Contract analysis

I. Executive Summary Calderwood & Harkness LLP ("C&H") has been engaged to assess Belmont Ridge Bank National Association's ("BRB" or the "Bank") exposure to additional regulatory and enforcement actions arising from or related to the compliance deficiencies that formed the basis of Consent Order No. OCC-2025-003, issued by the Office of the Comptroller of the Currency ("OCC") on January 15, 2025 (the "Consent Order"

II. Background and Context A. Summary of OCC Consent Order No. OCC-2025-003 On January 15, 2025, the OCC Northeastern District Office (340 Madison Avenue, New York, NY 10017) issued Consent Order No. OCC-2025-003 against BRB. The Consent Order was the culmination of a targeted Bank Secrecy Act/Anti-Money Laundering ("BSA/AML") examination conducted from March 2024 through September 2024 under the supervision of Jonat

1. OFAC Sanctions Screening Failures. BRB's OFAC screening system failed to screen approximately 12% of wire and Automated Clearing House ("ACH") transactions processed through the NovaPay BaaS channel. This failure resulted in approximately 3,800,000 of 31,700,000 total NovaPay transactions in calendar year 2023 not being screened against the Specially Designated Nationals and blocked Persons List ("SDN List") or ot

2. SAR Filing Deficiencies. BRB maintained a backlog of approximately 2,400 unreviewed suspicious activity alerts as of September 2024. The Bank's average SAR filing time was 78 days from initial alert detection — significantly exceeding the regulatory expectation that SARs be filed within 30 days of detection, as articulated in FinCEN guidance and OCC examination procedures. The deficiencies reflected both inadequat

3. Customer Due Diligence ("CDD") and Enhanced Due Diligence ("EDD") Failures. Approximately 47,000 high-risk customer accounts, primarily those onboarded through fintech BaaS channels, lacked adequate documentation to satisfy CDD and EDD requirements under 31 C.F.R. § 1020.210 and the OCC's implementing supervisory guidance. These accounts were identified as lacking verified beneficial ownership information, adequat

4. Model Validation Deficiencies. BRB's primary transaction monitoring system, Veridian TMS v.8.3 (provided by Veridian Analytics, Inc., under Master Services Agreement Contract No. VA-BRB-2023-0044), was last independently validated in March 2021 — approximately four years prior to the Consent Order. Tuning parameters were last updated in October 2022. The OCC determined that BRB failed to comply with its own model

5. Board Oversight Deficiencies. BRB's Board of Directors did not maintain a dedicated Compliance Committee, and the quarterly BSA/AML reporting provided to the Board lacked key performance metrics, including SAR filing timelines, alert backlog volumes, OFAC screening coverage rates, and CDD remediation progress. The OCC determined that the Board failed to provide the degree of oversight required by 12 C.F.R. § 21.21

III. FinCEN Enforcement Risk Assessment A. Current FinCEN Posture As of the date of C&H's engagement (February 10, 2025), FinCEN has not filed a separate enforcement action against BRB. However, our inquiries and review of interagency coordination protocols indicate that FinCEN is actively monitoring BRB's SAR filing remediation efforts pursuant to its coordination with the OCC. C&H has identified Angela Drummond, As

1. Proactive Outreach. C&H will develop and execute a proactive communication plan with FinCEN Associate Director Angela Drummond, establishing a dialogue regarding BRB's remediation progress and demonstrating the Bank's cooperative posture. The objective of this outreach is to provide FinCEN with comfort that BRB's remediation is proceeding effectively, thereby reducing the perceived need for separate FinCEN enforce

2. Remediation Progress Reporting. C&H will provide FinCEN with copies of key remediation milestones, including SAR backlog clearance status reports, process improvement metrics (including filing time trends), and staffing enhancement documentation. These reports will be coordinated with, and provided in conjunction with, BRB's OCC quarterly reporting (first quarterly report due September 15, 2025).

3. SAR Backlog Clearance. BRB should target clearance of the entire 2,400-alert backlog by June 30, 2025. Achieving this milestone prior to the first OCC quarterly report due date would demonstrate tangible progress. Filing time reduction toward the 30-day benchmark should also be prioritized, with interim targets of 60 days by Q2 2025 and 30 days by Q4 2025.

4. Voluntary Briefing. C&H recommends a voluntary briefing to FinCEN — ideally in conjunction with the first OCC quarterly report submission (September 15, 2025) — presenting BRB's remediation accomplishments, remaining work, and forward-looking compliance program enhancements.

5. Pinnacle Deployment. The deployment of 30 temporary FTE analysts from Pinnacle Compliance Solutions LLC (Andrea Solis, Director of Managed Services; Statement of Work Reference No. PCS-BRB-2025-0012; contract value $3.6 million) should be accelerated to begin no later than March 15, 2025. This deployment will serve both the practical objective of accelerating backlog clearance and the strategic objective of demons

IV. DOJ Criminal Referral Risk Assessment A. Current Status As of February 10, 2025, there is no indication that the OCC or FinCEN has made a criminal referral to the DOJ in connection with BRB's BSA/AML compliance deficiencies. The Consent Order does not reference any criminal referral, though it explicitly does not preclude future referral. C&H has not identified any indication of active grand jury investigation, f

1. Documentation of Remediation. BRB should maintain scrupulous documentation of all remediation efforts, compliance program improvements, and cooperation with regulators. This documentation serves the dual purpose of demonstrating good faith to regulators and providing a contemporaneous record that could be critical in any future DOJ inquiry.

2. SAR Lookback Oversight. C&H should closely monitor the SAR lookback project for any transactions or patterns suggesting criminal activity. Thomas Ikeda (BSA Officer) should be instructed to establish an immediate escalation protocol requiring any lookback finding suggesting possible criminal involvement — including transactions involving known criminal actors, terrorist financing, or sanctioned parties — to be esc

3. DOJ Outreach Timing. We do not recommend proactive outreach to DOJ at this time. In the absence of evidence of criminal activity, premature outreach to DOJ could draw unwanted investigative attention to BRB. We will reassess this recommendation if the lookback reveals specific concerning activity. If the lookback does identify activity warranting DOJ disclosure, C&H will evaluate the appropriateness and timing of

4. Document Preservation. BRB should ensure that comprehensive litigation holds are in place across all Bank systems, BaaS partner data repositories, email archives, and third-party vendor systems (including Veridian Analytics) to preserve all potentially relevant documents and communications. The litigation hold should cover the period from January 1, 2021 through the present and should encompass all documents relat

5. Enforcement Monitoring. C&H will monitor DOJ enforcement priorities, MLARS public statements, and SDNY press releases for signals regarding BSA enforcement trends and priorities. Any indication that DOJ is prioritizing BSA/AML enforcement against banks with BaaS programs or OFAC screening deficiencies would require reassessment of the risk profile.

V. OFAC Enforcement Risk Assessment A. Nature of the Exposure The OFAC screening gap in BRB's NovaPay BaaS channel represents the single most significant secondary enforcement risk identified in this assessment. The core finding in the Consent Order — that BRB's OFAC screening system failed to screen 100% of transactions processed through fintech BaaS channels — carries potentially severe implications under OFAC's st

1. Veridian OFAC Module Enhancement. BRB should prioritize completion of the Veridian OFAC screening module enhancement under the Statement of Work being developed as an amendment to the Veridian Master Services Agreement (Contract No. VA-BRB-2023-0044). The target completion date is November 1, 2025, at which time BRB should achieve full, validated OFAC screening operationalization across all BaaS channels — includi

2. NovaPay Transaction Lookback. BRB should conduct a targeted lookback of the 3,800,000 unscreened NovaPay transactions from calendar year 2023, screening each transaction against current SDN, SSI, and consolidated sanctions lists. This lookback should be conducted with appropriate methodological rigor to ensure defensibility, with clear documentation of methodology, results, and any apparent violations identified.

3. Independent Sanctions Assessment. Jennifer Hwang, Director of Sanctions & OFAC Compliance at Thornfield Consulting Group, should be engaged to provide an independent assessment of BRB's sanctions compliance program, including screening coverage, screening technology, list management, case management for screening hits, and compliance governance. This assessment should cover all BaaS channels, not only NovaPay.

4. VSD Preparation. C&H will begin preparing a draft OFAC voluntary self-disclosure filing framework, including draft narrative, transaction tables, and supporting documentation. This preparation will proceed in parallel with the lookback, with the understanding that the VSD will be finalized and filed only if the lookback reveals apparent violations. The C&H VSD analysis memorandum currently under development will p

5. NovaPay Compliance Remediation Letter. C&H has drafted a compliance remediation letter to NovaPay requiring enhanced cooperation and data sharing to support the lookback. This letter should be reviewed by BRB management and executed promptly to ensure that BRB has full access to the transaction data, account information, and counterparty details needed for a thorough lookback.

6. Enforcement Monitoring. C&H will monitor OFAC enforcement actions and guidance for analogous fintech/BaaS cases, new FAQ postings, and OFAC Advisory publications that may signal enforcement priorities or provide interpretive guidance relevant to BRB's exposure.

VI. State-Level Regulatory Exposure A. Preemption Analysis — National Bank Charter BRB holds a national charter under 12 U.S.C. § 21 et seq., with the OCC serving as its primary federal banking regulator. Under the National Bank Act and the OCC's preemption regulations at 12 C.F.R. Part 7, national banks are generally subject to federal preemption from state laws that "prevent or significantly interfere" with the exe