Contract analysis

I. EXECUTIVE SUMMARY This memorandum sets forth a detailed remediation plan addressing Deficiency Category (iv) of Consent Order No. OCC-2025-003 ("Consent Order"), issued by the Office of the Comptroller of the Currency ("OCC") on January 15, 2025, against Belmont Ridge Bank National Association ("BRB" or the "Bank"). Deficiency Category (iv) pertains specifically to BRB's failure to independently validate and adequ

1. Technology Upgrade: Upgrade from Veridian TMS v.8.3 to Veridian TMS v.10.0, including an enhanced OFAC screening module, providing expanded machine-learning-assisted behavioral analytics, improved peer-group analysis, BaaS-specific monitoring rules, and enhanced structuring detection capabilities.

2. Comprehensive Model Tuning: Full recalibration of all active detection scenarios and thresholds using statistical analysis, historical data review, and below-the-line testing, with particular attention to BaaS-specific tuning requirements.

3. Independent Model Validation: Engagement of a qualified third-party validator to perform a comprehensive independent model validation of the upgraded TMS v.10.0, including conceptual soundness review, outcomes analysis, and process verification.

4. Ongoing Governance Framework: Establishment of a permanent model risk management governance framework with defined roles and responsibilities, periodic validation cadences, quarterly tuning reviews, formal change management processes, and Board-level reporting. Key Milestones. The remediation plan targets the following critical deadlines, each of which aligns with the Consent Order's remediation timeline: • August

II. BACKGROUND AND CURRENT STATE ASSESSMENT

II.A. Consent Order Findings — Deficiency Category (iv): Model Validation Consent Order No. OCC-2025-003, issued by the OCC on January 15, 2025, identifies multiple categories of deficiency in BRB's BSA/AML compliance program. Deficiency Category (iv) addresses the Bank's failure to independently validate and adequately tune its transaction monitoring system in accordance with applicable supervisory expectations. The

II.B. Transaction Monitoring System — Current Configuration BRB's transaction monitoring operations are currently supported by the Veridian Analytics Inc. Transaction Monitoring System, version 8.3 ("Veridian TMS v.8.3"). The following describes the current configuration and operational parameters of the system. Vendor Information. Veridian Analytics Inc. is a Delaware corporation headquartered at 1900 Embarcadero Ro

II.C. Performance Metrics (CY 2024 Baseline) Understanding the current performance of the Veridian TMS v.8.3 is essential to defining the scope of remediation required and establishing meaningful optimization targets for the upgraded system. The following metrics represent the CY 2024 baseline against which remediation progress will be measured. Transaction Monitoring Alert Volume. During CY 2024, the Veridian TMS v.

II.D. Prior Validation and Tuning History A review of the historical record of model validation and tuning activities for BRB's Veridian TMS reveals a pattern of infrequent and incomplete attention to these critical model risk management functions. The following chronology summarizes the relevant history: March 2021 — Last Independent Model Validation. The most recent independent model validation of the Veridian TMS

II.E. BSA/AML Department Staffing Context The successful execution of the remediation plan outlined in this document depends in significant part on the adequacy of BRB's BSA/AML department staffing. The current and planned staffing levels are as follows: Current Headcount. As of January 2025, BRB's BSA/AML department comprises 62 full-time equivalent employees ("FTEs"). These employees include investigators, analysts

III.A. Consent Order Compliance Objectives The remediation plan for Workstream 4 is designed to achieve full compliance with the requirements of Consent Order No. OCC-2025-003, Deficiency Category (iv), within the timeframes mandated by the Consent Order. The specific compliance objectives are as follows: Independent Model Validation. BRB will achieve independent model validation of the upgraded Veridian TMS v.10.0 b

III.B. Operational Objectives Beyond achieving compliance with the Consent Order's specific requirements, the remediation plan for Workstream 4 pursues the following operational objectives, which are intended to enhance the long-term effectiveness and sustainability of BRB's transaction monitoring program: False-Positive Rate Reduction. BRB will reduce false-positive alert rates to improve investigator efficiency and

IV. TECHNOLOGY UPGRADE PLAN — VERIDIAN TMS v.10.0

IV.A. Scope of Upgrade The cornerstone of the technology component of this remediation plan is the upgrade from Veridian TMS v.8.3 to Veridian TMS v.10.0. The v.10.0 release represents a major platform upgrade that addresses many of the architectural and functional limitations of the current v.8.3 system. The scope of the upgrade encompasses the following principal areas: Enhanced Detection Scenarios. Veridian TMS v.

IV.B. Commercial Terms The upgrade from Veridian TMS v.8.3 to TMS v.10.0 has been negotiated with Veridian Analytics on the following commercial terms, which are subject to final documentation in an amendment to the existing Master Services Agreement: • One-Time Implementation Fee: $2,800,000, covering the platform upgrade, scenario configuration, data migration, integration development, professional services, UAT su

IV.C. Implementation Timeline The implementation of the Veridian TMS v.10.0 upgrade will follow the timeline set forth below. This timeline has been developed in coordination with Veridian Analytics and BRB's technology team under Linda Petrosian (CIO/CTO), and is designed to achieve the Consent Order's remediation milestones while allowing adequate time for thorough testing and validation.

IV.D. Implementation Risk Factors and Mitigation The implementation of a major platform upgrade on the timeline required by the Consent Order carries inherent execution risks. BRB has identified the following principal risk factors and corresponding mitigation strategies: Risk: Delay in Data Migration or BaaS Partner Feed Integration. The upgrade requires integration with data feeds from all 14 active BaaS partners,

V. CONTINGENCY — RIDGELINE DATA SYSTEMS LLC BRB's primary remediation strategy under this Workstream 4 is the upgrade to Veridian TMS v.10.0 as described in Section IV above. However, recognizing the critical importance of the transaction monitoring system to BSA/AML compliance and the significant consequences of a failed implementation, BRB has undertaken a parallel evaluation of an alternative TMS/sanctions screeni

1. Veridian vs. Ridgeline Vendor Comparison Memorandum: A comprehensive comparison of the two platforms across dimensions including functionality, scalability, BaaS integration capabilities, regulatory compliance features, implementation timelines, and total cost of ownership.

2. Ridgeline Term Sheet Review Memorandum: A detailed analysis of the proposed commercial terms, including identification of key negotiation points and risk provisions that would need to be addressed in any definitive agreement. Contingency Trigger. BRB will initiate a formal procurement process with Ridgeline if either of the following conditions is met: (a) Veridian TMS v.10.0 fails to meet specified performance be

VI. COMPREHENSIVE MODEL TUNING PLAN

VI.A. Tuning Objectives The comprehensive model tuning exercise represents one of the most critical components of the Workstream 4 remediation plan. The tuning objectives are designed to address the specific deficiencies cited in the Consent Order while establishing a framework for ongoing, data-driven calibration of the TMS. Full Recalibration. BRB will perform a full recalibration of all active detection scenarios

VI.B. Tuning Methodology The comprehensive tuning exercise will employ the following methodological framework, which incorporates quantitative analysis, qualitative risk assessment, and regulatory alignment considerations: Historical Data Analysis. The tuning team will conduct a thorough review of 24 months of transaction data across all business lines and BaaS partner channels (CY 2023 and CY 2024). This analysis wi

VI.C. Above-the-Line / Below-the-Line Threshold Review The formal establishment of an ATL/BTL threshold framework is a direct response to the Consent Order's specific finding that BRB lacked such a framework. This section describes the structure and governance of the ATL/BTL review. ATL Thresholds. For each active detection scenario, the ATL threshold represents the level at or above which the system generates an ale