Contract analysis

I. EXECUTIVE SUMMARY AND PURPOSE A. Purpose of This Memorandum The purpose of this memorandum is to establish a comprehensive framework for the supervision, quality assurance, and quality control of the thirty (30) full-time-equivalent ("FTE") temporary BSA/AML compliance analysts to be provided by Pinnacle Compliance Solutions LLC ("Pinnacle") to Belmont Ridge Bank National Association ("BRB" or the "Bank") under th

II. BACKGROUND AND ENGAGEMENT PARAMETERS A. Pinnacle Compliance Solutions LLC Engagement Overview BRB has engaged Pinnacle Compliance Solutions LLC, a limited liability company organized under the laws of the State of New York, with its principal office located at 90 Broad Street, 20th Floor, New York, NY 10004, to provide managed BSA/AML compliance staffing services. The key engagement parameters are summarized belo

III. ORGANIZATIONAL STRUCTURE AND SUPERVISORY HIERARCHY A. Primary Supervisory Authority All Pinnacle temporary analysts engaged under the MSA report directly to Thomas Ikeda, BSA Officer and AML Program Director of BRB, for all substantive work-related matters. Thomas Ikeda has ultimate day-to-day operational authority over work assignments, prioritization of tasks and workstreams, establishment and enforcement of q

IV. TRAINING REQUIREMENTS A. Pre-Deployment Training (Mandatory, Prior to Commencing Work) All thirty (30) Pinnacle FTEs must complete a mandatory pre-deployment training program before performing any substantive work on BRB's BSA/AML compliance functions. No Pinnacle analyst may be assigned to live work queues, granted production-level system access, or permitted to review, investigate, or disposition any alert, SAR

V. QUALITY REVIEW SAMPLING METHODOLOGY A. Overview BRB must implement and maintain a structured, multi-layered quality review program for all work performed by Pinnacle analysts. The quality review program is designed to identify and correct errors before they result in regulatory deficiencies, to provide data for individual and aggregate performance tracking, and to demonstrate to the OCC, Thornfield, and other stak

1. SAR Drafts and Filings A minimum of 25% of all SARs drafted by Pinnacle analysts must be reviewed by BRB senior SAR investigators before the SAR is filed with FinCEN. The sample shall be selected randomly from the population of all Pinnacle-drafted SARs, subject to the following stratification and targeted review requirements: • Stratification Requirement: At least 50% of the sampled SARs must involve BaaS-related

2. Alert Dispositions (Transaction Monitoring) A minimum of 20% of all alerts dispositioned as "no SAR required" by Pinnacle analysts must be reviewed by BRB senior staff. This review is critical because false negatives—alerts improperly cleared without SAR filing—represent the most significant compliance risk associated with the alert disposition function. The alert disposition sample shall be weighted toward the fo

3. CDD/EDD File Reviews A minimum of 15% of all customer files reviewed and updated by Pinnacle KYC/CDD analysts must be reviewed by BRB senior staff. The CDD/EDD file review sample shall be weighted toward accounts presenting the highest remediation risk, including: (a) Accounts onboarded by NovaPay Technologies Inc., FairLend Digital LLC, and VaultEdge Inc. (the three largest BaaS partners by volume), which collect

VI. ALERT DISPOSITION ACCURACY BENCHMARKS A. Performance Standards BRB establishes the following accuracy benchmarks for alert dispositions performed by Pinnacle analysts: Target Accuracy Rate: ≥95% accuracy for all alert dispositions, encompassing both "SAR filed" and "no SAR required" outcomes. This target reflects the expectation that Pinnacle analysts, following completion of the pre-deployment training program a

VII. SAR DRAFTING QUALITY STANDARDS A. Narrative Quality Requirements All SARs drafted by Pinnacle analysts must conform to FinCEN's SAR filing instructions and to BRB's revised SAR Policy and Procedures, as updated during the remediation period. SAR narratives are the primary means by which BRB communicates identified suspicious activity to FinCEN and law enforcement, and the quality of SAR narratives will be under

1. Subject Identification: Clear identification of the subject or subjects of the SAR, including all known identifying information (full name, date of birth, Social Security number or tax identification number, address, account numbers, and any other available identifiers).

2. Activity Description: A detailed description of the suspicious activity, including specific dates or date ranges, dollar amounts, transaction types (e.g., wire transfers, ACH transactions, cash deposits, peer-to-peer payments), counterparties (to the extent known), and the flow of funds.

3. Suspicion Rationale: A clear and well-reasoned explanation of why the identified activity is suspicious, with reference to applicable typologies, red flags, and indicators of potential money laundering, terrorist financing, fraud, or other illicit activity. The narrative must articulate the specific basis for the suspicion, not merely recite that the activity "appears suspicious" without supporting analysis.

4. Investigation Summary: A summary of the investigation steps taken and evidence reviewed, including transaction records examined, customer information reviewed, open-source research conducted, and any communications with BRB personnel or BaaS partners.

5. BaaS Partner Identification (for BaaS-Related SARs): For all SARs involving activity conducted through a BRB BaaS partner platform, the narrative must identify the relevant fintech partner by name and describe any partner-specific risk factors that contributed to the suspicion determination.

6. Prior SAR History: Notation of any prior SAR filings relating to the same subject, if applicable, with cross-references to prior SAR identification numbers. SAR narratives must be factual, objective, and free of legal conclusions. Narratives must not contain opinions as to whether criminal activity has occurred or characterize activity as constituting a specific criminal offense. Narratives must be sufficiently de

1. Narrative Completeness: Whether the narrative includes all required elements as described in Section VII.A.

2. Factual Accuracy: Whether the facts stated in the narrative are accurate and supported by the underlying evidence.

3. Typology Identification: Whether the narrative correctly identifies and articulates the applicable suspicious activity typology or typologies.

4. Supporting Documentation: Whether the SAR file contains adequate supporting documentation (transaction records, screen captures, research results).

5. Subject Identification: Whether all known subject information is accurately and completely reflected.

6. Timeliness: Whether the SAR was drafted and submitted for review within the applicable timeliness standards.

7. Proper Coding: Whether the SAR form fields (FinCEN Form 111) are correctly completed, including activity type codes, amount fields, and institution information. Deficiency data shall be aggregated monthly and analyzed for trends. Trend analysis results shall be used to inform the content of monthly refresher training sessions and shall be incorporated into individual performance evaluations. Persistent deficiencie

VIII. CDD/EDD REVIEW QUALITY STANDARDS A. Documentation Completeness Standards The CDD/EDD remediation project is one of the most significant workstreams within BRB's overall remediation program, requiring the review and remediation of approximately 47,000 customer accounts. For each account assigned to a Pinnacle KYC/CDD analyst, the analyst must ensure that the customer file meets the following minimum documentatio

1. Customer Identification Program (CIP) Documentation: Complete and current CIP documentation must be on file for each customer, including government-issued identification, verification of name, date of birth, address, and identification number, as required by 31 C.F.R. § 1020.220. Any gaps in CIP documentation must be identified and remediated, with appropriate follow-up conducted to obtain missing information.

2. Beneficial Ownership Information: Current and accurate beneficial ownership information must be on file for all legal entity customers, consistent with the FinCEN CDD Rule (31 C.F.R. § 1010.230). The file must identify each individual who, directly or indirectly, owns 25% or more of the equity interests of the legal entity, as well as a single individual with significant responsibility to control, manage, or direc

3. Risk Rating: Each customer must have a risk rating assigned in accordance with BRB's risk rating methodology, as set forth in BRB's CDD/EDD Policy (which is being updated as part of the remediation program). The risk rating must be documented and supported by the underlying risk factors identified during the CDD review.

4. Enhanced Due Diligence (EDD) Documentation: For all customers rated as high risk, the file must contain comprehensive EDD documentation, including: (a) Source of funds and source of wealth documentation; (b) Purpose of the account and expected account activity; (c) Adverse media screening results and analysis; (d) Any additional due diligence measures required by BRB's EDD procedures, such as senior management app

5. BaaS-Onboarded Account Documentation: For accounts onboarded through BRB's BaaS partnerships, the Pinnacle analyst must verify that the relevant fintech partner collected and transmitted all required CDD/EDD information to BRB in accordance with the BaaS Partner CDD/EDD Responsibility Matrix. This Responsibility Matrix delineates which CDD and EDD functions are performed by the BaaS partner at point of onboarding