Contract analysis

I. INTRODUCTION AND PURPOSE Belmont Ridge Bank National Association ("BRB" or the "Bank"), a national banking association organized under the laws of the United States and chartered by the Office of the Comptroller of the Currency ("OCC"), OCC Charter No. 48271, by and through its undersigned officers, hereby respectfully submits this Compliance Self-Certification (this "Self-Certification") to the OCC pursuant to Ar

II. PROCEDURAL BACKGROUND AND REMEDIATION TIMELINE A. Consent Order Issuance and Immediate Response Consent Order No. OCC-2025-003 was issued by the OCC on January 15, 2025, and became effective on that same date. The Consent Order was the result of a targeted BSA/AML examination conducted by the OCC's Northeastern District Office from March 2024 through September 2024. The Examination was led by Jonathan Frey, Natio

Article VII of the Consent Order required BRB to retain an independent consultant, acceptable to the OCC, to assess the Bank's BSA/AML and sanctions compliance program, monitor remediation activities, and deliver a final validation report. BRB proposed Thornfield Consulting Group LLC as the independent consultant, and the OCC provided its non-objection on February 5, 2025, ten days in advance of the February 15, 2025

III. CERTIFICATION OF REMEDIATION — DEFICIENCY CATEGORY 1: OFAC SANCTIONS SCREENING A. Description of Original Deficiency The Consent Order found that BRB's Office of Foreign Assets Control ("OFAC") sanctions screening system failed to screen 100% of transactions processed through the Bank's BaaS fintech partner channels. This deficiency represented a critical gap in the Bank's sanctions compliance program and posed

IV. CERTIFICATION OF REMEDIATION — DEFICIENCY CATEGORY 2: SAR FILING DEFICIENCIES A. Description of Original Deficiency The Consent Order identified significant deficiencies in BRB's SAR filing processes. These deficiencies were multifaceted, encompassing both a substantial backlog of unreviewed alerts and systemic timeliness failures in the filing of SARs with the Financial Crimes Enforcement Network ("FinCEN"). As

V. CERTIFICATION OF REMEDIATION — DEFICIENCY CATEGORY 3: CDD/EDD FAILURES A. Description of Original Deficiency The Consent Order identified pervasive failures in BRB's Customer Due Diligence ("CDD") and Enhanced Due Diligence ("EDD") processes, particularly with respect to high-risk customer accounts onboarded through the Bank's BaaS fintech partner channels. The OCC determined that approximately 47,000 high-risk cu

VI. CERTIFICATION OF REMEDIATION — DEFICIENCY CATEGORY 4: TRANSACTION MONITORING MODEL VALIDATION A. Description of Original Deficiency The Consent Order found that BRB's transaction monitoring system had not been independently validated in more than three years. BRB utilized the Veridian Analytics Inc. Transaction Monitoring System, version 8.3 ("Veridian TMS v.8.3"), under Contract No. VA-BRB-2023-0044. The most re

VII. CERTIFICATION OF REMEDIATION — DEFICIENCY CATEGORY 5: BOARD-LEVEL OVERSIGHT A. Description of Original Deficiency The Consent Order found that the Board of Directors of BRFG — which exercises oversight of BRB as its principal banking subsidiary — did not have a dedicated Compliance Committee. BSA/AML compliance oversight was handled in an ad hoc manner by the full Board and, to a limited extent, by the Audit Com

VIII. BSA/AML PROGRAM INFRASTRUCTURE AND ORGANIZATIONAL ENHANCEMENTS A. Staffing and Organizational Structure BRB has made significant investments in the staffing and organizational structure of its BSA/AML compliance function to support both the immediate remediation of the deficiencies identified in the Consent Order and the long-term sustainability of the Bank's compliance program. The Bank's BSA/AML compliance fu