Contract analysis

I. Purpose of Memorandum This memorandum documents the work performed by Calderwood & Harkness LLP ("C&H" or the "Firm") in ensuring that Belmont Ridge Bank National Association ("BRB" or the "Bank") achieved full and timely compliance with the independent consultant selection and engagement requirements set forth in Article VII of Consent Order No. OCC-2025-003 (the "Consent Order"), issued by the Office of the Comp

II. Background A. Consent Order Overview On January 15, 2025 (the "Effective Date"), the Office of the Comptroller of the Currency issued Consent Order No. OCC-2025-003 against Belmont Ridge Bank National Association, a nationally chartered bank headquartered in Stamford, Connecticut. The Consent Order was issued pursuant to 12 U.S.C. § 1818(b) and was the product of a negotiated resolution between BRB and the OCC fo

1. Inadequate OFAC Sanctions Screening Protocols. The OCC found that BRB's OFAC sanctions screening protocols were materially deficient, particularly with respect to transaction flows originating through BRB's banking-as-a-service ("BaaS") partnership with NovaPay Technologies Inc. ("NovaPay"), a fintech payments platform. The OCC determined that approximately twelve percent (12%) of NovaPay wire transfer and Automat

2. Deficient SAR Filing Timeliness and Quality. The OCC identified significant deficiencies in BRB's Suspicious Activity Report ("SAR") filing process, including both timeliness and quality of filings. As of September 2024, BRB maintained a backlog of approximately 2,400 unreviewed transaction monitoring alerts, representing cases that had been generated by BRB's automated monitoring systems but had not been disposit

3. Insufficient CDD/EDD for High-Risk Customers Onboarded Through Fintech Partners. The OCC found that BRB's Customer Due Diligence ("CDD") and Enhanced Due Diligence ("EDD") procedures were insufficient with respect to high-risk customers onboarded through BRB's fintech partnership channels. Approximately 47,000 accounts onboarded through fintech partners — including but not limited to NovaPay — lacked adequate CDD

4. Inadequate Model Validation for Transaction Monitoring System. The OCC determined that BRB's transaction monitoring system — Veridian TMS v.8.3, a third-party platform deployed across BRB's core banking operations — had not been independently validated since March 2021, and that the system's tuning parameters (including thresholds, rules, and typologies) had not been updated since October 2022. The absence of time

5. Board-Level Oversight Deficiencies. The OCC found that BRB's Board of Directors had failed to exercise adequate oversight over the Bank's BSA/AML and OFAC compliance programs. Specifically, the Board had not established a dedicated Compliance Committee (as distinguished from the Audit Committee, which had been tasked with compliance oversight on an ad hoc basis), and the BSA/AML reporting metrics provided to the B

Article VII of the Consent Order requires BRB to engage an independent consultant, acceptable to the OCC, to conduct a comprehensive assessment of BRB's BSA/AML and OFAC compliance program and to validate the Bank's remediation efforts undertaken in response to the Consent Order's findings. The independent consultant requirement is a standard element of OCC enforcement actions involving significant BSA/AML deficienci

Article VII specifies that the independent consultant must satisfy three core requirements. First, the consultant must be independent from BRB, meaning that the consulting firm and its key engagement personnel have no prior consulting, auditing, or advisory relationships with BRB that would create a conflict of interest or impair the consultant's objectivity. Second, the consultant must possess demonstrated expertise

III. Independent Consultant Candidate Identification and Evaluation A. Candidate Identification Process Immediately upon the formal commencement of C&H's engagement on February 10, 2025, the Firm undertook an accelerated process for identifying independent consultant candidates qualified to serve under Article VII of the Consent Order. The compressed timeline for this process was dictated by the Consent Order's Febru

IV. OCC Non-Objection Submission A. Submission to OCC C&H, acting on behalf of BRB, submitted a formal letter to the OCC Northeastern District Office, located at 340 Madison Avenue, New York, NY 10017, seeking non-objection to the engagement of Thornfield Consulting Group LLC as the independent consultant pursuant to Article VII of Consent Order No. OCC-2025-003. The letter was addressed to Jonathan Frey, National Ba

V. Execution of Thornfield Engagement Agreement A. Engagement Agreement Terms Following receipt of the OCC's written non-objection on February 5, 2025, C&H proceeded to draft the Independent Consultant Engagement Agreement (the "Engagement Agreement") between Belmont Ridge Bank National Association and Thornfield Consulting Group LLC. The Engagement Agreement was prepared by C&H and incorporates the terms and conditi

VI. Compliance Timeline Summary The following table summarizes the key dates and events in the independent consultant selection and non-objection process: As reflected in the timeline above, the Consent Order's February 15, 2025 deadline for engagement of the independent consultant was met with five days of margin, with the Engagement Agreement and all ancillary documentation having been executed on February 10, 2025

VII. Observations and Conclusions A. Compliance with Article VII Based on the work documented in this memorandum, it is C&H's assessment that BRB has achieved full and timely compliance with the independent consultant selection and engagement requirements of Article VII of Consent Order No. OCC-2025-003. All elements of Article VII have been satisfied: BRB identified a qualified independent consultant, submitted the