Contract analysis

I. Purpose I write on behalf of Belmont Ridge Bank National Association ("Belmont Ridge" or "BRB"), a national banking association chartered under 12 U.S.C. § 21 et seq. (OCC Charter No. 48271), to NovaPay Technologies Inc. ("NovaPay"), a Delaware corporation. As you are aware, NovaPay has operated as a Banking-as-a-Service ("BaaS") partner through BRB's national bank charter since NovaPay's onboarding in 2021, pursu

II. Background — Regulatory Context BRB has been the subject of a targeted BSA/AML examination conducted by the Office of the Comptroller of the Currency ("OCC") over the period from March 2024 through September 2024. The examination encompassed a comprehensive review of BRB's BSA/AML compliance program, including its OFAC sanctions screening infrastructure, suspicious activity monitoring and reporting processes, cus

III. Identification of Specific Compliance Deficiencies Related to NovaPay BRB has identified the following specific compliance deficiencies that directly involve or significantly implicate NovaPay's BaaS channel. These deficiencies are consistent with the findings described in the Consent Order, and their remediation is a priority under BRB's corrective action plan. A. OFAC Sanctions Screening Gap BRB's OFAC sanctio

IV. Demands for Enhanced Cooperation and Compliance Commitments In light of the foregoing deficiencies and the requirements of the Consent Order, BRB hereby demands that NovaPay undertake the following enhanced cooperation measures and compliance commitments. These demands are made pursuant to BRB's rights under the BaaS Program Agreement — including, without limitation, the cooperation, audit, data access, and compl

V. Timeline and Deadlines The remediation program operates under strict regulatory deadlines imposed by the Consent Order, and NovaPay's cooperation must be timely, consistent, and sustained throughout the remediation period. BRB requires NovaPay to adhere to the following timeline: Written Confirmation of Commitment. NovaPay must confirm in writing its commitment to all cooperation and compliance requirements set fo

VI. Consequences of Non-Cooperation BRB wishes to be transparent regarding the potential consequences of NovaPay's failure to provide the requested cooperation and comply with the commitments demanded in this letter. Failure to cooperate may result in actions by BRB including, but not limited to, the following: (a) Suspension or Restriction of BaaS Activities. BRB may suspend or restrict NovaPay's ability to onboard

VII. Reservation of Rights BRB expressly reserves all rights and remedies available to it under the BaaS Program Agreement, applicable law, and regulation, including but not limited to the right to exercise all contractual remedies, seek damages, and enforce all obligations of NovaPay under the BaaS Program Agreement and any amendments or addenda thereto. Nothing in this letter, or in BRB's forbearance in exercising

VIII. Point of Contact All communications regarding the matters addressed in this letter should be directed to the following individuals: Gregory Nardone General Counsel & Corporate Secretary Belmont Ridge Bank National Association 680 Lexington Avenue, 22nd Floor New York, NY 10022 Email: gnardone@belmontridgebank.com Telephone: (212) 554-7100 With a copy to: Warren Ashby Head of Fintech Partnerships / BaaS Division

IX. Closing BRB requests NovaPay's prompt acknowledgment of receipt of this letter and a written response confirming NovaPay's commitment to the cooperation and compliance requirements described herein within the fifteen (15) business day period specified above. BRB expects NovaPay to treat this matter with the urgency that the regulatory context demands. The timelines set forth in this letter are driven by binding r