Contract analysis

I. Executive Summary This memorandum analyzes the securities disclosure obligations of Belmont Ridge Financial Group, Inc. ("BRFG" or the "Company") (NYSE: BRFG) under the Securities Exchange Act of 1934, as amended (the "Exchange Act"), and the rules and regulations promulgated thereunder by the U.S. Securities and Exchange Commission (the "SEC"), in connection with the consent order issued by the Office of the Comp

II. Background A. The Consent Order On January 15, 2025, the OCC issued Consent Order No. OCC-2025-003 against BRB. The Consent Order is the culmination of a targeted BSA/AML examination that the OCC conducted from March 2024 through September 2024, during which OCC examiners identified pervasive deficiencies in BRB's BSA/AML compliance infrastructure. The Consent Order identifies five core categories of deficiency,

III. Form 8-K Disclosure Analysis A. Initial 8-K Filing — January 16, 2025 Disclosure BRFG publicly disclosed the Consent Order via a Current Report on Form 8-K filed with the SEC on January 16, 2025, one business day after the Consent Order's January 15, 2025 effective date. This section analyzes the applicable Form 8-K triggering items and the timeliness and appropriateness of the filing. Item 1.01 — Entry into a M

1. Description of the Consent Order's Core Findings. The 8-K should describe the five core deficiency categories identified by the OCC: OFAC sanctions screening failures, SAR filing deficiencies, CDD/EDD failures, transaction monitoring model validation deficiencies, and Board oversight deficiencies. While the level of detail may be more condensed in an 8-K than in an annual report, investors should be informed of th

2. Civil Money Penalty Amount and Payment Deadline. The 8-K should clearly state the $14,500,000 CMP amount and the March 16, 2025 payment deadline. This is a definite, quantifiable financial obligation that investors need to evaluate.

3. Statement Regarding BRB's Intent to Comply. The 8-K should include a statement that BRB has consented to the order and intends to comply fully with all of its terms. This is standard practice in disclosure of consent orders and signals to investors that the Company is not contesting the findings.

4. Engagement of Independent Consultant. The 8-K should disclose that the Consent Order mandates the engagement of an independent consultant, identify Thornfield as the selected consultant (if the OCC's non-objection had been received prior to filing, which in this case it had not, as the non-objection was received February 5, 2025), and describe the consultant's role. If Thornfield was not yet identified at the time

5. Estimated Financial Impact. The 8-K should provide the Board-approved remediation budget of $42,500,000 and the total estimated financial outlay of $57,000,000 (inclusive of the CMP). To the extent that the Board had not yet approved the full remediation budget on January 16, 2025, the 8-K should have noted that the Company expected to incur significant remediation costs and would provide estimates as they became

6. Risk Factors Regarding Potential Additional Regulatory Actions. The 8-K should include cautionary language noting the possibility of additional enforcement actions by FinCEN, DOJ, or OFAC, and that the Consent Order does not preclude such actions.

7. Cautionary Language Regarding Forward-Looking Statements. The 8-K should include safe harbor language under the Private Securities Litigation Reform Act of 1995 ("PSLRA"), 15 U.S.C. § 78u-5, identifying forward-looking statements regarding remediation costs, timelines, and outcomes, and cautioning investors that actual results may differ materially from those projected. We will coordinate with Mr. Nardone's office

IV. Form 10-K Disclosure Analysis A. Timing BRFG's annual report on Form 10-K for the fiscal year ended December 31, 2024 (the "FY 2024 10-K") will be the first annual report filed after the January 15, 2025 effective date of the Consent Order. As such, the FY 2024 10-K must reflect the Consent Order as a subsequent event and must integrate disclosure of the Consent Order and its implications throughout the relevant

1. Regulatory Compliance Risk. The 10-K should include a prominent risk factor disclosing the Consent Order and the required remediation program, and clearly stating the risk that additional enforcement actions may be taken by the OCC (including the potential for more severe sanctions if the Company fails to satisfy the Consent Order's requirements), FinCEN (which has reserved its enforcement rights), the DOJ (which

2. Financial Risk. A risk factor should address the $57,000,000 total estimated outlay, the potential for cost overruns beyond the Board-approved budget, the non-deductibility of the $14,500,000 CMP under 26 U.S.C. § 162(f) (which increases the effective after-tax cost of the CMP), and the potential for additional financial penalties if FinCEN, OFAC, or other agencies take separate enforcement action. The risk factor

3. Operational Risk. The 10-K should include a risk factor addressing the operational disruption that the remediation program will impose on BRB's day-to-day operations. This includes the risk associated with the technology upgrade from Veridian TMS v.8.3 to v.10.0, which involves a complex system implementation with inherent risk of delays, cost overruns, and integration challenges. It also includes the staffing cha

4. BaaS / Fintech Partnership Risk. Given the centrality of the BaaS business line to the Consent Order's findings, a dedicated risk factor should address the risk that enhanced compliance requirements may lead to the termination, non-renewal, or renegotiation of fintech partner agreements. This risk factor should specifically address the NovaPay Technologies relationship (given its identification in the Consent Orde

5. Reputational Risk. A risk factor should address the reputational harm arising from the Consent Order, including negative media coverage, potential loss of investor confidence (as evidenced by the 13.9% stock decline), and the risk of customer attrition in BRB's retail banking, commercial lending, and wealth management businesses.

6. Risk of Additional Regulatory Actions. While partially addressed in the regulatory compliance risk factor, a separate or supplemental risk factor should clearly state that FinCEN has reserved its enforcement rights, that no DOJ criminal referral has been made as of the date of the filing but that a referral is not precluded, and that the OFAC sanctions screening failures may give rise to independent OFAC enforceme

7. Key Personnel Risk. A risk factor should address the Company's reliance on key compliance personnel during the remediation period. CCO Patricia Langston was appointed in January 2024 and BSA Officer Thomas Ikeda was appointed in March 2023 — both are relatively recent appointees to their respective roles, and their continued service during the critical 12-month remediation period is essential to the success of the

V. Proxy Statement Disclosure Analysis A. Upcoming Annual Meeting BRFG's next annual meeting of shareholders is expected to be held in the spring of 2025, and the proxy statement filed in connection with that meeting will be the first proxy filed after the Consent Order's issuance. The proxy statement must address the Consent Order and its implications in multiple contexts, including Board governance and oversight, e

VI. Materiality Analysis — Comprehensive Framework A. Quantitative Materiality The quantitative materiality of the Consent Order-related financial exposure is assessed by measuring the $57,000,000 total outlay against key financial metrics of the Company: The $14,500,000 CMP, assessed independently: While the CMP alone falls below the 5% net income threshold, the CMP carries qualitative weight disproportionate to its

VII. Ongoing Disclosure Obligations and Monitoring A. Quarterly Reports (Form 10-Q) Each quarterly report on Form 10-Q filed by BRFG during the remediation period — which we expect to include at least the Q1 2025, Q2 2025, Q3 2025, and Q4 2025 quarterly filings — must include updated disclosures regarding the Consent Order and remediation program. Specifically, each 10-Q should address the following: • Remediation Pr