Contract analysis

Section 1: Executive Summary This SAR Backlog Triage Protocol (the "Protocol") establishes a structured, risk-based prioritization framework for the triage and dispositioning of approximately 2,400 unreviewed suspicious activity monitoring alerts that have been identified as constituting a backlog within Belmont Ridge Bank National Association's ("BRB" or the "Bank") BSA/AML transaction monitoring program. The existe

Section 2: Background and Regulatory Context 2.1 OCC Consent Order Findings on SAR Filing Deficiencies On January 15, 2025, the Office of the Comptroller of the Currency issued Consent Order No. OCC-2025-003 against Belmont Ridge Bank National Association (OCC Charter No. 48271; FDIC Certificate No. 31845). The Consent Order was the culmination of a targeted BSA/AML examination conducted from March 2024 through Septe

Section 3: Scope of Triage Protocol 3.1 Alerts In Scope The scope of this Triage Protocol encompasses the following categories of alerts: Primary Scope: All approximately 2,400 unreviewed suspicious activity monitoring alerts residing in BRB's transaction monitoring alert queue as of September 2024, the conclusion date of the OCC's targeted BSA/AML examination. These alerts were generated by the Veridian TMS v.8.3 sy

Section 4: Risk-Ranking Criteria and Triage Categories 4.1 Risk-Ranking Methodology The central feature of this Protocol is a quantitative, risk-based scoring methodology that assigns each of the approximately 2,400 backlog alerts a composite risk score. This composite score determines the alert's triage category (Priority 1 through Priority 4), which in turn governs the sequence, intensity, and staffing of the inves

1. Transaction Amount / Dollar Value — This dimension captures the aggregate dollar value of the transactions underlying the alert. Higher-dollar transactions present greater potential monetary harm and are more likely to warrant regulatory attention.

2. Customer Risk Rating — This dimension captures the customer's existing BSA/AML risk rating within BRB's systems (high, medium, or low), as well as whether the customer is among the approximately 47,000 high-risk accounts that have been identified as lacking adequate Customer Due Diligence ("CDD") or Enhanced Due Diligence ("EDD") documentation. Customers with elevated risk ratings or inadequate CDD/EDD documentati

3. Alert Type / Scenario — This dimension captures the specific transaction monitoring scenario that generated the alert. Different scenarios are associated with different underlying risk typologies, and some typologies (e.g., structuring, high-risk geography) are inherently higher-risk than others (e.g., peer comparison anomalies).

4. BaaS Partner Association — This dimension captures whether the alert involves a customer or transaction flowing through one of BRB's BaaS fintech partner channels, and if so, which partner. Given the identified compliance gaps in the BaaS program — including the OFAC screening gap affecting NovaPay transactions — BaaS-associated alerts receive elevated risk weighting. The composite risk score is computed as a weig

Section 5: Escalation Thresholds and Mandatory Escalation Criteria 5.1 Automatic Escalation to Priority 1 Regardless of the composite risk score calculated under the methodology set forth in Section 4, the following categories of alerts are subject to automatic escalation to Priority 1 and must be investigated and dispositioned within the Priority 1 timeframe (within 30 days of triage initiation, by approximately Mar

Section 6: Assignment Methodology — Pinnacle Temporary Staff and BRB Permanent Analysts 6.1 Staffing Overview The backlog clearance effort will be staffed through a combination of BRB's existing permanent BSA/AML personnel and temporary analysts provided by Pinnacle Compliance Solutions LLC under the Managed Services Agreement. BRB Permanent BSA/AML Staff: As of January 2025, BRB's BSA/AML department comprises 62 ful

Section 7: Investigation and Disposition Standards 7.1 Investigation Requirements by Triage Category The depth and scope of the investigation required for each backlog alert varies by triage category, reflecting the risk-based prioritization framework of this Protocol. The following investigation standards establish the minimum investigative requirements for each category. Analysts may, in their professional judgment