasky was also selected to serve a similar role under orders filed by the U.S. Board of Governors of the Federal Reserve System (“Federal Reserve”) and the United Kingdom’s Financial Conduct Authority (“U.K. Regulator”), which were pursuing regulatory actions against HSBC for the same conduct described in the DPA. Id. ¶ 2. HSBC agreed to “cooperate fully” with the Monitor as he worked to fulfill his mandate, including by granting the Monitor “access to all information, documents, records, facilities and/or employees, as reasonably requested by the Monitor.” Monitor Agreement ¶ 2.

The Monitor was tasked with undertaking an initial review and preparing an initial report detailing HSBC’s compliance with relevant legal obligations and its implementation of remedial measures, followed by annual follow-up reviews and reports. Id. ¶¶ 3–4, 6. The reports were to be submitted to HSBC, DOJ, the Federal Reserve, and the U.K. Regulator. Id. In view of the “proprietary, financial, confidential, and competitive business information” likely to be included in the reports, and because their “public disclosure . . . could discourage cooperation, impede pending or potential government investigations and thus undermine the objectives of the Monitorship,” the Monitor Agreement provided that “the reports and the contents thereof are intended to remain and shall remain non-public . . . except to the extent that [DOJ] determines in its sole discretion that disclosure would be in furtherance of [DOJ’s] discharge of its duties and responsibilities or is otherwise required by law.” Id. ¶ 9.

5

B. The Monitor Report

The Monitor issued the First Annual Follow-Up Review Report in January 2015.

Cherkasky Aff. ¶ 4. The Report, which numbers over a thousand pages, sets forth the Monitor’s “findings and assessment of the then-current state of HSBC Group’s AML and sanctions compliance program.” Id. As further described by HSBC, the Report includes “phased reviews of HSBC’s operations and implementation of that program within certain countries,” “thematic reviews of HSBC’s AML and sanctions compliance program within its trade finance and private banking business,” and assessments of “HSBC remediation efforts and program enhancements.” Decl. of Benjamin Naftalis (“2d Naftalis Decl.”) ¶ 8, ECF No. 34-4. The Report includes six appendices, corresponding to the Monitor’s review of HSBC’s operations in six countries (“Country Review Reports”), one of which is the United States (“U.S. Country Report”). In the Monitor’s words, the Report “identifies significant, current deficiencies” in HSBC’s compliance program. Cherkasky Aff. ¶ 12.

In preparing the Report, the Monitor worked with foreign regulators to gain access to “confidential client information” in multiple jurisdictions under the “presumption of confidentiality.” Id. ¶ 9. The Report “reflects the Monitor’s review, analysis, and summary” of this confidential information, much of which the Monitor “was only permitted to access . . . because HSBC and the Monitor provided express assurances [of confidentiality] to regulators in those jurisdictions.” 2d Naftalis Decl. ¶ 9; see also Cherkasky Aff. ¶ 9. The Monitor additionally relied on the “full, open and candid cooperation from employees at all levels” of HSBC. Cherkasky Aff. ¶ 11. The Report “contains substantial amounts of . . . confidential commercial information, such as HSBC’s operations, strategies, business

6

decisions, non-public evaluations of HSBC’s mark standing or performance, and internal HSBC technologies and proprietary methods.” 2d Naftalis Decl. ¶ 8.

C. DOJ’s Quarterly Reports When Judge Gleeson approved the DPA, he ordered the government to file quarterly reports with the district court “to keep it apprised of all significant developments in the implementation of the DPA.” See HSBC I, 2013 WL 3306161, at *11. Through these quarterly reports, which DOJ filed on the public docket, DOJ provided the district court and the public with certain information about HSBC’s compliance with the DPA. See Decl. of Stephen Stich Match (“Match Decl.”) Exs. 3–9, ECF No. 56-4.

In the quarterly report filed on April 1, 2014, for example, DOJ discussed deficiencies in HSBC’s AML and sanctions compliance program that the Monitor identified in his initial review, including with respect to “the reliability of the data [HSBC] gathers and maintains on its customers,” “its methods of sharing such data among its affiliates,” and its “transaction monitoring systems.” Match Decl. Ex. 5, Apr. 1, 2014 Quarterly Report at 2, ECF No. 56-4. DOJ also summarized several recommendations made by the Monitor, including that “HSBC Group develop global strategy and implementation plans . . . for integrated IT systems, data sharing within HSBC Group, transaction monitoring pursuant to a minimal global standard, and global sharing of information underlying Suspicious Activity Reports (‘SARs’) and other intelligence relevant for financial crime,” that “HSBC Group develop a risk-based approach for remediating customer files against the best available Know Your Customer (‘KYC’) / Customer Due Diligence (‘CDD’) standard,” and that “HSBC Group’s Remuneration Committee have the ability to apply a downward override of up to 100% of incentive awards for HSBC Group’s most

7

senior executives based on any failure to develop an effective AML and sanctions compliance program.” Id. at 2–3.

A year later, after the Monitor had issued the first Monitor Report, DOJ filed a quarterly report with the district court summarizing certain aspects of the Report. See Match Decl. Ex. 9, Apr. 1, 2015 Quarterly Report, ECF No. 56-4. As summarized by DOJ, the Monitor found that “HSBC Group ha[d] made progress in developing an effective AML and sanctions compliance program,” although “progress ha[d] been too slow” in two areas: HSBC’s “corporate culture and its compliance technology.” Id. at 2. As to corporate culture, the Monitor found that certain HSBC senior managers had “inappropriately pushed back against adverse findings by the HSBC Global Internal Audit team and HSBC Bank USA’s Compliance Testing and Control (‘CTAC’) team,” causing a “final audit report to be more favorable to the business than it would otherwise have been.” Id. at 3. In response to this situation, DOJ noted, HSBC leadership sought to reassign and partially dock the bonuses of responsible individuals, and HSBC Group’s Chief Executive issued a directive to senior employees instructing them to “respect Internal Audit’s independent opinions.” Id. at 3–4. And as to compliance technology, DOJ noted the Monitor’s belief that “HSBC Group’s compliance technology systems continue[d] to suffer from fragmentation and lack of connectivity.” Id. at 4.

D. Monitor’s Affidavit, Judge Gleeson’s Order, and Second Circuit Opinion Soon after the Monitor issued the Monitor Report, Judge Gleeson ordered the government to file the Report with the district court. See Order (Apr. 28, 2015), United States v. HSBC Bank USA, N.A., No. 12-CR-763 (E.D.N.Y. Apr. 28, 2015). DOJ requested that the district court keep the Report under seal. See Cherkasky Aff. ¶ 6. In support of this request, the Monitor submitted an affidavit (“Monitor’s Affidavit”) to the district court expressing his desire

8

that the Report remain confidential. See id. ¶ 12. The Monitor opined that confidentiality was in the “best interests of an effective monitorship,” noting that public disclosure of the Report would harm his relationship with foreign regulators and HSBC employees, whose collaboration he relied on to perform his work, and would reveal deficiencies in HSBC’s operations that criminals could exploit to launder funds or violate sanctions laws. See id. ¶¶ 10–12. However, the Monitor “considered the possibility that the DOJ might file a version of the [Report] that has sensitive information redacted” and reasoned that “a redacted report that d[id] not negatively impact [his] work c[ould] be produced.” Id. ¶ 13. Nevertheless, the Monitor felt that a redacted Report would lack “critical context” and not be “fully comprehensible.” Id.

Judge Gleeson initially kept the Report under seal. See Decl. of Margaret A. Moeser (“Moeser Decl.”) ¶ 15, ECF No. 15-10. A few months later, however, he granted a third party’s request to unseal the Monitor Report based on a First Amendment right of access claim. See United States v. HSBC Bank USA, N.A. (“HSBC II”), No. 12-CR-763, 2016 WL 347670 (E.D.N.Y. Jan. 28, 2016), rev’d, 863 F.3d 125 (2d Cir. 2017). Judge Gleeson determined that, because he continued to oversee the implementation of the DPA, the Monitor Report, which informed that judicial function, was a “judicial document” subject to a right of public access. Id. at *2–3. Judge Gleeson thus held that the Report should be released, but with “targeted redactions” to preserve several interests that the government and HSBC advanced in keeping the Report sealed. Id. at *5.

Judge Gleeson considered four such interests. First, the parties argued that the Report’s disclosure could chill HSBC employees’ cooperation with the Monitor and thus undermine his ability to assess HSBC’s compliance with the DPA. Id. Judge Gleeson concluded, however, that this concern could be addressed by redacting identifying information about HSBC employees.

9

Id. Second, the parties contended that release of the Report “could give criminals a ‘road map’ to exploit weaknesses” in HSBC’s compliance programs. Id. at *6. Although Judge Gleeson found much of the information in the Report to be generalized or otherwise unhelpful to potential criminals, he nevertheless allowed redactions “to the extent that information detailing the processes by which criminals could exploit HSBC exists in the Monitor’s Report.” Id. Third, the government argued that unsealing the Report would undercut the effectiveness of monitors in future cases because it could “impact the relationship between [DOJ] and financial regulators . . . when independent monitors are imposed,” as regulators might reject a joint monitorship if it could lead to a monitor’s work becoming public. Id. (citation omitted). Judge Gleeson dismissed this argument, however, finding “the government’s interest in . . . its future law enforcement efforts” to be “minimal.” Id. Fourth, the parties argued that disclosure would damage the Monitor’s relationship with foreign regulators, as it would contravene assurances of confidentiality that the Monitor had given to the foreign regulators and could prompt them to restrict the Monitor’s work in their jurisdictions. Id. Judge Gleeson addressed this concern by ordering that five of the six Country Review Reports—all except the U.S. Country Report— remain under seal, and by allowing redactions of “country names and explicit references to confidential material.” Id. Judge Gleeson ordered the parties to submit proposed redactions to the Report in line with these considerations. Id. at *7.

Shortly thereafter, the parties filed notices of appeal. Judge Gleeson kept the Report under seal while the parties submitted their proposed redactions and pending their appeal of his order. See generally Order, United States v. HSBC Bank USA, N.A., No. 12-CR-763 (E.D.N.Y. Mar. 9, 2016), ECF No. 70. On appeal, the Second Circuit reversed Judge Gleeson’s ruling, finding that the Monitor Report was not a “judicial document” subject to a right of public access.

10

See United States v. HSBC Bank USA, N.A., 863 F.3d 125, 129 (2d Cir. 2017). Given this finding, the Second Circuit did not address Judge Gleeson’s analysis regarding the extent to which redactions would mitigate concerns from disclosure. See id. at 142 n.7. Even though the Report was not a “judicial document,” the Second Circuit noted that the public was not “necessarily without recourse” given that executive records could be requested through FOIA, although it “offer[ed] no view on whether any of FOIA’s exemptions would apply.” Id.

E. The Present Case

In July 2019, Plaintiffs filed a FOIA request for the Monitor Report with the Executive Office for U.S. Attorneys (“EOUSA”), which EOUSA denied pursuant to FOIA exemptions 4, 6, 7(A), 7(C), 7(D), and 8. See Compl. Ex. A; Decl. of Vinay J. Jolly (“Jolly Decl.”) ¶¶ 1, 8–25, ECF No. 15-3. Plaintiffs initiated the present FOIA suit to compel disclosure of the Report, and the parties filed initial cross-motions for summary judgment. In support of its motion, DOJ filed sworn declarations from EOUSA, USAO-EDNY, MLARS, and HSBC attesting to the contents of the Monitor Report and the applicability of various FOIA exemptions. See generally Jolly Decl.; Decl. of David K. Kessler (“1st Kessler Decl.”), ECF No. 15-7; Moeser Decl.; Decl. of Benjamin Naftalis (“1st Naftalis Decl.”) Ex. A, ECF No. 20-2. The Court found that Exemption 8, which protects from disclosure materials “contained in or related to examination, operating, or condition reports” prepared by or for agencies that regulate or supervise financial institutions, 5 U.S.C. § 552(b)(8), applied to the Monitor Report. See 1st Mem. Op. at 20. Nevertheless, the Court denied summary judgment to DOJ because it was not satisfied that DOJ had complied with its obligation under FOIA to release any reasonably segregable, non-exempt information in the Report. Id. at 22–24. Considering Judge Gleeson’s finding in HSBC II that concerns from disclosure could be addressed through redactions, the Court instructed DOJ to conduct a line-by-

11

line review of the Report to determine whether any information in the Report—particularly the specific portions that Judge Gleeson had concluded were appropriate for release—could be reasonably segregated and released. Id. at 23–24.

Following the Court’s ruling, DOJ conducted a line-by-line review and determined that no portion of the Report could be reasonably segregated and released because the Report in its entirety fell within the scope of Exemption 8. See Decl. of David K. Kessler (“2d Kessler Decl.”) ¶¶ 2–3, ECF No. 34-3. The parties once again cross-moved for summary judgment. DOJ supported its motion with a declaration from USAO-EDNY detailing the Department’s segregability analysis and another declaration from HSBC. See id.; 2d Naftalis Decl. The Court granted DOJ’s second motion for summary judgment because it agreed with DOJ that Exemption 8 covered all portions of the Report, although the Court did not determine whether other FOIA exemptions also applied. See 2d Mem. Op. at 24. Plaintiffs appealed the Court’s ruling.

On March 1, 2024, the D.C. Circuit vacated the Court’s grant of summary judgment to DOJ and remanded the case to this Court for further proceedings. See Leopold v. Dep’t of Just., 94 F.4th 33 (D.C. Cir. 2024). The D.C. Circuit observed that the FOIA Improvement Act of 2016 limited withholding pursuant to most FOIA exemptions, including Exemption 8, by requiring an agency to show not only that a record falls under an exemption, but also that either the agency “reasonably foresees that disclosure would harm an interest protected by an exemption” or “disclosure is prohibited by law.” Id. at 36–37 (quoting 5 U.S.C. § 552(a)(8)(A)(i)). The D.C. Circuit found this Court’s summary judgment ruling insufficient because it did not adequately consider whether any portion of the Monitor Report, although covered by Exemption 8, could nevertheless be released without foreseeable harm to an interest protected by the exemption. Id. Likewise, the D.C. Circuit noted that on the record before it, it

12

could not conclude that DOJ had met its “independent and meaningful burden” to “specifically and thoughtfully” consider foreseeable harm from disclosure of otherwise-exempt portions of the Report. Id. at 38 (quoting Reps. Comm. for Freedom of the Press v. FBI, 3 F.4th 350, 369, 372 (D.C. Cir. 2021)). On remand, the D.C. Circuit emphasized, DOJ must explain in detail how harm would result from disclosure of every portion of the Monitor’s Report and address Judge Gleeson’s findings regarding the sufficiency of redactions. Id. at 38–39.

Following the D.C. Circuit’s decision, the parties filed their third round of cross-motions for summary judgment. On March 20, 2025, this Court denied the parties’ cross-motions, finding that it would gain a better understanding of the parties’ factual disputes by conducting an in camera review of the Monitor Report. See 3d Mem. Op. at 13–14. The Court ordered DOJ to submit the Report, as redacted by Judge Gleeson, to allow the Court to compare the information that Judge Gleeson redacted with that he found suitable to disclose. See id. The Court informed the parties that after reviewing the Report, it would determine whether any part of it must be disclosed pursuant to FOIA. See id.

III. LEGAL STANDARD

The Freedom of Information Act, enacted in 1966, “sets forth a policy of broad disclosure of Government documents in order ‘to ensure an informed citizenry, vital to the functioning of a democratic society.’” FBI v. Abramson, 456 U.S. 615, 621 (1982) (quoting NLRB v. Robbins Tire & Rubber Co., 437 U.S. 214, 242 (1978)); see also Dep’t of Air Force v. Rose, 425 U.S. 352, 361 (1976) (explaining that FOIA is intended “to pierce the veil of administrative secrecy and to open agency action to the light of public scrutiny” (citation omitted)). As such, FOIA “mandates that an agency disclose records on request, unless they fall within one of nine exemptions.” Milner v. Dep’t of Navy, 562 U.S. 562, 565 (2011). Since the enactment of the

13

FOIA Improvement Act of 2016, agencies must meet “additional, crosscutting obligations” before withholding information pursuant to most FOIA exemptions. Hum. Rts. Def. Ctr. v. United States Park Police, 126 F.4th 708, 713 (D.C. Cir. 2025). First, as noted above, an agency must show that disclosing the information would foreseeably harm an exemption-protected interest or be prohibited by law. See 5 U.S.C. § 552(a)(8)(A)(i). Second, the agency must “consider whether partial disclosure of information is possible” and “take reasonable steps necessary to segregate and release nonexempt information.” Id. § 552(a)(8)(A)(ii).

Under Rule 56 of the Federal Rules of Civil Procedure, summary judgment shall be granted “if the movant shows that there is no genuine dispute as to any material fact and the movant is entitled to judgment as a matter of law.” Fed. R. Civ. P. 56(a). “FOIA cases typically and appropriately are decided on motions for summary judgment.” Defenders of Wildlife v. U.S. Border Patrol, 623 F. Supp. 2d 83, 87 (D.D.C. 2009). “[T]he FOIA expressly places the burden ‘on the agency to sustain its action’ and directs the district courts to ‘determine the matter de novo.’” U.S. Dep’t of Just. v. Reps. Comm. for Freedom of Press, 489 U.S. 749, 755 (1989) (citing 5 U.S.C. § 552(a)(4)(B)). “An agency that has withheld responsive documents pursuant to a FOIA exemption can carry its burden to prove the applicability of the claimed exemption by affidavit,” provided that such affidavits “describe the justifications for nondisclosure with reasonably specific detail, demonstrate that the information withheld logically falls within the claimed exemption, and are not controverted by either contrary evidence in the record nor by evidence of agency bad faith.” Larson v. Dep’t of State, 565 F.3d 857, 862 (D.C. Cir. 2009) (quoting Miller v. Casey, 730 F.2d 773, 776 (D.C. Cir. 1984)). “Ultimately, an agency’s justification for invoking a FOIA exemption is sufficient if it appears ‘logical’ or ‘plausible.’” Id. (quoting Wolf v. CIA, 473 F.3d 370, 374–75 (D.C. Cir. 2007)).

14

IV. ANALYSIS

The Court has completed its in camera review of the redacted Monitor Report and, accordingly, now considers whether any part of the Report must be disclosed pursuant to FOIA in light of the parties’ arguments. As the Court noted in its last summary judgment opinion, the parties have confirmed that Plaintiffs seek only the First Annual Follow-Up Review Report and U.S. Country Report (together, “Monitor Report” or “Report”) as redacted by Judge Gleeson, and Plaintiffs have additionally conceded that the entire Report falls under Exemption 8 of FOIA. See 3d Mem. Op. at 7. Therefore, the sole remaining issue before the Court is whether DOJ has satisfied its burden to show that disclosure of every aspect of the redacted Report would harm an interest protected by Exemption 8.

In support of its present motion for summary judgment, DOJ submits sworn declarations from Michael P. Grady, Chief of the Bank Integrity Unit of the Money Laundering and Asset Recovery Section (“MLARS”) of DOJ’s Criminal Division; Richard Naylor, Associate Director in the Division of Supervision and Regulation of the Federal Reserve; Judson O. Littleton, outside counsel to HSBC; and Emad Aladhal, Director of Retail Banking at the United Kingdom’s Financial Conduct Authority (“U.K. Regulator”). See Decl. of Michael P. Grady (“Grady Decl.”), ECF No. 54-4; Decl. of Richard Naylor (“Naylor Decl.”), ECF No. 54-5; Decl. of Judson O. Littleton (“Littleton Decl.”), ECF No. 54-6; Decl. of Emad Aladhal (“Aladhal Decl.”), ECF No. 58-2. DOJ contends that these supplemental declarations provide detailed descriptions of the harms it anticipates from disclosure and address why Judge Gleeson’s redactions would not eliminate these harms. See Def.’s MSJ at 16–36. It therefore submits that it has met its burden to show that it reasonably foresees harm from the release of every portion of the redacted Monitor Report. See id. at 36.

15

DOJ invokes several interests justifying nondisclosure. First, it argues that disclosure of the Report would threaten the security of HSBC and other financial institutions. See id. at 25– 28. Even as redacted by Judge Gleeson, DOJ asserts, the Monitor Report details key vulnerabilities in HSBC’s systems, which, if exposed, could be exploited by criminals to conduct financial crime and by other banks to gain a competitive advantage over HSBC. See id. Second, DOJ contends that the Report’s release would impair financial regulators’ ability to carry out their responsibilities to supervise financial institutions. See id. at 22–25. Because disclosure would signal to banks that bank examination reports like the Monitor Report could become public, DOJ explains, it would hinder future cooperation between banks and their examiners and regulators and discourage candid communications about compliance deficiencies. See id. Third, DOJ argues that disclosure would strain future monitors’ relationships with foreign regulators, as it would undermine foreign regulators’ expectations that information shared with monitors and their ensuing reports would remain confidential. 2 See id. at 19–22.

Plaintiffs dispute that DOJ’s evidence is sufficient to convince a rational factfinder that disclosing the redacted Monitor Report would harm an interest protected by Exemption 8. See Pls.’ Cross-MSJ at 17–34. Plaintiffs stress that this case concerns a bank that was aware of its criminal conduct and had no leverage to refuse a DPA or monitorship, rendering implausible

2 DOJ further maintains that disclosing the Monitor Report would harm the prosecution of other financial institutions. See Def.’s MSJ at 17–19. This argument similarly invokes concerns that disclosure would chill cooperation between banks and their regulators and monitors, which would diminish the effectiveness of monitorships when used in conjunction with deferred prosecutions. See id. Additionally, DOJ argues that disclosure would harm future prosecutions because it would deter banks from agreeing to monitorships, which would constrain DOJ’s ability to assess banks’ compliance with legal obligations. See id. Plaintiffs counter that Exemption 8 of FOIA does not recognize an interest in facilitating the prosecution of financial institutions. See Pls.’ Cross-MSJ at 18. The Court need not resolve this issue, however. Plaintiffs concede that the other interests that DOJ invokes are protected by Exemption 8, and, as set forth below, the Court finds that such interests justify withholding the Report in full.

16

DOJ’s claims that HSBC—or other banks facing similar circumstances—would have refused to cooperate or share information with the Monitor simply because parts of his ensuing Report could later become public. See id. at 20–23. And although Plaintiffs accept that certain parts of the Report could harm exemption-protected interests if released, they argue that Judge Gleeson’s redactions are sufficient to protect against such harms. See generally id.

The Court concludes that DOJ has satisfied its burden of showing that the disclosure of any portion of the Monitor Report, even as redacted by Judge Gleeson, would foreseeably harm an interest protected by Exemption 8. Specifically, the Court finds that DOJ’s concern about disclosure impairing the relationship between foreign regulators and monitors justifies withholding the Report in full, and that several of DOJ’s other concerns independently justify withholding certain sections of the Report. Below, the Court explains Exemption 8 and FOIA’s foreseeable harm requirement before turning to the parties’ arguments.

A. Exemption 8

Exemption 8 of FOIA protects from disclosure materials that are “contained in or related to examination, operating, or condition reports” prepared by or for agencies that regulate or supervise financial institutions. 5 U.S.C. § 552(b)(8). Although FOIA exemptions are generally construed narrowly, Congress “intentionally and unambiguously” crafted Exemption 8 with “a particularly broad, all-inclusive definition.” Consumers Union of U.S., Inc. v. Heimann, 589 F.2d 531, 533 (D.C. Cir. 1978). In view of Exemption 8’s “unique breadth,” this Court previously explained that the entire Monitor Report falls under Exemption 8, as either the Report

17

is itself an examination report or, at minimum, all information therein is “related to” an examination report. 3 See 2d Mem. Op. at 15–16.

The D.C. Circuit has recognized that Congress drafted Exemption 8 with two main purposes in mind. Congress’s “primary reason” for adopting Exemption 8 was “to ensure the security of financial institutions.” Consumers Union of U.S., Inc. v. Heimann, 589 F.2d 531, 534 (D.C. Cir. 1978). In particular, “there was concern that disclosure of examination, operation, and condition reports containing frank evaluations of the investigated banks might undermine public confidence and cause unwarranted runs on banks.” Id. A “secondary purpose” in enacting Exemption 8 was “to safeguard the relationship between the banks and their supervising agencies.” Id. Specifically, “if details of the bank examinations were made freely available to the public and to banking competitors, there was concern that banks would cooperate less than fully with federal authorities.” Id.

1. Foreseeable Harm Requirement Although the entire Monitor Report falls within the parameters of Exemption 8, DOJ must nevertheless “release any reasonably segregable information within the [Report] that could be disclosed without causing reasonably foreseeable harm to an interest that the exemption protects.” Leopold, 94 F.4th at 33. As noted, Congress codified the foreseeable harm

3 As noted above, EOUSA initially withheld the Monitor Report pursuant to FOIA exemptions 4, 6, 7(A), 7(C), 7(D), and 8. See Jolly Decl. ¶¶ 1, 8–25. In prior rounds of summary judgment, the parties briefed the applicability of these exceptions. In its second summary judgment opinion, the Court found that because Exemption 8 sufficed to allow DOJ to withhold the Report in full, it did not need to determine whether other exemptions also applied. See 2d Mem. Op. at 24. In its present motion for summary judgment, DOJ thus briefs only Exemption 8, while “continu[ing] to assert” its prior arguments regarding other exemptions. See Def.’s MSJ at 6. Plaintiffs argue, however, that DOJ’s failure to brief the other exemptions at this juncture means that it has forfeited them. See Pls.’ Cross-MSJ at 12–15. The Court declines to address this argument given its renewed finding that Exemption 8 allows DOJ to withhold the redacted Monitor Report in full.

18

requirement as part of the “additional, crosscutting obligations” imposed on agencies through the FOIA Improvement Act. Hum. Rts. Def. Ctr., 126 F.4th at 713. Under the Improvement Act, DOJ bears the burden of showing, with respect to every portion of the Report it seeks to withhold, that it “reasonably foresees that disclosure would harm an interest protected by an exemption.” 5 U.S.C. § 552(a)(8)(A)(i)(I).

To meet the foreseeable harm standard, DOJ must “articulate both the nature of the harm from release and the link between the specified harm and specific information contained in the material withheld.” Reps. Comm., 3 F.4th at 369 (citation modified) (quoting H.R. Rep. No. 391, 114th Cong., 2d Sess. 9 (2016)). DOJ may not withhold information “merely because public officials might be embarrassed by disclosure, because errors and failures might be revealed, or because of speculative or abstract fears.” Jud. Watch, Inc. v. U.S. Dep't of Just., No. 17-cv-0832, 2019 WL 4644029, at *3 (D.D.C. Sept. 24, 2019) (quoting S. Rep. No. 114-4 (2016), as reprinted in 2016 U.S.C.C.A.N. 321, 324). Nor may it rely on “general explanations” or “boiler plate language” in articulating claims of foreseeable harm. Ctr. for Investigative Reporting v. U.S. Customs & Border Prot., 436 F. Supp. 3d 90, 106 (D.D.C. 2019) (citation omitted). Rather, “the agency has the burden to submit evidence and offer reasoning based on that evidence.” Leopold, 94 F.4th at 38.

B. Foreseeable Harm Analysis DOJ claims that it reasonably foresees that the release of the Monitor Report in any form, even as redacted by Judge Gleeson, would harm Exemption 8’s primary and secondary purposes. The Court considers the interests in “ensur[ing] the security of financial institutions” and in “safeguard[ing] the relationship between the banks and their supervising agencies” in turn. Consumers Union, 589 F.2d at 534.

19

1. Ensuring the Security of Financial Organizations a. Exploitation by Bad Actors DOJ contends that disclosure of the Monitor Report would threaten the security of HSBC and other financial institutions by helping criminals exploit banks’ compliance deficiencies to conduct financial crime and avoid scrutiny from banks, regulators, and law enforcement authorities. Def.’s MSJ at 25–26. Even as redacted, HSBC declares, the Monitor Report “contain[s] detailed descriptions of potential gaps in HSBC’s compliance processes and technology.” Littleton Decl. ¶ 32. MLRAS “reasonably foresee[s] that criminals would use this [unredacted] information to conduct financial crime.” Grady Decl. ¶ 24. Furthermore, “[n]either the passage of time nor any remediation by HSBC allays [these] concerns,” because criminals would infer that other financial institutions that have not taken remedial efforts likely suffer from similar compliance deficiencies. Id. Plaintiffs discredit this security concern, noting that Judge Gleeson found much of the information in the Monitor Report too “generalized” to help potential criminals. See Pls.’ Cross-MSJ at 26–28. Regardless, Plaintiffs contend, DOJ’s arguments are implausible because DOJ does not establish that HSBC or other banks currently suffer from the deficiencies identified in the Report. See id.

The Court’s review of the Monitor Report leaves it with the impression that Judge Gleeson’s redactions largely protect against the risk that potential criminals could exploit security weaknesses identified in the Report. Although the Report describes significant shortcomings in HSBC’s compliance program—at times in great detail—its unredacted portions mostly refer to these shortcomings at a level of granularity that is unlikely to be helpful to bad actors. Consider, for example, HSBC’s assertion that the redacted Report contains “[d]etailed evaluations of HSBC’s data processes and compliance technology systems, including the

20

Monitor’s observations about the limitations of a particular kind of case management software,” which would cause harm if released. Littleton Decl. ¶ 33(b). Although the Court agrees that the redacted Report contains this information, the Court notes that the name of this software is redacted. The Court struggles to see how potential criminals could seize upon the Monitor’s observations about the limitations of an unnamed software to infiltrate financial institutions, especially considering that the criminals would not know which financial institutions, if any, currently use this software.

In the Court’s view, however, Judge Gleeson’s redactions do not fully remove all information in the Report implicating this security risk. The Court identified scattered passages in the Report containing unredacted descriptions of compliance practices and limitations that, whether particularized or not, could conceivably tip off criminals to potentially common compliance vulnerabilities in the financial industry. In this regard, the Court appreciates DOJ’s point that “bits and pieces” of facts that are “not of obvious importance” in themselves—or immediately helpful to financial criminals—might “aid in piecing together bits of other information” that could expose banks’ security vulnerabilities to individuals with “a broad view of the scene.” See Def.’s MSJ at 25 (quoting Ctr. for Nat’l Sec. Studs. v. Dep’t of Just., 331 F.3d 918, 928–29 (D.C. Cir. 2003)).

Nevertheless, the Court believes that additional, targeted redactions would eliminate DOJ’s concern that bad actors could exploit information in the Monitor Report for malicious ends. Moreover, Plaintiffs are correct that the redacted Report contains “mundane” parts that do not implicate this concern, including “‘long sections’ summariz[ing] . . . ‘the processes that the Monitor took to reach [his] findings.’” See Pls.’ Reply at 7, ECF No. 60 (quoting HSBC II, 2016 WL 347670, at *6 n.11). Accordingly, while DOJ’s concern that public release of the Monitor

21

Report could assist potential criminals is reasonable, this concern cannot justify withholding the entire redacted Report.

b. Other Security Concerns DOJ claims that security concerns implicated by disclosure of the Monitor Report are “not limited to potential nefarious exploitation by criminals.” Def.’s MSJ at 26. As the Federal Reserve avers, disclosure of “key and detailed vulnerabilities in HSBC’s systems” in the redacted Report would allow HBSC’s competitors “to take advantage of real or perceived weaknesses in HSBC’s operations,” thus harming HSBC’s competitive strength. Naylor Decl. ¶ 25. HSBC echoes this concern. See Littleton Decl. ¶ 7 (“The redacted versions of the Report and the U.S. Country Report likewise contain substantial amounts of . . . information about HSBC’s operations, strategies, business decisions, non-public evaluations of HSBC’s market standing or performance, and internal HSBC technologies and proprietary methods.”). And MLARS expresses a further concern that “an unfiltered recitation of [HSBC’s] affairs, albeit historic, increases the risk to [HSBC’s] current security by undermining public confidence in the [financial institution] or the financial system.” Grady Decl. ¶ 13.

As the D.C. Circuit has explained, the release of a monitor report “containing frank evaluations” of a bank could threaten the bank’s security because it “might undermine public confidence and cause unwarranted runs” on the bank. Consumers Union, 589 F.2d at 534. As for the preservation of a bank’s competitive strength, the D.C. Circuit has not explicitly recognized this interest as falling within Exemption 8’s umbrella of protection, although it has observed that this exemption was generally drawn “to protect not simply each individual bank but the integrity of financial institutions as an industry.” Gregory v. Fed. Deposit Ins. Corp., 631 F.2d 896, 898 (D.C. Cir. 1980). Judge Gleeson permitted HSBC to redact proprietary business

22

information that, if released, could advantage commercial competitors. See Order at 2 & n.2, United States v. HSBC Bank USA, N.A., No. 12-CR-763 (E.D.N.Y. Mar. 9, 2016), ECF No. 70. Plaintiffs suggest these redactions are covered by Exemption 4, which protects privileged or confidential “trade secrets and commercial or financial information.” 5 U.S.C. § 552(b)(4); see also Pls.’ Cross-MSJ at 29 n.12. Although Plaintiffs argue that DOJ has forfeited Exemption 4, they nevertheless agree to “accept these redactions.” Pls.’ Cross-MSJ at 29 n.12.

Assuming the propriety of redactions related to DOJ’s additional security concerns, the Court reiterates its prior holding that Judge Gleeson’s redactions are narrower than those required to eliminate these concerns. See 2d Mem. Op. at 22. Specifically, the Monitor Report is replete with unredacted descriptions of deficiencies in HSBC’s operations that would likely harm the bank’s public image, even if such descriptions do not in themselves constitute proprietary business information. See id. Nevertheless, the Court is unpersuaded that such concerns justify withholding the entire redacted Report, or even large swaths of it. To the extent DOJ argues that disclosure of HSBC’s compliance deficiencies from 2015 would presently “undermin[e] public confidence” in the bank, see Grady Decl. ¶ 13, DOJ does not explain why this risk remains a decade later, and after the government ultimately moved to dismiss the criminal information against HSBC based on the bank’s compliance with the DPA. See Mot. Dismiss, United States v. HSBC Bank USA, N.A., No. 12-CR-763 (E.D.N.Y. Dec. 12, 2017), ECF No. 96. Furthermore, the Court finds that additional redactions could remove any proprietary business information that Judge Gleeson may have overlooked. In any event, these concerns also do not justify withholding “mundane” parts of the Report unrelated to the substance of HSBC’s compliance deficiencies. See Pls.’ Reply at 7.

23

2. Safeguarding the Relationship Between Banks and Supervising Agencies a. Candor and Cooperation DOJ argues that even partial disclosure of the redacted Monitor Report would impair regulators’ supervision of financial institutions by impeding cooperation and the free flow of communications between banks and regulators, particularly in cases where monitorships are imposed. See Def.’s MSJ at 22–25. As the Federal Reserve attests, a “full, complete, and unvarnished flow of information from the financial institution and unfettered access to employees and systems is critical to enable the Board effectively to perform its bank examination and supervision functions through the use of independent consultants.” Naylor Decl. ¶ 22. The U.K. Regulator concurs. See Aladhal Decl. ¶ 28. But if banks “believed that information given to an [independent monitor] for purposes of gauging compliance . . . would be made public, they would be far less cooperative and forthcoming in providing full and unfettered access to their files, systems, and knowledgeable staff, especially information which could negatively impact the financial institution’s operations and reputation.” Naylor Decl. ¶ 22; see also Aladhal Decl. ¶ 28; Littleton Decl. ¶ 24; Grady Decl. ¶ 22. Bank officers and employees would also be “less forthcoming in providing full, complete, and accurate information . . . if they believed that the information they provide and the resultant” bank examination reports could be disclosed. Naylor Decl. ¶ 23; see also Littleton Decl. ¶ 29. And this concern would not be alleviated by redacting identifying information from such reports. Because bank employees provide information to bank examiners “with the expectation that it will be kept confidential,” the Federal Reserve declares that “even employees whose identifying information is not disclosed would be reluctant to share sensitive information regarding the bank and its operations if they believed [it] would be publicly disclosed, causing harm to the financial institution.” Naylor Decl. ¶ 26.

24

Although Plaintiffs concede that the interests in candor and cooperation are protected by Exemption 8, they find it implausible that disclosure of the redacted Monitor Report would foreseeably harm these interests. See Pls.’ Cross-MSJ at 20. Plaintiffs note that in this case, HSBC agreed in the Monitor Agreement to “cooperate fully” with the Monitor, including by providing him “access to all information, documents, records, facilities and/or employees, as reasonably requested by the Monitor.” See Monitor Agreement ¶ 2; Pls.’ Cross-MSJ at 20. Likewise, Plaintiffs argue that it is speculative at best that bank officials and employees would be reluctant to share sensitive information that might later become public, especially if these individuals were assured anonymity. See Pls.’ Cross-MSJ at 21–22.

Plaintiffs’ contentions are not without substance. In Consumers Union, the D.C. Circuit explained that Exemption 8’s “secondary purpose”—safeguarding the relationship between banks and their regulators—derives from Congress’s concern that “banks would cooperate less than fully with federal authorities” if details of “bank examinations were made freely available to the public and to banking competitors.” 589 F.2d at 534. Nevertheless, Chief Judge J. Skelly Wright questioned this proposition in a concurring opinion. Given the “considerable arsenal of weapons” that the Comptroller of the Currency—a financial regulator and party in that case— had at his disposal to compel banks to cooperate with bank examiners, Chief Judge Wright expressed doubt “that confidentiality is necessary to maintain the smooth functioning of the examination process and the cooperation of bank officials.” Id. at 541 (Wright, C.J., concurring). The Court believes that similar considerations are at play here. HSBC assented to a monitorship as a condition to avoiding prosecution for crimes to which it confessed, and, as Plaintiffs note, it agreed—on pain of prosecution—to “cooperate fully” with the Monitor. See DPA ¶¶ 2, 5, 9–13; Monitor Agreement ¶ 2. Assuming similar circumstances in future cases, the

25

Court is doubtful that the prospect of even partial release of a bank examination report would make financial institutions “far less” cooperative in granting monitors access to their files, systems, and staff. See, e.g., Naylor Decl. ¶ 22.

Nevertheless, the Court is not entirely discounting Exemption 8’s secondary purpose here. As DOJ observes, the D.C. Circuit has recognized the importance of frank and open communications between banks and financial regulators to the “success of [regulators’] supervision.” See Def.’s MSJ at 22–23 (quoting In re Subpoena Served upon Comptroller of Currency, & Sec’y of Bd. of Governors of Fed. Rsrv. Sys., 967 F.2d 630, 633 (D.C. Cir. 1992)). In In re Subpoena Served Upon Comptroller of Currency—a non-FOIA case concerning the evidentiary privilege traditionally afforded to bank examination reports—the D.C. Circuit emphasized that “[b]ank management must be open and forthcoming in response to the inquiries of bank examiners,” which “simply could not [occur] as well if communications between the bank and its regulators were not privileged.” 967 F.2d at 634. The Court concurs that a promise of confidentiality should cause a bank official to be less “circumspect in releasing confidential information,” particularly with respect to sensitive topics. Grady Decl. ¶ 13; see also Williams & Connolly LLP v. Off. of the Comptroller of the Currency, 39 F. Supp. 3d 82, 93 (D.D.C. 2014) (“[T]he Court is persuaded . . . that withholding the requested documents furthers one of [Exemption 8’s] underlying purposes—it encourages banks to be candid and transparent with the Comptroller.”).

As discussed, the Federal Reserve, U.K. Regulator, MLARS, and HSBC attest that bank employees would be less forthcoming with monitors if they believed that information shared with them could later become public, regardless of whether identifying information is redacted. Contrary to Plaintiffs’ contentions, this concern is neither speculative nor implausible. As

26

MLRAS explains, bank officials “will not know at the time whether the information they provide will be protected from disclosure from a court in the future,” and may additionally be concerned that their identities could be discerned based solely on the information that they provided. Grady Decl. ¶ 22. Furthermore, if an employee knows that certain information “could negatively impact the financial institution’s operations and reputation,” Naylor Decl. ¶ 22, it is conceivable that the employee—whether out of loyalty to the bank or fear of suffering negative repercussions—would hesitate to share it. The point here is not that release of the Monitor Report would cause bank employees to refuse to cooperate altogether in future monitorships. It is that confidentiality concerns would cause them to become “more cautious and guarded” in their responses, Aladhal Decl. ¶ 28, which would compromise “the quality, accuracy, completeness, and free flow” of information provided to monitors, Naylor Decl. ¶ 22.

Because DOJ’s concern about candor appears “logical” and “plausible,” it justifies withholding at least some portions of the Monitor Report. Larson, 565 F.3d at 862 (citation omitted). The question remains, however, whether Judge Gleeson’s redactions—which removed “identifying information about HSBC employees” from the Report but left in the “non- identifying information” provided by the employees—are sufficient to eliminate this concern. See HSBC II, 2016 WL 347670, at *5. On a general level, the Court finds that release of much of the “non-identifying information” provided to the Monitor would implicate DOJ’s concern about candor. Judge Gleeson declined to redact such information “given the high number of individuals interviewed for the Report,” which “helps ensure their anonymity.” Id. at *5 n.9. Nevertheless, the Court agrees with HSBC that certain unredacted portions of the Report contain “references to specific individuals’ roles and functions, as well as quotes from specific individuals’ interviews and emails,” which could enable identification of these individuals.

27

Littleton Decl. ¶ 43. Furthermore, Judge Gleeson’s singular focus on anonymity ignores that bank officials might additionally be concerned about sharing information “negatively impact[ing] the financial institution’s operations and reputation” that could later become public. Naylor Decl. ¶ 22. Needless to say, such information comprises large portions of the Monitor Report. As noted, even unredacted sections of the Report reveal—in general or specific terms— deficiencies in HBSC’s systems and operations, including its AML and sanctions policies and procedures; its compliance technology systems, training programs, and monitoring capabilities; and its remediation efforts.

Given the Monitor’s dependence on information provided by HSBC to conduct his work, see Cherkasky Aff. ¶ 3, the Court finds that DOJ’s concern about candor justifies withholding, at a broad level, the Monitor’s unredacted findings and assessment regarding deficiencies in HSBC’s systems and operations, to the extent these reflect information shared by HSBC employees. The Court is convinced that preserving the confidentiality of this information is necessary to encourage a high “level of cooperation and candor” from bank officials in future monitorships and is therefore “in the interest of an effective monitorship.” Id. ¶ 11. However, as with DOJ’s prior arguments, this concern does not justify withholding “mundane” portions of the Monitor Report unrelated to the substance of the Monitor’s findings. See Pls.’ Reply at 7.

b. Cooperation with Foreign Regulators DOJ next argues that disclosure of any part of the Monitor Report would discourage foreign regulators from cooperating with monitors in the future. See Def.’s MSJ at 19–22. “[W]hen the DOJ imposes a monitor on a global [financial institution],” MLARS explains, “the monitor must also review operations in other countries, and must obtain approval from foreign regulators to do so.” Grady Decl. ¶ 23. Furthermore, “[f]oreign regulators expect confidential

28

supervisory information from their regulation of [financial institutions] to be kept confidential . . . and rely on that expectation of confidentiality in granting [financial institutions] permission to share that information with monitors.” Id. ¶ 12. In the context of the Monitor Report, DOJ maintains that “all interested parties,” including foreign regulators, “received express assurances that the Monitor Report would remain confidential.” Def.’s Combined Opp’n to Pls.’ Cross-MSJ and Reply (“Def.’s Reply”) at 8, ECF No. 58; see also Grady Decl. ¶ 27. “[I]f any disclosure [of the Monitor Report] were permitted,” MLRAS attests that it “reasonably expect[s] that certain foreign regulators would refuse to permit monitors to obtain supervisory or regulatory information about the [financial institution’s] operations in those foreign nations, would refuse to permit monitors to interview witnesses located in their jurisdictions, and would limit the monitor’s investigation in other ways.” Id.; see also Aladhal Decl. ¶ 30.

The Court finds that DOJ has articulated a reasonable fear that disclosure of the redacted Monitor Report would harm future monitors’ relationships with foreign regulators. As the Court explained in its first summary judgment opinion, confidentiality is “‘the crux of a successful monitorship,’ because without it, ‘domestic and foreign financial institution regulators, financial institution employees, and others upon whom the monitors rely may be unwilling to cooperate with the monitor.’” 1st Mem. Op. at 21 (quoting Moeser Decl. ¶¶ 9–10). Confidentiality therefore “safeguard[s] the relationship between the banks and their supervising agencies.” Consumers Union, 589 F.2d at 534. The Monitor’s experience in this case supports this notion. As the Monitor explained in his affidavit to Judge Gleeson, “the presumption of confidentiality [was] a critical component in obtaining foreign regulators’ agreement to access confidential client information and to rely on it in preparing [his] reports.” Cherkasky Aff. ¶ 9. The Monitor therefore anticipated, as DOJ does now with respect to future monitorships, that “the level of

29

support that [he] would receive from foreign banking regulators could decrease substantially” if the Report were released. Id. ¶ 10.

Plaintiffs agree that the interest in promoting cooperation between monitors and foreign regulators justifies withholding parts of the Monitor Report relating to foreign jurisdictions. See Pls.’ Cross-MSJ at 23–24. However, they deem “far too speculative” DOJ’s argument that foreseeable harm to this interest would result even from disclosure of parts of the Report lacking foreign country information. See Pls.’ Reply at 12–13. Plaintiffs observe that the DOJ did not promise “strict confidentiality” to HSBC with respect to the Monitor Report, given that DOJ retained “sole discretion” under the Monitor Agreement to publish the Monitor Report. Monitor Agreement ¶ 9. Plaintiffs further maintain that DOJ has not otherwise shown that foreign regulators were promised “strict confidentiality.” Pls.’ Reply at 12–13. Thus, Plaintiffs argue, disclosing a redacted Report would not break promises to foreign regulators or reduce their willingness to cooperate with monitors. See id.

Plaintiffs’ arguments about the Monitor Agreement’s confidentiality provisions miss the mark. Plaintiffs note that these provisions stated that the Monitor’s “reports and the contents thereof [would] remain non-public . . . except to the extent that the Department determines in its sole discretion that disclosure would be in furtherance of the Department’s discharge of its duties and responsibilities or is otherwise required by law.” Monitor Agreement ¶ 9 (emphasis added). However, DOJ has determined “in its sole discretion” that disclosure of the Monitor Report would not be in furtherance of its duties and responsibilities. See Def.’s Reply at 9. Moreover, it is up to this Court, not DOJ, to determine whether FOIA requires disclosure here. In any event, as DOJ notes, neither the Federal Reserve nor any foreign regulator was a party to the Monitor

30

Agreement. Id. at 8. Therefore, the Monitor Agreement does not prove that foreign regulators agreed that DOJ could release the Monitor Report if required to do so under FOIA.

In contrast, DOJ’s evidence does reasonably show that foreign regulators received assurances of confidentiality, see, e.g., Aladhal Decl. ¶ 25, and, more importantly, that foreign regulators expected that no portion of the Monitor Report would be released. Notably, MLARS attests that the “settled expectations” of foreign regulators were that the Monitor Report “would be kept confidential.” Grady Decl. ¶ 27. The U.K. Regulator confirms that it “understood that not only the information that it shared but also the ensuing Report in its entirety would remain confidential.” Aladhal Decl. ¶ 25. In light of these attestations, the Court agrees with DOJ that the release of the Monitor Report in any form, even with foreign country information redacted, would undermine foreign regulators’ expectations of confidentiality. See Grady Decl. ¶ 27; see also SafeCard Servs., Inc. v. S.E.C., 926 F.2d 1197, 1200 (D.C. Cir. 1991) (“Agency affidavits are accorded a presumption of good faith.”).

The Court further finds that DOJ has plausibly shown that foreign regulators could restrict future monitors’ work in response to the release of any portion of the Monitor Report. MLRAS attests that any disclosure of the Report would signal to foreign regulators “that monitor reports may be disclosed in whole or in part,” and foreign regulators “w[ould] have no certainty or control over what information a court may or may not protect from disclosure in the future.” Grady Decl. ¶ 23. “In the absence of such certainty or control over what material may be disclosed,” MLRAS warns, “foreign regulators will likely decline to permit [financial institutions] to disclose information and otherwise cooperate with monitors in the future.” Id.

Further evidence supports MLARS’s belief that disclosure of any part of the Report would inhibit future cooperation with foreign regulators. In this latest round of summary

31

judgment, DOJ has finally procured admissible evidence from a foreign regulator—a declaration from the U.K. Regulator made under penalty of perjury under the laws of the United States—that is probative on this point.4 The U.K. Regulator attests that U.K. law imposes a duty of confidentiality on both itself and on “skilled persons,” such as monitors, which “enables firms to provide sensitive information” to the U.K. Regulator and skilled persons regarding firms’ compliance with regulatory obligations. Aladhal Decl. ¶ 23. Although U.K. law allows the U.K. Regulator to share such information with other regulators, this generally occurs “subject to an agreement that the other person will keep the information confidential.” Id. ¶ 24. The U.K. Regulator believes that public disclosure of the Monitor Report “would constitute a criminal offence under UK law,” and, accordingly, attests that if it “perceive[s] there is a risk that an outside party may seek to gain access to [confidential] information through foreign courts,” it “itself may, give greater consideration to, or indeed refuse to, provide reports or confidential information to overseas regulators (including those in the US).” Id. ¶ 30.

These declarations satisfy DOJ’s burden to “articulate both the nature of the harm from release and the link between the specified harm and specific information contained in the material withheld.” Reps. Comm., 3 F.4th at 369 (citation modified). As DOJ asserts, disclosure of the Report in any form will undermine foreign regulators’ expectations that the United States will keep future monitor reports entirely confidential, which could prompt them to refuse to provide confidential information to U.S. regulators and monitors in the future. Without access to this information, “monitors will be less likely to detect criminal activity at the [financial

4 DOJ cited other foreign regulators’ unsworn letters as additional evidence of concerns expressed by foreign regulators. See Def.’s MSJ at 20–21. The Court previously declined to consider such letters on hearsay grounds. See 1st Mem. Op. at 14–15. The Court declines to revisit this issue given that DOJ was able to procure a sworn letter from the U.K. Regulator.

32

institution] and less able to assess whether the [financial institution] is complying with” regulatory and legal obligations. Grady Decl. ¶ 12. And because this harm could materialize once any part of the Report is released, it is connected to the contents of the entire Report, even its “mundane” sections.

Furthermore, DOJ’s asserted harm with respect to foreign regulators is reasonably foreseeable. The Court is mindful that DOJ is not entitled to withhold the Monitor Report “merely because public officials might be embarrassed by disclosure, because errors and failures might be revealed, or because of speculative or abstract fears.” Jud. Watch, Inc., 2019 WL 4644029, at *3 (citation omitted). Having now reviewed the Report itself, however, the Court is comfortable that there is not a hint that DOJ is seeking to withhold the Report to avoid exposing embarrassing regulatory failures. Moreover, the U.K. Regulator’s attestations confirm that DOJ’s concerns are neither speculative nor abstract. Like DOJ, the U.K. Regulator believes that disclosure of any portion of the Report would undermine cooperation with international regulators. Aladhal Decl. ¶ 33. Indeed, the U.K. Regulator attests that it may itself refuse to provide confidential information to foreign regulators in the future if it foresees that third parties could “seek to gain access” to that information through the courts. Id. ¶ 30. Based on the U.K. Regulator’s experience, its concerns—and those of other foreign regulators—“extend beyond their respective nations’ boundaries,” id. ¶ 32, and are thus not simply limited to information related to foreign jurisdictions, as Plaintiffs contend, see Pls.’ Cross-MSJ at 31.

On the whole, the Court finds that DOJ has “specifically and thoughtfully” explained why foreign regulators would impede the work of future monitors in response to the release of any part of the Monitor Report. Leopold, 94 F.4th at 38 (quoting Reps. Comm., 3 F.4th at 372). Accordingly, DOJ’s interest in maintaining future cooperation between foreign regulators and

33

domestic regulators, monitors, and financial institutions justifies withholding the redacted Monitor Report in full.

C. Plaintiffs’ Evidence Does Not Justify Disclosure In its opinion on appeal, the D.C. Circuit held that in view of Judge Gleeson’s conclusion that a redacted Monitor Report could be released and the Monitor’s statement in his affidavit to Judge Gleeson that “a redacted report that does not negatively impact [his] work c[ould] be produced,” see Cherkasky Aff. ¶ 13, “a reasonable factfinder could conclude . . . that the Report can be partially disclosed without harming Exemption 8 interests.” Leopold, 94 F.4th at 39. Plaintiffs further argue in their present briefing that the fact that DOJ filed quarterly reports about the Monitor Report on Judge Gleeson’s public docket “shows that it is possible to produce . . . parts of the Monitor Report itself, without causing any of the harms DOJ posits.” Pls.’ Reply at 18. In the Court’s last summary judgment opinion, it decided to resolve the factual disputes raised by Plaintiffs’ evidence by reviewing the Monitor Report in camera. See 3d Mem. Op. at 13. Having now completed its review, the Court finds Plaintiffs’ evidence insufficient to refute DOJ’s claims of foreseeable harm or justify disclosure of the Report.

As the Court has now concluded, DOJ’s interest in promoting cooperation with foreign regulators justifies withholding the Report in full, and several of DOJ’s other claimed interests independently justify withholding certain parts of the Report. Neither Judge Gleeson’s opinion, nor the Monitor’s Affidavit, nor DOJ’s quarterly reports change the Court’s conclusions. First, although Judge Gleeson redacted “country names and explicit references to confidential material” in the Report, see HSBC II, 2016 WL 347670, at *6, DOJ has shown that cooperation with foreign regulators would foreseeably be harmed by the release of any part of the Report, not just sections containing foreign country information.

34

Second, although the Monitor opined in his affidavit that a redacted Report could be produced without negatively impacting his work, see Cherkasky Aff. ¶ 13, this opinion is insufficient to rebut DOJ’s new evidence that no part of the Report can be released without foreseeably chilling future cooperation between foreign regulators, monitors, and financial institutions. The D.C. Circuit found this proposition insufficiently supported on the record before it. Leopold, 94 F.4th at 38–39. However, DOJ has now obtained a sworn declaration from the U.K. Regulator stating that its concerns about disclosure of the Report “extend beyond” the United Kingdom and that release of the Report in any form could lead it to “indeed, refuse to provide reports or confidential information to overseas regulators” in the future. See Aladhal Decl. ¶¶ 30, 32. Although the Monitor reasoned that foreign regulators would be concerned about the disclosure of confidential materials in an unredacted Report, see Cherkasky Aff. ¶ 9, his Affidavit does not suggest that he considered that these concerns could extend to the “disclosure of the Report in full or in part,” see Aladhal Decl. ¶ 32. As the Court has found, the latter consideration can justify withholding the entire Monitor Report.

Third, the Court disagrees with Plaintiffs that DOJ’s decision to file quarterly reports about the Monitor Report on Judge Gleeson’s public docket indicates that a redacted Monitor Report could be disclosed without harm. Having reviewed the Report, the Court concurs with DOJ that the Monitor Report is “different in kind” from the quarterly reports. See Def.’s Reply at 11. The quarterly reports describe several of the Monitor’s findings and recommendations on a general level, while the Monitor Report unsurprisingly provides additional context, citations, and analysis at a high level of detail. Still, the Monitor Report includes an executive summary that, like the quarterly reports, describes certain findings on a general level. However, the Court agrees with DOJ that the publication of the quarterly reports does not implicate the same

35

confidentiality concerns that would arise from disclosure of any part of the Monitor Report. See id. The key point is that the quarterly reports do not disclose the actual text of the Monitor Report, so their disclosure would not undermine foreign regulators’ expectations that no part of the Monitor Report be released.

* * *

Because DOJ has shown that cooperation and support from foreign regulators would foreseeably decline if any part of the redacted Monitor Report is released, DOJ is entitled to withhold the Report in full. The Court does not reach this decision lightly. Indeed, the Court recognizes the strong interest of the public in scrutinizing the government’s efforts to bring global financial institutions into compliance with applicable laws and regulations. Nevertheless, the Court is persuaded that confidentiality can serve valuable purposes in the context of monitorships and deferred prosecutions, and that the effectiveness of future monitorships would foreseeably be impaired by the release of the Monitor Report. As the Monitor observed in this case, without full cooperation from foreign regulators and HSBC employees, he would have had less information with which to assess HSBC’s operations and formulate recommendations on improving the bank’s AML and sanctions compliance program—and this “would not [have been] to the benefit of the public or the Bank.” Cherkasky Aff. ¶ 11.

V. CONCLUSION

For the foregoing reasons, Defendant’s Motion for Summary Judgment (ECF No. 54) is GRANTED and Plaintiffs’ Cross-Motion for Summary Judgment (ECF No. 56) is DENIED. The First Annual Follow-Up Review Report and appendices can be withheld in their entireties. An order consistent with this Memorandum Opinion is separately and contemporaneously issued.

Dated: January 15, 2026 RUDOLPH CONTRERAS United States District Judge