Contract analysis

I. Executive Summary This memorandum has been prepared at the request of the Board of Directors of Belmont Ridge Financial Group, Inc. ("BRFG") and Gregory Nardone, General Counsel and Corporate Secretary of Belmont Ridge Bank National Association ("BRB" or the "Bank"), to assess the individual liability exposure of directors and officers of BRB (OCC Charter No. 48271; FDIC Certificate No. 31845) and its holding comp

II. Factual Background A. Institutional Profile Belmont Ridge Bank National Association is a national banking association chartered under 12 U.S.C. § 21 et seq., with OCC Charter No. 48271 and FDIC Certificate No. 31845. The Bank's RSSD ID is 1247893. BRB is a wholly-owned subsidiary of Belmont Ridge Financial Group, Inc., a Delaware corporation listed on the New York Stock Exchange under the ticker symbol "BRFG." Th

1. OFAC Sanctions Screening Failures. The Consent Order found that BRB failed to screen a significant volume of transactions processed through its BaaS channel for compliance with OFAC sanctions requirements. Specifically, approximately 12% of NovaPay wire and ACH transactions — equating to approximately 3,800,000 out of 31,700,000 total NovaPay transactions processed during calendar year 2023 — were not screened aga

2. SAR Filing Deficiencies. The Consent Order identified a backlog of approximately 2,400 unreviewed transaction monitoring alerts as of September 2024, the conclusion of the examination period. In addition, for SARs that were filed, the average time from alert generation to SAR filing was approximately 78 days, far exceeding the regulatory expectation of filing within 30 calendar days of the initial detection of a p

3. CDD/EDD Failures. The Consent Order found that approximately 47,000 high-risk customer accounts — primarily accounts onboarded through BaaS channels — lacked adequate CDD and EDD documentation. The FinCEN CDD Rule (31 C.F.R. § 1010.230) requires covered financial institutions to identify and verify the identity of the beneficial owners of legal entity customers at the time of account opening and to maintain update

4. Model Validation Failures. As noted above, the Veridian TMS v.8.3 had not been independently validated since March 2021 — a gap of more than three years prior to the examination. The last tuning of the system's monitoring parameters occurred in October 2022. Given the significant growth in BaaS transaction volumes during the intervening period and the evolving nature of money laundering typologies, the absence of

5. Board-Level Oversight Deficiencies. The Consent Order specifically criticizes the Bank's board-level governance and oversight of its BSA/AML compliance program. Key findings include: (a) the absence of a dedicated Compliance Committee at the Board level, requiring the Board to address BSA/AML matters through its existing committee structure, which proved inadequate; (b) Board-level BSA/AML reporting on a quarterly

III. Legal Framework: Federal Banking Law Liability Exposure This section analyzes the principal federal banking law and related statutory frameworks under which individual directors and officers of BRB and BRFG may face personal liability in connection with the matters identified in the Consent Order. The analysis addresses civil money penalties, removal and prohibition proceedings, cease-and-desist proceedings, and

1. Tier 1 Penalties — 12 U.S.C. § 1818(i)(2)(A) Tier 1 penalties are available for any violation of a law, rule, regulation, or any condition imposed in writing by the OCC, including any condition or requirement of a consent order. The statute authorizes the assessment of a CMP against any IAP for such a violation. The maximum Tier 1 penalty amount is currently approximately $11,000 per day for each day during which

2. Tier 2 Penalties — 12 U.S.C. § 1818(i)(2)(B) Tier 2 penalties require a higher threshold of culpability. The OCC must demonstrate that the IAP's violation, reckless engagement in an unsafe or unsound practice, or breach of fiduciary duty meets one or more of the following conditions: (a) the violation, practice, or breach was part of a pattern of misconduct; (b) the violation, practice, or breach caused or is like

3. Tier 3 Penalties — 12 U.S.C. § 1818(i)(2)(C) Tier 3 penalties represent the most severe tier of civil money penalties and are reserved for the most culpable conduct. The OCC must establish that the IAP committed a knowing violation or acted with reckless disregard for the applicable law, regulation, or condition, and that such knowing or reckless violation caused or is likely to cause a substantial loss to the ins

Section 1818(e) requires the OCC to establish three elements: (1) Misconduct Element: The IAP has (a) directly or indirectly violated any law, rule, regulation, consent order, condition imposed in writing, or written agreement; (b) engaged or participated in any unsafe or unsound practice in connection with the institution; or (c) committed or engaged in any act, omission, or practice constituting a breach of fiducia

IV. Shareholder Derivative Litigation Risk A. Breach of Fiduciary Duty Claims BRFG is incorporated in the State of Delaware, and Delaware law therefore governs the fiduciary duties of the BRFG Board of Directors. Under Delaware law, directors owe the corporation and its stockholders two fundamental fiduciary duties: the duty of care and the duty of loyalty. Duty of Care. The duty of care requires that directors exerc

Section 10(b) and Rule 10b-5 Claims. Potential plaintiffs could allege that BRFG and its officers made materially misleading statements or omissions regarding the adequacy of the Bank's BSA/AML compliance program in SEC filings — including Forms 10-K, 10-Q, and proxy statements — during the period preceding the public disclosure of the Consent Order. Specifically, plaintiffs would likely contend that BRFG's public fi

Section 20(a) Controlling Person Liability. In addition to direct claims under Section 10(b) and Rule 10b-5, individual officers face potential liability under Section 20(a) of the Securities Exchange Act of 1934 as "controlling persons" of BRFG. Section 20(a) imposes joint and several liability on any person who controls a person liable under the Exchange Act, unless the controlling person acted in good faith and di