Contract analysis

I. Background — The Consent Order and Engagement Context As the OCC is aware, the Consent Order was issued on January 15, 2025, following a targeted Bank Secrecy Act / Anti-Money Laundering ("BSA/AML") examination of BRB conducted by the OCC's Northeastern District Office between approximately March 2024 and September 2024. The examination focused principally on the Bank's BSA/AML compliance infrastructure as it rela

1. Inadequate OFAC Sanctions Screening Protocols. The OCC found that BRB's Office of Foreign Assets Control ("OFAC") sanctions screening protocols were materially deficient, particularly with respect to fintech BaaS transaction flows. The examination revealed that approximately 3,800,000 wire and ACH transactions originated through BRB's largest BaaS partner, NovaPay Technologies Inc. ("NovaPay"), during calendar yea

2. Deficient SAR Filing Timeliness and Quality. The examination identified a substantial backlog of approximately 2,400 unreviewed suspicious activity alerts as of September 2024, accumulated across both the Bank's retail banking division and its BaaS partner channels. Additionally, the OCC found that for those Suspicious Activity Reports ("SARs") that were filed during the examination period, the average filing time

3. Insufficient Customer Due Diligence / Enhanced Due Diligence ("CDD/EDD"). The Consent Order cited inadequate CDD/EDD procedures for approximately 47,000 high-risk customer accounts, the majority of which were onboarded through BRB's fintech BaaS partner channels. The OCC determined that these accounts had been subjected to a standardized onboarding process that failed to apply risk-based due diligence commensurate

4. Inadequate Transaction Monitoring System Model Validation. The OCC found that BRB's primary transaction monitoring system — Veridian Analytics Inc. Transaction Monitoring System version 8.3 ("TMS v.8.3") — had not been independently validated since March 2021, and that its tuning parameters had last been updated in October 2022. Given the significant growth in BaaS transaction volumes and the introduction of new p

5. Board-Level Oversight Deficiencies in BSA/AML Governance. The Consent Order identified deficiencies in the Board of Directors' oversight of BSA/AML compliance, including the absence of a dedicated compliance committee at the board level, infrequent and insufficiently detailed reporting from the BSA Officer to the Board, and a lack of documented evidence that the Board had meaningfully evaluated the adequacy of BSA

II. Summary of Interim Compliance Actions Completed to Date The Bank recognizes the urgency and seriousness of the deficiencies identified in the Consent Order and has not waited for submission of the RAP to begin remediation. In the approximately four months since the Consent Order was issued, BRB has already completed several significant actions required by the Consent Order, and we wish to bring the OCC's attentio

III. Description of the Comprehensive Remediation Action Plan The enclosed RAP is the product of an intensive, cross-functional effort involving BRB's senior management, the BSA/AML compliance department, information technology division, internal audit function, Calderwood & Harkness, and Thornfield Consulting Group. The Plan addresses all five core deficiency categories identified in the Consent Order through five i

IV. Remediation Budget Summary The Board of Directors of BRFG has approved a total remediation budget of $42,500,000, exclusive of the $14,500,000 civil money penalty. When combined with the civil money penalty, the total anticipated financial outlay associated with the Consent Order and the remediation effort is approximately $57,000,000. The key components of the $42,500,000 remediation budget are summarized below:

V. Key Milestones and Deadlines The following table summarizes the remaining critical milestones for the remediation effort, each of which is aligned with the specific requirements and deadlines set forth in the Consent Order: BRB is committed to meeting or exceeding each of these milestones and will promptly notify the OCC of any material developments that may affect the Bank's ability to do so.

VI. Enclosures Enclosed with this letter for the OCC's review and approval are the following documents, each of which forms an integral part of this submission:

1. Comprehensive Remediation Action Plan (master document)

2. Remediation Action Plan — Executive Summary

3. Workstream 1: OFAC Sanctions Screening Remediation Plan

4. Workstream 2: SAR Backlog Clearance & Process Improvement Plan

5. Workstream 3: CDD/EDD Remediation Plan

6. Workstream 4: Transaction Monitoring Model Validation & Tuning Plan

7. Workstream 5: BSA/AML Program Governance & Training Enhancement Plan

8. Remediation Milestone Tracker

9. Board Resolution dated February 28, 2025 (Acknowledgment of Consent Order and Establishment of Compliance Committee)

10. Thornfield Consulting Group LLC — Preliminary Gap Assessment (dated April 15, 2025)

VII. Cooperation and Availability BRB and Calderwood & Harkness remain fully committed to open, transparent, and proactive cooperation with the OCC throughout the entirety of the remediation process. The Bank recognizes that effective remediation requires a strong and collaborative working relationship with its primary federal regulator and is dedicated to ensuring that the OCC receives all information necessary to m