Contract analysis

I. EXECUTIVE SUMMARY AND PURPOSE Calderwood & Harkness LLP ("C&H" or "the Firm") was engaged by Belmont Ridge Bank National Association ("BRB," "Belmont Ridge," or "the Bank"; OCC Charter No. 48271; FDIC Certificate No. 31845) on February 10, 2025, to serve as outside regulatory counsel and to advise on the Bank Secrecy Act/Anti-Money Laundering ("BSA/AML") and sanctions compliance-program uplift mandated by Consent

II. BACKGROUND: THE CONSENT ORDER AND ITS CONTEXT A. Summary of Consent Order No. OCC-2025-003 On January 15, 2025, the OCC issued Consent Order No. OCC-2025-003 against Belmont Ridge Bank National Association. The Consent Order became effective immediately upon issuance. It is a public enforcement action and was posted to the OCC's enforcement actions database on the date of issuance. The Consent Order is the culmin

1. OFAC Sanctions Screening Failures The OCC found that BRB failed to screen 100% of transactions processed through its BaaS partner channels against OFAC sanctions lists. Specifically, the Consent Order determined that approximately 12% of all transactions processed through the Bank's largest BaaS partner, NovaPay Technologies Inc. ("NovaPay"), were not subjected to OFAC screening during calendar year 2023. This fai

2. SAR Filing Deficiencies The OCC found that BRB maintained a substantial backlog of unreviewed suspicious activity alerts. As of September 2024, the Bank had approximately 2,400 unreviewed alerts pending disposition. In addition, the Bank's average SAR filing time during the examination period was approximately 78 days from the date of initial detection of suspicious activity — far in excess of the 30-day regulator

3. CDD/EDD Failures The OCC found that approximately 47,000 high-risk customer accounts lacked adequate Customer Due Diligence or Enhanced Due Diligence documentation. The vast majority of these accounts were onboarded through the Bank's fintech BaaS partner channels. The OCC concluded that the Bank's CDD/EDD processes did not satisfy the requirements of FinCEN's CDD Rule (31 C.F.R. § 1010.230) or the Bank's own inte

4. Model Validation Deficiencies The OCC found that the Bank's transaction monitoring system — Veridian TMS v.8.3, provided by Veridian Analytics Inc. — had not been independently validated since March 2021, a period of more than three years prior to the commencement of the 2024 examination. In addition, the tuning parameters for the system had not been updated since October 2022. The OCC concluded that the Bank's fa

5. Board Oversight Deficiencies The OCC found that the BRB Board of Directors lacked a dedicated Compliance Committee and that BSA/AML reporting to the Board was only quarterly in frequency and omitted key metrics, including SAR volumes, OFAC screening hit rates, and risk ratings by BaaS partner. The OCC concluded that the Board's governance structure was insufficient to provide the level of oversight required by the

III. LEGAL FRAMEWORK FOR BOARD OVERSIGHT OF BSA/AML COMPLIANCE A. Federal Banking Law — Statutory Obligations The Bank Secrecy Act, codified at 31 U.S.C. §§ 5311–5332, together with its implementing regulations at 31 C.F.R. Chapter X, imposes on all banks and other covered financial institutions the obligation to establish and maintain an effective BSA/AML compliance program. The statutory and regulatory framework is

Article VII of Consent Order No. OCC-2025-003, captioned "Governance and Board Oversight Provisions," imposes a series of specific requirements on the Board of Directors. These requirements are mandatory, not advisory, and the Board's compliance with each requirement will be closely monitored by the OCC's examiners and by the independent consultant, Thornfield Consulting Group LLC. The key requirements are as follows

IV. ESTABLISHMENT AND MANDATE OF THE COMPLIANCE COMMITTEE A. Compliance Committee Composition The Consent Order requires the Board to establish a dedicated Compliance Committee to oversee all aspects of the Bank's BSA/AML and sanctions compliance remediation. The establishment of this Committee is one of the most immediate and important governance actions required of the Board. The Committee must be formally establis

V. INDIVIDUAL DIRECTOR RESPONSIBILITIES AND STANDARDS OF CONDUCT A. Duty of Care Each director of BRFG and BRB has a fiduciary duty of care that requires informed, diligent, and independent participation in Board and committee deliberations related to BSA/AML compliance and the Consent Order remediation. The duty of care is not a passive obligation; it demands that each director take affirmative steps to fulfill his

VI. REPORTING AND INFORMATION FLOW A. Monthly Reporting Package C&H recommends that BRB management, through Patricia Langston (CCO) and Thomas Ikeda (BSA Officer), prepare a comprehensive monthly BSA/AML compliance reporting package for the Compliance Committee. The reporting package should be distributed to Committee members no fewer than five (5) business days in advance of each scheduled monthly meeting to provide

VII. PERSONAL LIABILITY EXPOSURE FOR DIRECTORS AND OFFICERS The Board should understand that the Consent Order and the circumstances surrounding it create meaningful personal liability exposure for individual directors and officers. This section summarizes the principal categories of risk. A. Civil Money Penalties Under 12 U.S.C. § 1818 The OCC has broad authority under 12 U.S.C. § 1818(i) to impose civil money penal