Contract analysis

1. Executive Summary This document constitutes the Workstream 3 remediation plan (the "Plan") and addresses Deficiency Category (iii) as identified in Consent Order No. OCC-2025-003, issued by the Office of the Comptroller of the Currency ("OCC") on January 15, 2025, against Belmont Ridge Bank National Association ("BRB" or the "Bank") (OCC Charter No. 48271; FDIC Certificate No. 31845). The Consent Order identified,

2. Background and Regulatory Context 2.1 Consent Order Findings — CDD/EDD Deficiencies The OCC's targeted BSA/AML examination of BRB commenced in March 2024 and concluded in September 2024. The examination was conducted by the OCC Northeastern District Office under the direction of Jonathan Frey, National Bank Examiner, Examiner-in-Charge, and was prompted in part by the Bank's failure to satisfactorily remediate pri

3. Scope Definition 3.1 In-Scope Account Population The total in-scope account population for Workstream 3 consists of 47,000 high-risk customer accounts that have been identified as lacking adequate CDD or EDD documentation as of the OCC examination conclusion date in September 2024. This figure was determined through the OCC examination team's review of BRB's account records, BaaS partner data feeds, and compliance

4. Governance and Accountability 4.1 Workstream Leadership The effective execution of this Plan requires clear lines of authority, defined roles and responsibilities, and robust escalation protocols. The following individuals have been designated as the leadership team for Workstream 3: Workstream Sponsor: Patricia Langston, Chief Compliance Officer, BRB. Ms. Langston serves as the executive sponsor for Workstream 3

5. Risk-Based Prioritization Methodology 5.1 Prioritization Criteria Given the magnitude of the remediation population — 47,000 accounts — a risk-based prioritization methodology is essential to ensure that the accounts presenting the greatest risk to BRB, its customers, and the integrity of the financial system are remediated first. This approach is consistent with regulatory expectations for risk-based BSA/AML comp

1. Customer Risk Rating. Accounts that are currently rated "high" or "very high" risk under BRB's existing risk-rating methodology will receive the highest priority for remediation. Accounts for which no risk rating has been assigned — a deficiency that is itself one of the CDD gaps to be remediated — will be presumed to be high risk pending the assignment of a risk rating during the remediation process. This presump

2. Transaction Volume and Value. Accounts with higher aggregate transaction volumes, and particularly accounts with significant wire transfer and Automated Clearing House ("ACH") transaction activity, will be prioritized. These transaction types are subject to OFAC screening requirements and are commonly associated with higher BSA/AML risk due to their speed, volume, and cross-border capabilities. Accounts with aggre

3. BaaS Partner Risk Profile. Accounts onboarded through the BaaS partners assessed as presenting the highest risk will be prioritized. Specifically, accounts from NovaPay Technologies are elevated in priority due to the OFAC sanctions screening gap affecting approximately 3.8 million transactions in CY 2023, which compounds the CDD/EDD deficiency for the NovaPay customer population. Accounts from FairLend Digital ar

4. Geographic Risk. Accounts with connections to high-risk jurisdictions — including countries on the Financial Action Task Force ("FATF") grey list or black list, jurisdictions subject to OFAC comprehensive or sectoral sanctions, and jurisdictions identified by BRB's own country risk assessment as presenting elevated money laundering or terrorist financing risk — will be elevated in priority. Geographic connections

5. SAR History. Accounts that have been the subject of prior Suspicious Activity Report filings, or that are currently associated with pending transaction monitoring alerts in BRB's Veridian TMS, will be prioritized. The existence of a SAR filing or pending alert indicates that the account has already been identified as presenting potential suspicious activity, making the absence of adequate CDD/EDD documentation par

6. Account Age and Activity Status. Active accounts with high levels of ongoing transaction activity will be prioritized over dormant or low-activity accounts. While dormant accounts are not exempt from CDD/EDD requirements, the immediate risk of ongoing illicit activity is higher for accounts that are actively transacting. Dormant accounts will be remediated in Tier 3, with the additional step of assessing whether t

6. Remediation Process and Procedures 6.1 CDD Remediation Steps The remediation of each deficient account will follow a structured, documented process designed to identify all CDD/EDD gaps, collect the required information and documentation, update the account's risk profile, and confirm that the remediated file meets all applicable regulatory and policy requirements. For each deficient account, the remediation team

1. Initial escalation by Warren Ashby to the partner's designated compliance contact;

2. Escalation by Warren Ashby to the partner's CEO with a formal written demand for cooperation;

3. Issuance of a formal compliance remediation letter, prepared by Calderwood & Harkness LLP, to the partner CEO, citing the partner's contractual obligations and the potential consequences of continued non-cooperation (see companion documents: NovaPay Compliance Remediation Letter, FairLend Compliance Remediation Letter);

4. As a measure of last resort, consideration of suspension of new account onboarding through the non-cooperating partner, or termination of the BaaS partnership agreement, subject to the approval of the CCO, CEO, General Counsel, and outside counsel, and with notification to the Compliance Committee. The BaaS Partner CDD/EDD Responsibility Matrix (Appendix F, companion document) provides a detailed delineation of wh

7. Staffing and Resource Allocation 7.1 Temporary Staffing — Pinnacle Compliance Solutions LLC The scale of the CDD/EDD remediation effort — 47,000 accounts to be remediated within approximately twelve months — exceeds the capacity of BRB's existing BSA/AML department. To ensure that BRB has sufficient analyst capacity to execute this Plan within the mandated timeframes, BRB has contracted with Pinnacle Compliance So

8. Budget 8.1 Total Workstream Budget: $4,300,000 The total budget allocated to Workstream 3 (CDD/EDD Remediation) is $4,300,000. This budget encompasses the following categories of expenditure: Temporary Staffing (CDD/EDD-Allocated Pinnacle FTEs): Approximately $1,440,000–$1,800,000. This represents the CDD/EDD workstream's share of the broader Pinnacle Compliance Solutions contract ($3,600,000 total for 30 FTEs ove