Contract analysis

I. Executive Summary Calderwood & Harkness LLP ("C&H") has been retained by Belmont Ridge Bank NA ("BRB" or the "Bank") to serve as board governance advisory counsel in connection with certain regulatory findings and to provide a comprehensive assessment of the Bank's current board governance practices. This memorandum constitutes the initial comprehensive assessment deliverable under our engagement. Its purpose is t

1. Revised Risk Committee Charter (addressing MRA Finding 1)

2. Revised Audit Committee Charter (addressing MRA Finding 2)

3. Revised Governance & Nominating Committee Charter (addressing MRA Finding 4)

4. New Board Information Flow Policy (addressing MRA Finding 3)

5. Amended and Restated Corporate Governance Guidelines

6. Enhanced Board and Committee Self-Evaluation Framework

7. Updated Director Independence Standards

8. Initial Director Skills Matrix

9. Director Independence Assessment Memorandum (separate deliverable) Each of these deliverables is discussed in detail below, together with the underlying gap analysis, regulatory expectations, and peer benchmarking that support our recommendations.

II. Background and Regulatory Context A. BRB Board Composition and Structure BRB's Board of Directors currently consists of thirteen (13) members. Of these, ten (10) are independent directors under applicable Nasdaq listing standards and OCC guidance, and three (3) are non-independent by virtue of their management roles at the Bank: • Richard A. Montague, President and Chief Executive Officer • Franklin D. Reeves, Ch

III. Peer-Institution Benchmarking Methodology To provide the Board with an objective, data-driven assessment of BRB's governance practices relative to comparable institutions, C&H conducted a structured peer benchmarking analysis. This section describes the methodology employed, the composition of the peer group, the data sources utilized, and the dimensions of governance benchmarked. Selection Criteria. Peer instit

1. Committee charter content and specificity — the degree to which committee charters contain detailed, actionable provisions addressing the committee's responsibilities, authority, and procedures;

2. Risk-escalation protocols — the presence and content of formalized protocols for escalating enterprise risk matters from the Risk Committee to the full board;

3. Audit committee independence practices and independent information access — the extent to which audit committees have structural mechanisms for independent verification of management-prepared information and access to independent advisors;

4. Board information-flow mechanisms — the existence and content of board-level policies governing the flow of information on compliance, BSA/AML, and regulatory matters;

5. Director skill-matrix practices — the use of formalized competency matrices to assess board composition and inform director recruitment;

6. Committee chair succession planning — the existence of documented plans for the orderly succession of committee leadership;

7. Board self-evaluation processes — the presence and rigor of annual board and committee self-evaluation frameworks; and

8. Governance document refresh frequency — the regularity with which governance documents are reviewed and updated. Limitations. We note that peer benchmarking necessarily relies on publicly available information. Internal practices, informal procedures, and confidential regulatory guidance received by peer institutions are not captured in this analysis. Accordingly, the benchmarking results should be understood as r

IV. Detailed Gap Analysis — MRA Finding 1: Risk Committee Escalation Protocol A. Current State Assessment The Risk Committee Charter, last amended in January 2021, defines the Risk Committee's general oversight responsibilities for enterprise risk management. The Charter grants the Committee authority to "oversee the establishment, implementation, and maintenance of the Bank's enterprise risk management framework," t

1. Amend the Risk Committee Charter to incorporate a detailed escalation protocol section. The amended Charter should include: (a) Defined quantitative triggers tied to BRB's risk appetite statement thresholds, including but not limited to: breaches of Board-approved risk limits in any material risk category (credit, market, liquidity, operational, compliance); single-event losses or aggregated losses within a rollin

2. Establish a direct, unfiltered reporting line from the CRO to the Risk Committee chair (Ms. Venkataraman). The amended Charter should specify that the CRO shall have the right and responsibility to communicate directly with the Risk Committee chair on any enterprise risk matter, without prior management review or approval, and that the CRO shall attend all Risk Committee meetings and participate in executive sessi

3. Add a charter provision requiring annual review and recalibration of escalation triggers. The Risk Committee should be required to review the escalation protocol at least annually, in conjunction with the annual review and approval of the Bank's risk appetite statement, and to recalibrate triggers as necessary to reflect changes in the Bank's risk profile, strategic direction, and regulatory environment.

4. Coordinate with Ashford Pike Advisory (Kenneth R. Stoltz) to ensure that the charter-level escalation protocol is aligned with the operational risk-management framework that Ashford Pike is developing as part of the broader MRA remediation. The escalation protocol should be integrated into the Bank's risk governance architecture, not isolated as a standalone document disconnected from operational risk processes.

5. Target completion: C&H will prepare a revised Risk Committee Charter incorporating these recommendations. The revised Charter (including a redline against the January 2021 version) will be completed by September 15, 2025, for Board review at the October regularly scheduled Board meeting.

V. Detailed Gap Analysis — MRA Finding 2: Audit Committee Independent Verification A. Current State Assessment The Audit Committee Charter, last amended in February 2023, is the most recently updated of BRB's committee charters. It grants the Audit Committee authority to "oversee the financial reporting process, including the integrity of the Bank's financial statements," and to "oversee the independent audit of the

1. Amend the Audit Committee Charter to include the following provisions: (a) Explicit, unconditional authority to retain independent counsel, advisors, and consultants as the Committee determines necessary to carry out its duties, without the requirement of management pre-approval. The amended Charter should state that the Bank shall provide appropriate funding, as determined by the Committee, for the compensation o

2. Add a provision for independent assessment of the internal audit function at least triennially. The assessment should be conducted by a qualified, independent third party selected by the Audit Committee and should evaluate the internal audit function's effectiveness, independence, staffing adequacy, methodology, and compliance with IIA standards.

3. Expand whistleblower complaint oversight provisions. The amended Charter should include detailed procedures for the receipt, investigation, and tracking of complaints regarding accounting, internal controls, auditing matters, and financial reporting irregularities. These provisions should address: (i) the mechanisms by which complaints are received (including anonymous reporting channels); (ii) the Committee's rol

4. Coordinate with Ridgewell & Haines LLP (Lydia M. Chow, engagement partner) to ensure that the independent auditor is aware of and prepared to support the enhanced Audit Committee procedures. In particular, the auditor should be prepared to participate actively in mandatory executive sessions and to respond to direct Committee inquiries regarding management cooperation, accounting judgments, and areas of elevated r

5. Target completion: September 15, 2025. The revised Audit Committee Charter (including a redline against the February 2023 version) will be prepared by C&H and delivered for Board review at the October 2025 Board meeting.

VI. Detailed Gap Analysis — MRA Finding 3: Board Information Flow (Compliance and BSA/AML) A. Current State Assessment BRB does not currently maintain a standalone Board Information Flow Policy. The flow of information to the Board on compliance and BSA/AML matters is governed entirely by informal management reporting practices rather than by a structured, board-approved framework. This absence of a formalized policy

1. Adopt a new, board-approved Board Information Flow Policy establishing the following elements: (a) Quarterly comprehensive reporting. The CCO and BSA Officer shall prepare and deliver comprehensive compliance and BSA/AML reports to the full Board on at least a quarterly basis. These reports shall address: the overall compliance risk profile; the status and effectiveness of the BSA/AML program; significant regulato