Contract analysis

I. EXECUTIVE SUMMARY This Second Quarterly Progress Report (this "Report") is submitted on behalf of Belmont Ridge Bank National Association ("BRB" or the "Bank") to the Office of the Comptroller of the Currency (the "OCC") by Calderwood & Harkness LLP ("C&H"), as the Bank's outside regulatory counsel, pursuant to the reporting requirements set forth in Article XII of Consent Order No. OCC-2025-003 (the "Consent Orde

II. BACKGROUND AND REGULATORY CONTEXT A. Consent Order Summary On January 15, 2025, the OCC issued Consent Order No. OCC-2025-003 against Belmont Ridge Bank National Association. The Order resulted from a targeted BSA/AML examination that was commenced in March 2024 and concluded in September 2024. The examination was conducted by a team of OCC examiners led by National Bank Examiner Jonathan Frey, Examiner-in-Charge

III. WORKSTREAM 1: OFAC SANCTIONS SCREENING REMEDIATION A. Objective and Consent Order Requirements Articles III and IV of the Consent Order required the Bank to remediate deficiencies in its OFAC sanctions screening program. The OCC examination identified that the Bank had failed to screen 100% of transactions processed through its fintech BaaS partner channels against applicable OFAC sanctions lists. Specifically,

IV. WORKSTREAM 2: SAR BACKLOG CLEARANCE & PROCESS IMPROVEMENT A. Objective and Consent Order Requirements

Article V of the Consent Order required the Bank to address two related deficiencies in its suspicious activity reporting program: (i) the existence of a backlog of approximately 2,400 potentially suspicious activity alerts that had not been reviewed or dispositioned as of the September 2024 OCC examination date; and (ii) the Bank's excessive average SAR filing time of approximately 78 days from the date of alert gen

V. WORKSTREAM 3: CDD/EDD REMEDIATION A. Objective and Consent Order Requirements

Article VI of the Consent Order required the Bank to remediate CDD/EDD documentation for approximately 47,000 high-risk customer accounts, the majority of which were onboarded through the Bank's fintech BaaS partner channels. The OCC examination determined that these accounts had inadequate or missing CDD/EDD documentation, including deficient customer identification records, incomplete beneficial ownership informati

VI. WORKSTREAM 4: TRANSACTION MONITORING MODEL VALIDATION & TUNING A. Objective and Consent Order Requirements

Article VII of the Consent Order required the Bank to address significant deficiencies in the validation and tuning of its transaction monitoring system. The OCC examination determined that the Bank's Veridian Analytics TMS v.8.3 had not been independently validated since March 2021, a period of more than three years prior to the commencement of the OCC's targeted examination. Additionally, the tuning parameters for

VII. WORKSTREAM 5: BSA/AML PROGRAM GOVERNANCE & TRAINING ENHANCEMENT A. Objective and Consent Order Requirements

Article IX of the Consent Order required the Bank to address deficiencies in its BSA/AML program governance structure and training program. Specifically, the Order required the Bank to: (i) Establish a dedicated Compliance Committee of the Board of Directors with specific responsibility for overseeing the Bank's BSA/AML and OFAC compliance program; (ii) Enhance BSA/AML reporting to the Board to include key metrics re

1. Revised OFAC Compliance Policy

2. OFAC Screening Procedures Manual

3. Revised SAR Policy & Procedures

5. BaaS Partner CDD/EDD Responsibility Matrix (RACI)

6. BaaS Compliance Oversight Framework

7. Transaction Monitoring Program Policy

8. Model Risk Management Policy (BSA/AML-specific provisions)

10. Compliance Committee Charter and Reporting Framework

11. BSA/AML Risk Assessment Methodology

12. Independent Testing Program Charter All policies have been approved by the Compliance Committee and, where required, the full Board of Directors. Copies of all policies have been provided to Thornfield and are available for OCC review upon request.

VIII. FINTECH / BaaS PARTNERSHIP OVERSIGHT A. BaaS Compliance Oversight Framework The Bank has implemented a restructured BaaS Compliance Oversight Framework governing the Bank's relationship with all fourteen (14) active BaaS partners. The framework is designed to ensure that the Bank's BSA/AML and OFAC compliance obligations are met across all BaaS partner channels and is aligned with the OCC's guidance on third-pa