Contract analysis

I. EXECUTIVE SUMMARY The purpose of this memorandum is to map the technology implementation milestones for the Veridian Analytics Inc. ("Veridian") Transaction Monitoring System ("TMS") v.10.0 upgrade and OFAC sanctions screening module enhancement against the mandatory deadlines established in OCC Consent Order No. OCC-2025-003 (the "Consent Order"), which was issued against Belmont Ridge Bank National Association (

II. BACKGROUND A. Regulatory Context On January 15, 2025, the Office of the Comptroller of the Currency ("OCC") issued Consent Order No. OCC-2025-003 (the "Consent Order") against Belmont Ridge Bank National Association (OCC Charter No. 48271; FDIC Certificate No. 31845). The Consent Order resulted from an OCC examination that identified significant deficiencies in the Bank's Bank Secrecy Act/Anti-Money Laundering ("

III. CONSENT ORDER DEADLINE MAPPING This section provides a detailed analysis of each of the three technology-related Consent Order deadlines, including the specific requirements, available calendar time, key milestones, dependencies, and schedule float for each. A. Deadline 1: August 1, 2025 — TMS v.10.0 UAT Complete and Deployed Consent Order Requirement. The Consent Order requires that the upgraded transaction mon

1. MSA Amendment and SOW Finalization and Execution: Target April 1, 2025. This is the gating milestone. Veridian's professional services resources cannot be formally committed, and implementation work cannot commence, until the contractual framework is executed.

2. Environment Provisioning and Data Migration Kickoff: April 7–18, 2025 (approximately two weeks). This phase includes provisioning the TMS v.10.0 environment in Veridian's hosted infrastructure, establishing secure connectivity with BRB's data sources, and initiating the migration of transaction data, customer data, and historical alert records from the v.8.3 platform.

3. System Configuration and Scenario Library Migration/Upgrade: April 21 – May 30, 2025 (approximately six weeks). This is the most labor-intensive phase, involving configuration of the TMS v.10.0 detection engine, migration and upgrade of BRB's existing scenario library (including above-the-line and below-the-line thresholds), configuration of alert management workflows, and integration with BRB's core banking syste

4. Initial System Testing (Unit Testing and Integration Testing): June 2–20, 2025 (approximately three weeks). Veridian's implementation team and BRB's IT team will conduct systematic unit testing of individual system components and integration testing to verify end-to-end data flow from source systems through the detection engine to alert generation and case management.

5. User Acceptance Testing (UAT): June 23 – July 18, 2025 (approximately four weeks). BRB's business users — including BSA/AML analysts, OFAC compliance staff, and IT personnel — will execute a comprehensive UAT plan designed to validate that the system meets all functional requirements, performance specifications, and regulatory expectations. UAT will include scenario-based testing, regression testing, performance/s

6. UAT Remediation and Defect Resolution: July 21–28, 2025 (approximately one week). Any defects identified during UAT will be triaged, prioritized, and remediated. Critical and high-severity defects must be resolved prior to production cutover; medium- and low-severity defects may be deferred to a post-deployment patch cycle, subject to documented risk acceptance.

7. Production Cutover and Go-Live: July 29 – August 1, 2025. The production cutover involves final data synchronization, system activation, parallel processing validation, and formal go-live. A rollback plan must be in place in case critical issues are identified during cutover. Schedule Float. The schedule float for the August 1 deadline is minimal — approximately three to five business days of buffer built into end

1. Engage/Confirm Validation Firm: By June 15, 2025. Early engagement is critical to allow the validation firm to begin planning, assign resources, and conduct preliminary documentation review. Waiting until after the August 1 go-live to engage the firm would compress an already tight timeline to an unacceptable degree.

2. Validation Firm Review of Pre-Deployment Documentation and Model Design: June–July 2025 (pre-positioning phase). The validation firm should review the TMS v.10.0 model documentation, scenario design specifications, tuning methodology, and governance framework during the pre-deployment period. This "pre-positioning" activity allows the firm to identify any conceptual soundness concerns before the system goes live a

3. Post-Deployment Production Data Analysis and Testing: August 4 – September 5, 2025 (approximately five weeks). Following the August 1 go-live, the validation firm will collect and analyze production data to assess alert generation accuracy, false-positive rates, detection coverage, and threshold calibration. A minimum of 30 days of production data is standard practice for a meaningful quantitative validation.

4. Draft Validation Report: September 8–19, 2025. The validation firm will prepare a draft report summarizing its findings, including any identified deficiencies or recommendations for remediation.

5. Final Validation Report and Remediation of Identified Issues: September 22 – October 1, 2025. BRB and Veridian will review the draft report, address any identified issues or implement recommended adjustments, and the validation firm will finalize its report. The final report must be completed by October 1, 2025. Schedule Float. The schedule float for the October 1 deadline is very limited — approximately five busi

1. OFAC Module Configuration and BaaS API Integration: This workstream is included within the broader TMS v.10.0 implementation timeline (April–July 2025). During the system configuration phase, the OFAC module will be configured with BRB's screening parameters, list management settings, and hit disposition workflows. Concurrently, API integration specifications will be developed for each of the 14 BaaS partner trans

2. BaaS Partner Technical Coordination: This is a parallel workstream that requires active cooperation from all 14 fintech partners on data feeds, API specifications, and transaction format standardization. Each partner must provide transaction data in a format compatible with the Veridian TMS v.10.0 OFAC screening module, and must implement the required API connections to enable real-time screening. NovaPay, FairLen

3. Compliance Remediation Letters. Compliance remediation letters have already been sent to NovaPay (attention: Ethan Garrison, Chief Executive Officer) and FairLend Digital (attention: Aisha Okonkwo, Chief Executive Officer), demanding enhanced cooperation and data sharing in support of the OFAC screening enhancement. The cooperation of BaaS partners is a prerequisite for successful integration, and the remediation

4. OFAC Screening Parallel Run (Dual Processing): August 1 – September 15, 2025 (approximately six weeks). During this phase, the upgraded OFAC screening module will process transactions in parallel with the legacy screening system. This parallel-run approach allows BRB to compare screening results between the old and new systems, identify any discrepancies, and validate that the upgraded module is capturing all tran

5. OFAC Screening Accuracy Testing and Tuning: September 15 – October 15, 2025 (approximately four weeks). Based on the results of the parallel run, the OFAC module will be tuned to optimize screening accuracy, reduce false-positive rates, and ensure that the hit disposition workflow is functioning correctly. This phase also includes testing of list update processes and verification that all sanctions list sources ar

6. Full Cutover to Production OFAC Screening for All 14 BaaS Channels: October 15–31, 2025 (approximately two weeks). The legacy OFAC screening system will be retired, and the upgraded module within TMS v.10.0 will become the sole production OFAC screening platform for all BaaS channels. Each of the 14 partner channels will be individually verified for complete integration and 100% transaction coverage.

7. Confirmation of 100% Screening Operationalization: November 1, 2025. BRB will confirm, through system reporting and compliance validation, that all 14 BaaS partner transaction channels are fully integrated with the OFAC screening module and that 100% of transactions are being screened in real time. Schedule Float. The OFAC screening timeline includes approximately two weeks of float, primarily located in the paral

IV. CRITICAL PATH ANALYSIS A. Identification of Critical Path Based on the deadline mapping set forth in Section III, the critical path for the technology implementation runs through the following sequential chain: MSA Amendment Execution (April 1) → System Configuration and Scenario Library Migration (April–May) → System Testing (June) → User Acceptance Testing (June–July) → Production Deployment (August 1) → Produc

V. RISK ASSESSMENT This section identifies and assesses the principal risks to BRB's ability to meet the three Consent Order technology deadlines. For each risk, we assess the likelihood of occurrence, the potential impact on the timeline, the current status of any relevant activity, and recommended mitigation measures. A. Risk 1: MSA Amendment Execution Delay Description. The Veridian MSA amendment and Statement of