Contract analysis

I. Purpose and Overview This memorandum provides a detailed article-by-article annotated breakdown of OCC Consent Order No. OCC-2025-003, issued on January 15, 2025 (the "Effective Date"), against Belmont Ridge Bank National Association ("BRB" or the "Bank"). The Consent Order was issued by the Office of the Comptroller of the Currency ("OCC"), Northeastern District Office, located at 340 Madison Avenue, New York, NY

1. Inadequate OFAC sanctions screening, including screening coverage gaps affecting approximately 12% of transactions processed through BRB's largest Banking-as-a-Service ("BaaS") partner;

2. Deficient Suspicious Activity Report ("SAR") filing practices, including a substantial backlog of unreviewed alerts and excessive filing timelines;

3. Insufficient Customer Due Diligence ("CDD") and Enhanced Due Diligence ("EDD") procedures, particularly with respect to accounts onboarded through fintech BaaS partnerships;

4. Inadequate model validation of BRB's transaction monitoring system, which had not been independently validated in more than three years; and

5. Board-level oversight failures, including the absence of a dedicated Compliance Committee and insufficient BSA/AML reporting to the Board of Directors. The Consent Order follows a pattern of prior unresolved supervisory actions. Specifically, the OCC issued a Matter Requiring Attention ("MRA") in June 2022 regarding deficiencies in BRB's BSA/AML transaction monitoring program. That MRA was not adequately remediate

II. Recitals and Jurisdictional Provisions

Article I — Parties and Jurisdiction

Article I of the Consent Order identifies the parties and establishes the jurisdictional basis for the OCC's supervisory and enforcement authority over BRB. Parties. The Consent Order identifies Belmont Ridge Bank National Association as a national banking association organized and existing under the laws of the United States, chartered pursuant to 12 U.S.C. § 21 et seq., and assigned OCC Charter No. 48271. BRB is su

Article II — Background and Findings

Article II of the Consent Order sets forth the factual background and summarizes the OCC's findings from the targeted BSA/AML examination. Examination History. Article II recounts that the OCC conducted a targeted BSA/AML examination of BRB from March 2024 through September 2024, during which examiners identified significant deficiencies across multiple components of BRB's BSA/AML compliance program. The Article furt

III. Article III — OFAC Sanctions Screening Deficiencies

Article III of the Consent Order addresses deficiencies in BRB's Office of Foreign Assets Control ("OFAC") sanctions screening program. The OCC's findings in this regard are among the most serious in the Consent Order, given the potential for violations of U.S. sanctions laws and regulations. Screening Coverage Gaps. The OCC determined that BRB's OFAC screening system failed to screen 100% of transactions processed t

Article III.B — Compliance Obligations

Article III imposes the following compliance obligations on BRB with respect to OFAC sanctions screening:

1. Comprehensive Screening. BRB shall implement a comprehensive OFAC sanctions screening program that ensures 100% screening of all transactions across all business lines and all BaaS channels, including wire transfers, ACH transactions, card transactions, and all other payment types processed through or by BRB. No transaction category or channel may be excluded from screening.

2. Technology Upgrade or Replacement. BRB shall upgrade or replace its sanctions screening technology to eliminate the screening gaps identified in the Consent Order. The upgraded or replacement system must be capable of processing all transaction types across all channels without coverage gaps.

3. Real-Time and Batch Screening. BRB shall implement real-time screening for applicable transaction types (including wire transfers and other time-sensitive payment types) and batch screening for other transaction types, in each case with appropriate interdiction and blocking capabilities to ensure that transactions involving sanctioned parties are identified and stopped before completion.

4. Revised Policies and Procedures. BRB shall adopt revised OFAC compliance policies, procedures, and screening procedures manuals that reflect the upgraded screening capabilities and address the deficiencies identified in the Consent Order.

5. List Management Protocols. BRB shall establish enhanced list management protocols covering the Specially Designated Nationals and blocked Persons ("SDN") List, the Consolidated Sanctions List, the Sectoral Sanctions Identifications ("SSI") List, and all applicable non-SDN lists maintained by OFAC, including the Non-SDN Menu-Based Sanctions List, the Foreign Sanctions Evaders List, and other relevant lists. The pro

6. Post-Remediation Testing. BRB shall conduct comprehensive testing to validate 100% BaaS transaction screening coverage following implementation of the upgraded or replacement screening system. Testing results must be documented and made available to the OCC upon request.

Article III.C — Deadline November 1, 2025: BRB's OFAC screening must be fully operational for all BaaS channels by this date. The fully operational system must screen 100% of transactions across all business lines and channels without coverage gaps, in accordance with the requirements set forth in Article III.B above. Interim milestones leading to the November 1, 2025 deadline are to be set forth in the Comprehensive

Article III.D — Responsible Parties at BRB The following BRB personnel bear responsibility for compliance with Article III: • Thomas Ikeda, BSA Officer / AML Program Director — Primary operational responsibility for the OFAC sanctions screening remediation, including oversight of the technology upgrade, revised screening procedures, and post-remediation testing. • Patricia Langston, Chief Compliance Officer — Oversig

IV. Article IV — SAR Filing Deficiencies

Article IV of the Consent Order addresses deficiencies in BRB's Suspicious Activity Report ("SAR") filing operations, which the OCC determined to be among the most significant compliance failures identified during the targeted examination. Alert Backlog. The OCC found that BRB had a backlog of approximately 2,400 potentially suspicious activity alerts that remained unreviewed as of the examination date in September 2

Article IV.B — Compliance Obligations

Article IV imposes the following compliance obligations on BRB:

1. Backlog Clearance. BRB shall clear the backlog of approximately 2,400 unreviewed alerts and disposition each alert with full documentation. Each alert must be reviewed by a qualified BSA/AML analyst, investigated as appropriate, and either escalated for SAR filing or closed with a documented rationale for the closure decision.

2. SAR Lookback Project. BRB shall conduct a SAR lookback project covering the relevant lookback period to identify and file any previously unfiled SARs. The lookback must include a review of transactions and accounts associated with the backlogged alerts, as well as a broader population analysis to determine whether additional SARs should have been filed during the period in which the alert backlog accumulated. The

3. Revised SAR Policies and Procedures. BRB shall revise its SAR filing policies and procedures to ensure timely filing, targeting a turnaround time of no more than 30 days from the initial determination that activity is suspicious. The revised policies must address alert triage, escalation protocols, investigation standards, SAR narrative quality, filing timelines, and management reporting.

4. Quality Assurance Protocols. BRB shall implement quality assurance ("QA") protocols for SAR filing, including transaction-level sampling of completed SAR filings, error tracking, and corrective action procedures. The QA function must be independent of the SAR filing operations it reviews, and QA results must be reported to the BSA Officer and the Compliance Committee.

5. Interim and Ongoing Reporting. BRB shall provide interim and ongoing reporting to the OCC on SAR backlog clearance progress, including quantitative metrics on the number of alerts reviewed, dispositioned, and escalated.

6. Staffing Augmentation. BRB shall augment BSA/AML staffing to sustainable levels sufficient to prevent the recurrence of alert backlogs and ensure timely SAR filing on an ongoing basis. Staffing plans are to be set forth in the Comprehensive RAP.

Article IV.C — Deadlines The Consent Order establishes the following deadlines for SAR-related compliance obligations: • March 31, 2025: Interim SAR backlog status report due to the OCC, documenting the number of alerts reviewed, dispositioned, and remaining, as well as the number of SARs filed as a result of backlog clearance efforts to date. • June 30, 2025: SAR backlog clearance target — all approximately 2,400 un

Article IV.D — Responsible Parties at BRB • Thomas Ikeda, BSA Officer / AML Program Director — Direct management of SAR filing operations, alert disposition, lookback project execution, and backlog clearance. Mr. Ikeda is the day-to-day owner of this workstream. • Patricia Langston, Chief Compliance Officer — Policy oversight, including review and approval of revised SAR policies and procedures and quality assurance

V. Article V — CDD/EDD Deficiencies

Article V of the Consent Order addresses deficiencies in BRB's Customer Due Diligence ("CDD") and Enhanced Due Diligence ("EDD") practices. Scope of Deficiency. The OCC identified approximately 47,000 high-risk customer accounts that lacked adequate CDD or EDD documentation. These accounts did not meet the minimum documentation and monitoring standards required by the Bank Secrecy Act, its implementing regulations (3

Article V.B — Compliance Obligations

Article V imposes the following compliance obligations on BRB:

1. Account Remediation. BRB shall remediate all 47,000 identified CDD/EDD-deficient accounts using a risk-based prioritization approach. Remediation must include collection of missing CIP documentation, updated risk ratings, collection of beneficial ownership information where applicable, and establishment of ongoing monitoring profiles.

2. Revised Policies and Procedures. BRB shall adopt revised CDD/EDD policies and procedures for all customer channels, including specific requirements for customers onboarded through BaaS partnerships. The revised policies must clearly articulate the CDD/EDD standards applicable to BaaS-channel customers and ensure that those standards are no less rigorous than the standards applied to customers onboarded through BRB

3. Responsibility Matrix. BRB shall establish a clear responsibility matrix delineating BRB's versus fintech partners' respective obligations for customer onboarding, CDD/EDD collection, ongoing monitoring, and periodic review. The responsibility matrix must make clear that BRB, as the chartered institution, retains ultimate responsibility for BSA/AML compliance regardless of the division of operational tasks between

4. Progress Tracking and Reporting. BRB shall implement a progress tracking mechanism to monitor the remediation of the 47,000 deficient accounts and shall provide regular reporting on remediation progress to the Board's Compliance Committee (once established) and to the OCC.

Article V.C — Deadlines • July 15, 2025: 50% remediation milestone — 23,500 of the 47,000 identified deficient accounts must be fully remediated by this date. • January 15, 2026: 100% remediation milestone — all 47,000 identified deficient accounts must be fully remediated by this date.

Article V.D — Responsible Parties at BRB • Patricia Langston, Chief Compliance Officer — Policy and program oversight for CDD/EDD remediation, including adoption of revised policies and procedures. • Thomas Ikeda, BSA Officer / AML Program Director — Operational execution of the account remediation project, including supervision of remediation analysts, quality control, and progress tracking. • Warren Ashby, Head of

VI. Article VI — Model Validation Deficiencies

Article VI of the Consent Order addresses deficiencies in the independent validation of BRB's transaction monitoring model, which is a critical component of the Bank's BSA/AML compliance program. Validation Gap. The OCC found that BRB's transaction monitoring model — the Veridian Analytics Inc. TMS platform, version 8.3, operating under Contract No. VA-BRB-2023-0044 — had not been independently validated since March

Article VI.B — Compliance Obligations

Article VI imposes the following compliance obligations on BRB:

1. System Upgrade or Replacement. BRB shall upgrade or replace its transaction monitoring system to address the identified deficiencies, including both the validation gap and the tuning deficiency.

2. Independent Model Validation. BRB shall complete an independent model validation of the upgraded or replacement system. The validation must be performed by a qualified independent party with no conflicts of interest and must cover the model's conceptual soundness, data integrity, scenario coverage, threshold calibration, outcome analysis, and overall effectiveness.

3. Tuning Update and Periodic Validation. BRB shall update the model's tuning parameters to reflect current transaction patterns, customer demographics, and risk characteristics, including BaaS-specific patterns. BRB shall establish a periodic validation schedule requiring independent validation no less than annually, or more frequently as the institution's risk profile warrants.

4. Threshold Review Process. BRB shall establish above-the-line/below-the-line threshold review processes to ensure that thresholds are set at levels that appropriately balance detection effectiveness and operational feasibility. All threshold-setting decisions must be documented, including the rationale for each threshold, the data and analysis supporting the threshold level, and the approval of the BSA Officer and

Article VI.C — Deadlines • August 1, 2025: Veridian TMS v.10.0 deployment — user acceptance testing ("UAT") must be complete by this date, with the upgraded system operational in BRB's production environment. • October 1, 2025: Independent model validation of the upgraded transaction monitoring system must be complete by this date, with the validation report delivered to BRB management, the Compliance Committee, and

Article VI.D — Responsible Parties at BRB • Thomas Ikeda, BSA Officer / AML Program Director — Model governance and validation oversight, including coordination with the independent validation firm and oversight of tuning updates. • Linda Petrosian, CIO/CTO — Technology implementation and UAT for the Veridian TMS v.10.0 upgrade, including infrastructure readiness, data migration, and system testing. • Melissa Chu, Ch

VII. Article VII — Independent Consultant Engagement