Contract analysis

1. The incumbent vendor: Veridian Analytics Inc. (Contract No. VA-BRB-2023-0044), including the proposed upgrade from Veridian TMS v.8.3 to v.10.0 and the addition of the enhanced OFAC screening module; and

2. Any alternative vendor under consideration, including Ridgeline Data Systems LLC, which is currently under preliminary evaluation as a potential replacement platform. The checklist must be refreshed at least annually, or upon the occurrence of material changes in the vendor relationship, the vendor's product or service offering, or the vendor's risk profile. Triggering events for ad hoc reassessment are described

1. OFAC Sanctions Screening Adequacy — The Consent Order found that the Bank's OFAC sanctions screening program failed to screen all transactions across all channels, with a specific finding that approximately 12% of NovaPay wire and ACH transactions (approximately 3,800,000 of 31,700,000 total NovaPay transactions in CY 2023) were not screened against OFAC sanctions lists. Checklist items addressing this deficiency

2. Transaction Monitoring Model Validation — The Consent Order found that the Bank's transaction monitoring system (Veridian TMS v.8.3) had not undergone an independent model validation since March 2021, and that tuning parameters had not been updated since October 2022. Checklist items addressing this deficiency are concentrated in Sections 7.1 and 8.3.

3. SAR Filing Process — The Consent Order identified deficiencies in the Bank's suspicious activity reporting process, including backlogs, untimely filings, and inadequate documentation. Checklist items addressing SAR-related vendor capabilities are found in Section 7.1.

4. CDD/EDD — The Consent Order identified weaknesses in the Bank's customer due diligence and enhanced due diligence processes, particularly with respect to BaaS partner end-user accounts. Checklist items addressing CDD/EDD-related vendor capabilities are found in Section 7.3.

5. Board-Level Reporting — The Consent Order found that the Bank's board and senior management did not receive adequate, timely, and comprehensive BSA/AML compliance reporting. Checklist items addressing reporting and dashboard capabilities are found in Sections 7.1 and 9.2. Users of this checklist should pay particular attention to items flagged with the notation "[CO]" in the body of the checklist, which indicates

1. Cost Differential: Ridgeline's proposed ACV of $7,200,000/year exceeds the proposed Veridian v.10.0 ACV of $6,000,000/year by $1,200,000/year. Over the proposed 5-year term, the total Ridgeline contract value of $36,000,000 would exceed the projected Veridian v.10.0 cost over the same period (approximately $30,000,000, assuming ACV remains stable after the initial upgrade) by approximately $6,000,000. The cost-ben

2. Implementation Risk: Transitioning to a new vendor platform introduces significant implementation risk, including the risk of delays that could jeopardize compliance with Consent Order deadlines. The assessment team should evaluate whether a full platform replacement can realistically be completed within the Consent Order timelines (OFAC screening fully operational for all BaaS channels by November 1, 2025).

3. Operational Continuity: A vendor transition would require parallel running of the old and new platforms during the transition period, imposing additional operational burden on the Bank's BSA, compliance, and technology teams.

4. Consent Order Notification: As noted in Section 11.2, any change in AML/sanctions technology vendor must be communicated to the OCC in advance, and a non-objection may be required under the Consent Order. This requirement should be factored into the evaluation timeline.

5. Contingency Planning: Even if the Bank's primary strategy is to proceed with the Veridian v.10.0 upgrade, maintaining Ridgeline as a viable alternative serves a valuable contingency planning function. The Bank should advance Ridgeline to detailed evaluation if, and to the extent that, the Veridian upgrade encounters significant technical, operational, or contractual obstacles that call into question the Bank's abi