Contract analysis

1. Executive Summary This Workstream 2 plan addresses the suspicious activity report ("SAR") filing deficiencies identified in OCC Consent Order No. OCC-2025-003 (the "Consent Order"), issued January 15, 2025, against Belmont Ridge Bank National Association ("BRB" or "Belmont Ridge"). The Consent Order identified pervasive and longstanding deficiencies in BRB's suspicious activity monitoring and reporting processes,

2. Background and Regulatory Context 2.1 Consent Order Findings — SAR Deficiencies OCC Consent Order No. OCC-2025-003, issued January 15, 2025, identified significant deficiencies in BRB's suspicious activity monitoring and SAR filing program. The Consent Order was the culmination of a multi-year supervisory process during which the OCC identified, escalated, and ultimately determined that BRB had failed to adequatel

3. Objectives and Success Criteria 3.1 Primary Objectives This Workstream 2 plan is designed to achieve five primary objectives, each of which is essential to the overall remediation of the SAR deficiencies identified in the Consent Order:

1. Backlog Clearance. Complete the review, disposition, and — where warranted — SAR filing for all approximately 2,400 unreviewed suspicious activity alerts that had accumulated as of the September 2024 OCC examination date. The target date for full backlog clearance is June 30, 2025. This objective requires the systematic triage, investigation, and resolution of every alert in the backlog, with full documentation of

2. Filing Timeliness. Reduce the average SAR filing time from the current 78-day average to within 30 days of alert generation on a sustained basis. This objective requires fundamental changes to BRB's alert-to-SAR workflow, including the implementation of automated routing and prioritization, streamlined investigation processes, and enhanced staffing capacity. The target date for achieving the 30-day filing standard

3. Lookback Completion. Conduct a comprehensive SAR lookback project covering the period from January 1, 2022 through September 30, 2024 (approximately 33 months), designed to identify and remediate any previously undetected suspicious activity that should have been reported during the period when BRB's SAR processes were deficient. The lookback is a critical component of the remediation, as it addresses the risk tha

4. Quality Enhancement. Establish and implement enhanced SAR quality review standards to ensure that all SAR narratives meet FinCEN quality expectations for completeness, accuracy, and analytical rigor. Quality enhancement encompasses both the immediate remediation period (during which backlog and lookback SARs are being filed at elevated volumes) and the post-remediation steady state.

5. Sustainable Compliance. Build a staffing model, process infrastructure, and governance framework that sustains compliance beyond the remediation period. The Consent Order requires BRB to achieve and maintain full compliance through February 15, 2026 (the date of the final self-certification) and on an ongoing basis thereafter. Sustainable compliance requires a permanent increase in BSA/AML staffing, modernized tec

4. Backlog Clearance Plan 4.1 Scope of Backlog The backlog subject to this clearance plan consists of approximately 2,400 suspicious activity alerts that remained unreviewed as of the OCC examination date of September 2024. These alerts represent a cross-section of BRB's transaction monitoring output and manual referral activity during the period from approximately January 2024 through September 2024. The alerts in t

5. SAR Lookback Project 5.1 Scope and Purpose In addition to the clearance of the existing alert backlog, a comprehensive lookback is required to identify potentially suspicious activity that was not detected, investigated, or reported during the period when BRB's SAR processes were deficient. The lookback is a distinct undertaking from the backlog clearance: while the backlog clearance addresses alerts that were gen

6. Process Improvement — Reducing SAR Filing Time 6.1 Root Cause Analysis of 78-Day Average Filing Time A thorough root cause analysis has been conducted to identify the factors contributing to BRB's 78-day average SAR filing time. Understanding the root causes is essential to designing effective process improvements that address the underlying problems rather than merely treating symptoms. Seven key contributing fac

1. Insufficient Staffing. With 62 FTEs responsible for processing 41,500 annual alerts, each analyst was responsible for approximately 670 alerts per year, or roughly 13 alerts per week. While this workload figure may appear manageable in the abstract, it must be understood in the context of the complexity and documentation requirements associated with each alert investigation. Many alerts, particularly those origina

2. Manual, Paper-Based Workflows. BRB's alert-to-SAR process relied heavily on manual case file assembly and lacked automated routing and escalation capabilities. Analysts were required to manually compile transaction data from multiple systems, assemble case documentation in physical or semi-electronic files, and manually route cases through the review and approval chain. These manual processes introduced delays at

3. Inadequate TMS Tuning. The Veridian TMS v.8.3 transaction monitoring model was last tuned in October 2022, more than two years before the OCC examination. During the intervening period, BRB's transaction volumes and patterns had changed significantly, particularly due to the rapid growth of BaaS-channel activity. The failure to retune the model resulted in excessive false-positive alert generation, which consumed

4. Lack of Prioritization. BRB did not have a formalized triage or risk-ranking system for alert disposition. Alerts were reviewed on a largely first-in, first-out basis without systematic assessment of relative risk or priority. This approach meant that high-risk alerts involving potential sanctions violations or large-dollar suspicious activity were not prioritized over lower-risk alerts, and analysts had no struct

5. Quality Review Bottleneck. BRB's quality review process consisted of a single review layer with limited senior analyst capacity. The bottleneck at the quality review stage introduced delays of days or weeks for alerts that had been fully investigated and for which SAR narratives had been drafted but which were awaiting review and sign-off. The single-layer review structure also provided insufficient assurance of q

6. BaaS Data Challenges. The investigation of BaaS-originated alerts was frequently impeded by incomplete or delayed transaction data from fintech partners. NovaPay, FairLend Digital, and VaultEdge — BRB's three largest BaaS partners — did not consistently provide real-time or near-real-time transaction data to BRB, and analysts were often required to request supplemental data on a case-by-case basis, introducing del

7. Board Oversight Gap. BRB did not have a dedicated Compliance Committee at the Board level to drive accountability for SAR timeliness metrics. BSA/AML reporting to the Board of Directors was provided on a quarterly basis and did not include SAR filing timeliness data or backlog metrics. The absence of Board-level visibility into SAR filing timeliness meant that there was no governance mechanism to identify deterior

1. Automated Alert Routing and Prioritization. Upon deployment of Veridian TMS v.10.0 (targeted for August 1, 2025, under Workstream 4), alerts will be automatically routed and prioritized based on a risk-scoring algorithm that assigns each alert a risk score based on multiple factors, including transaction amount, customer risk rating, counterparty risk indicators, geographic risk, and historical alert and SAR filin

2. Streamlined Investigation Workflow. The investigation workflow will be redesigned to eliminate unnecessary manual steps and leverage automation where possible. Key improvements include standardized case investigation templates that ensure consistent documentation across all investigations, automated data pulls from BRB's core banking system and BaaS partner systems to pre-populate investigation files with relevant

3. Tiered Review Structure. The current single-layer quality review will be replaced with a three-tier review structure with defined service-level agreements ("SLAs") at each tier: • Level 1 — Analyst Review: The assigned analyst completes the investigation and prepares the disposition recommendation and, if applicable, the draft SAR narrative. Target SLA: 10 calendar days from alert assignment. • Level 2 — Senior An