Contract analysis

I. Purpose and Executive Summary This memorandum sets forth Calderwood & Harkness LLP's ("C&H") recommendations for fifteen (15) permanent full-time equivalent ("FTE") additions to the Bank Secrecy Act / Anti-Money Laundering ("BSA/AML") compliance department of Belmont Ridge Bank National Association ("BRB" or the "Bank"). The recommendations contained herein are the product of C&H's comprehensive assessment of the

II. Consent Order Requirements Driving Headcount Expansion A. Core Deficiency Categories Requiring Additional Staff The Consent Order identifies multiple categories of deficiency across BRB's BSA/AML and OFAC compliance programs. Each of these categories implicates the need for additional permanent compliance personnel. Below, we summarize the key deficiency findings and their staffing implications.

1. OFAC Sanctions Screening (Consent Order, Article III)

Article III of the Consent Order addresses BRB's failure to maintain an effective sanctions compliance program, with particular emphasis on the Bank's failure to screen 100% of transactions processed through its BaaS channels against the OFAC Specially Designated Nationals and blocked Persons List ("SDN List"), the Consolidated Sanctions List, and applicable sectoral sanctions lists. The OCC's examination findings re

2. SAR Filing Deficiencies (Consent Order, Article IV)

Article IV of the Consent Order addresses BRB's failure to file Suspicious Activity Reports ("SARs") in a timely and complete manner. The examination found that the Bank maintained a backlog of approximately 2,400 unreviewed transaction monitoring alerts as of September 2024, and that the average time from alert generation to SAR filing was approximately seventy-eight (78) days. This significantly exceeds the thirty

3. CDD/EDD Failures (Consent Order, Article V)

Article V of the Consent Order addresses BRB's failure to maintain an adequate Customer Due Diligence and Enhanced Due Diligence program, as required by 31 C.F.R. § 1020.210 and OCC supervisory expectations. The examination identified approximately 47,000 high-risk customer accounts that lacked adequate CDD/EDD documentation. The majority of these accounts were onboarded through the Bank's fintech partner channels, w

4. Model Validation Deficiencies (Consent Order, Article VI)

Article VI of the Consent Order addresses deficiencies in BRB's transaction monitoring model risk management practices. Specifically, the OCC found that the Bank's primary transaction monitoring system, Veridian TMS v.8.3, had not been subjected to an independent model validation since March 2021—a gap of nearly four years. Furthermore, the system's detection scenarios and thresholds had not been tuned since October

5. Board Oversight and Program Governance (Consent Order, Article VIII)

Article VIII of the Consent Order addresses deficiencies in Board-level oversight of BRB's BSA/AML compliance program. In response, the Bank has established a dedicated Compliance Committee of the Board, chaired by James Rutherford, which will receive monthly reporting on key compliance metrics including SAR volumes and filing timeliness, OFAC screening hit rates, CDD/EDD remediation progress, transaction monitoring

III. Current Organizational Structure — BSA/AML Department A. Existing Headcount: 62 FTEs BRB's BSA/AML compliance department currently comprises sixty-two (62) permanent FTEs, organized across nine functional areas. The department is led by Thomas Ikeda, who holds the title of BSA Officer and AML Program Director. Mr. Ikeda was appointed to this role in March 2023 and is responsible for the overall design, implement

IV. Recommended Position Descriptions — 15 New Permanent FTEs The following section provides detailed position descriptions for each of the fifteen recommended new permanent FTE positions. Each description includes the reporting structure, estimated fully loaded annual cost, purpose and rationale, minimum qualifications, and key responsibilities. The positions are numbered sequentially and organized by functional are

V. Cost Summary The following table summarizes the estimated fully loaded annual cost of the fifteen recommended positions: The total estimated annual cost of $2,205,000 falls within the Board-approved budget allocation of $2,250,000 for internal headcount additions. The $45,000 buffer between the estimated position costs and the approved budget allocation is intended to cover hiring-related costs, including recruiti

VI. Reporting Structure — Post-Hiring Organizational Chart Upon completion of the recommended hiring plan, the BSA/AML compliance department organizational structure will be as follows: Patricia Langston, Chief Compliance Officer Reports to: CEO Diane Whitford (direct reporting line); Compliance Committee, chaired by James Rutherford (dotted-line reporting) Thomas Ikeda, BSA Officer / AML Program Director Deputy BSA

VII. Phased Hiring Timeline C&H recommends a phased approach to hiring that aligns the timing of new hires with Consent Order milestones and remediation workstream needs. The phased approach recognizes that not all positions are of equal urgency and that the Bank's recruiting capacity will be most effective if deployed in a structured manner. The three phases are summarized below. Phase A: Critical Hires (March – Apr

1. Deputy BSA Officer / Senior AML Program Manager (Position 1) — Needed to support remediation oversight, Compliance Committee reporting, and the preparation of the interim SAR backlog report due to the OCC by March 31, 2025. This position is the highest-priority hire in the entire plan.

2. Senior SAR Investigators (Positions 2–3, 2 FTEs) — Needed for SAR backlog clearance operations targeting the June 30, 2025 deadline. These senior investigators will provide quality oversight of the SAR work product being produced by Pinnacle temporary staff and will handle the most complex escalated cases.

3. OFAC / Sanctions Compliance Analyst (Position 7, 1 FTE) — Needed for OFAC remediation testing, including the retroactive review of unscreened BaaS transactions, and for enhanced ongoing BaaS screening oversight.

4. Compliance Data Analyst / Reporting Specialist (Position 15, 1 FTE) — Needed to support the Compliance Committee reporting framework. The Committee held its initial organizational meeting following the Board Resolution on February 28, 2025, and will require monthly reporting packages beginning in April 2025. This analyst is also needed to develop and maintain the CDD/EDD Progress Tracking Dashboard.

5. BaaS / Fintech Compliance Specialist (Position 11, 1 FTE) — Needed for enhanced BaaS partner oversight, including follow-up on compliance remediation letters issued to NovaPay and FairLend Digital in connection with the Consent Order, and for the launch of the quarterly BaaS partner risk assessment program. Target Start Date: On or before April 15, 2025, to coincide with Thornfield Consulting's preliminary gap ass

1. SAR Analysts / Investigators (Positions 4–6, 3 FTEs) — Needed to build sustainable post-Pinnacle investigation capacity. These hires should be onboarded in advance of the June 30, 2025 SAR backlog clearance target to contribute to the final push, and more importantly, to be trained and acclimated to BRB's systems and processes before the Pinnacle staff begin to phase out. With the three Phase A SAR hires already i

2. OFAC / Sanctions Compliance Analyst (Position 8, 1 FTE) — The second OFAC hire supports the November 1, 2025 deadline for full operationalization of enhanced OFAC screening across all BaaS channels. This analyst will participate in the testing and validation of the upgraded Veridian OFAC screening module and will provide additional capacity for the expanded sanctions screening workload.

3. KYC / CDD / EDD Analyst (Position 9, 1 FTE) — Needed to support the CDD/EDD remediation effort, which has a fifty percent (50%) completion milestone of July 15, 2025 (representing approximately 23,500 of the 47,000 accounts requiring remediation). While the bulk of the remediation backlog work is being performed by Pinnacle staff, this permanent analyst will contribute to the effort and begin transitioning to stea

4. BaaS / Fintech Compliance Specialist (Position 12, 1 FTE) — The second BaaS compliance hire expands the partner oversight team to its full complement of six and provides additional capacity ahead of the second quarterly BaaS partner risk assessment cycle. This specialist will take on dedicated coverage responsibilities for specific partner relationships. Target Start Date: On or before July 1, 2025. Phase C: Remai

1. KYC / CDD / EDD Analyst (Position 10, 1 FTE) — The second KYC/CDD hire supports ongoing periodic review obligations and the 100% CDD/EDD remediation completion milestone of January 15, 2026 (all 47,000 accounts). This analyst will be primarily focused on steady-state ongoing reviews rather than backlog remediation.

2. Model Risk / TM Governance Analyst (Position 13, 1 FTE) — Needed to support post-deployment governance of Veridian TMS v.10.0. The system is scheduled to complete UAT by August 1, 2025, with production deployment shortly thereafter, and an independent model validation targeted for October 1, 2025. The Model Risk Analyst should be onboarded in time to participate in the final stages of UAT and to lead the coordinat

3. BSA/AML Quality Assurance Specialist (Position 14, 1 FTE) — Supports the post-remediation quality assurance framework and OCC examination preparedness. By the time this position is filled, the core remediation workstreams should be substantially advanced, and the focus will shift to ensuring that the quality of ongoing compliance operations is systematically tested and documented. This QA Specialist will be critic