Contract analysis

I. PURPOSE AND EXECUTIVE SUMMARY This memorandum has been prepared to analyze the Financial Crimes Enforcement Network's ("FinCEN") parallel monitoring role in the ongoing Bank Secrecy Act / Anti-Money Laundering ("BSA/AML") remediation effort at Belmont Ridge Bank National Association ("BRB" or the "Bank"), and to develop a proactive coordination strategy designed to mitigate the risk of separate FinCEN enforcement

II. BACKGROUND A. OCC Consent Order and SAR-Related Findings On January 15, 2025, the OCC issued Consent Order No. OCC-2025-003 against Belmont Ridge Bank National Association. The Consent Order was the culmination of a targeted BSA/AML examination conducted by the OCC from March 2024 through September 2024, during which OCC examiners identified pervasive deficiencies in BRB's BSA/AML compliance program across multip

1. SAR Filing Deficiencies. The Consent Order identifies a backlog of approximately 2,400 potentially suspicious activity alerts generated by the Veridian TMS that remained unreviewed and undispositioned as of September 2024, the close of the OCC examination period. Additionally, the OCC found that BRB's average SAR filing time — measured from the date of initial alert generation to the date of SAR filing with FinCEN

2. CDD/EDD Failures. The Consent Order identifies approximately 47,000 high-risk customer accounts — primarily accounts onboarded through BRB's BaaS fintech partners — that lacked adequate CDD/EDD documentation as of the examination date. These accounts were concentrated in BRB's BaaS channels, with NovaPay Technologies, FairLend Digital, and VaultEdge accounting for the vast majority. The CDD/EDD failures have a dir

3. Model Validation Deficiencies. The Consent Order identifies that BRB's primary transaction monitoring system, Veridian TMS v.8.3, had not been independently validated since March 2021 — nearly four years before the Consent Order date. Furthermore, the tuning parameters governing the system's alert-generation thresholds and detection scenarios had not been updated since October 2022. These deficiencies raise fundam

III. FINCEN ENFORCEMENT RISK ASSESSMENT A. Statutory and Regulatory Framework FinCEN's enforcement authority in this matter derives from the Bank Secrecy Act, as amended, and its implementing regulations. A clear understanding of this framework is essential to assessing the risk of separate FinCEN enforcement action and to designing an effective engagement strategy. SAR Filing Requirements. The obligation to file SAR

1. Severity and Duration of SAR Filing Deficiencies. The combination of a 78-day average SAR filing time and a backlog of 2,400 unreviewed alerts represents a material and prolonged failure to meet one of the most fundamental obligations under the BSA. FinCEN's enforcement division views timely SAR filing as a core requirement whose breach directly undermines law enforcement's ability to detect and prevent financial

2. Escalating Supervisory History. The trajectory from MRA (June 2022) to MRIA (November 2023) to Consent Order (January 2025) demonstrates a pattern of identified deficiencies that were not adequately addressed, despite progressively more urgent supervisory direction. FinCEN is likely to view this pattern as evidence that BRB's noncompliance was not the result of isolated operational failures but rather reflected a

3. Volume and Nature of Potentially Unreported Suspicious Activity. Given the 47,000 high-risk accounts lacking adequate CDD/EDD, the model validation and tuning gaps dating to late 2022, and the high volume of BaaS-related transactions ($74.3 billion in CY 2024), there is a meaningful probability that the SAR lookback will reveal a significant volume of previously unreported suspicious activity. If the lookback iden

4. FinCEN's Increased Focus on BaaS/Fintech Compliance. FinCEN has made clear through recent enforcement actions, guidance, and public statements that banks providing BaaS services bear the same BSA/AML compliance obligations with respect to accounts and transactions processed through their fintech partners as they do with respect to their directly-onboarded customers. BRB's BaaS concentration — 14 active fintech par

5. Potential discovery of Significant Unreported Activity in the SAR Lookback. The SAR lookback project, while necessary and appropriate, carries inherent risk: it may reveal previously unreported suspicious activity of a nature or scale that independently triggers FinCEN enforcement interest. The lookback period covers the timeframe during which the Veridian TMS was operating with stale tuning parameters and without

1. Existing OCC Penalty. BRB has already been assessed a $14.5 million CMP by the OCC. While this penalty does not legally preclude a separate FinCEN action, it is a factor that FinCEN's enforcement division may weigh in exercising its discretion. FinCEN has historically shown some degree of sensitivity to the cumulative financial burden imposed on an institution by multiple regulatory actions, particularly where the

2. Prompt Engagement of New Counsel and Independent Consultant. BRB's decision to engage C&H on February 10, 2025 — within approximately four weeks of the Consent Order's issuance — and its retention of the Thornfield Consulting Group as the independent consultant required under the Consent Order, both within the prescribed deadlines, demonstrate a level of responsiveness and seriousness of purpose that FinCEN is lik

3. Comprehensive Remediation Program with Substantial Budget. The Bank has committed a $42.5 million budget (exclusive of the $14.5 million CMP) to the remediation effort, for a total outlay of $57.0 million. This budget encompasses SAR backlog clearance, the SAR lookback project, transaction monitoring system upgrades, CDD/EDD remediation, staffing enhancements, and other compliance program improvements. The scale o

4. Proactive Engagement with FinCEN. Our recommended strategy of voluntary, proactive engagement with FinCEN — as detailed in Section IV below — is designed to demonstrate good faith and a cooperative posture. FinCEN's enforcement division has, in multiple prior matters, credited institutions that engaged proactively and transparently with reduced penalties or declinations of enforcement action.

5. Absence of DOJ Criminal Referral. As of February 10, 2025, no criminal referral has been made to the DOJ. While this fact does not preclude future referral, the absence of a concurrent criminal investigation reduces the immediate severity of the enforcement landscape and suggests that the OCC and FinCEN do not currently view the violations as involving conduct that rises to the level of criminal culpability. Asses

IV. RECOMMENDED FINCEN ENGAGEMENT STRATEGY A. Overarching Principles The FinCEN engagement strategy for BRB is built upon four overarching principles, each of which is essential to achieving the strategic objective of reducing the risk of separate FinCEN enforcement action while protecting the Bank's legal interests:

1. Proactive but Controlled Communication. BRB should adopt a posture of proactive engagement with FinCEN that demonstrates the Bank's cooperative spirit and genuine commitment to remediating the identified BSA/AML deficiencies. At the same time, all communications must be carefully controlled to avoid volunteering information beyond what is necessary to achieve the strategic objective and to avoid creating admission

2. Alignment with OCC Communications. All FinCEN communications must be consistent with, and must not contradict, representations made to the OCC in connection with the Consent Order remediation. Given that FinCEN and the OCC are coordinating in this matter, any inconsistency between the Bank's representations to the two agencies would be immediately apparent and would undermine credibility with both. The team should

3. Privilege Preservation. All substantive FinCEN engagement is to be coordinated through C&H. Internal BRB discussions regarding FinCEN strategy, risk assessment, and communication planning remain privileged attorney-client communications and attorney work product. Bank personnel should be clearly instructed that discussions about FinCEN strategy are privileged and should not be disclosed to third parties, including

4. Documentation Discipline. The engagement team will maintain contemporaneous records of all FinCEN communications — whether initiated by BRB/C&H or by FinCEN — in the OCC Correspondence Log & Tracking Memorandum maintained by C&H. These records will include the date, participants, medium (telephone, in-person meeting, email, letter), a summary of topics discussed, any commitments or representations made, and any fo

V. SAR FILING QUALITY IMPROVEMENTS TO MITIGATE FINCEN RISK The substantive remediation of SAR filing deficiencies is the single most important factor in mitigating FinCEN enforcement risk. While the engagement strategy and communication protocol described in Section IV are critical, they are ultimately supportive of the core imperative: demonstrating to FinCEN, through concrete and verifiable improvements, that BRB i