Contract analysis

I. INTRODUCTION AND TRAINING OBJECTIVES 1.1 Purpose of This Training This training has been developed and is being delivered by Calderwood & Harkness LLP ("C&H") at the direction and for the benefit of the Board of Directors and Senior Management of Belmont Ridge Financial Group, Inc. ("BRFG") and its wholly owned banking subsidiary, Belmont Ridge Bank National Association ("BRB" or the "Bank"). The training is deliv

1. Regulatory Framework Comprehension. Equip Board members and senior management with a working understanding of the BSA/AML regulatory framework, including the Bank Secrecy Act, the USA PATRIOT Act, the Anti-Money Laundering Act of 2020, and OFAC sanctions obligations. Attendees should leave this training with a clear understanding of the key statutes, regulations, and supervisory expectations that govern BRB's BSA/

2. Personal Liability Awareness. Clarify the personal liability exposure that directors and officers face under federal banking enforcement statutes, including the potential for individual civil money penalties, cease and desist orders, removal and prohibition orders, and, in cases of willful violations, criminal prosecution. Each attendee should understand that BSA/AML compliance failures can give rise to personal c

3. Consent Order Comprehension. Explain the specific findings, requirements, and deadlines of Consent Order No. OCC-2025-003, so that each Board member and senior officer can articulate the nature and scope of the deficiencies identified by the OCC, the remediation requirements imposed, and the critical milestones and deadlines that must be met over the ensuing twelve-month period.

4. Governance Oversight Clarity. Define the governance oversight responsibilities that the Consent Order imposes upon the Board, including the role and charter of the newly established Compliance Committee, the required reporting cadences and metrics, and the standard of engagement that the OCC expects from directors of a national bank under an active consent order.

5. Red Flag Identification. Enable Board members and senior management to identify key BSA/AML and OFAC compliance red flags relevant to BRB's business lines, with particular emphasis on the risks presented by the BaaS/fintech partnership channel — the channel from which the most significant deficiencies identified in the Consent Order originated.

6. Remediation Engagement. Establish clear expectations for ongoing Board and senior management engagement throughout the twelve-month remediation period, which runs from the Consent Order effective date of January 15, 2025 through the self-certification and final validation report due date of February 15, 2026. Attendees should leave this training with a concrete understanding of what is expected of them, individual

II. BSA/AML REGULATORY FRAMEWORK OVERVIEW 2.1 The Bank Secrecy Act (BSA) The Bank Secrecy Act, formally known as the Currency and Foreign Transactions Reporting Act, was enacted in 1970 and is codified at 31 U.S.C. §§ 5311–5332. The implementing regulations promulgated by the Financial Crimes Enforcement Network ("FinCEN") are found at 31 C.F.R. Chapter X. The BSA is the foundational federal statute governing anti-mo

Section 312: Special Due Diligence for Correspondent Accounts and Private Banking Accounts. Section 312 requires financial institutions to establish, maintain, and administer programs of special due diligence for correspondent accounts maintained for foreign financial institutions and for private banking accounts maintained for non-U.S. persons. These programs must include reasonable procedures to detect and report k

Section 314: Information Sharing Between Government and Financial Institutions. Section 314 established two critical information-sharing mechanisms. Section 314(a) allows federal law enforcement agencies, through FinCEN, to reach out to financial institutions to locate accounts and transactions of individuals or entities suspected of engaging in terrorism or money laundering. Section 314(b) provides a safe harbor for

Section 326: Customer Identification Program (CIP) Requirements. Section 326 requires financial institutions to implement reasonable procedures for verifying the identity of any person seeking to open an account, maintaining records of the information used to verify a customer's identity, and determining whether the person appears on any list of known or suspected terrorists or terrorist organizations. The CIP requir

III. OFAC SANCTIONS COMPLIANCE OBLIGATIONS 3.1 Overview of the OFAC Sanctions Framework The Office of Foreign Assets Control ("OFAC") is a bureau of the U.S. Department of the Treasury responsible for administering and enforcing economic and trade sanctions programs based on U.S. foreign policy and national security goals. OFAC sanctions are among the most powerful tools available to the U.S. government for combating

IV. CONSENT ORDER NO. OCC-2025-003: KEY PROVISIONS AND DEADLINES 4.1 Consent Order Overview Consent Order No. OCC-2025-003 was issued by the Office of the Comptroller of the Currency on January 15, 2025 — the effective date of the order. The Consent Order was entered into by the OCC and Belmont Ridge Bank National Association following the OCC's targeted BSA/AML examination conducted between March 2024 and September

1. OFAC Sanctions Screening. As discussed in Section III above, BRB's OFAC screening system failed to screen 100% of transactions processed through its BaaS channels. Approximately 12% of NovaPay Technologies transactions — representing approximately 3,800,000 individual transactions in CY 2023 — were not subjected to OFAC screening. This gap represented a fundamental failure in BRB's sanctions compliance architectur

2. SAR Filing Deficiencies. BRB had accumulated a backlog of approximately 2,400 unreviewed transaction monitoring alerts as of September 2024, the conclusion of the targeted examination. These were alerts generated by the Veridian TMS that had not been investigated, dispositioned, and, where warranted, converted to SAR filings. In addition, the average time from alert generation to SAR filing was 78 days — more than

3. CDD/EDD Failures. Approximately 47,000 high-risk customer accounts — primarily accounts onboarded through BaaS/fintech partners — lacked adequate CDD or EDD documentation. These accounts had been opened with either incomplete or absent beneficial ownership information, inadequate source-of-funds documentation, or insufficient risk assessment documentation. The 47,000-account figure represents a significant complia

4. Model Validation. BRB's transaction monitoring system, Veridian TMS v.8.3, had not been independently validated since March 2021 — more than three years prior to the examination. Industry standards and regulatory expectations call for independent model validation at least annually, or more frequently when there are significant changes to the model, the data environment, or the risk profile. In addition, the tuning

5. Board Oversight. The OCC found that BRB's Board of Directors had not maintained adequate oversight of the Bank's BSA/AML compliance program. Specifically, the OCC identified the following governance deficiencies: (a) no dedicated Board Compliance Committee existed, and BSA/AML oversight was subsumed within the broader Audit Committee and Risk Committee mandates without adequate focus; (b) BSA/AML reporting to the

Article VII of the Consent Order requires BRB to retain an independent consultant, acceptable to the OCC, to conduct a comprehensive assessment of BRB's BSA/AML and OFAC compliance programs, to validate remediation efforts, and to deliver a final validation report confirming that BRB has achieved full compliance with the Consent Order's requirements. Thornfield Consulting Group LLC ("Thornfield") has been engaged for

V. PERSONAL LIABILITY EXPOSURE FOR DIRECTORS AND OFFICERS 5.1 Statutory Framework for Personal Liability Board members and senior management should understand that BSA/AML and OFAC compliance failures can give rise to personal liability for the individuals responsible for the institution's governance and operations. The relevant statutory provisions are summarized below. 12 U.S.C. § 1818(b) — Cease and Desist Orders.