Contract analysis

I. Executive Summary This memorandum establishes the methodology, prioritization framework, phased timeline, and resource allocation for the remediation of approximately 47,000 high-risk customer accounts identified as lacking adequate Customer Due Diligence ("CDD") or Enhanced Due Diligence ("EDD") documentation. These deficiencies were cited in Finding (iii) of OCC Consent Order No. OCC-2025-003, issued January 15,

II. Background and Regulatory Context A. Consent Order Requirements OCC Consent Order No. OCC-2025-003 was issued on January 15, 2025, against Belmont Ridge Bank National Association (OCC Charter No. 48271; FDIC Certificate No. 31845). The Consent Order was entered by stipulation following the completion of the OCC's targeted BSA/AML examination, which spanned the period from March 2024 through September 2024. The Co

III. Remediation Objectives A. Primary Objectives The CDD/EDD remediation effort is organized around three primary objectives, each of which is essential to achieving full compliance with the Consent Order and restoring the integrity of BRB's BSA/AML compliance program.

1. Remediate all 47,000 identified high-risk customer accounts to achieve full CDD/EDD compliance. Each account within the identified deficient population must be brought into compliance with the requirements of 31 C.F.R. § 1010.230, applicable OCC supervisory guidance (including the Comptroller's Handbook on BSA/AML, the OCC's Guidance on Model Risk Management (OCC Bulletin 2011-12), and related issuances), and BRB'

2. Meet the two Consent Order milestones within the specified deadlines. The remediation plan must be structured and resourced to ensure that no fewer than 23,500 accounts (50% of the identified population) are fully remediated by July 15, 2025, and that all 47,000 accounts (100% of the identified population) are fully remediated by January 15, 2026. These are firm regulatory deadlines that carry significant conseque

3. Establish sustainable processes for ongoing CDD/EDD compliance across all channels, including BaaS. The remediation effort should not be viewed solely as a one-time catch-up exercise. A critical objective is to ensure that the processes, staffing, technology, and governance structures put in place during remediation provide a durable foundation for ongoing CDD/EDD compliance. This includes the integration of enhan

1. Identify and escalate accounts presenting potential suspicious activity requiring SAR filing. The detailed file reviews conducted during remediation will inevitably surface accounts that present indicia of suspicious activity that may not have been previously identified or reported. A formal referral protocol will be established to route such findings to the SAR review team operating under Workstream 2 (SAR Backlo

2. Support the Compliance Committee's reporting requirements. The Compliance Committee, chaired by James Rutherford, is required under the Consent Order to provide quarterly progress reports to the OCC and to exercise active oversight of the remediation program. The CDD/EDD remediation effort will provide monthly remediation progress metrics — including accounts completed, quality assurance results, BaaS partner coop

3. Align BaaS partner onboarding and ongoing due diligence responsibilities. The remediation effort provides an opportunity to clarify and formalize the respective CDD/EDD responsibilities of BRB and its fintech partners. This will be accomplished through the BaaS Partner CDD/EDD Responsibility Matrix, a separate deliverable that will delineate which CDD/EDD functions are performed by the fintech partner, which are p

4. Produce auditable evidence of remediation for validation and supervisory review. Every remediation action taken on every account must be thoroughly documented, time-stamped, and associated with an identifiable analyst, producing an auditable trail that will support Thornfield Consulting Group's independent validation, Caldera & Pope's independent testing, and the OCC's ongoing supervisory review. The importance of

IV. Account Population Analysis and Segmentation A. Total Population Identification The total identified population of deficient accounts is approximately 47,000. This figure is derived from the OCC's targeted BSA/AML examination findings (March 2024 – September 2024) and has been corroborated by the independent BSA/AML test conducted by Caldera & Pope LLP in September 2024. Both the OCC examination and the Caldera &

V. Risk-Based Prioritization Framework A. Prioritization Methodology Overview The remediation of 47,000 accounts over a twelve-month period requires a principled approach to sequencing that maximizes risk reduction in the earliest phases of the effort. The prioritization framework described in this section employs a composite risk scoring methodology that assigns each account a priority tier based on three primary fa

VI. Remediation Methodology A. Overview of Remediation Process Each of the 47,000 accounts in the deficient population will undergo a structured, five-step remediation workflow designed to ensure completeness, consistency, and auditability. The five steps are: (1) file review and gap identification, (2) customer outreach and documentation collection, (3) risk re-rating and EDD preparation, (4) quality review, and (5)

VII. Phased Timeline and Milestones A. Phase 1: Preparation and Mobilization (February 10 – March 31, 2025) Phase 1 encompasses the foundational activities necessary to launch the CDD/EDD remediation effort at scale. This phase is currently underway and includes the following key activities:

1. Finalize remediation methodology. This memorandum constitutes the primary deliverable for this activity. Upon review and approval by BRB management and Calderwood & Harkness, the methodology will be submitted to Thornfield Consulting Group for independent review.

2. Complete account population validation and segmentation. Thomas Ikeda's team is completing the cross-referencing exercise described in Section IV.A to validate the 47,000-account population and finalize the segmentation by BaaS partner and deficiency type. This work is expected to be substantially complete by March 20, 2025.

3. Deploy Pinnacle Compliance Solutions LLC temporary staff. Pinnacle Compliance Solutions LLC (SOW Reference: PCS-BRB-2025-0012; contract value: $3,600,000 for 12 months at $300,000/month; key contact: Andrea Solis, Director of Managed Services) will provide 30 FTE temporary analysts, of whom approximately 15 will be dedicated to CDD/EDD remediation (the remainder supporting SAR backlog clearance under Workstream 2)

4. Develop Gap Identification Checklist and standardized remediation templates. The standardized tools that will be used by all analysts (both BRB permanent staff and Pinnacle temporary staff) are being developed during Phase 1. The Gap Identification Checklist template is attached as Appendix C.

5. Issue compliance remediation letters to BaaS partners. As described in Section VI.C, compliance remediation letters have been issued to NovaPay Technologies and FairLend Digital, and letters to VaultEdge and the remaining BaaS partners will be issued by March 31, 2025.

6. Coordinate with Thornfield Consulting Group. Thornfield's on-site assessment commenced March 1, 2025, under the direction of Dr. Vivian Castellano. Calderwood & Harkness recommends providing Thornfield with a copy of this memorandum for review as part of Thornfield's preliminary gap assessment (due April 15, 2025), subject to the privilege protections afforded by the Privilege & Confidentiality Side Letter. B. Pha