Contract analysis

I. Executive Summary Calderwood & Harkness LLP ("C&H") has prepared this memorandum to present our recommendations for a comprehensive, restructured framework governing Belmont Ridge Bank National Association's ("BRB" or the "Bank") oversight of all fourteen (14) active Banking-as-a-Service ("BaaS") fintech partners. This framework has been developed in direct response to OCC Consent Order No. OCC-2025-003 (the "Cons

II. Background and Regulatory Context A. BRB's BaaS Business Model Belmont Ridge Bank National Association operates a Banking-as-a-Service division within its broader banking operations. The BaaS division is led by Warren Ashby, Senior Vice President and Head of Fintech Partnerships / BaaS Division, and is responsible for managing the Bank's relationships with fintech companies that leverage BRB's national bank chart

1. OFAC Sanctions Screening Failures. The OCC found that BRB's OFAC screening system failed to screen one hundred percent (100%) of transactions processed through fintech BaaS channels against the SDN List and other OFAC sanctions lists. The most significant gap was identified in NovaPay's wire and ACH transaction flows, where approximately twelve percent (12%) of transactions — approximately 3,800,000 out of 31,700,

2. CDD/EDD Failures. The OCC found that approximately 47,000 high-risk customer accounts lacked adequate Customer Due Diligence or Enhanced Due Diligence documentation as required by the CDD Rule (31 C.F.R. § 1020.220) and BRB's own CDD/EDD policies. The majority of these accounts were onboarded through fintech partner platforms, where the delegation of customer identification and due diligence functions was not acco

3. SAR Filing Deficiencies. The OCC found that as of September 2024, a backlog of approximately 2,400 potentially suspicious activity alerts remained unreviewed in BRB's transaction monitoring queue. The backlog was attributed to inadequate staffing in BRB's BSA/AML department, which at the time consisted of 62 full-time equivalents ("FTEs"), as well as the high volume of alerts generated by BaaS transaction activity

4. Board Oversight Deficiencies. The OCC found that BRB's Board of Directors did not receive key BaaS-specific compliance metrics necessary to fulfill its oversight responsibilities. Specifically, the Board was not provided with partner-level data on SAR volumes, OFAC screening hit rates, risk ratings, escalation actions, or compliance testing results disaggregated by BaaS partner. Board-level BSA/AML reporting was p

III. Current-State Assessment: Deficiencies in BaaS Compliance Oversight Based on C&H's review of BRB's existing compliance infrastructure, internal audit reports, the September 2024 Caldera & Pope independent BSA/AML test, OCC examination correspondence, and interviews with BRB management, we have identified the following categories of deficiencies in BRB's current BaaS compliance oversight. This assessment has info

IV. Recommended BaaS Compliance Oversight Framework Based on the current-state assessment described in Section III and the regulatory requirements established by the Consent Order and applicable regulatory guidance, C&H recommends the following comprehensive BaaS Compliance Oversight Framework. The framework is organized into nine components, each addressing a specific dimension of BaaS compliance oversight. A. Gover

1. BaaS Compliance Oversight Committee C&H recommends the establishment of an internal BaaS Compliance Oversight Committee (the "BCOC") as the primary governance body responsible for overseeing BRB's compliance with BSA/AML, OFAC, and other regulatory requirements across all BaaS partner relationships. The BCOC should be established as a standing management committee with cross-functional membership to ensure that co

2. Dedicated BaaS Compliance Function C&H recommends the creation of a dedicated BaaS Compliance Unit within the BSA/AML department. This unit should be staffed with compliance analysts who possess specialized expertise in fintech transaction patterns, BaaS regulatory requirements, and the unique BSA/AML risks associated with bank-fintech partnerships. The BaaS Compliance Unit should be responsible for the day-to-day

3. Compliance Liaison Embedded in BaaS Division To address the organizational disconnect between the BaaS Division and BRB's compliance function, C&H recommends that a senior compliance officer — at minimum a Vice President-level professional — be assigned as an embedded compliance liaison within the BaaS Division. This individual should maintain a dual reporting line to Warren Ashby (BaaS Division head) and Patricia

1. Tiering Methodology C&H recommends the establishment of a three-tier risk classification system for all fourteen BaaS partners. The tiering model is designed to differentiate BRB's compliance oversight intensity based on each partner's inherent risk profile, enabling the Bank to allocate its finite compliance resources most effectively and to satisfy regulatory expectations for a risk-based approach to third-party

2. Current Tier Assignments (Preliminary) Based on available data and C&H's preliminary assessment, the following tier assignments are recommended for BRB's BaaS partners. These assignments are preliminary and should be confirmed by the BCOC following the completion of individual risk assessments using the BaaS Partner BSA/AML Risk Assessment Template. Tier 1 — High Risk: NovaPay Technologies Inc. — NovaPay meets mul

3. Reassessment Frequency Tier assignments should be reassessed on a regular schedule and on an ad hoc basis as circumstances warrant: (a) Quarterly reassessment: The BCOC should review tier assignments for all fourteen partners at each quarterly meeting (or monthly meeting during the remediation period), considering updated transaction volume data, SAR activity, OFAC screening metrics, compliance testing results, an

1. Tier 1 (High Risk) Partners — Enhanced Monitoring Tier 1 partners are subject to the following enhanced monitoring requirements: Monthly Compliance Reporting. Each Tier 1 partner must provide monthly compliance reports to BRB, delivered no later than the fifteenth (15th) calendar day of the following month. The monthly report must include, at minimum: (a) total transaction volumes (by transaction type: wire, ACH,

2. Tier 2 (Medium Risk) Partners — Standard Enhanced Monitoring Tier 2 partners are subject to the following standard enhanced monitoring requirements: Quarterly Compliance Reporting. Each Tier 2 partner must provide quarterly compliance reports to BRB, delivered no later than thirty (30) calendar days after the end of each calendar quarter. The report should cover the same categories as the Tier 1 monthly report but

3. Tier 3 (Low Risk) Partners — Baseline Monitoring Tier 3 partners are subject to the following baseline monitoring requirements: Quarterly Compliance Reporting. Each Tier 3 partner must provide quarterly compliance reports to BRB, delivered no later than thirty (30) calendar days after the end of each calendar quarter. OFAC Screening per Standard Protocols. Tier 3 partner transaction flows are subject to OFAC scree

1. Scope. BRB's Internal Audit function, led by Derek Ballard, Head of Internal Audit, should develop a dedicated BaaS compliance testing program that is fully integrated into BRB's annual audit plan. The BaaS compliance testing program should be designed to provide independent assurance that BRB's BaaS compliance oversight framework is operating effectively and that BaaS partner activities are in compliance with app

2. Testing Frequency The frequency of compliance testing should be differentiated by partner risk tier: Tier 1 partners: Semi-annual compliance testing. Each Tier 1 partner should be subject to a dedicated compliance test at least twice per year, with testing cycles aligned to BRB's semi-annual risk assessment schedule. Tier 2 partners: Annual compliance testing. Each Tier 2 partner should be subject to a dedicated c

3. Independent Testing In addition to BRB's internal compliance testing, the BaaS compliance oversight framework should be subject to independent testing by qualified external parties: Caldera & Pope LLP Independent BSA/AML Test. Caldera & Pope LLP (311 South Wacker Drive, Suite 5400, Chicago, Illinois 60606; engagement partner: Franklin Dorsey), which conducts BRB's annual independent BSA/AML test (CY 2024 annual fe

1. Revised BaaS Program Agreement — Compliance Addendum All fourteen BaaS partner agreements must be amended to incorporate a standardized compliance addendum. The compliance addendum is being prepared as a separate C&H deliverable (the "Revised BaaS Program Agreement Template Compliance Addendum") and will be provided to BRB under separate cover. The compliance addendum will serve as the primary contractual mechanis

2. Implementation Timeline The implementation timeline for the compliance addendum is as follows: (a) The draft compliance addendum is to be circulated to all fourteen BaaS partners within thirty (30) days of the submission of BRB's Comprehensive Remediation Action Plan to the OCC — i.e., by June 15, 2025. (b) Tier 1 partners (NovaPay Technologies Inc. and FairLend Digital LLC) are required to execute the compliance