Contract analysis

From: Yuki Nakamura <ynakamura@calderwoodharkness.com> To: Thomas Ikeda <tikeda@belmontridgebank.com> Cc: Carlos Espinoza <cespinoza@calderwoodharkness.com> Date: Tue, 18 Feb 2025 10:43:00 -0000 Subject: SAR Backlog Clearance Workplan — Draft Triage Protocol and Pinnacle Staffing Coordination

Attachment(s): SAR_Backlog_Triage_Protocol_DRAFT_2025-02-18.docx

I hope you're doing well. It was good connecting with you and your team during last week's sessions following our engagement kickoff on February 10. I appreciate how quickly you've been getting us up to speed — it's making a real difference as we build out the workplan.

I'm writing to transmit the attached **draft SAR Backlog Triage Protocol** for your review and comment, and to coordinate on several related items, including the deployment of Pinnacle Compliance Solutions staffing to support backlog clearance. For reference, this falls under **C&H Matter No. 1045-00002**.

There's a fair amount to cover below, so I've organized this into sections for ease of reference.

As you know, the OCC's targeted BSA/AML examination (March 2024–September 2024) and the resulting **Consent Order No. OCC-2025-003** identified approximately **2,400 potentially suspicious activity alerts that remained unreviewed** as of the September 2024 examination date. The examination also found that BRB's average SAR filing time was **78 days from alert generation**, well in excess of the expected 30-day benchm

The Consent Order requires timely remediation of these deficiencies. The two key milestones we are working toward are:

- **March 31, 2025** — Interim SAR backlog status report due to the OCC - **June 30, 2025** — Full backlog clearance target

These dates are driving the urgency behind the workplan items outlined below.

**2. Summary of the Attached Draft SAR Backlog Triage Protocol**

The attached draft protocol establishes a prioritization framework for dispositioning the 2,400 unreviewed alerts. Here are the key elements:

- **Risk-Ranking Criteria:** Alerts are scored based on (i) transaction amount, (ii) customer risk rating, (iii) alert type/scenario, and (iv) BaaS partner association. On this last point, BaaS-related SARs constituted approximately 2,108 of 3,847 total SARs filed in CY 2024 (~54.8% of all SARs), so we anticipate that BaaS-linked alerts will represent a significant portion of the backlog.

- **Triage Categories:** Alerts are sorted into **high, medium, and low priority tiers** based on the risk-ranking criteria.

- **Escalation Thresholds:** The protocol defines criteria for escalating alerts that may require immediate SAR filing or further investigation, including indicators of potential ongoing illicit activity.

- **Assignment Methodology:** The protocol outlines how alerts will be distributed between BRB's existing 62 BSA/AML FTEs and the incoming Pinnacle temporary analysts, with higher-complexity alerts assigned to more experienced staff.

**I'd appreciate your input on the following:**

- Do the risk-ranking criteria appropriately reflect BRB's current alert typologies? - Are there alert scenarios unique to BRB's BaaS channels — particularly the **NovaPay**, **FairLend Digital**, and **VaultEdge** flows — that need additional weighting or separate handling? We want to make sure the protocol captures any nuances that may not have been apparent from the documentation we've reviewed to date.

**3. Pinnacle Compliance Solutions — Staffing Coordination**

Turning to staffing. Under the Pinnacle Compliance Solutions managed services engagement (**SOW Ref: PCS-BRB-2025-0012**), BRB has secured 30 full-time-equivalent BSA/AML analysts at $10,000/month per FTE for a 12-month term ($3,600,000 total contract value). Andrea Solis, Pinnacle's Director of Managed Services, has confirmed readiness to begin ramping staff.

A few items I'd like to coordinate with you:

**(a) Onboarding Date.** We'd suggest targeting the **first week of March** for the initial wave of Pinnacle analysts. This aligns with Thornfield Consulting Group's on-site assessment commencement on March 1, 2025, and ensures staffing is visibly in place when the independent consultant begins evaluating remediation efforts. Does that timeline work from your end?

**(b) Workspace and System Access.** Pinnacle analysts will need access to BRB's transaction monitoring system (**Veridian TMS v.8.3**) and your case management platforms. Could you coordinate with **Linda Petrosian** (CIO/CTO) on credentialing and access provisioning? The sooner we can initiate that process, the better positioned we'll be for a smooth onboarding.

**(c) Supervision Structure.** We are preparing a separate memorandum on temporary staff supervision and quality control protocols, which we'll circulate shortly. In the interim, our recommendation is that the Pinnacle analysts **report directly to you as BSA Officer**, with quality review sampling conducted by BRB's permanent compliance staff. We believe this structure best demonstrates to the OCC that the bank — no

Our working assumption is that Pinnacle analysts will be deployed **primarily on SAR backlog triage and alert disposition** initially, then transition to supporting the broader SAR lookback project (estimated at a $5,500,000 budget) once the immediate backlog is substantially cleared.

**4. SAR Lookback — Preliminary Scope Considerations**

On a related track, we are separately developing the **SAR Lookback Scope & Methodology Memorandum**, which will define the lookback period, transaction types, customer populations, and sampling methodology. The lookback will need to cover both retail banking and BaaS channel activity, given the concentration of suspicious activity in fintech partner flows.

To support that effort, I'd ask you to begin compiling the following when you have bandwidth:

- Historical alert volumes and disposition outcomes - Any prior lookback or quality review exercises BRB has conducted - Outputs from the **Caldera & Pope independent BSA/AML test** completed in September 2024, to the extent those findings inform the lookback scope

No immediate deadline on this — we'll set a more specific timeline once the lookback memorandum is further along — but earlier is always better.

This one is time-sensitive. We will draft the interim SAR backlog status report for BRB's review, but we need current data from your team to get started:

- Number of the ~2,400 alerts dispositioned to date (as of the most recent count available) - Any SARs filed from the backlog since the Consent Order was issued on January 15, 2025 - Current staffing allocation dedicated to backlog clearance

**Could you provide this data by end of day Friday, February 21?** That will give us sufficient lead time to prepare a solid draft well in advance of the March 31 filing deadline.

To keep everything on track, here are the action items as I see them:

1. **Thomas** — Review the attached draft SAR Backlog Triage Protocol and provide comments by **February 25, 2025**. 2. **Thomas** — Coordinate with Linda Petrosian's team on Pinnacle analyst system access and workspace by **February 28, 2025**. 3. **Thomas** — Provide current backlog disposition data by **February 21, 2025**. 4. **C&H (Carlos Espinoza)** — Schedule an initial coordination call with Andrea Solis at P

Additionally, I'd like to propose a **standing weekly working call** between C&H (Carlos and me) and your team to track backlog clearance progress through the June 30, 2025 target date. We can discuss cadence and scheduling on the Pinnacle coordination call.

I've copied Patricia for visibility given her role as CCO and overall accountability for the compliance program remediation.

Please don't hesitate to call or email if you have any questions on the above or the attached protocol. If it would be helpful to sit down in person to walk through the triage framework, I'm happy to come to your offices at 680 Lexington Avenue — just let me know what works.

**Yuki Nakamura** Lead Associate, Litigation (General) Practice Group Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, NY 10019 T: (212) 554-7823 E: ynakamura@calderwoodharkness.com

*CONFIDENTIALITY NOTICE: This email message and any attachments are confidential, may be protected by the attorney-client privilege and/or work-product doctrine, and are intended solely for the use of the individual or entity to whom this message is addressed. If you are not the intended recipient, you are hereby notified that any use, dissemination, distribution, or copying of this communication is strictly prohibit