Contract analysis

I. Purpose and Executive Summary This memorandum evaluates three candidate firms under consideration for the independent consultant role mandated by Article VII of Consent Order No. OCC-2025-003, issued by the Office of the Comptroller of the Currency on January 15, 2025, against Belmont Ridge Bank National Association ("BRB" or the "Bank") (OCC Charter No. 48271; FDIC Certificate No. 31845). The purpose of this eval

Article VII of the Consent Order requires BRB to engage, within thirty (30) days of the effective date of the Order — that is, by no later than February 14, 2025 — an independent consultant acceptable to the OCC. The independent consultant is charged with conducting a comprehensive assessment of BRB's Bank Secrecy Act / Anti-Money Laundering ("BSA/AML") and Office of Foreign Assets Control ("OFAC") compliance program

1. Thornfield Consulting Group LLC ("Thornfield")

2. Bracken Advisory Partners LLC ("Bracken")

3. Merriweather Risk Consulting LLC ("Merriweather") Each firm was evaluated against a set of five weighted selection criteria developed by C&H in consultation with Patricia Langston, Chief Compliance Officer, and Gregory Nardone, General Counsel. These criteria, described in detail in Section III below, reflect the specific requirements of Article VII and the particular nature of BRB's deficiency profile, which invo

II. Background and Consent Order Requirements A. Consent Order Context OCC Consent Order No. OCC-2025-003 was issued on January 15, 2025, following a targeted BSA/AML examination of BRB conducted by the OCC's Northeastern District Office from March 2024 through September 2024. The examination was precipitated by a series of escalating supervisory concerns regarding BRB's BSA/AML and OFAC compliance program, particula

1. OFAC Sanctions Screening Failures. The OCC determined that approximately twelve percent (12%) of transaction volume associated with BRB's largest BaaS partner, NovaPay Technologies Inc. ("NovaPay"), was not subjected to OFAC sanctions screening during calendar year 2023. Specifically, approximately 3,800,000 wire and ACH transactions out of a total of approximately 31,700,000 NovaPay transactions in CY 2023 were u

2. Suspicious Activity Report ("SAR") Filing Deficiencies. As of September 2024 — the conclusion of the OCC examination — BRB had a backlog of approximately 2,400 unreviewed transaction monitoring alerts. The OCC further determined that the Bank's average time from alert generation to SAR filing was approximately 78 days, well in excess of the regulatory expectation of 30 days from the date of initial detection. The

3. Customer Due Diligence ("CDD") and Enhanced Due Diligence ("EDD") Failures. The OCC identified approximately 47,000 high-risk customer accounts — the substantial majority of which were onboarded through BRB's fintech BaaS partners — lacking adequate CDD and EDD documentation. The deficiencies included incomplete beneficial ownership information, missing or stale risk ratings, and insufficient ongoing monitoring of

4. Transaction Monitoring Model Validation. BRB's primary transaction monitoring system, Veridian TMS version 8.3 (a product of Veridian Analytics, Inc.), had not undergone an independent model validation since March 2021. Furthermore, the system's tuning parameters were last updated in October 2022. The OCC concluded that the failure to validate and tune the transaction monitoring model on a timely basis created a s

5. Board Oversight Deficiencies. The OCC found that BRB's Board of Directors lacked a dedicated Compliance Committee and that BSA/AML and OFAC compliance reporting to the Board was inadequate. Specifically, the Board received only summary-level BSA/AML metrics on a quarterly basis, without sufficient granularity regarding alert backlog trends, SAR filing timeliness, sanctions screening coverage rates, or fintech part

Article VII of the Consent Order sets forth the specific requirements governing the engagement of the independent consultant. These requirements are summarized below: Independence. The consultant must be independent of BRB. Specifically, the consultant firm must have had no prior engagement with BRB or its affiliates within the preceding twenty-four (24) months that would impair the consultant's independence or objec

III. Selection Criteria C&H developed the following weighted evaluation criteria in consultation with BRB management, specifically Patricia Langston, Chief Compliance Officer, and Gregory Nardone, General Counsel. The criteria and weightings were designed to reflect the specific requirements of Article VII, the nature and complexity of BRB's deficiency profile, and the practical demands of a twelve-month intensive re

1. BSA/AML and OFAC Subject Matter Expertise (30% Weight — Maximum 30 Points) This criterion evaluates the depth and breadth of each candidate firm's team expertise in BSA/AML compliance, OFAC sanctions programs, suspicious activity reporting, customer due diligence and enhanced due diligence, and transaction monitoring model validation. Given the breadth of BRB's deficiency profile — spanning five distinct categorie

2. OCC Engagement Experience (25% Weight — Maximum 25 Points) This criterion evaluates each candidate firm's prior experience serving as an OCC-mandated independent consultant or in a similar regulatory-mandated role, as well as the firm's familiarity with OCC supervisory expectations, examination processes, and communication protocols. The OCC non-objection process is not merely a formality; the OCC will scrutinize

3. Fintech / BaaS Compliance Expertise (20% Weight — Maximum 20 Points) This criterion evaluates each candidate firm's demonstrated experience with Banking-as-a-Service models, fintech partnership compliance oversight, and payments compliance. This criterion was given significant weight — twenty percent — because the deficiencies identified in the Consent Order are inextricably linked to BRB's BaaS operations. The OF

4. Team Composition and Capacity (15% Weight — Maximum 15 Points) This criterion evaluates the seniority, qualifications, and availability of each candidate firm's proposed team members, as well as the firm's ability to commit sufficient resources for a twelve-month intensive engagement commencing with on-site assessment in early March 2025. The independent consultant engagement will require substantial commitment of

5. Fee Structure and Value (10% Weight — Maximum 10 Points) This criterion evaluates the reasonableness of each candidate firm's proposed fees relative to the scope of the engagement, and the alignment of the proposed fees with BRB's board-approved remediation budget of $42,500,000 (exclusive of the $14,500,000 CMP). While cost is a relevant consideration, it was assigned the lowest weighting because the Bank's overr

IV. Candidate Firm Profiles and Evaluation A. Thornfield Consulting Group LLC

1. Firm Overview Full Legal Name: Thornfield Consulting Group LLC Entity Type: Delaware limited liability company Principal Address: 200 Park Avenue South, 15th Floor, New York, New York 10003 Practice Areas: Thornfield is a specialized financial crimes advisory firm focusing on BSA/AML compliance, OFAC sanctions program design and remediation, regulatory remediation engagements, and fintech and payments compliance a

2. Proposed Team Thornfield has proposed a senior, well-credentialed engagement team comprising four senior professionals, supported by a broader team of approximately eight to ten additional consultants who would be deployed as needed over the course of the engagement. The four proposed senior team members are as follows: Dr. Vivian Castellano — Managing Director, Financial Crimes Advisory (Engagement Lead). Dr. Cas

3. Relevant Experience Thornfield's experience profile is the most closely aligned with BRB's specific needs among the three candidate firms. Key highlights of the firm's relevant experience include: • Four Prior OCC-Mandated Independent Consultant Engagements. Thornfield, under Dr. Castellano's leadership, has served as the OCC-mandated independent consultant in at least four prior BSA/AML consent order engagements

4. Proposed Fee Structure Thornfield's proposed fee structure is as follows: The fixed-fee structure provides cost certainty for BRB and eliminates the risk of fee disputes related to hourly billing or scope-related rate increases. The expense cap of $400,000 covers travel, technology access, secure document production, and other engagement-related out-of-pocket costs. No success fee, completion bonus, or other conti

5. Evaluation Scores (Weighted) B. Bracken Advisory Partners LLC

1. Firm Overview Full Legal Name: Bracken Advisory Partners LLC Entity Type: Delaware limited liability company Principal Address: 777 Third Avenue, 28th Floor, New York, New York 10017 Practice Areas: Bracken is a regulatory compliance consulting firm serving the financial services industry. Its practice areas include BSA/AML advisory, financial institution risk management, regulatory compliance program design, and

2. Proposed Team Martin Caufield — Senior Managing Director (Proposed Engagement Lead). Mr. Caufield has approximately fifteen years of BSA/AML consulting experience and has served as the independent consultant in two prior OCC-mandated engagements. However, both of those engagements involved traditional commercial banks — not institutions with significant fintech or BaaS operations — and the deficiencies in those en

3. Relevant Experience Bracken's relevant experience includes two prior OCC-mandated independent consultant engagements, both of which involved smaller institutions with total assets under $10 billion and traditional BSA/AML deficiencies focused on SAR filing backlogs and CDD program weaknesses. While these engagements demonstrate that Bracken is capable of fulfilling the independent consultant role in a straightforw

4. Proposed Fee Structure Bracken's proposal is the lowest-cost among the three candidates, representing a savings of $750,000 relative to Thornfield and $1,550,000 relative to Merriweather. However, the lower cost must be evaluated in light of the firm's lower evaluation scores on the substantive criteria. A lower fee does not deliver value if the consultant lacks the expertise to effectively fulfill the mandate.

5. Evaluation Scores (Weighted) C. Merriweather Risk Consulting LLC

1. Firm Overview Full Legal Name: Merriweather Risk Consulting LLC Entity Type: New York limited liability company Principal Address: 1345 Broadway, 22nd Floor, New York, New York 10018 Practice Areas: Merriweather is a broad-based risk management and compliance advisory firm serving financial institutions. Its practice areas include enterprise risk management, compliance advisory, financial crimes consulting, and re

2. Proposed Team Karen Albrecht — Partner (Proposed Engagement Lead). Ms. Albrecht has approximately eighteen years of experience in financial crimes compliance and has served as the independent consultant in three prior OCC-mandated engagements. Her experience includes comprehensive BSA/AML program assessments, SAR quality reviews, and transaction monitoring system evaluations. Ms. Albrecht is a well-regarded profes

3. Relevant Experience Merriweather's relevant experience is stronger than Bracken's but does not reach the level of alignment demonstrated by Thornfield. Key highlights include: • Three Prior OCC-Mandated Independent Consultant Engagements. Ms. Albrecht has led three such engagements, including one involving a bank with approximately $25 billion in total assets — a size more comparable to BRB than the institutions i

4. Proposed Fee Structure Merriweather's proposal is the highest-cost among the three candidates, exceeding Thornfield's all-in cost by $800,000 and Bracken's by $1,550,000. The higher fee reflects, in part, Merriweather's broader organizational overhead as a larger, more diversified firm. However, the premium over Thornfield is difficult to justify given that Merriweather scored lower than Thornfield on every substa

5. Evaluation Scores (Weighted)

V. Comparative Summary Table The following table presents a side-by-side comparison of all three candidate firms across the five weighted evaluation criteria: As the table reflects, Thornfield achieved the highest score across every substantive criterion and the highest total weighted score. Merriweather is a credible and qualified firm that could serve as an alternative if Thornfield were unavailable or if the OCC w

VI. Recommendation A. Basis for Recommendation of Thornfield Consulting Group LLC Based on the evaluation described in this memorandum, C&H recommends that BRB engage Thornfield Consulting Group LLC as its independent consultant pursuant to Article VII of Consent Order No. OCC-2025-003. Thornfield achieved the highest total weighted evaluation score (98 out of 100) across all five criteria and was rated "Excellent" o

VII. Proposed Next Steps and Timeline Based on the foregoing analysis and recommendation, C&H proposes the following next steps and target timeline: The timeline above is designed to comply with the thirty-day deadline established in Article VII for engagement of the independent consultant (i.e., by February 14, 2025) and to ensure that Thornfield has sufficient time to conduct its preliminary gap assessment in advan

VIII. Attachments (Referenced) The following attachments are referenced in this memorandum and are enclosed herewith for your review: Attachment A: Thornfield Consulting Group LLC — Firm Profile and Team Biographies Attachment B: Bracken Advisory Partners LLC — Firm Profile and Team Biographies Attachment C: Merriweather Risk Consulting LLC — Firm Profile and Team Biographies Attachment D: Detailed Scoring Worksheets