Contract analysis

I. EXECUTIVE SUMMARY This memorandum presents Calderwood & Harkness LLP's ("C&H") comparative analysis of two technology paths available to Belmont Ridge Bank National Association ("BRB" or the "Bank") for remediating the transaction monitoring and OFAC sanctions screening deficiencies identified in the Consent Order issued by the Office of the Comptroller of the Currency ("OCC"), Consent Order No. OCC-2025-003 (the

II. BACKGROUND A. Regulatory Context On January 15, 2025, the OCC issued Consent Order No. OCC-2025-003 against Belmont Ridge Bank National Association (OCC Charter No. 48271, FDIC Certificate No. 31845), a national banking association headquartered in Philadelphia, Pennsylvania. The Consent Order followed a series of supervisory findings and enforcement escalation over the preceding three years, culminating in the O

1. NovaPay Technologies Inc. — Approximately 41% of total BaaS volume, or approximately $30,500,000,000 in CY 2024. NovaPay is the partner most directly implicated in the Consent Order's OFAC screening findings.

2. FairLend Digital LLC — Approximately 28% of total BaaS volume. FairLend Digital provides consumer lending products through BRB's charter.

3. VaultEdge Inc. — Approximately 18% of total BaaS volume. VaultEdge provides digital banking and savings products. The remaining eleven (11) BaaS partners collectively represent approximately 13% of total BaaS transaction volume. BaaS revenue to BRB in CY 2024 was $127,400,000, representing a material revenue stream for the institution. The strategic importance of the BaaS program to BRB's long-term business plan u

III. OPTION A: VERIDIAN ANALYTICS TMS v.10.0 UPGRADE A. Scope of Upgrade Option A involves an upgrade of BRB's existing Veridian Analytics platform from TMS v.8.3 to TMS v.10.0, Veridian's next-generation transaction monitoring and financial crime compliance platform. The upgrade encompasses the following principal components: Transaction Monitoring System Upgrade. TMS v.10.0 represents a significant generational adv

IV. OPTION B: RIDGELINE DATA SYSTEMS LLC FULL PLATFORM REPLACEMENT A. Vendor Profile Ridgeline Data Systems LLC ("Ridgeline") is a Delaware limited liability company with principal offices at 500 West Monroe Street, Suite 2800, Chicago, Illinois 60661. BRB's primary point of contact at Ridgeline is David Marchetti, Chief Revenue Officer. Ridgeline provides a full-service AML transaction monitoring and sanctions scree

V. TOTAL COST OF OWNERSHIP COMPARISON A. Cost Summary Table The following table summarizes the estimated total cost of ownership for each option over a five-year horizon: Notes on Veridian Option A Cost Structure. BRB's existing Veridian contract (VA-BRB-2023-0044) carries an ACV of $4,100,000 per year and runs through December 2026. BRB is obligated to pay this ACV regardless of whether it proceeds with the upgrade

VI. CONSENT ORDER TIMELINE ALIGNMENT ANALYSIS A. Critical Deadlines Mapping The following table maps each Consent Order technology-related deadline against achievability for each vendor option: The contrast between the two options is stark. The Veridian upgrade path enables BRB to meet every technology-related Consent Order deadline, whereas the Ridgeline replacement path fails to meet any of them. This fundamental t

VII. REGULATORY PERCEPTION ANALYSIS A. OCC and Examiner Considerations Regulatory perception is a critical factor in the vendor selection analysis, separate from the technical and financial considerations discussed above. BRB's relationship with the OCC and its examination team will be shaped in significant part by the nature, speed, and quality of BRB's remediation response to the Consent Order. OCC examiners genera

VIII. CONTINGENCY FRAMEWORK: RIDGELINE AS FALLBACK While C&H recommends the Veridian upgrade as the primary remediation path, prudent risk management requires BRB to maintain a documented contingency plan in the event that the Veridian upgrade fails to meet critical milestones. The following framework defines the trigger events, activation process, and pre-positioning steps for transitioning to Ridgeline as the prima

1. Veridian UAT Delivery Failure. Veridian fails to deliver TMS v.10.0 in a state suitable for commencement of user acceptance testing by July 1, 2025 — one month before the August 1, 2025 Consent Order deadline. This one-month buffer is necessary to provide adequate time for UAT completion and issue remediation before the production deployment deadline.

2. OFAC Module Integration Failure. The Veridian OFAC module fails integration testing with BaaS partner transaction flows by September 1, 2025 — two months before the November 1, 2025 Consent Order deadline. This buffer is necessary to allow for remediation of integration issues and comprehensive screening validation before the full operationalization deadline.

3. Thornfield Architectural Insufficiency Finding. Thornfield Consulting's preliminary gap assessment, due April 15, 2025, concludes