**Assumption for the plan:** Treat the hotline attachments as authentic for preservation purposes and treat the 30-day voluntary-disclosure clock as potentially running from **Monday, August 2**. Even if the ultimate recipient is not yet known, the invoice, chat, and reimbursement spreadsheet together are enough to trigger immediate investigation and a protective disclosure analysis. --- ## 1. Immediate preservation and suspension of deletion These steps must occur **before** any interview with Cole, East Reach, or the CFO’s proposed “let Cole explain” meeting. - Retain outside counsel immediately and have outside counsel direct the investigation. - Issue an immediate verbal and written legal hold to: - Cole Marr, - the chief compliance officer, - CFO, - finance/accounts payable staff, - IT/system administrators, - messaging application administrators, - customs/logistics/import staff, - any East Reach relationship manager. - Suspend all auto-deletion: - Disable the messaging application’s 7-day deletion rule, or export/preserve all relevant chats immediately before deletion occurs. - Disable or copy finance-system audit logs before the 21-day rollover. - Cancel this weekend’s quarterly server purge. If purge has started, stop it and preserve affected servers/backups. - Preserve, do not modify, the original hotline report and attachments with full metadata and chain of custody. - Preserve company-issued devices **and** personal devices used for work, including Cole’s and the compliance officer’s personal phones. Do not wait until “the complaint is real.” The legal standard is credible evidence, not certainty. - Preserve all East Reach-related files in Solstice’s control: contracts, vendor onboarding, invoices, purchase orders, payment approvals, due diligence files, and communications. - If Solstice has contractual audit rights over East Reach’s books, exercise them immediately; if not, outside counsel should consider a preservation demand or legal process. Do not let Cole or the CFO contact East Reach first. --- ## 2. Payments and relationships to pause - Immediately pause any outstanding or future payments to East Reach under: - the $240,000 invoice, - any invoice described as “border facilitation,” - any invoice described as “technical consulting” in connection with customs, - any reimbursement for Cole’s expenses involving East Reach. - Do **not** necessarily terminate East Reach’s legitimate $160,000/year customs brokerage work without legal and operational review. But require: - no further East Reach payments without written approval from outside counsel or the independent committee, - enhanced documentation of all future services, - a segregation between legitimate brokerage work and the suspicious consulting category. - Suspend Cole’s authority to approve or direct payments to East Reach or customs-related vendors while the investigation proceeds. - If Cole has access to payment systems, messaging apps, or relevant files, temporarily restrict access to prevent spoliation and further payments. Do this neutrally and not as public discipline. --- ## 3. Board and counsel structure - The board should appoint an **independent special committee** of directors who have no close relationship with Cole, no involvement in the alleged transactions, and no other conflict. - The two directors who are close business allies of Cole must be **recused** from: - receiving investigation reports, - making disclosure decisions, - making employment decisions about Cole, - approving any East Reach relationship decisions. - The special committee should retain **independent outside counsel** and, if necessary, a separate forensic accounting firm. - Outside counsel should report to the special committee, not to the CFO, GC, or CCO. - The CFO’s proposal to assign internal audit and “let Cole explain” should be rejected and documented. Internal audit may provide technical support, but it should not direct the investigation or be the decision-maker. - If the GC, CFO, or CCO becomes a fact witness or target, separate counsel may be needed for them. --- ## 4. Privilege limits and employee interview warnings Outside counsel should direct witness interviews for legal advice, but privilege has limits: - **Privileged:** confidential communications made to counsel for the purpose of legal advice. - **Not privileged:** the underlying facts, the hotline report, invoices, chat messages, spreadsheets, emails, audit logs, and remediation actions. - Do not mark ordinary business records as privileged merely because counsel reviewed them. - If Solstice seeks voluntary-disclosure credit, it must disclose relevant facts and cannot use privilege to hide who, what, when, or how much. At the start of every interview, counsel must say: > “I represent Solstice Transit Group, not you personally. The company controls the attorney-client privilege and may decide to disclose what you tell me. You may need your own lawyer. The company prohibits retaliation against witnesses, and you must not retaliate against anyone involved in this matter. I cannot promise you personal confidentiality that the company cannot honor. You must preserve and not delete any relevant documents or communications.” Counsel should not promise an interviewee that their statements will never be shared with regulators. If an employee wants their own counsel, allow them to consult counsel before proceeding. --- ## 5. First custodians, devices, and records to collect Initial custodians: 1. **Cole Marr** — company email, calendar, company phone, personal phone used for work, messaging apps, reimbursement records, expense reports, and his communications with East Reach. 2. **Chief compliance officer** — hotline report, communications about the report, company phone, personal phone used for work, and compliance files. 3. **CFO** — emails and calendar concerning payments, East Reach, and the decision to delay preservation. 4. **Finance/accounts payable staff** — payment approvals, wire instructions, invoices, reimbursement spreadsheets, audit logs. 5. **IT and messaging system administrators** — messaging app deletion settings, finance log rollover settings, server purge schedule, backups. 6. **Customs/logistics staff** — customs entry records, brokerage files, communications with East Reach. Devices: - Company laptops, desktops, phones, tablets. - Personal phones used for work, especially Cole’s and the compliance officer’s. - Cloud accounts, messaging applications, and personal email only to the extent work-related. Records: - Hotline report and attachments. - Messaging/chat logs. - Finance-system audit logs. - East Reach contract, invoices, purchase orders, due diligence, and broker files. - Bank records and wire/beneficiary information if accessible. - Customs entry records for rail-control equipment. - Server backups and any restored deleted data. Collect these forensically with chain-of-custody procedures, not by allowing employees to “search” their own files. --- ## 6. Nonretaliation and witness-contact controls - Issue a no-retaliation directive to all employees and managers: - no adverse action against the hotline reporter or any witness, - no threats, demotion, discipline, or termination for cooperating, - no “investigating the reporter.” - Cole must not contact East Reach, East Reach’s owner, finance staff, or other witnesses about this report. - No manager, including the CFO, should ask Cole to “explain” before documents and devices have been preserved and collected. - All witness communications should be handled by outside counsel. Employees should be instructed to direct questions about the investigation to outside counsel, not to Cole, CFO, or the board allies. - If any employee complains of retaliation, that complaint should go directly to outside counsel or the special committee. --- ## 7. Do the existing attachments start the 30-day clock? **Likely yes, assuming the attachments are authentic.** - This is not a bare anonymous accusation. - The hotline includes an invoice for “border facilitation and technical consulting.” - The chat from Cole says: “Use the consultant who makes the border problem disappear. Do not put government names in our file.” - The spreadsheet corroborates that Solstice reimbursed the $240,000 in four installments. That combination is sufficient to support a **reasonable belief** that a covered payment may have occurred. The fact that Solstice has not yet identified the ultimate recipient, the consultant, or the government official is a **material uncertainty**, not necessarily a reason to say the clock has not started. **Prudent decision:** treat August 2 as Day 0. The 30th day would be around September 1. Solstice should not wait until then. It should set an internal deadline of **August 23** for a protective filing, and an earlier decision date. --- ## 8. Missing facts needed for the disclosure decision Before Solstice can make a complete, final disclosure, it needs: 1. Identity of the bank recipient/beneficiary of the $240,000. 2. Whether any portion of the $240,000 reached a government official or customs official. 3. Identity of the “consultant.” 4. Whether the consultant performed any legitimate service. 5. Country and specific customs office involved. 6. Customs entry records for the rail-control equipment. 7. East Reach’s subledger showing what it did with the money. 8. The four payment dates and approval chain. 9. Whether payments are ongoing or completed. 10. Whether Cole, CFO, finance staff, or any director knew about or approved the suspicious payment. 11. Any legitimate brokerage services actually provided by East Reach during the relevant period. These facts are needed for a complete factual disclosure, but they are **not** all needed before deciding to file a protective disclosure. --- ## 9. Seven-day investigative plan and decision date **Day 1 — Monday, August 2** - Retain outside counsel and forensic vendor. - Issue legal hold and suspend deletions. - Halt server purge. - Pause East Reach payments. - Preserve hotline report and attachments. - Identify initial custodians. **Day 2 — Tuesday, August 3** - Form independent special committee; recuse conflicted directors. - Forensically image Cole’s and the compliance officer’s devices. - Export messaging app data before deletion. - Copy finance audit logs before rollover. - Preserve East Reach vendor file and payment records. **Day 3 — Wednesday, August 4** - Begin key-word searches: - “border facilitation,” - “consultant,” - “government names,” - “East Reach,” - “customs,” - “make the problem disappear.” - Trace the $240,000 in four installments through Solstice’s books. - Identify bank/beneficiary information if available. **Day 4 — Thursday, August 5** - Interview, with Upjohn warnings: - compliance officer, - IT administrator, - finance/AP staff, - CFO if needed. - Collect customs-entry records for rail-control equipment. - Identify countries, customs offices, and brokers involved. **Day 5 — Friday, August 6** - Interview customs/logistics staff. - Analyze Cole’s communications and devices. - Determine whether any other Solstice employees knew about the “border facilitator.” - If possible, obtain East Reach’s subledger or bank records. **Day 6–7 — Saturday/Sunday, August 8–9** - Prepare a factual chronology. - Separate privileged legal advice from factual findings. - Special committee meets by **August 9** to decide: - whether credible evidence of a covered payment exists, - whether to seek voluntary-disclosure credit, - whether to file a protective disclosure immediately. **Decision date:** **By August 9**, the committee should make the initial go/no-go credit decision. The outside deadline for a protective filing, if credit is sought, should be **August 23**, leaving a buffer before the around-September 1 deadline. Solstice must not wait until Day 30. --- ## 10. How to disclose material uncertainty without waiving privileged advice If the investigation confirms—or cannot rule out—a covered payment, Solstice should file a **protective disclosure** even if all facts are not known. The disclosure should: - State that Solstice is voluntarily cooperating. - Describe known facts: - hotline report, - East Reach invoice, - Cole’s chat instruction, - spreadsheet showing four reimbursements, - amounts and approximate dates, - participants known so far. - State material uncertainties: - the ultimate recipient is not yet identified, - Solstice cannot yet confirm whether any government official received money, - the identity of the consultant is unknown, - the specific country/customs office is not yet confirmed. - Commit to continuing cooperation and supplementing the disclosure. - Avoid speculation presented as fact. Example language: > “Solstice has not yet been able to determine the ultimate recipient of the $240,000 paid to East Reach. Based on the records reviewed to date, Solstice cannot rule out that all or part of the payment was intended for customs officials. Solstice is continuing to trace the funds and will supplement this disclosure as additional facts are learned.” Do **not** include: - outside counsel’s legal advice, - counsel’s mental impressions, - privileged strategy discussions, - statements like “counsel believes that...” The company can state that it is preserving privileges, but it must still provide the underlying facts. Privilege cannot be used to conceal who, what, when, or how much. --- **Bottom line:** Preserve immediately, pause suspicious payments, use an independent committee and outside counsel, interview with proper warnings, assume the 30-day clock has started, investigate for seven days, and make a protective disclosure by August 23 at the latest—so that Solstice does not lose the voluntary-disclosure credit by waiting until the last minute or until the regulator calls.