Contract analysis

I. Executive Summary The purpose of this memorandum is to set forth Calderwood & Harkness LLP's recommended design specifications and reporting requirements for a real-time reporting dashboard (the "Dashboard") to track Belmont Ridge Bank NA's remediation of approximately 47,000 high-risk customer accounts that have been identified as lacking adequate Customer Due Diligence ("CDD") or Enhanced Due Diligence ("EDD") d

II. Background and Regulatory Context A. Consent Order Findings on CDD/EDD OCC Consent Order No. OCC-2025-003, which became effective on January 15, 2025, identified significant and pervasive deficiencies in BRB's Customer Due Diligence and Enhanced Due Diligence processes as one of five core deficiency categories warranting formal enforcement action. The Consent Order followed an extensive targeted BSA/AML examinati

III. Dashboard Scope and Objectives A. Primary Objectives The Dashboard must be designed and implemented to achieve the following primary objectives, each of which is critical to BRB's ability to demonstrate timely and effective remediation to the OCC, the Thornfield independent consultant, and BRB's own Board and senior management:

1. Real-Time Remediation Visibility. The Dashboard must provide real-time (or, at minimum, near-real-time with daily updates) visibility into the remediation status of all 47,000 CDD/EDD-deficient accounts identified in connection with the Consent Order. Every account in the remediation population must be represented in the Dashboard at all times, with its current status clearly indicated. The Dashboard should serve

2. Milestone Tracking and Pace Analysis. The Dashboard must track progress against both the July 15, 2025 (50% / 23,500 accounts) and January 15, 2026 (100% / 47,000 accounts) milestones with automated countdown functionality and pace/trajectory analysis. Users should be able to see, at a glance, whether the remediation effort is on track to meet each milestone, the projected completion date based on the current reme

3. Multi-Level Drill-Down Capability. The Dashboard must enable users to drill down from enterprise-level summary views to progressively more granular levels of detail, including by individual BaaS partner, by account risk tier, and ultimately to the individual account level. This drill-down capability is essential for identifying patterns, concentrations, and partner-specific issues that may require targeted managem

4. Audit Trail and Evidentiary Support. The Dashboard must maintain a comprehensive audit trail that supports evidentiary documentation requirements for OCC examination, Thornfield independent validation, and potential FinCEN inquiries. Every status change, data entry, and user action must be logged with sufficient detail to reconstruct the complete history of each account's remediation journey. This audit trail will

5. Bottleneck and Quality Issue Identification. The Dashboard must facilitate the real-time identification of bottlenecks, overdue accounts, resource constraints, and remediation quality issues. Accounts that are aging beyond expected cycle times, analysts whose productivity is lagging, BaaS partners whose cooperation is inadequate, and quality review failures must all be surfaced through automated alerts and visual

6. Single Source of Truth. The Dashboard must serve as the single, authoritative source of truth for all CDD/EDD remediation reporting across all stakeholder groups. All reporting — whether to the Board, to senior management, to Thornfield, or to the OCC — must be derived from the same underlying data set, ensuring consistency and eliminating the risks inherent in manual report compilation from disparate sources. The

IV. Recommended Key Performance Indicators and Metrics This section sets forth the key performance indicators ("KPIs") and metrics that the Dashboard should track and display. These metrics have been organized into logical groupings reflecting different dimensions of the remediation effort. Each metric group should be accessible from the Dashboard interface, with the ability to filter and cross-tabulate across dimens

1. Total Accounts in Scope. The total number of accounts in the remediation population, which is 47,000. This serves as the fixed denominator for all percentage-based calculations. The scope should not be adjusted without formal approval from both the CCO and C&H, documented through the Dashboard's administrative controls, and any scope adjustments should be reported to the OCC. We note that reconciliation of this fi

2. Accounts Remediated (Cumulative). The cumulative count and percentage of accounts for which CDD/EDD remediation has been completed. "Completed" should be defined as accounts for which all required CDD/EDD documentation has been obtained, the documentation has been reviewed for completeness and accuracy, and the account has received quality review sign-off from an authorized reviewer. This is the single most import

3. Accounts In Progress. The count and percentage of accounts that are currently in active remediation. This category should encompass accounts at various stages of the remediation workflow, including accounts for which documentation has been requested from the customer or BaaS partner, accounts for which documentation has been partially received and is under review, accounts undergoing analyst review and documentati

4. Accounts Not Yet Started. The count and percentage of accounts that remain in the remediation queue but have not yet been assigned to an analyst or otherwise initiated. This metric serves as a critical indicator of remediation pipeline health and will be particularly important in the early months of the remediation effort as the 47,000-account population is progressively absorbed into the remediation workflow.

5. Accounts Requiring Escalation. The count and percentage of accounts that have been flagged for escalation due to complicating factors, including customer non-responsiveness to repeated documentation requests, a determination that additional EDD is needed beyond the standard remediation scope, identification of adverse information or suspicious activity during the remediation process, or accounts where relationship

6. Accounts Closed / Exited. The count and percentage of accounts for which remediation has resulted in account closure or relationship termination. Closures may occur where the customer remains non-responsive after exhaustion of all reasonable outreach efforts, where the EDD process reveals information that is incompatible with continued account maintenance (e.g., unresolvable beneficial ownership opacity, adverse l

7. Pace Indicator (Burn Rate). The number of accounts completed per week and per month, plotted against the required pace to meet the July 15, 2025, and January 15, 2026, milestones. By way of illustration, to meet the first milestone of 23,500 remediated accounts by July 15, 2025, assuming remediation activities commence in earnest on approximately April 1, 2025 (following Dashboard go-live and full analyst deployme

1. Days Remaining to July 15, 2025, Milestone. A countdown indicator showing the number of calendar days remaining until the first milestone date, along with the projected completion date based on the current burn rate. If the projected completion date falls after July 15, 2025, the indicator should display in red with the projected overshoot duration.

2. Days Remaining to January 15, 2026, Milestone. The same countdown and projection functionality for the second milestone date. Although the second milestone is further in the future, it should be displayed from the outset of Dashboard operations to maintain organizational awareness of the full remediation timeline.

3. Projected Milestone Attainment Status. A Green / Yellow / Red status indicator for each milestone: • Green: The current remediation pace, if sustained, is projected to result in timely attainment of the milestone (i.e., the projected completion date is on or before the milestone date, with remediation on pace at ≥100% of the planned trajectory). • Yellow (Early Warning): The current remediation pace is within 10%

4. Variance Analysis. A detailed variance analysis comparing actual versus planned remediation counts on both a weekly incremental and cumulative basis. This analysis should be displayed in both tabular and graphical formats, enabling users to identify trends, inflection points, and periods of acceleration or deceleration in the remediation effort. The variance analysis should be exportable for inclusion in OCC quart

1. Accounts by BaaS Partner. The number and percentage of the 47,000 in-scope accounts attributable to each of the 14 active BaaS partners. The three largest partners should be individually identified and prominently displayed: • NovaPay Technologies Inc. (Ethan Garrison, CEO) • FairLend Digital LLC (Aisha Okonkwo, CEO) • VaultEdge Inc. (Marcus Tan, CEO) Each of the remaining 11 BaaS partners should also be individua

2. Remediation Status by Partner. For each of the 14 BaaS partners, the Dashboard should display the number and percentage of accounts in each remediation status category: Completed, In Progress, Not Yet Started, Escalated, and Closed/Exited. This partner-level breakdown is critical for identifying partner-specific remediation challenges, evaluating partner cooperation, and informing decisions about resource allocati

3. Partner Cooperation Score. The Dashboard should include a qualitative and/or quantitative rating of each BaaS partner's responsiveness and cooperation with the remediation effort. Relevant factors for this score include the timeliness of the partner's response to documentation requests, the quality and completeness of documentation provided, error rates in partner-submitted data, the partner's willingness to engag

4. BaaS-Related SARs Correlation. The Dashboard should include a cross-reference metric identifying the number and percentage of CDD/EDD-deficient accounts that have also been associated with filed or pending Suspicious Activity Reports ("SARs"). This metric provides important context for prioritization and risk assessment. We note that in calendar year 2024, BRB filed 2,108 BaaS-related SARs, representing approximat

1. Accounts by Risk Rating. The distribution of the 47,000 in-scope accounts across BRB's customer risk rating tiers (e.g., high, medium-high, elevated, or other categories consistent with BRB's customer risk rating methodology). This distribution should be displayed as both a table and a visual chart, enabling users to understand the risk composition of the remediation population at a glance.

2. Remediation by Risk Tier. Completion rates broken out by risk tier, showing the percentage of accounts remediated within each tier relative to the total number of accounts in that tier. This metric is critical for ensuring that the remediation effort is appropriately prioritizing the highest-risk accounts, consistent with both the Consent Order's expectations and prudent risk management principles. The Dashboard s

3. Risk Rating Changes. The Dashboard should track and display accounts whose customer risk rating has been upgraded or downgraded as a result of findings during the remediation process. For example, an account initially rated as "medium-high" risk may be upgraded to "high" risk if the EDD process reveals previously unidentified risk factors, or downgraded if documentation obtained during remediation mitigates previo

1. First-Pass Quality Rate. The percentage of remediated accounts that pass the initial quality review without requiring rework. A high first-pass quality rate indicates that analysts are performing thorough and accurate remediation work. A declining first-pass quality rate may indicate inadequate training, unrealistic productivity targets, or systemic documentation gaps that need to be addressed. This metric should

2. Rework Rate. The percentage of accounts that are returned for additional documentation, correction, or supplemental review after failing the initial quality review. This is the inverse complement of the first-pass quality rate and provides a direct measure of remediation inefficiency. The rework rate should be tracked over time to identify trends and should be broken out by common rework reasons (e.g., missing ben

3. Average Remediation Cycle Time. The average number of calendar days from the date an account is assigned to an analyst to the date the account receives final quality review sign-off. This metric provides insight into the efficiency of the remediation workflow and enables identification of process bottlenecks. The cycle time should be broken out by remediation status (e.g., average cycle time for completed accounts

4. QA Sample Results. Summary results from quality review sampling, including both random samples (drawn from the overall remediated population to estimate the aggregate quality rate) and risk-based samples (targeted at higher-risk accounts, accounts from specific partners, or accounts remediated by specific analysts where quality concerns have been identified). The sample methodology, sample sizes, and results shoul

1. Analyst Productivity. The number of accounts remediated per analyst per week, tracked separately for Pinnacle Compliance Solutions temporary FTE analysts and BRB permanent compliance staff. Productivity metrics should be displayed at both the aggregate team level and the individual analyst level. Productivity outliers — both high performers and underperformers — should be identifiable through the Dashboard, enabli

2. Staffing Deployment Status. The current number of Pinnacle FTEs deployed against the 30 FTE contractual commitment, and the current number of BRB permanent FTEs assigned to the CDD/EDD remediation workstream against both the current complement of 62 staff and the 15 planned new hires. Staffing shortfalls — e.g., delays in Pinnacle onboarding, attrition among BRB permanent staff, or delays in the hiring of the 15 p

3. Workload Queue Depth. The number of accounts assigned but not yet completed per analyst and per team. Excessive queue depth may indicate staffing insufficiency or individual capacity constraints, while shallow queue depth may indicate opportunities to accelerate the pace by reassigning idle capacity. G. Financial / Budget Metrics Financial tracking ensures that the remediation effort remains within budget and that

1. CDD/EDD Remediation Budget. The total project budget of $4,300,000, displayed alongside actual spend to date, committed but unexpended amounts, and remaining budget. Budget consumption should be tracked against the remediation timeline to identify whether spending is running ahead of or behind plan.

2. Cost per Account Remediated. Total cost to date divided by the number of accounts completed. This metric provides a unit cost indicator that enables projection of total cost at completion and comparison against the budgeted cost per account implied by the $4,300,000 total budget (approximately $91.49 per account if all 47,000 are remediated within budget).

3. Projected Total Cost at Completion. Based on the current cost-per-account run rate and the total number of accounts remaining, this metric projects the total cost to fully remediate all 47,000 accounts. If the projected total cost exceeds the $4,300,000 budget, the Dashboard should flag the projected overrun amount and percentage, enabling timely management action to request additional budget authorization from th

V. Data Sources and Integration Requirements The Dashboard's value is entirely dependent on the quality, completeness, and timeliness of the underlying data. This section specifies the data sources that must be integrated into the Dashboard and the associated data quality and technical requirements. A. Primary Data Sources The Dashboard should draw data from the following primary sources:

1. CDD/EDD Remediation Case Management System. This system will serve as the central system of record for account-level remediation status, workflow management, document storage, and quality review tracking. It is the most critical data source for the Dashboard. BRB's IT team, under Linda Petrosian's direction, must either designate an existing system or establish a new purpose-built system for this function. C&H's r

2. Core Banking System. BRB's core banking system contains the master customer data, including account opening dates, account types and product classifications, current balances, transaction activity summaries, geographic and demographic information, and relationship history. Integration with the core banking system is necessary to provide contextual information for the remediation effort and to enable risk-tier segm

3. BaaS Partner Data Feeds. Each of the 14 active BaaS partners maintains its own customer onboarding data, identity verification results, and customer documentation repositories. The remediation effort will require obtaining significant amounts of documentation and data from these partners. The Dashboard should integrate feeds from each partner showing the status of documentation requests, documentation received, an

4. Customer Risk Rating Engine. BRB's customer risk rating engine generates the risk scores and tier assignments used to segment and prioritize the remediation population. The Dashboard must integrate with the risk rating engine to display current risk ratings for all 47,000 in-scope accounts and to reflect any rating changes that occur during the remediation process. The risk rating engine integration should also su

5. Veridian Analytics Transaction Monitoring System ("TMS"). The Veridian Analytics TMS, currently deployed as version 8.3 with a planned upgrade to version 10.0 scheduled for deployment on August 1, 2025, generates transaction monitoring alerts that may be associated with CDD/EDD-deficient accounts. Integration with the TMS enables the Dashboard to cross-reference remediation status with transaction monitoring alert

6. SAR Filing Database. BRB's SAR filing database contains records of all filed and pending Suspicious Activity Reports. Integration with this database enables the Dashboard to identify and flag CDD/EDD-deficient accounts that are associated with SAR filings, supporting the SAR correlation metric and informing remediation prioritization.

7. OFAC Screening System. BRB's OFAC screening system contains records of screening hits, including both false positives and true matches. Integration with this system enables the Dashboard to cross-reference CDD/EDD-deficient accounts with OFAC screening results. We note that BRB's OFAC screening system generated 14,320 hits in calendar year 2024, of which 12 were determined to be true matches. While the OFAC screen

VI. Visualization and Reporting Requirements The Dashboard must accommodate multiple stakeholder groups with differing information needs, analytical sophistication, and access frequency. Accordingly, C&H recommends a multi-view architecture in which each stakeholder group has access to a purpose-built Dashboard view tailored to its specific requirements. A. Executive Dashboard View (Board / Compliance Committee) The