Contract analysis

I. EXECUTIVE SUMMARY This First Quarterly Progress Report (this "Report") is submitted by Belmont Ridge Bank National Association ("BRB" or the "Bank") pursuant to the reporting requirements set forth in Article XII of Consent Order No. OCC-2025-003, issued by the Office of the Comptroller of the Currency (the "OCC") on January 15, 2025 (the "Consent Order"). This Report covers remediation progress across all five wo

1. Workstream 1 — OFAC Sanctions Screening Remediation: Addressing the failure to screen 100% of transactions processed through fintech Banking-as-a-Service ("BaaS") channels, with particular focus on the approximately 3,800,000 unscreened NovaPay Technologies Inc. transactions identified in Calendar Year 2023.

2. Workstream 2 — SAR Backlog Clearance & Process Improvement: Clearing the backlog of approximately 2,400 potentially suspicious activity alerts that were unreviewed as of September 2024, and implementing sustainable process improvements to ensure timely SAR filing going forward.

3. Workstream 3 — CDD/EDD Remediation: Remediating approximately 47,000 high-risk customer accounts—primarily those onboarded through fintech BaaS partners—that lacked adequate Customer Due Diligence ("CDD") or Enhanced Due Diligence ("EDD") documentation.

4. Workstream 4 — Transaction Monitoring Model Validation & Tuning: Upgrading the Bank's transaction monitoring system from Veridian TMS v.8.3 to Veridian TMS v.10.0, and completing an independent model validation to address the OCC's finding that the system had not been independently validated since March 2021.

5. Workstream 5 — BSA/AML Program Governance & Training Enhancement: Restructuring Board-level governance of BSA/AML compliance, expanding staffing, enhancing training, and updating the Bank's policy suite. Thornfield Consulting Group delivered its preliminary gap assessment on April 15, 2025, confirming and elaborating upon the five deficiency categories identified in the Consent Order. Informed by Thornfield's asse

II. BACKGROUND AND CONSENT ORDER OVERVIEW A. Regulatory History and Examination Findings BRB's current regulatory posture is informed by a supervisory history that includes escalating concern by the OCC over the Bank's BSA/AML compliance infrastructure, particularly as it pertains to the Bank's growing fintech BaaS business. The key supervisory events preceding the Consent Order are summarized below. In June 2022, th

1. OFAC Sanctions Screening Deficiencies. The OCC found that BRB failed to screen 100% of transactions processed through its fintech BaaS channels against applicable OFAC sanctions lists, including the Specially Designated Nationals and blocked Persons List ("SDN List"), the Consolidated Sanctions List, and applicable sectoral sanctions programs. The examination determined that approximately 12% of transactions proce

2. SAR Filing Deficiencies. The OCC identified a backlog of approximately 2,400 potentially suspicious activity alerts that remained unreviewed as of the September 2024 examination date. Furthermore, the OCC found that BRB's average SAR filing time—measured from the date of initial alert generation to the date of FinCEN filing—was approximately 78 days, far exceeding the regulatory expectation of timely filing within

3. CDD/EDD Failures. The OCC determined that approximately 47,000 high-risk customer accounts—the substantial majority of which had been onboarded through BRB's fintech BaaS partners—lacked adequate CDD or EDD documentation as required by the Bank Secrecy Act, its implementing regulations, and BRB's own policies. The deficiencies encompassed missing or incomplete customer identification information, inadequate benefi

4. Model Validation Deficiencies. The OCC cited BRB's failure to maintain a current independent validation of its transaction monitoring system, Veridian TMS v.8.3, provided by Veridian Analytics Inc. under Contract No. VA-BRB-2023-0044. The system had not been independently validated since March 2021—a period of more than three years prior to the examination—and the tuning parameters governing alert generation scena

5. Board Oversight Deficiencies. The OCC found that BRB's Board of Directors did not maintain a dedicated Compliance Committee, and that BSA/AML reporting to the Board was limited to quarterly presentations that lacked key metrics essential for effective oversight. Specifically, Board reporting did not include SAR volumes and filing timeliness data, OFAC screening hit rates, risk ratings by BaaS partner, CDD/EDD comp

III. ORGANIZATIONAL AND GOVERNANCE ACTIONS A. Board Resolution and Compliance Committee Establishment On February 28, 2025, the Board of Directors of Belmont Ridge Financial Group, Inc. ("BRFG") and its wholly owned subsidiary, Belmont Ridge Bank National Association, adopted a formal Board Resolution (the "Resolution") in compliance with Article IV of the Consent Order, which required Board acknowledgment of the Con

IV. INDEPENDENT CONSULTANT ENGAGEMENT AND ACTIVITIES A. Engagement of Thornfield Consulting Group LLC Pursuant to Article VII of the Consent Order, which requires BRB to engage an independent consultant acceptable to the OCC, the Bank selected Thornfield Consulting Group LLC as its independent consultant for purposes of assessing, monitoring, and validating the Bank's remediation activities. Thornfield's principal of

V. WORKSTREAM 1: OFAC SANCTIONS SCREENING REMEDIATION A. Deficiency Summary The OCC's examination determined that BRB's OFAC sanctions screening system failed to screen 100% of transactions processed through the Bank's fintech BaaS channels. The deficiency was most acute with respect to transactions originated by NovaPay Technologies Inc., BRB's largest BaaS partner, where approximately 12% of wire and ACH transactio

VI. WORKSTREAM 2: SAR BACKLOG CLEARANCE & PROCESS IMPROVEMENT A. Deficiency Summary As of September 2024, the date of the OCC examination, BRB maintained a backlog of approximately 2,400 potentially suspicious activity alerts that had been generated by the Bank's transaction monitoring system but remained unreviewed. These alerts had accumulated over a period of months as alert volumes—driven in significant part by t

VII. WORKSTREAM 3: CDD/EDD REMEDIATION A. Deficiency Summary The OCC found that approximately 47,000 high-risk customer accounts lacked adequate CDD or EDD documentation as required by the Bank Secrecy Act, FinCEN's CDD Rule (31 C.F.R. § 1010.230), and BRB's internal policies. The substantial majority of these accounts were onboarded through BRB's fintech BaaS partners, where the division of responsibility for custom

VIII. WORKSTREAM 4: TRANSACTION MONITORING MODEL VALIDATION & TUNING A. Deficiency Summary The OCC found that BRB's transaction monitoring system, Veridian TMS v.8.3, provided by Veridian Analytics Inc. under Contract No. VA-BRB-2023-0044, had not been independently validated since March 2021—a period of more than three years prior to the commencement of the OCC examination. Furthermore, the tuning parameters governi