Contract analysis

I. EXECUTIVE SUMMARY A. Purpose of the Remediation Action Plan This Comprehensive Remediation Action Plan (the "RAP" or "Plan") is submitted by Belmont Ridge Bank National Association ("BRB" or the "Bank") pursuant to the requirements of OCC Consent Order No. OCC-2025-003, issued on January 15, 2025 (the "Consent Order"). The Consent Order directed the Bank to submit, within 120 days of the effective date thereof, a

1. OFAC Sanctions Screening Deficiencies (Workstream 1). The Bank's OFAC screening system failed to screen 100% of transactions processed through fintech BaaS channels. The most significant gap was identified in the NovaPay Technologies transaction flow, where approximately 12% of wire and Automated Clearing House ("ACH") transactions were not screened against OFAC sanctions lists during calendar year 2023. This repr

2. SAR Filing Deficiencies (Workstream 2). As of September 2024, a backlog of approximately 2,400 potentially suspicious activity alerts remained unreviewed within the Bank's transaction monitoring system. The average time from alert generation to SAR filing was 78 days, significantly exceeding the 30-day regulatory expectation for timely filing of SARs with FinCEN. The accumulation of this backlog reflects inadequat

3. CDD/EDD Failures (Workstream 3). Approximately 47,000 high-risk customer accounts, predominantly onboarded through the Bank's fintech BaaS partners, were identified as lacking adequate CDD or EDD documentation. These deficiencies include missing or incomplete Customer Identification Program ("CIP") verification, absent beneficial ownership records, incomplete risk assessments, and the failure to conduct periodic r

4. Model Validation Deficiencies (Workstream 4). The Bank's transaction monitoring system, Veridian TMS v.8.3, had not been independently validated since March 2021 — a gap of more than three years at the time of the OCC examination. The system's tuning parameters had last been updated in October 2022, more than two years prior to the examination. The OCC found that the absence of regular validation and tuning result

5. Board Oversight Deficiencies (Workstream 5). Prior to the Consent Order, the BRFG Board of Directors did not maintain a dedicated Compliance Committee. BSA/AML reporting to the full Board was conducted on a quarterly basis and excluded key performance and risk metrics, including SAR filing volumes and timeliness, OFAC screening hit rates, and individualized risk ratings for each BaaS partner. The OCC concluded tha

II. CONSENT ORDER REQUIREMENTS AND COMPLIANCE OBLIGATIONS A. Summary of Consent Order Articles OCC Consent Order No. OCC-2025-003 contains multiple substantive articles imposing specific obligations on BRB, each with defined deadlines or performance standards. This Section provides an article-by-article summary of the Consent Order's requirements and the Bank's corresponding obligations. Each article is cross-referen

Article I — Effective Date and General Provisions. The Consent Order became effective on January 15, 2025. It remains in effect until terminated by the OCC upon written notification. The Bank consented to the issuance of the Consent Order without admitting or denying any of the OCC's findings, except as to facts admitted in the stipulation accompanying the Consent Order. The Consent Order is enforceable under 12 U.S.

Article II — Comprehensive Remediation Action Plan. The Bank is required to submit to the OCC a comprehensive remediation action plan within 120 days of the effective date (i.e., by May 15, 2025). The plan must address each deficiency identified in the Consent Order, including OFAC sanctions screening, SAR filing processes, CDD/EDD practices, transaction monitoring model validation, and board-level governance. This P

Article III — OFAC Sanctions Screening. The Bank is required to achieve 100% screening coverage for all transactions across all business lines, including all BaaS partner channels, by no later than November 1, 2025. The Bank must implement real-time screening capabilities for wire, ACH, card, and all BaaS partner transaction flows and must adopt revised OFAC compliance policies and procedures.

Article IV — SAR Filing Remediation. The Bank is required to clear the existing backlog of approximately 2,400 unreviewed suspicious activity alerts by no later than June 30, 2025. The Bank must reduce its average SAR filing time to within 30 days of alert generation on a sustained basis and must conduct a comprehensive lookback review to identify any potentially suspicious activity that was missed during the period

Article V — Customer Due Diligence and Enhanced Due Diligence. The Bank is required to complete CDD/EDD remediation for 100% of the approximately 47,000 identified high-risk accounts by January 15, 2026, with an interim milestone of 50% completion (23,500 accounts) by July 15, 2025. The Bank must revise its CDD/EDD policies and procedures for all channels, including BaaS, and must establish clear responsibility alloc

Article VI — Transaction Monitoring Model Validation. The Bank is required to conduct an independent validation of its transaction monitoring system by October 1, 2025. The Bank must re-tune all monitoring scenarios, thresholds, and parameters and must establish a policy requiring annual independent model validation and periodic tuning reviews.

Article VII — Board Oversight and Governance. The Bank is required to establish a dedicated Compliance Committee of the Board within 45 days of the effective date (i.e., by March 1, 2025). The Compliance Committee must receive monthly reporting during the remediation period on specified metrics, including SAR volumes, OFAC screening coverage, CDD/EDD remediation progress, and BaaS partner risk ratings.

Article VIII — Independent Consultant. The Bank is required to retain an independent consultant, acceptable to the OCC, to assess the Bank's BSA/AML compliance program, monitor remediation progress, and deliver a final validation report by February 15, 2026. The independent consultant must have access to all Bank records, personnel, and facilities relevant to the engagement.

Article IX — Civil Money Penalty. A civil money penalty of $14,500,000 is assessed against the Bank, payable within 60 days of the effective date (by March 16, 2025). The CMP was paid in full on March 14, 2025.

Article X — Reporting Requirements. The Bank is required to submit quarterly progress reports to the OCC detailing remediation status across all workstreams. The first quarterly report is due September 15, 2025; the second quarterly report is due December 15, 2025. An interim SAR backlog status report is due March 31, 2025. A compliance self-certification is due February 15, 2026.

Article XI — Cooperation. The Bank is required to cooperate fully with the OCC and the independent consultant throughout the remediation period, including providing unrestricted access to records, personnel, and facilities.

Article XII — Miscellaneous Provisions. The Consent Order provides that it does not preclude any additional action by the OCC, FinCEN, or other federal agencies. The Bank is required to notify the OCC promptly of any material development that may affect compliance with the Consent Order. B. Mapping of Consent Order Requirements to Workstreams The following table provides a cross-reference mapping each substantive art

III. GOVERNANCE AND OVERSIGHT FRAMEWORK FOR THE REMEDIATION A. Remediation Steering Committee To ensure coordinated execution across all workstreams, the Bank has established a Remediation Steering Committee (the "Steering Committee") responsible for the day-to-day management, coordination, and oversight of remediation activities. The Steering Committee serves as the central governance body for the remediation progra

IV. WORKSTREAM 1: OFAC SANCTIONS SCREENING REMEDIATION A. Current State and Identified Deficiencies The Consent Order's most acute finding concerns the Bank's failure to achieve comprehensive OFAC sanctions screening for all transactions processed through its fintech BaaS channels. The Bank's OFAC screening infrastructure, as configured prior to the remediation, was designed to screen all transactions originated thro

1. Achieve 100% OFAC Screening Coverage. The Bank will implement sanctions screening for 100% of all transactions across all business lines, including all 14 BaaS partner channels, screened against current OFAC sanctions lists in real time prior to settlement.

2. Implement Real-Time Screening. The Bank will deploy real-time screening capabilities for all transaction types, including wire transfers, ACH transactions, card transactions, and all BaaS partner transaction flows, ensuring that no transaction is processed or settled without first being screened against applicable sanctions lists.

3. Implement Enhanced Batch Screening. The Bank will implement enhanced batch screening processes for retrospective screening (to address the historical NovaPay gap) and periodic rescreening of existing customers and counterparties against updated sanctions lists.

4. Reduce False-Positive Rates. The Bank will pursue optimization of its screening algorithms and tuning parameters to reduce the false-positive rate while maintaining 100% screening coverage. False-positive reduction will be achieved through improved matching logic, enhanced list management, and scenario-specific tuning.

5. Establish Robust Escalation and Reporting Procedures. The Bank will implement documented procedures for the escalation, interdiction, and blocking of sanctions-matched transactions, as well as timely OFAC reporting, including the 10-day blocking report requirement. C. Remediation Activities and Milestones The following activities will be undertaken to achieve the objectives of Workstream 1:

1. Veridian OFAC Module Enhancement. As part of the broader Veridian TMS v.10.0 upgrade (described in detail in Workstream 4, Section VII), the Bank will deploy an enhanced OFAC screening module with integrated real-time screening capabilities for all 14 BaaS partner transaction flows. A Statement of Work has been executed with Veridian Analytics Inc. (contact: Priya Subramanian, Vice President of Client Solutions) c

2. BaaS Channel Integration. Working under the direction of Warren Ashby (Head of Fintech Partnerships) and Linda Petrosian (CIO/CTO), the Bank's technology team will redesign the data architecture connecting each of the 14 BaaS partner transaction processing platforms to the enhanced OFAC screening module. The redesigned architecture will ensure that all BaaS partner API connections route transactions through the en

3. Policy and Procedure Updates. The Bank will draft and approve a revised OFAC Compliance Policy and an OFAC Screening Procedures Manual. These documents will comprehensively address the following topics: (a) Scope of OFAC screening obligations, covering all transaction types and all business lines; (b) Real-time screening workflows, including system architecture, data flows, and exception handling; (c) Interdiction

4. NovaPay-Specific Remediation. C&H, on behalf of BRB, has issued a compliance remediation letter to NovaPay Technologies (addressed to Ethan Garrison, CEO) demanding the following: (a) Enhanced cooperation with BRB's remediation efforts, including full transparency regarding NovaPay's transaction processing architecture; (b) Provision of complete transaction data for all NovaPay transactions processed during the pe

5. Testing and Validation. The Bank will implement an OFAC remediation testing plan establishing the methodology for validating that 100% of BaaS transactions are screened prior to settlement upon deployment of the enhanced OFAC module. The testing plan will include: (a) Sample-based verification across all 14 BaaS partner channels, with statistically significant sample sizes; (b) End-to-end transaction flow testing

6. Voluntary Self-Disclosure Consideration. C&H and the Bank are conducting an analysis of whether to file a voluntary self-disclosure ("VSD") with OFAC regarding the NovaPay screening gap. The 3.8 million unscreened transactions in CY 2023 present a potential apparent violation of OFAC regulations if any of those transactions involved sanctioned persons or entities. The analysis considers the following factors: the

1. One hundred percent (100%) of transactions across all business lines and all 14 BaaS partner channels are screened against current OFAC sanctions lists in real time prior to settlement, as demonstrated through testing and validated by Thornfield.

2. Documented, tested, and validated screening workflows exist for each transaction type and each BaaS partner channel, with no exception paths or bypass routes.

3. The revised OFAC Compliance Policy and OFAC Screening Procedures Manual have been approved and disseminated to all relevant personnel.

4. Thornfield has validated the full operationalization of the enhanced OFAC screening module by November 1, 2025, and has confirmed the completeness and effectiveness of the Bank's screening remediation by November 15, 2025.

5. The Bank has determined and documented its position regarding the OFAC voluntary self-disclosure and has taken appropriate action.

V. WORKSTREAM 2: SAR BACKLOG CLEARANCE AND PROCESS IMPROVEMENT A. Current State and Identified Deficiencies At the time of the OCC examination's conclusion in September 2024, the Bank's BSA/AML department maintained a backlog of approximately 2,400 potentially suspicious activity alerts that had not been reviewed, investigated, or dispositioned. This backlog had accumulated over a period of several months as a result

1. Clear Entire Alert Backlog. The Bank will disposition all 2,400 unreviewed alerts by June 30, 2025, ensuring that each alert is reviewed, investigated (where warranted), and either filed as a SAR or closed with appropriate documentation.

2. Reduce SAR Filing Time. The Bank will reduce its average SAR filing time to within 30 days of alert generation, measured on a rolling monthly basis, and will sustain this performance level on an ongoing basis.

3. Conduct Comprehensive Lookback Review. The Bank will conduct a comprehensive lookback review to identify any potentially suspicious activity that may have been missed during the period in which the backlog accumulated. The lookback will cover both retail and BaaS channels and will employ a risk-based methodology.

4. Establish Sustainable Processes. The Bank will establish staffing levels and workflow processes sufficient to prevent future backlog accumulation, including a capacity model calibrated to current and projected alert volumes.

5. Implement Quality Assurance Framework. The Bank will implement a quality assurance ("QA") framework for SAR filing, including random and risk-based sampling, error tracking, root cause analysis, and corrective action procedures. C. Remediation Activities and Milestones

1. Backlog Triage. The Bank has implemented a SAR Backlog Triage Protocol that establishes risk-ranking criteria for the 2,400 unreviewed alerts. The triage criteria include transaction amount, customer risk rating, alert type, BaaS partner association, geographic exposure, and the presence of any known red flags. Based on these criteria, each alert has been assigned to one of three triage categories: • Priority 1 (H

2. Temporary Staffing Deployment. The Bank has engaged Pinnacle Compliance Solutions LLC ("Pinnacle") to provide 30 full-time-equivalent BSA/AML analysts for a period of 12 months (SOW Reference: PCS-BRB-2025-0012; Andrea Solis, Director of Managed Services). The Pinnacle analysts were deployed and trained by March 15, 2025. These temporary analysts support backlog clearance, the SAR lookback project, and ongoing ale

3. SAR Lookback Project. The Bank will conduct a comprehensive SAR lookback covering the period from January 1, 2023 through September 30, 2024, encompassing the period during which the alert backlog accumulated. The lookback methodology is documented in the SAR Lookback Scope and Methodology Memorandum, which will be finalized by April 30, 2025. The lookback will employ the following approach: (a) Population Identif

4. Policy and Procedure Updates. The Bank will draft and approve a revised SAR Policy and Procedures establishing the following standards: (a) A 30-day filing target from alert generation to SAR submission; (b) Escalation protocols for complex investigations requiring additional time; (c) Quality review requirements, including supervisory review of all SAR narratives prior to filing; (d) Narrative drafting standards

5. Quality Assurance Framework. Upon completion of the backlog clearance, the Bank will implement a post-remediation QA process that includes: (a) Random sampling of filed SARs (minimum 10% per month) for quality review; (b) Risk-based sampling of high-risk SARs (100% of SARs involving BaaS partners exceeding defined transaction thresholds); (c) Error tracking and classification, with root cause analysis for identifi

1. The alert backlog is reduced to zero as of June 30, 2025, with all 2,400 previously unreviewed alerts fully dispositioned (either filed as SARs or closed with documented rationale).

2. The Bank's average SAR filing time is consistently at or below 30 days on a rolling monthly basis, as measured from the date of alert generation to the date of SAR filing with FinCEN.

3. The SAR lookback project is substantially complete by September 30, 2025, with all identified suspicious activity appropriately filed.

4. The QA framework is operational, with error rates below defined thresholds as established in the revised SAR Policy and Procedures.

5. Thornfield has validated the sustainability of the Bank's SAR filing process and has confirmed that the Bank's staffing levels, workflows, and quality controls are adequate to prevent future backlog accumulation.

VI. WORKSTREAM 3: CDD/EDD REMEDIATION A. Current State and Identified Deficiencies The OCC examination and Thornfield's preliminary gap assessment identified approximately 47,000 high-risk customer accounts that lack adequate CDD or EDD documentation. These accounts are predominantly associated with customers onboarded through the Bank's fintech BaaS partners. The deficiencies encompass a range of documentation ga