Contract analysis

I. Executive Summary This OFAC Remediation Testing Plan (the "Testing Plan" or "Plan") sets forth the comprehensive framework for the independent validation that one hundred percent (100%) of Banking-as-a-Service ("BaaS") transactions processed through Belmont Ridge Bank National Association ("BRB" or the "Bank") are screened against all applicable Office of Foreign Assets Control ("OFAC") sanctions lists following t

II. Background and Regulatory Context A. OCC Consent Order Findings — OFAC Screening Deficiencies On January 15, 2025, the OCC issued Consent Order No. OCC-2025-003 against Belmont Ridge Bank National Association. The Consent Order was the culmination of a multi-year supervisory process during which the OCC identified increasingly serious deficiencies in the Bank's OFAC sanctions screening program, particularly with

III. Scope of Testing A. Transaction Types in Scope This Testing Plan covers all transaction types processed through the Bank's BaaS partner channels, without exception. The principle underlying this Plan is that every transaction processed through the Bank's charter, regardless of the originating fintech partner, transaction type, or payment rail, must be screened against all applicable OFAC sanctions lists prior to

1. NovaPay Technologies Inc. • Chief Executive Officer: Ethan Garrison • Address: 450 Mission Street, Suite 1200, San Francisco, California 94105 • Share of BaaS Transaction Volume: Approximately 41% (~$30.5 billion in CY 2024) • End-User Accounts: Approximately 2.1 million • Primary Business Line: Consumer payments and P2P transfers • Relevance to Testing Plan: NovaPay is the source of the identified 12% OFAC screen

2. FairLend Digital LLC • Chief Executive Officer: Aisha Okonkwo • Address: 100 Summer Street, Suite 800, Boston, Massachusetts 02110 • Share of BaaS Transaction Volume: Approximately 28% • Loan Originations Through BRB (FY 2024): Approximately $1.4 billion • Primary Business Line: Online small-business lending • Relevance to Testing Plan: FairLend Digital's lending operations require screening of both borrower and b

3. VaultEdge Inc. • Chief Executive Officer: Marcus Tan • Address: 2200 Ross Avenue, Suite 3600, Dallas, Texas 75201 • Share of BaaS Transaction Volume: Approximately 18% • End-User Accounts: Approximately 870,000 deposit accounts • Primary Business Line: Digital savings and neobanking • Relevance to Testing Plan: VaultEdge's deposit account operations involve high-volume funding transactions, including external tran

4. Remaining Eleven (11) BaaS Partners The remaining eleven BaaS partners collectively represent approximately 13% of total BaaS transaction volume. Each of these partners will be subject to the full scope of testing described in this Plan, including partner-specific integration testing, transaction coverage reconciliation, and statistical sampling. The identities and specific details of these partners are maintained

IV. Testing Methodology A. Pre-Deployment Testing (Veridian TMS v.10.0 UAT Phase)

1. Unit Testing of OFAC Module Prior to the commencement of user acceptance testing, Veridian Analytics Inc. will conduct internal unit testing of the enhanced OFAC module within Veridian TMS v.10.0. While unit testing is primarily a vendor responsibility, Calderwood & Harkness LLP will review and approve all unit test scripts prior to their execution to ensure that the test scenarios are sufficiently comprehensive t

2. User Acceptance Testing (UAT) — Target Completion: August 1, 2025 User acceptance testing will be led by BRB's technology and compliance teams, with participation from Calderwood & Harkness LLP and Thornfield Consulting Group LLC. UAT is the critical pre-deployment testing phase during which the Bank will validate that the upgraded Veridian TMS v.10.0 system, including the enhanced OFAC module, performs as require

3. Integration Testing per BaaS Partner In addition to the cross-partner UAT scenarios described above, each of the fourteen (14) BaaS partner API integrations will be tested individually. The purpose of partner-specific integration testing is to validate the completeness and integrity of the data feed from each partner to the screening engine. Transaction Data Feed Completeness. For each BaaS partner, the integratio

1. Parallel Processing Period Following the deployment of Veridian TMS v.10.0 to the production environment, the Bank will conduct a minimum thirty (30) day parallel processing period during which all production transactions are processed through both the legacy Veridian TMS v.8.3 screening engine (if feasible to maintain in a parallel configuration) and the new v.10.0 screening engine. If full parallel processing is

3. Hit Disposition Workflow Testing During the go-live validation period, the testing will also validate the hit disposition workflow — that is, the process by which OFAC screening alerts are reviewed, investigated, and resolved by qualified compliance personnel. The testing will confirm the following: • All OFAC screening hits generated by the v.10.0 system are properly routed to the hit disposition queue for human

4. False Positive Rate Analysis During the initial go-live period, the testing will measure the false positive rate of the upgraded OFAC screening system and compare it against the CY 2024 baseline false positive rate of approximately 99.9% (14,308 false positives out of 14,320 total alerts). A high false positive rate imposes significant operational burden on the compliance team and can degrade the quality of alert

1. Monthly Transaction Coverage Reconciliation Following the November 1, 2025 operationalization milestone, the Bank will perform a comprehensive transaction coverage reconciliation every calendar month. The methodology is consistent with the 100% coverage confirmation testing described in Section IV.B.2 above: • Extract 100% of BaaS transactions from the core banking system for the calendar month. • Reconcile agains

2. Quarterly Statistical Sampling and Deep-Dive Testing On a quarterly basis, aligned with the OCC reporting dates of September 15, 2025 and December 15, 2025, the Bank will perform statistically significant random sampling of screened transactions to validate the quality of screening. While the monthly reconciliation validates screening coverage (i.e., whether transactions were screened), the quarterly sampling vali

3. OFAC List Update Timeliness Testing On a monthly basis, the testing will verify that all OFAC list updates published during the period were ingested by Veridian TMS v.10.0 within twenty-four (24) hours of their publication by OFAC. The testing methodology involves comparing OFAC's publication log (available on the OFAC website and through OFAC's electronic distribution channels) against the system's ingestion logs

4. Retroactive Screening Testing (Post-List-Update) Upon each OFAC list update, the testing will validate that the Bank's existing customer and counterparty databases are retroactively screened against newly added entries within the system-defined service level agreement. Retroactive screening is critical to ensure that customers who were not on OFAC sanctions lists at the time of onboarding or last screening are ide

V. Sample Design and Statistical Parameters A. Sample Size Methodology The sampling approach for ongoing testing under this Plan follows statistical sampling standards consistent with OCC examination guidance, including the guidance set forth in the Comptroller's Handbook — Bank Supervision Process and the FFIEC BSA/AML Examination Manual. The sampling methodology is designed to provide statistically valid assurance

VI. Acceptance Criteria and Pass/Fail Standards A. Absolute Requirements (Non-Negotiable) The following acceptance criteria are absolute requirements that reflect the Bank's regulatory obligations under OFAC regulations and the specific terms of the Consent Order. No deviation from these requirements is permitted under any circumstances. 1. 100% of BaaS transactions screened against current OFAC lists. There is zero

2. OFAC list updates ingested within 24 hours of publication. There is zero tolerance for delays in OFAC list update ingestion. The Veridian TMS v.10.0 system must download, parse, and integrate all OFAC list updates within twenty-four (24) hours of their publication by OFAC. Any delay beyond this threshold constitutes a critical deficiency.

3. All confirmed OFAC matches result in immediate blocking/rejection. When a transaction is confirmed as involving a person or entity on the SDN List or other applicable OFAC sanctions list, the transaction must be immediately blocked or rejected in accordance with OFAC regulations. Any failure to block a confirmed match constitutes a critical deficiency.

4. All blocking events generate required 10-day OFAC blocking reports. For every blocked transaction, the Bank must file the required OFAC blocking report within ten (10) business days of the blocking action, in accordance with 31 C.F.R. § 501.603. Any failure to file a required blocking report constitutes a critical deficiency.

5. Complete audit trail for all screening actions, hit dispositions, and escalations. The system must maintain a complete and immutable audit trail documenting every screening action (including the transaction screened, the lists applied, the list version used, and the screening result), every hit disposition decision (including the analyst, the decision, the basis, and the timestamp), and every escalation action. An

1. Real-time screening latency: Less than 500 milliseconds per transaction for real-time channels (wires, P2P transfers, card authorizations). This benchmark ensures that OFAC screening does not create unacceptable delays in transaction processing that could affect customer experience or partner service level agreements.

2. Batch screening completion: Within four (4) hours of batch submission for batch-processed transactions (ACH, certain loan disbursements). This benchmark ensures that batch screening is completed within a timeframe that does not delay settlement or disbursement processing.

3. Hit disposition turnaround: Initial review of screening alerts within four (4) business hours of alert generation. This benchmark ensures that potential OFAC matches are reviewed promptly, minimizing the holding period for legitimate transactions that are false positives while ensuring timely identification and blocking of true matches.

4. False positive rate: Target reduction from the CY 2024 baseline of approximately 99.9% while maintaining or improving detection sensitivity. The specific false positive rate target will be established jointly by Thornfield Consulting and BRB compliance leadership and documented in a supplemental memorandum. C. Deficiency Classification All deficiencies identified during testing will be classified according to the

VII. Roles and Responsibilities A. BRB Internal Thomas Ikeda, BSA Officer / AML Program Director. Mr. Ikeda bears overall accountability for the effectiveness of the Bank's OFAC screening program. Under this Testing Plan, Mr. Ikeda is responsible for: (i) sign-off on testing results at each phase; (ii) serving as the escalation point for confirmed OFAC matches identified during testing or production operations; (iii)