Contract analysis

1. Executive Summary This Workstream 5 Governance and Training Enhancement Plan (the "Plan") has been prepared by Calderwood & Harkness LLP ("C&H") in coordination with the senior management of Belmont Ridge Bank National Association ("BRB" or the "Bank") and its holding company, Belmont Ridge Financial Group, Inc. ("BRFG"). The Plan is one of five interlocking workstreams that together comprise the Bank's Comprehens

2. Consent Order Requirements — Governance and Training Provisions 2.1 Specific Consent Order Mandates The Consent Order contains several discrete provisions bearing directly on the scope of Workstream 5. In summary form, and on an article-by-article basis, the following mandates apply: • Article III (Board Oversight). The Board is required to establish and maintain a dedicated Compliance Committee comprised principa

3. Board-Level Governance Restructuring 3.1 Establishment of the Compliance Committee Consistent with Article III of the Consent Order, the BRFG Board of Directors will adopt, on or before February 28, 2025, a Board Resolution acknowledging the Consent Order and establishing a standing Compliance Committee of the Board (the "Compliance Committee"). The draft Resolution and accompanying Compliance Committee Charter ha

1. Report of the BSA Officer (Thomas Ikeda) on the operational status of the BSA/AML program;

2. Report of the CCO (Patricia Langston) on cross-workstream remediation progress;

3. SAR filing metrics — including monthly, year-to-date, and trailing 12-month volumes, and average filing timeliness (CY 2024 baseline: 3,847 SARs filed; 78-day average filing time against the Bank's target of 30 days);

4. OFAC screening hit rates and true-match statistics (CY 2024 baseline: 14,320 hits generated; 12 true matches; false-positive rate of approximately 99.9%);

5. CDD/EDD remediation progress against the population of 47,000 accounts subject to remediation, tracked to interim milestone of 23,500 accounts by July 15, 2025 and completion by January 15, 2026;

6. Transaction monitoring alert volumes and SAR conversion rates (CY 2024 baseline: 41,500 alerts; 9.3% SAR conversion rate);

7. BaaS partner risk ratings and compliance status across the Bank's 14 active BaaS partners, with particular focus on the three largest by volume: NovaPay (41% of BaaS volume), FairLend Digital (28%), and VaultEdge (18%);

8. Status of the SAR backlog (2,400 unreviewed alerts at baseline) against the June 30, 2025 clearance target;

9. Status updates from the independent consultant, Thornfield Consulting Group;

10. Engagement updates from Calderwood & Harkness LLP, including regulatory strategy and privilege matters;

11. Budget and resource utilization against the $42,500,000 remediation budget (exclusive of the $14,500,000 civil money penalty);

12. Regulatory correspondence update, including all communications with the OCC and, as applicable, FinCEN. 3.3 Reporting Metrics and Dashboard A Board-level BSA/AML compliance dashboard will be developed and deployed to enable the Compliance Committee and full Board to receive standardized, quantitative reporting on the health of the BSA/AML program. The dashboard will be updated on a monthly basis and will include,

4. Senior Management Governance Enhancements 4.1 BSA/AML Program Governance Structure — Current State As of the date hereof, the Bank's BSA/AML governance structure at the management level is as follows: • Thomas Ikeda, BSA Officer and AML Program Director (appointed March 2023), reports to the Chief Compliance Officer. • Patricia Langston, Chief Compliance Officer (appointed January 2024; her predecessor was termina

5. Organizational Restructuring of the BSA/AML Department 5.1 Current State Staffing Assessment The BSA/AML department, as of January 2025, comprises 62 FTEs distributed across the following functional areas: transaction monitoring analysts, SAR investigators, OFAC screening analysts, KYC/CDD specialists, quality assurance reviewers, compliance officers, and administrative support. C&H's staffing assessment, informed

6. Enterprise-Wide BSA/AML and OFAC Training Program 6.1 Training Program Objectives The Consent Order specifically found that the Bank's BSA/AML training program was insufficient in scope, depth, and coverage, and that it did not adequately address OFAC obligations, fintech/BaaS-specific risks, or Board-level responsibilities. To remediate these findings, the Bank will implement an enterprise-wide training program w

7. Policy Development and Revision 7.1 Policy Suite Overview Workstream 5 encompasses a comprehensive revision of the Bank's BSA/AML and sanctions-related governance policies. Every revised policy will be cross-referenced to the specific articles of Consent Order No. OCC-2025-003 that it is designed to address, and a consolidated master policy index will be maintained by the Compliance function. The policies within t

1. C&H drafts initial policy revisions with substantive input from Patricia Langston, Thomas Ikeda, and the relevant functional heads;

2. Thornfield Consulting Group reviews drafts as part of its independent assessment and provides feedback;

3. Policies are reviewed and approved by the Management-Level BSA/AML Steering Committee and then presented to the Compliance Committee for Board-level approval;

4. Final policies become effective upon Compliance Committee approval and are distributed to all relevant personnel;

5. Policy revision history and version control are maintained by the Compliance function. 7.3 Policy Implementation and Communication All revised policies will be communicated to affected personnel within 15 business days of adoption. Policy acknowledgment will be required from all employees in scope, tracked through the training management system. Changes to policies will be integrated into the training curriculum d

8. Accountability Framework 8.1 Roles and Responsibilities Matrix (RACI) Workstream 5 deliverables have been mapped across the Board, the Compliance Committee, the C-suite, the BSA Officer, the CCO, line-of-business heads, and support functions (IT, Legal, Audit) through a formal RACI matrix. The full RACI is provided in Appendix E. In summary: • The Compliance Committee is Accountable for Board-level oversight and i

9. Budget Summary for Workstream 5 The budget for Workstream 5 is structured as follows: The staffing components (both permanent at $2,250,000 and temporary at $3,600,000) are shared across multiple workstreams; Workstream 5 captures the organizational restructuring and governance framework within which those resources will operate. All costs are captured within the Board-approved $42,500,000 remediation budget, excl

10. Integration with Other Workstreams The governance and training framework established in Workstream 5 provides the operating structure within which the four operational workstreams will be executed. Specific integration points are as follows: • Workstream 1 — OFAC Sanctions Screening Remediation. Governance reporting to the Compliance Committee includes OFAC screening metrics. OFAC training is embedded across the

11. Independent Consultant Validation — Workstream 5 Thornfield Consulting Group LLC will assess Workstream 5 deliverables as part of its comprehensive review of the Bank's remediation efforts pursuant to Article X of the Consent Order. The Thornfield engagement (reference TCG-BRB-2025-001) is structured as a fixed fee of $6,500,000 plus reimbursable expenses not to exceed $400,000. The Thornfield engagement team res

12. OCC Reporting Requirements — Workstream 5 Workstream 5 deliverables will be reflected in the Bank's periodic reporting to the OCC as follows: • First quarterly progress report (September 15, 2025): Report on Compliance Committee establishment and operations; staffing progress (permanent and temporary); training completion rates across Tiers 1–5; policy adoption status; and management governance enhancements. • Se

13. Risk Factors and Contingencies The following risk factors have been identified as potentially impacting successful execution of Workstream 5, together with mitigation strategies: Hiring delays. Competition for qualified BSA/AML professionals — particularly those with BaaS/fintech experience — may delay filling of the 15 permanent positions. Mitigation: Pinnacle temporary staff bridge the interim gap; expanded rec

14. Appendices The following appendices are incorporated herein by reference and are filed under separate cover with the Comprehensive Remediation Action Plan. Appendix A — Compliance Committee Charter (Draft) Full text of the Compliance Committee Charter as prepared by Calderwood & Harkness LLP, including provisions concerning composition, qualifications, authority, meeting frequency, reporting obligations, retentio