Contract analysis

I. PURPOSE AND BACKGROUND A. Purpose of This Executive Summary This Executive Summary has been prepared by Calderwood & Harkness LLP ("C&H") for the Board of Directors (the "Board") and the Compliance Committee of Belmont Ridge Financial Group, Inc. ("BRFG" or the "Company") to serve as a board-level summary of the Comprehensive Remediation Action Plan (the "RAP") prepared for submission to the Office of the Comptrol

1. The five remediation workstreams, each of which corresponds to a deficiency category identified in the Consent Order;

2. Key milestones, deadlines, and the master remediation timeline;

3. The aggregate remediation budget, inclusive of outside counsel fees, independent consultant costs, technology expenditures, temporary and permanent staffing, and ancillary costs;

4. Accountability assignments for each workstream at the executive, management, and external advisor levels; and

5. Material risk factors that may affect the execution, timing, or cost of the remediation program. This document is protected by the attorney-client privilege and the work product doctrine. It has been prepared at the direction of counsel in anticipation of continued regulatory engagement and reflects the mental impressions, legal conclusions, and strategic assessments of C&H. It should not be shared with any third

II. SUMMARY OF CONSENT ORDER DEFICIENCY CATEGORIES The Consent Order identifies five principal categories of deficiency in BRB's BSA/AML and sanctions compliance program. Each deficiency category has been mapped to a dedicated remediation workstream within the RAP. The following subsections summarize the nature and scope of each deficiency as articulated in the Consent Order and corroborated by the Thornfield prelimi

III. REMEDIATION WORKSTREAMS — SUMMARY The RAP is organized into five remediation workstreams, each corresponding to one of the deficiency categories identified in the Consent Order. The workstreams are designed to be executed in parallel, with interdependencies managed through a centralized program management function overseen by Patricia Langston, CCO, and coordinated by C&H. The following subsections provide a sum

1. Veridian TMS Upgrade — OFAC Module Enhancement. BRB will upgrade from Veridian TMS v.8.3 to Veridian TMS v.10.0, which includes an enhanced OFAC screening module capable of real-time and batch screening integration for all BaaS transaction flows, including wire transfers, ACH originations and receipts, card transactions, and partner-specific transaction flows. The upgrade will address the fundamental root cause of

2. BaaS Partner Screening Workflow Redesign. BRB will redesign its sanctions screening workflows for each of the fourteen (14) active BaaS partners to ensure that all transaction types originated through each partner's platform are properly mapped, ingested, and screened by the Veridian TMS v.10.0 OFAC module. Particular focus will be placed on NovaPay Technologies Inc., which accounts for approximately 41% of total

3. OFAC List Management. BRB will implement enhanced OFAC list management procedures to ensure timely ingestion of all OFAC list updates, including same-day updates for changes to the SDN List and other high-priority sanctions lists. The list management procedures will include automated update verification, reconciliation protocols, and escalation procedures for list ingestion failures.

4. Interdiction, Escalation, and Reporting Protocols. BRB will implement revised interdiction, escalation, and reporting protocols, including procedures for blocking or rejecting transactions that generate true OFAC matches, escalation procedures for potential matches requiring further investigation, and reporting protocols for the filing of OFAC blocking reports within the required ten (10) business day timeframe.

5. Remediation Testing. BRB will conduct comprehensive remediation testing, including end-to-end testing of all BaaS partner transaction flows, to validate that 100% of transactions are being screened by the upgraded OFAC module. The remediation testing will be conducted in coordination with Thornfield's Jennifer Hwang and will be subject to independent validation by Thornfield as part of its overall assessment. Mile

1. SAR Backlog Triage and Risk-Ranking. BRB has developed and is implementing a SAR Backlog Triage Protocol under which each of the 2,400 unreviewed alerts is being triaged and risk-ranked based on a multi-factor prioritization methodology. The prioritization factors include transaction amount, customer risk rating, alert type and detection scenario, BaaS partner association, and the length of time the alert has been

2. Temporary Analyst Deployment. To provide the human resources necessary to clear the backlog on an accelerated timeline while simultaneously maintaining ongoing alert review operations, BRB has engaged Pinnacle Compliance Solutions LLC ("Pinnacle") to deploy thirty (30) full-time-equivalent temporary BSA/AML analysts. The Pinnacle engagement (SOW Ref: PCS-BRB-2025-0012; key contact: Andrea Solis) provides for a twe

3. Comprehensive SAR Lookback Project. In addition to clearing the pending backlog of 2,400 unreviewed alerts, BRB is conducting a comprehensive SAR lookback project to identify and report any additional suspicious activity that may have been missed during the period when BRB's transaction monitoring system and SAR processes were deficient. The lookback project encompasses a defined lookback period, specific transact

4. Revised SAR Filing Standards. BRB is implementing revised SAR filing standards that incorporate a 30-day timeliness benchmark measured from alert generation to SAR filing, clearly defined escalation protocols for complex or high-priority cases, and quality review requirements including supervisory review of all SAR narratives prior to filing. The revised standards have been documented in updated SAR policies and p

5. Post-Remediation SAR Quality Assurance Framework. To ensure the sustainability of the remediation and prevent recurrence, BRB is establishing a comprehensive SAR quality assurance ("QA") framework that includes regular QA sampling of filed SARs, error tracking and trending analysis, root cause analysis for identified deficiencies, and a continuous improvement feedback loop to drive ongoing process refinement.

6. Interim SAR Backlog Status Report. As required by the Consent Order, BRB filed an interim SAR backlog status report with the OCC on March 31, 2025. The interim report detailed the status of the backlog clearance effort, the deployment of Pinnacle temporary analysts, and BRB's projected timeline for full clearance of the backlog. Milestone Deadlines. • June 30, 2025: SAR backlog of 2,400 alerts fully cleared — i.e.

1. Risk-Based Account Prioritization. The 47,000 accounts requiring remediation have been prioritized using a risk-based methodology that assigns the highest priority to BaaS-onboarded accounts associated with NovaPay Technologies, FairLend Digital LLC, and VaultEdge Inc. Within this population, further prioritization is based on individual account risk scores, transaction volumes, and the risk profile of the associa

2. Phased Remediation Timeline. The account remediation will be executed on a phased basis: • Phase 1 (by July 15, 2025): Remediation of 50% of the affected accounts, or approximately 23,500 accounts. Phase 1 will focus on the highest-risk accounts, including those associated with NovaPay and FairLend Digital. • Phase 2 (by January 15, 2026): Remediation of the remaining 50%, achieving 100% completion — or the full p

3. Revised CDD/EDD Policy. BRB is implementing a comprehensive revised CDD/EDD policy that addresses all elements of customer due diligence, including the customer identification program, risk rating methodology, beneficial ownership identification and verification, ongoing monitoring, periodic reviews for high-risk accounts, and specific requirements for all customer channels, with particular attention to BaaS-origi

4. BaaS Partner CDD/EDD Responsibility Matrix. A critical component of the CDD/EDD remediation is the development and implementation of a BaaS Partner CDD/EDD Responsibility Matrix using a RACI framework (Responsible, Accountable, Consulted, Informed). The matrix delineates, for each BaaS partner, the specific CDD/EDD responsibilities retained by BRB and those delegated to the partner, with clear accountability and e

5. CDD/EDD Progress Tracking Dashboard. BRB is developing a CDD/EDD progress tracking dashboard that will provide real-time visibility into the status of the remediation effort, including accounts remediated, accounts pending, accounts approaching deadline, and accounts presenting remediation challenges. The dashboard will be used for internal management reporting, Compliance Committee reporting, and OCC reporting.

6. BaaS Partner Compliance Remediation Letters. BRB has issued formal compliance remediation letters to the CEOs of its top BaaS partners demanding enhanced cooperation and data sharing in support of the CDD/EDD remediation: • A letter was sent to Ethan Garrison, CEO of NovaPay Technologies Inc., on March 15, 2025. • A letter was sent to Aisha Okonkwo, CEO of FairLend Digital LLC, on March 15, 2025. These letters set

1. Veridian TMS Upgrade to v.10.0. BRB will upgrade from Veridian TMS v.8.3 to v.10.0 pursuant to an amended Master Services Agreement with Veridian Analytics Inc. (Contract No. VA-BRB-2023-0044). The upgrade includes enhanced transaction monitoring capabilities, improved BaaS transaction integration, expanded detection scenario libraries, enhanced case management functionality, and the upgraded OFAC screening module

2. User Acceptance Testing. UAT for the Veridian TMS v.10.0 is targeted for completion by August 1, 2025. The UAT will encompass functional testing, integration testing across all BaaS partner transaction flows, performance testing under production-scale transaction volumes, and validation of detection scenario logic and alert generation.

3. Independent Model Validation. Upon successful deployment of Veridian TMS v.10.0, an independent model validation will be conducted and completed by October 1, 2025. The model validation will be performed by Thornfield under the direction of Robert Eastman and will assess the adequacy of the model's design, the appropriateness of tuning parameters and thresholds, the completeness of transaction coverage, the effect

4. Tuning Parameter Recalibration. Following the model validation, BRB will recalibrate all tuning parameters, including above-the-line and below-the-line thresholds, based on the model validation findings and BRB's updated risk profile. The recalibration will specifically address the growth in BaaS transaction volume and the associated changes in transaction typologies and risk patterns.

5. Ongoing Periodic Validation Schedule. BRB will establish an ongoing periodic validation schedule requiring independent model validation of the transaction monitoring system at least annually, with additional validations required upon any material change to the model, its inputs, or the operating environment.

6. Contingency Vendor Evaluation. BRB has evaluated Ridgeline Data Systems LLC as a contingency alternative to the Veridian TMS v.10.0 upgrade. The Ridgeline platform would involve the following commercial terms: • Annual contract value: $7,200,000 per year • Contract term: 5 years • Total contract value: $36,000,000 • Key Ridgeline contact: David Marchetti, Chief Revenue Officer C&H's recommendation is to proceed wi

1. Compliance Committee Establishment and Governance. As noted in Section II.E above, the BRFG Board adopted a Board Resolution dated February 28, 2025 establishing the Compliance Committee as a standing committee of the Board, with James Rutherford appointed as Chair. The Compliance Committee Charter — adopted concurrently — defines the Committee's composition, authority, duties, and meeting frequency. During the re

2. Enhanced BSA/AML Reporting to the Board. BRB is implementing a significantly enhanced BSA/AML reporting framework that includes: • Monthly reports to the Compliance Committee covering: SAR filing volumes and filing timeliness metrics; OFAC screening hit rates and disposition outcomes; CDD/EDD remediation progress against milestones; transaction monitoring alert volumes, SAR conversion rates, and alert aging; BaaS

3. BSA/AML Department Organizational Restructuring. BRB is increasing its permanent BSA/AML department headcount from 62 FTEs to 77 FTEs, a net increase of 15 new permanent hires. The new positions span multiple functions within the BSA/AML department, including alert review and investigation, SAR preparation and filing, OFAC screening operations, CDD/EDD operations, transaction monitoring analytics, and compliance p

4. Enterprise-Wide BSA/AML Training Program. BRB is developing and deploying a comprehensive, audience-segmented BSA/AML and sanctions training program covering all relevant personnel throughout the organization. The training program includes the following components: • Front-Line Staff Training: Fundamental BSA/AML awareness, red flags for suspicious activity, customer identification requirements, and SAR referral p

IV. BaaS / FINTECH PARTNERSHIP OVERSIGHT — CROSS-CUTTING THEME While each of the five remediation workstreams addresses a specific deficiency category identified in the Consent Order, a cross-cutting theme that pervades the entire remediation program is the need for fundamental restructuring of BRB's oversight of its Banking-as-a-Service and fintech partnership business. The Consent Order's findings are not incidenta

V. MASTER TIMELINE AND KEY MILESTONES The following table sets forth the master timeline and key milestones for the remediation program, from the effective date of the Consent Order through the compliance self-certification date. The status of each milestone as of the RAP filing date (May 15, 2025) is indicated. The master milestone tracker, which provides additional granularity including sub-milestones, dependencies

VI. BUDGET SUMMARY A. Remediation Budget (Board-Approved, Exclusive of CMP) The following table summarizes the remediation budget approved by the Board of Directors in the February 28, 2025 Board Resolution. This budget is exclusive of the $14,500,000 civil money penalty, which is addressed separately in Section VI.B below. A contingency allowance of approximately 10% has been embedded within the line item estimates