Contract analysis

I. EXECUTIVE SUMMARY This memorandum sets forth Calderwood & Harkness LLP's ("C&H") recommended post-remediation quality assurance ("QA") framework for suspicious activity report ("SAR") filing at Belmont Ridge Bank National Association ("BRB" or the "Bank"). The framework is designed to establish a sustainable, ongoing control structure that will demonstrate to the Office of the Comptroller of the Currency ("OCC") t

II. REGULATORY AND SUPERVISORY BACKGROUND A thorough understanding of the regulatory and supervisory context in which this QA Framework is being developed is essential to appreciating both the urgency of its implementation and the specific design choices embedded within it. This section summarizes the relevant supervisory history, the Consent Order's SAR-related findings, and the roles of the various regulatory and c

1. Preliminary Gap Assessment — Due April 15, 2025, this deliverable will include Thornfield's initial evaluation of BRB's SAR processes, transaction monitoring program, and related controls. The gap assessment will inform the design refinements to this QA Framework to the extent Thornfield identifies additional areas of concern not already addressed.

2. Final Validation Report — Due February 15, 2026, this deliverable will assess the sustainability of BRB's remediation efforts, including the QA Framework described in this memorandum. A favorable validation from Thornfield is a prerequisite to BRB's ability to file the compliance self-certification required by the Consent Order and, ultimately, to petition the OCC for termination of the Consent Order. The QA Frame

III. OBJECTIVES OF THE SAR QA FRAMEWORK The QA Framework is designed to achieve a primary objective and several supporting secondary objectives. Together, these objectives align the framework with the Bank's regulatory obligations, the specific requirements of the Consent Order, and the broader goal of establishing a culture of sustainable compliance within the BSA/AML department. Primary Objective The primary object

1. Error Detection and Correction. The framework is designed to detect and correct errors in SAR narrative quality, supporting documentation, and filing decisions before they become systemic. By identifying errors at the earliest possible stage and tracing them to their root causes, the framework enables the Bank to implement corrective actions that prevent recurrence rather than merely addressing individual instance

2. Auditable Trail of QA Activities. The framework establishes a comprehensive, auditable trail of QA activities that demonstrates sustained compliance to the OCC, FinCEN, and Thornfield Consulting. This documentation trail is essential to supporting BRB's compliance self-certification, satisfying Thornfield's validation requirements, and providing evidence of good faith compliance efforts should FinCEN elect to exer

3. Data-Driven Continuous Improvement. The framework is designed to produce data-driven insights that enable continuous improvement of the transaction monitoring and investigation process. By tracking error rates, timeliness metrics, and quality scores over time — and by analyzing these data across multiple dimensions (analyst, business line, BaaS partner, alert source, and staffing category) — the framework enables

4. Support for Committee and Board-Level Reporting. The framework provides the metrics and analysis necessary to support reporting to the Compliance Committee, chaired by James Rutherford, and to the BRFG Board of Directors on SAR quality and timeliness. Effective Board-level oversight of the BSA/AML program is a regulatory expectation, and the QA Framework ensures that the Board receives the information it needs to

5. Staffing Transition Management. The framework is specifically designed to bridge the transition from remediation-period staffing — comprising 62 permanent FTEs, 30 Pinnacle temporary analysts, and 15 new permanent hires in the onboarding process — to steady-state operations with 77 permanent FTEs. The framework includes differentiated quality controls for temporary staff and adjustable sampling rates that can be c

IV. SCOPE The QA Framework is designed to cover the full spectrum of SAR filing activity at BRB. This section defines the types of SARs subject to QA review, the business lines whose SAR activity is within scope, and the personnel whose work product is subject to the framework's quality controls. A. SAR Types Covered The QA Framework applies to all SARs filed by BRB, regardless of the source or trigger for the filing

1. NovaPay Technologies Inc. — NovaPay accounted for approximately 41% of BaaS transaction volume in CY 2024, representing approximately $30.5 billion in total transaction value. NovaPay's prepaid card and digital payments platform generates a significant volume of transaction monitoring alerts, and SARs related to NovaPay activity are a priority for targeted sampling.

2. FairLend Digital LLC — FairLend accounted for approximately 28% of BaaS transaction volume in CY 2024. FairLend's digital lending platform presents unique suspicious activity typologies, including concerns related to application fraud and synthetic identity fraud.

3. VaultEdge Inc. — VaultEdge accounted for approximately 18% of BaaS transaction volume in CY 2024. VaultEdge's cryptocurrency-adjacent services present elevated money laundering risk factors that require specialized attention in SAR narratives. The remaining 11 BaaS partners collectively account for the balance of approximately 13% of BaaS transaction volume and are subject to standard QA review procedures. C. Pers

V. QA SAMPLING METHODOLOGY The credibility and effectiveness of the QA Framework depend upon a sampling methodology that is both statistically sound and risk-sensitive. This section sets forth the dual-track sampling approach employed by the framework, the specific parameters governing each track, and the adjustments to sampling rates during the remediation period versus steady-state operations. A. Dual-Track Samplin

VI. QA REVIEW PROCESS AND CRITERIA This section describes the organizational structure of the QA review function, the standardized review criteria applied to each sampled SAR, and the scoring methodology used to quantify SAR quality. A. QA Review Team Structure The QA Framework contemplates the establishment of a dedicated QA Review Unit within the BSA/AML department. The QA Unit will operate under the direct supervi

1. Timeliness. The number of calendar days elapsed from alert generation (or initial detection of potentially suspicious activity) to SAR filing with FinCEN is measured and compared against the 30-day benchmark. For purposes of this criterion, the following grading thresholds apply: • Green: ≤ 25 days from alert generation to filing • Yellow: 26–30 days from alert generation to filing • Red: > 30 days from alert gene

2. Narrative Completeness. The SAR narrative is evaluated for the following elements: • Identification of the subject(s) of the suspicious activity, including full legal names, dates of birth, identification numbers, and account numbers • Clear and specific description of the suspicious activity, including the nature, timing, and pattern of the transactions or conduct at issue • Explanation of why the activity is sus

3. Form Accuracy. All FinCEN SAR form fields (Parts I through V) are reviewed for accuracy and completeness, including: • Correct entity and individual identification information • Accurate dollar amounts and date ranges for the reported activity • Proper characterization of the type(s) of suspicious activity • Correct identification of the filing institution and branch(es) involved

4. Supporting Documentation. The adequacy of the investigation file is assessed, including the presence and quality of: • Transaction records (account statements, wire transfer records, ACH records, check images) • CDD/EDD records (customer identification documents, beneficial ownership information, risk ratings, enhanced due diligence documentation) • Internal correspondence and referral documentation • Prior SAR fi

5. Decision Quality. The appropriateness of the determination to file (or not file) a SAR is assessed. This criterion evaluates whether the filing decision was consistent with the facts and circumstances of the investigation, BRB's revised SAR Policy & Procedures (currently being drafted as part of the remediation effort), and applicable regulatory guidance. The decision quality assessment also considers whether the

6. Continuing SAR Compliance. For continuing SARs, the following elements are evaluated: • Timeliness of the 90-day follow-up filing, measured from the date of the prior filing • Substantive updates to the narrative reflecting additional investigation findings, new transactions, or changes in the subject's activity since the prior filing • Appropriate determination regarding whether to continue, amend, or close the c

7. BaaS-Specific Review Elements. For SARs originating from BaaS partner channels, the following additional elements are evaluated: • Confirmation that BaaS partner data (including partner-sourced transaction data, customer identification information, and risk assessments) was incorporated into the investigation and SAR narrative • Verification that partner notification and coordination occurred in accordance with th

VII. ERROR TRACKING AND CLASSIFICATION Effective quality assurance requires not only the identification of errors but also their systematic tracking, classification, and analysis over time. This section establishes the error taxonomy, tracking methodology, and database infrastructure that underpin the QA Framework's error management capabilities. A. Error Taxonomy All errors identified during QA reviews are classifie

VIII. ROOT CAUSE ANALYSIS Root cause analysis ("RCA") is a critical component of the QA Framework. Without a systematic effort to understand why errors occur, corrective actions risk addressing symptoms rather than underlying causes, leading to error recurrence and undermining the sustainability of the Bank's compliance improvements. This section establishes the trigger thresholds for RCA, the analytical methodologie

IX. CORRECTIVE ACTION PROCEDURES The identification of errors and their root causes is meaningful only to the extent that it drives effective corrective action. This section establishes the procedures for developing, implementing, tracking, and validating corrective action plans, as well as the protocols for remedial training and personnel actions when warranted. A. Corrective Action Plans (CAPs) Category 1 Error CAP

X. REPORTING AND ESCALATION Effective reporting and escalation mechanisms are essential to ensuring that QA results are communicated to the appropriate stakeholders in a timely manner and that significant quality issues receive the attention of senior management, the Board, and regulators as warranted. This section describes the reporting cadences, content requirements, and escalation protocols that govern the flow o