PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT
ACCESS AND COOPERATION PROTOCOL
Governing the Independent Consultant Engagement of Thornfield Consulting Group LLC with Belmont Ridge Bank National Association
Prepared by:
Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, NY 10019
C&H Matter No.: 1045-00002
February 10, 2025
Reference: Consent Order No. OCC-2025-003 (effective January 15, 2025) Thornfield Engagement Reference: TCG-BRB-2025-001
Right-click to update Table of Contents
SECTION 1: PURPOSE AND BACKGROUND
1.1 Purpose. This Access and Cooperation Protocol (this "Protocol") establishes the comprehensive framework governing Thornfield Consulting Group LLC's ("Thornfield" or the "Independent Consultant") access to the systems, personnel, records, data, and facilities of Belmont Ridge Bank National Association ("BRB" or the "Bank") during the independent consultant engagement mandated by Article VII of OCC Consent Order No. OCC-2025-003 (the "Consent Order"). The Protocol is designed to ensure that Thornfield is afforded timely, complete, and unrestricted access to all materials and resources reasonably necessary for the efficient and thorough completion of its independent assessment and validation mandate.
The objectives of this Protocol are threefold. First, this Protocol ensures that the cooperation obligations of BRB and its personnel are clearly defined and understood at every level of the organization, from the Board of Directors through front-line compliance analysts. Second, this Protocol is intended to facilitate the efficient completion of Thornfield's independent assessment and validation activities within the timeframes established by the Consent Order and the Engagement Agreement, thereby supporting BRB's timely satisfaction of its regulatory obligations. Third, this Protocol establishes procedures and safeguards designed to protect the attorney-client privilege and work-product protections applicable to communications and materials generated in connection with BRB's legal representation by Calderwood & Harkness LLP ("C&H" or "Outside Counsel") and, to the extent applicable, by BRB's in-house legal department.
This Protocol is supplementary to, and should be read in conjunction with, the following governing documents: (a) the Independent Consultant Engagement Agreement between BRB and Thornfield, dated February 10, 2025 (the "Engagement Agreement"), and (b) the Privilege & Confidentiality Side Letter among BRB, C&H, and Thornfield, dated February 10, 2025 (the "Side Letter"). In the event of any conflict between this Protocol and the Engagement Agreement, the terms of the Engagement Agreement shall control. In the event of any conflict between this Protocol and the Consent Order, the terms of the Consent Order shall control in all respects.
1.2 Background. On January 15, 2025, the Office of the Comptroller of the Currency (the "OCC") issued Consent Order No. OCC-2025-003 against Belmont Ridge Bank National Association (OCC Charter No. 48271; FDIC Certificate No. 31845), a nationally chartered banking institution headquartered in New York, New York, and a wholly owned subsidiary of Belmont Ridge Financial Group, Inc. (NYSE: BRFG), a Delaware corporation and registered bank holding company. The Consent Order identifies significant deficiencies in BRB's Bank Secrecy Act / Anti-Money Laundering ("BSA/AML") compliance program across five core deficiency categories:
(i) OFAC sanctions screening failures, including a material gap in screening coverage affecting the Bank's fintech Banking-as-a-Service ("BaaS") partner channels;
(ii) Suspicious Activity Report ("SAR") filing deficiencies, including untimely filings, inadequate supporting narratives, and a substantial backlog of unreviewed transaction monitoring alerts;
(iii) Customer Due Diligence ("CDD") and Enhanced Due Diligence ("EDD") failures, affecting a significant population of high-risk customer accounts;
(iv) Transaction monitoring model validation deficiencies, including the failure to conduct timely independent model validation and tuning of the Bank's automated transaction monitoring system; and
(v) Board-level oversight deficiencies, reflecting inadequate governance, reporting, and escalation structures for BSA/AML program management.
Article VII of the Consent Order requires BRB to engage an independent consultant, acceptable to the OCC, to conduct a comprehensive BSA/AML and OFAC program assessment and to validate BRB's remediation efforts. The independent consultant is required to deliver specified reports to BRB and the OCC within designated timeframes and to maintain independence from BRB management throughout the engagement.
The OCC communicated its non-objection to the engagement of Thornfield Consulting Group LLC as the independent consultant on February 5, 2025. On February 10, 2025, BRB and Thornfield executed the Engagement Agreement, establishing a twelve-month engagement term commencing February 10, 2025 and concluding no later than February 15, 2026. Thornfield's on-site assessment activities are scheduled to commence on March 1, 2025.
Under the Engagement Agreement and the Scope of Work set forth in Appendix A thereto, Thornfield's deliverables include:
(a) A preliminary gap assessment report, due to BRB and the OCC no later than April 15, 2025, identifying areas of continued deficiency and prioritized remediation recommendations;
(b) Ongoing monitoring and validation activities throughout the engagement term, with quarterly progress reports to BRB and the OCC; and
(c) A final validation report, due to BRB and the OCC no later than February 15, 2026, assessing the adequacy and effectiveness of BRB's remediation efforts and the current state of BRB's BSA/AML and OFAC compliance program.
1.3 Governing Documents
This Protocol is one component of a suite of governing documents establishing the legal, operational, and procedural framework for the Thornfield engagement. The complete set of governing documents is as follows:
(a) OCC Consent Order No. OCC-2025-003, effective January 15, 2025;
(b) Independent Consultant Engagement Agreement between BRB and Thornfield, dated February 10, 2025 (Engagement Reference: TCG-BRB-2025-001);
(c) Scope of Work, attached as Appendix A to the Engagement Agreement;
(d) Privilege & Confidentiality Side Letter among BRB, C&H, and Thornfield, dated February 10, 2025;
(e) Oversight & Communication Protocol Memorandum, prepared by C&H; and
(f) This Access & Cooperation Protocol.
Each of the foregoing documents is intended to be read and interpreted in harmony with the others. In the event of a conflict between any of the foregoing documents and the Consent Order, the Consent Order shall govern.
SECTION 2: DEFINITIONS
For purposes of this Protocol, the following terms shall have the meanings set forth below. Capitalized terms used but not defined in this Protocol shall have the meanings ascribed to them in the Engagement Agreement or the Consent Order, as applicable.
"Bank" or "BRB" means Belmont Ridge Bank National Association, a national banking association chartered under the laws of the United States (OCC Charter No. 48271; FDIC Certificate No. 31845), with its principal office located at 680 Lexington Avenue, 22nd Floor, New York, NY 10022.
"BRFG" means Belmont Ridge Financial Group, Inc., a Delaware corporation and registered bank holding company (NYSE: BRFG), which is the sole parent and bank holding company of BRB.
"Consent Order" means OCC Consent Order No. OCC-2025-003, effective January 15, 2025, issued against Belmont Ridge Bank National Association.
"Engagement Agreement" means the Independent Consultant Engagement Agreement between BRB and Thornfield, dated February 10, 2025 (Engagement Reference: TCG-BRB-2025-001).
"Independent Consultant" or "Thornfield" means Thornfield Consulting Group LLC, a limited liability company organized under the laws of the State of New York, with offices at 200 Park Avenue South, 15th Floor, New York, NY 10003, engaged by BRB as the independent consultant pursuant to Article VII of the Consent Order.
"OCC" means the Office of the Comptroller of the Currency, an independent bureau of the United States Department of the Treasury.
"Outside Counsel" or "C&H" means Calderwood & Harkness LLP, a New York limited liability partnership, with offices at 1285 Avenue of the Americas, 40th Floor, New York, NY 10019, engaged by BRB as outside counsel in connection with the Consent Order and the Thornfield engagement.
"Privileged Materials" means documents, communications, and materials protected by the attorney-client privilege and/or the work-product doctrine, as more fully defined and described in the Privilege & Confidentiality Side Letter dated February 10, 2025. Privileged Materials include, without limitation, communications between BRB and C&H or BRB's in-house legal department made for the purpose of seeking or providing legal advice, as well as documents and tangible things prepared by or for C&H or BRB's in-house legal department in anticipation of litigation or for trial.
"Protocol" means this Access & Cooperation Protocol, including all Exhibits attached hereto, as may be amended from time to time in accordance with Section 11.1 hereof.
"Thornfield Team" means the following individuals designated by Thornfield to perform services under the Engagement Agreement, and such additional Thornfield personnel as may be identified and approved in writing by BRB and Thornfield from time to time:
(a) Dr. Vivian Castellano, Managing Director, Financial Crimes Advisory — Engagement Lead;
(b) Robert Eastman, Senior Director, AML Transaction Monitoring;
(c) Jennifer Hwang, Director, Sanctions & OFAC Compliance; and
(d) Nathaniel Burgess, Director, Fintech & Payments Compliance.
SECTION 3: KEY CONTACTS AND COORDINATION STRUCTURE
3.1 BRB Primary Contacts
The following individuals are designated as BRB's primary points of contact for purposes of this Protocol and the Thornfield engagement. All communications from Thornfield to BRB departments should be directed through the appropriate contact identified below, with copies provided to the BRB Coordination Lead and C&H as specified herein.
BRB Coordination Lead: Patricia Langston, Chief Compliance Officer. Ms. Langston shall serve as the primary point of contact for all Thornfield access requests and coordination matters. She is responsible for ensuring departmental cooperation across BRB, triaging and routing document and data requests to the appropriate BRB business units, monitoring BRB's compliance with the response timeframes set forth in this Protocol, and serving as the first point of escalation for any access-related issues. All formal communications from Thornfield to BRB regarding access, scheduling, and logistics shall be directed to Ms. Langston unless this Protocol specifies an alternative contact.
BSA/AML Program: Thomas Ikeda, BSA Officer / AML Program Director. Mr. Ikeda shall serve as the primary contact for all BSA/AML-related document requests, including transaction monitoring data, SAR filing records, alert disposition documentation, AML program materials, and BSA/AML staffing records. Mr. Ikeda is responsible for facilitating access to BSA/AML department personnel and for ensuring that all BSA/AML-related materials are made available to Thornfield in a timely manner.
Fintech Partnerships / BaaS Division: Warren Ashby, Head of Fintech Partnerships / BaaS Division. Mr. Ashby shall serve as the primary contact for all materials related to BRB's fintech Banking-as-a-Service partnerships, including BaaS partner program agreements, compliance addenda, fintech transaction data, partner onboarding and due diligence files, and partner compliance documentation. Mr. Ashby's responsibilities encompass all fourteen (14) active BaaS partners, with particular emphasis on the three largest partners: NovaPay Technologies Inc., FairLend Digital LLC, and VaultEdge Inc.
Information Technology / Systems Access: Linda Petrosian, Chief Information Officer / Chief Technology Officer. Ms. Petrosian shall serve as the primary contact for all matters related to system access provisioning for Thornfield personnel, technology infrastructure documentation, Veridian TMS v.8.3 system data and configuration documentation, data extracts and technical reports, IT security protocols, and BaaS partner integration architecture documentation.
Risk Management: Melissa Chu, Chief Risk Officer. Ms. Chu shall serve as the primary contact for enterprise risk management materials, BSA/AML and OFAC risk assessment documentation, risk appetite statements, and risk committee reporting.
Internal Audit: Derek Ballard, Head of Internal Audit. Mr. Ballard shall serve as the primary contact for internal audit reports, audit workpapers, BSA/AML audit findings, and records of the independent BSA/AML testing conducted by Caldera & Pope LLP.
Legal / General Counsel: Gregory Nardone, General Counsel & Corporate Secretary. Mr. Nardone shall serve as the escalation contact for any legal issues arising in connection with the Thornfield engagement, including privilege determinations, disputes regarding scope of access, and coordination of Board and governance materials. Mr. Nardone shall also coordinate the privilege review of document productions and serve as the primary interface with C&H on privilege and confidentiality matters.
Finance: Samantha Reeves, Chief Financial Officer. Ms. Reeves shall serve as the primary contact for financial data relevant to remediation budgeting, BSA/AML program budgets, civil money penalty payment records, and other financial information requested by Thornfield.
3.2 Thornfield Engagement Team Contacts
The following individuals comprise the Thornfield Team and are authorized to interact with BRB personnel and access BRB systems and facilities in connection with the engagement.
Engagement Lead: Dr. Vivian Castellano, Managing Director, Financial Crimes Advisory. Dr. Castellano shall serve as the overall engagement leader and the primary Thornfield interface with C&H and BRB senior management. She is responsible for the overall direction and quality of Thornfield's assessment, coordination of the Thornfield Team's workstreams, and communication of findings and recommendations. All formal communications from Thornfield to BRB and C&H shall be issued by or on behalf of Dr. Castellano.
AML Transaction Monitoring Lead: Robert Eastman, Senior Director. Mr. Eastman shall lead Workstream 4 of the engagement, encompassing the independent validation of BRB's transaction monitoring system (Veridian TMS v.8.3), including model validation and tuning assessment, transaction monitoring alert data analysis, SAR conversion rate analytics, and SAR process review.
Sanctions & OFAC Lead: Jennifer Hwang, Director. Ms. Hwang shall lead the assessment of BRB's OFAC sanctions screening program across all business lines and BaaS partner channels, including the evaluation of screening coverage, hit resolution processes, and OFAC list management procedures.
Fintech & Payments Compliance Lead: Nathaniel Burgess, Director. Mr. Burgess shall lead the assessment of BRB's BaaS partner oversight framework, fintech compliance program, CDD/EDD remediation processes for BaaS-originated accounts, and the adequacy of BRB's controls over BaaS partner compliance obligations.
3.3 Calderwood & Harkness Contacts
The following C&H personnel are designated to support the Thornfield engagement and facilitate coordination among BRB, Thornfield, and the OCC.
Primary C&H Contact: Philip Hartmann, Partner, Banking & Finance Practice Group. Mr. Hartmann shall serve as the responsible partner for C&H's engagement, providing overall engagement oversight, regulatory strategy guidance, and interface with the OCC. Mr. Hartmann is authorized to make determinations regarding privilege, confidentiality, and legal strategy on behalf of BRB, in consultation with Gregory Nardone.
C&H Lead Associate: Yuki Nakamura, Litigation (General) Practice Group. Ms. Nakamura shall serve as the day-to-day C&H coordinator for the Thornfield engagement, responsible for oversight of document productions, privilege review, coordination of interview logistics, and maintenance of the Document Production Tracker. All routine communications from Thornfield to C&H should be directed to Ms. Nakamura.
C&H Working Associate: Carlos Espinoza, Litigation (General) Practice Group. Mr. Espinoza shall support Ms. Nakamura in day-to-day coordination activities, document management, privilege review, and attendance at interviews.
3.4 Coordination Meetings
To ensure effective communication and timely resolution of issues throughout the engagement, the parties shall participate in the following standing meetings:
Bi-Weekly Status Calls. Bi-weekly status calls shall be held on alternating Tuesdays at 10:00 AM ET (or such other day and time as the parties may agree) among Dr. Vivian Castellano (Thornfield), Philip Hartmann and Yuki Nakamura (C&H), and Patricia Langston and Thomas Ikeda (BRB). The purpose of these calls is to review the status of outstanding document and data requests, discuss upcoming interview schedules, identify and resolve access issues, and provide a general update on engagement progress. Agendas shall be circulated by Ms. Nakamura no later than twenty-four (24) hours in advance of each call.
Monthly Progress Meetings. Monthly progress meetings shall be held on the first Wednesday of each calendar month (or such other date as the parties may agree), with expanded attendance including Gregory Nardone (BRB General Counsel), Melissa Chu (BRB CRO), and the relevant Thornfield workstream leads. These meetings shall provide a more comprehensive review of engagement progress, including discussion of preliminary findings, remediation status, upcoming milestones, and any material issues requiring senior-level attention.
Ad Hoc Meetings. Ad hoc meetings may be convened at any time by any of the parties for the purpose of addressing urgent matters, resolving escalations, or discussing time-sensitive developments. Requests for ad hoc meetings should be directed to the relevant contacts identified in Sections 3.1 through 3.3 above.
SECTION 4: SCOPE OF ACCESS
4.1 General Scope
Thornfield shall have access to all BRB records, systems, personnel, data, and facilities reasonably necessary to fulfill the Scope of Work set forth in Appendix A to the Engagement Agreement and to carry out the independent assessment and validation mandate established by Article VII of the Consent Order. BRB shall cooperate fully with Thornfield and shall not unreasonably restrict, delay, or condition Thornfield's access to any materials or resources within the scope of the engagement.
The scope of Thornfield's access shall encompass all five core deficiency categories identified in the Consent Order:
(i) OFAC sanctions screening — including screening policies, procedures, system configurations, screening coverage data, hit resolution processes, and records of the NovaPay screening gap;
(ii) SAR filing and suspicious activity monitoring — including SAR case files, alert disposition records, filing statistics and timeliness metrics, the alert backlog, and SAR lookback activities;
(iii) CDD/EDD — including customer due diligence documentation, enhanced due diligence files, high-risk customer identification records, and remediation progress for the affected account population;
(iv) Transaction monitoring model validation — including Veridian TMS v.8.3 configuration, rule sets, tuning history, model validation reports, alert data, and conversion analytics; and
(v) Board-level oversight and governance — including Board and committee meeting minutes, presentations, reports, organizational structures, and escalation procedures.
Access shall extend across all BRB business lines, including retail banking, commercial lending, wealth management, and fintech Banking-as-a-Service partnerships. Thornfield's access shall not be limited to any single business unit or compliance function, and BRB shall ensure cross-departmental cooperation as necessary to provide Thornfield with a complete and integrated view of the Bank's BSA/AML and OFAC compliance program.
4.2 Records and Documents
Thornfield shall have access to the following categories of records and documents, which are illustrative and not exhaustive. BRB acknowledges that additional categories may be identified as the engagement progresses, and agrees to provide access to such additional materials as are reasonably within the scope of the engagement.
(a) BSA/AML Policies, Procedures, and Manuals. All current and historical versions of BRB's BSA/AML policies, procedures, and operational manuals, including any interim updates or revisions issued in connection with the Consent Order remediation.
(b) OFAC Compliance Documentation. OFAC compliance policies, sanctions screening procedures, interdiction records, list management protocols, and documentation of the OFAC screening gap affecting BaaS partner channels.
(c) SAR Filings and Supporting Documentation. All SAR filings for calendar years 2023 and 2024 (CY 2023: 2,914 SARs; CY 2024: 3,847 SARs), together with supporting documentation, case files, investigative memoranda, alert disposition records, and quality assurance review materials.
(d) SAR Backlog Records. Records pertaining to the backlog of 2,400 unreviewed transaction monitoring alerts as of September 2024, including the current status of backlog remediation efforts, prioritization criteria, and staffing deployment records.
(e) CTR Filings. Currency Transaction Report filing data for calendar year 2024 (CY 2024: 28,612 CTRs) and associated records.
(f) OFAC Screening Hit Records. OFAC screening hit data for calendar year 2024 (CY 2024: 14,320 hits; 12 true matches), including hit disposition records, escalation documentation, and records of any blocked or rejected transactions.
(g) Transaction Monitoring Alert Data. Complete transaction monitoring alert data for calendar year 2024 (CY 2024: 41,500 alerts), including alert type, risk score, disposition, investigation outcome, and SAR conversion analytics (overall SAR conversion rate: 9.3%).
(h) CDD/EDD Documentation. Customer due diligence and enhanced due diligence documentation for the 47,000 high-risk customer accounts identified as deficient in the Consent Order, including original onboarding documentation, periodic review records, and remediation progress files.
(i) BaaS Partner Agreements and Compliance Records. All BaaS partner program agreements, compliance addenda, and partner oversight records for all fourteen (14) active fintech sponsors, with particular emphasis on the following:
• NovaPay Technologies Inc. — representing 41% of BaaS transaction volume ($30.5 billion in CY 2024), approximately 2.1 million end-user accounts, onboarded in 2021. Records shall include documentation of the OFAC screening gap affecting approximately 3.8 million unscreened transactions out of 31.7 million total NovaPay transactions in CY 2023 (approximately 12% unscreened).
• FairLend Digital LLC — representing 28% of BaaS transaction volume, approximately $1.4 billion in loan originations through BRB in FY 2024, onboarded in 2022.
• VaultEdge Inc. — representing 18% of BaaS transaction volume, approximately 870,000 deposit accounts, onboarded in 2023.
(j) BaaS Transaction Data. Aggregate and partner-level BaaS transaction data for calendar year 2024 (total CY 2024 volume: $74.3 billion), including transaction type, volume, value, and channel information.
(k) Veridian TMS Documentation. Veridian TMS v.8.3 configuration documentation, tuning parameters (last tuned October 2022), model validation reports (last independent validation March 2021), alert rules and thresholds, system architecture documentation, and contract documentation (Veridian Contract No. VA-BRB-2023-0044).
(l) Board and Committee Materials. Board of Directors and committee meeting minutes, presentations, reports, and resolutions related to BSA/AML oversight, including materials from the Compliance Committee, Risk Committee, and Audit Committee.
(m) OCC Supervisory Correspondence. OCC examination reports, Matters Requiring Attention ("MRA") issued June 2022, Matters Requiring Immediate Attention ("MRIA") issued November 2023, and all correspondence with the OCC related to the Consent Order.
(n) Internal Audit Reports and Workpapers. Internal audit reports and workpapers related to BSA/AML and OFAC compliance, including the independent BSA/AML testing report prepared by Caldera & Pope LLP (completed September 2024).
(o) Risk Assessment Documentation. Enterprise-wide and BSA/AML-specific risk assessments, including risk scoring methodologies, customer risk rating models, and geographic and product risk assessments.
(p) Training Records and Materials. BSA/AML and OFAC training records, materials, completion reports, and training program documentation for all relevant personnel.
(q) Organizational Charts and Staffing Records. Organizational charts and staffing records for the BSA/AML department (current headcount: 62 FTEs), including job descriptions, reporting lines, and records of planned hiring.
(r) Prior Outside Counsel Work Product. Work product of Drayton Mercer LLP, BRB's prior outside counsel for BSA/AML matters, to the extent privilege is waived or shared under common-interest arrangements, as directed by Gregory Nardone, BRB General Counsel.
4.3 Systems Access
Thornfield shall be provisioned read-only access to the following BRB systems in order to conduct the assessment and validation activities required under the Engagement Agreement. All systems access shall be subject to the IT security protocols established by Linda Petrosian (CIO/CTO) and the information security requirements set forth in Section 8 of this Protocol.
(a) Veridian TMS v.8.3 — BRB's transaction monitoring platform, including alert queues, case management modules, rule configuration interfaces, reporting dashboards, and historical alert and case data.
(b) OFAC Sanctions Screening Platform (Veridian Module) — BRB's OFAC sanctions screening system, including screening results logs, hit logs, disposition records, list management tools, and screening coverage reports.
(c) Core Banking System — Customer records, account data, and transaction histories relevant to CDD/EDD remediation, SAR investigations, and overall BSA/AML assessment activities.
(d) BaaS Partner Integration Layer — Transaction flow data for all fourteen (14) BaaS partner channels, including real-time and batch processing data, reconciliation records, and partner-level transaction summaries.
(e) SAR and CTR Filing Systems — FinCEN BSA E-Filing records, including filed SAR and CTR data, filing status records, and submission confirmations.
(f) Customer Onboarding and KYC Systems — CDD/EDD documentation repositories, customer risk rating systems, identity verification records, and beneficial ownership documentation.
(g) Document Management System — BRB's enterprise document management system containing policies, procedures, compliance records, and other materials relevant to the engagement.
(h) Board Portal — Board and committee materials, meeting minutes, resolutions, and governance documents. Access to the Board portal shall be coordinated through Gregory Nardone, BRB General Counsel.
All system access granted to Thornfield personnel shall be logged and auditable. BRB's IT department shall maintain comprehensive access logs recording the identity of each Thornfield user, the systems accessed, and the dates and times of access.
Thornfield personnel accessing BRB systems must comply with BRB's information security policies, including but not limited to multi-factor authentication requirements, virtual private network (VPN) requirements, acceptable use policies, and any additional security controls communicated by Linda Petrosian's IT team. Thornfield shall ensure that all members of the Thornfield Team complete any required information security training or acknowledgments prior to receiving system access credentials.
Linda Petrosian's IT team shall provision system access for approved Thornfield personnel within five (5) business days of receipt of a completed System Access Request Form (Exhibit A to this Protocol). Any delays in provisioning shall be promptly communicated to Patricia Langston and Dr. Castellano for escalation, if necessary.
4.4 Facilities Access
Thornfield Team members shall have on-site access to BRB's headquarters at 680 Lexington Avenue, 22nd Floor, New York, NY 10022, during regular business hours, Monday through Friday, 8:00 AM to 7:00 PM Eastern Time. On-site access outside of these hours may be arranged on an as-needed basis through coordination with Patricia Langston.
BRB shall provide a dedicated workspace — consisting of a conference room or office suite of reasonable size to accommodate the on-site Thornfield Team — for Thornfield's use during the assessment period commencing March 1, 2025. The dedicated workspace shall be equipped with network connectivity, printing access, and telephone service. BRB shall also provide reasonable access to common facilities, including restrooms, break rooms, and building amenities.
Building access credentials and visitor protocols shall be coordinated through Patricia Langston's office. Thornfield personnel shall comply with all BRB building security requirements, including identification badge protocols and visitor registration procedures.
To the extent Thornfield's assessment requires access to BRB offices or operational centers other than the headquarters location, such access shall be arranged through Patricia Langston with reasonable advance notice of no fewer than five (5) business days.
SECTION 5: DOCUMENT REQUEST PROCEDURES
5.1 Formal Document Requests
All formal document and data requests from Thornfield shall be submitted in writing via email to Patricia Langston (BRB Coordination Lead), with a contemporaneous copy to Yuki Nakamura (C&H Lead Associate). Informal or verbal requests for documents or data are not prohibited but shall not be considered formal requests for purposes of the response timeframes set forth in this Section 5.1, and BRB shall not be obligated to respond to informal requests within specified timeframes. Any material or sensitive document requests should be submitted through the formal process described herein.
Each formal document and data request shall be submitted using the standardized Document Request Form attached as Exhibit B to this Protocol. Each request shall specify:
(a) A clear and reasonably specific description of the documents and/or data requested;
(b) The relevant time period for the requested materials;
(c) The business line or department to which the request relates;
(d) The applicable Consent Order deficiency category (OFAC, SAR, CDD/EDD, transaction monitoring, or governance);
(e) The Thornfield Team member making the request; and
(f) The requested production date.
BRB shall use commercially reasonable efforts to respond to formal document requests within ten (10) business days of receipt. For requests designated as "urgent" by Thornfield, BRB shall use best efforts to respond within five (5) business days. The designation of a request as "urgent" shall be made by Dr. Castellano or her designee and shall be used judiciously, limited to circumstances where a shorter response time is necessary to meet an engagement milestone, regulatory deadline, or other time-sensitive objective.
All document productions from BRB to Thornfield shall be logged in a shared Document Production Tracker, the template for which is attached as Exhibit C to this Protocol. The Document Production Tracker shall be maintained jointly by C&H (Yuki Nakamura) and BRB (Patricia Langston or her designee) and shall be updated promptly upon each production. The Tracker shall be made available to Thornfield on a current basis.
5.2 Privilege Review
Prior to production to Thornfield, all documents responsive to a formal document request shall be reviewed by C&H (Yuki Nakamura) or BRB's in-house legal team (Gregory Nardone or his designee) for attorney-client privilege and work-product protection. The purpose of this review is to identify and, where appropriate, withhold from production any Privileged Materials that are not subject to sharing under the common-interest framework established by the Privilege & Confidentiality Side Letter.
Privileged Materials withheld from production shall be identified on a privilege log maintained by C&H. The privilege log shall include, for each withheld document: (a) the date of the document, (b) the author and all recipients, (c) the general subject matter (described at a level of generality that does not disclose privileged content), and (d) the basis for the privilege assertion. The privilege log shall be made available to Thornfield upon request.
In the event that Privileged Materials are inadvertently produced to Thornfield, the inadvertent production shall be governed by the following clawback procedure: Upon notification by BRB, C&H, or BRB's in-house legal team that a document has been inadvertently produced, Thornfield shall promptly (and in no event later than two (2) business days after receiving such notification) return or securely destroy all copies of the inadvertently produced materials and shall not use, disclose, or reference the content thereof in any work product, report, or communication. The inadvertent production of Privileged Materials shall not constitute a waiver of any applicable privilege or protection.
5.3 Third-Party Records
To the extent Thornfield's assessment requires records from BRB's third-party vendors, service providers, or BaaS partners, BRB shall use reasonable efforts to obtain and produce such records in a timely manner, subject to any applicable confidentiality agreements, contractual restrictions, or legal limitations. Third parties whose records may be relevant to the engagement include, without limitation:
(a) Veridian Analytics Inc. (transaction monitoring and OFAC screening system vendor);
(b) NovaPay Technologies Inc. (BaaS partner);
(c) FairLend Digital LLC (BaaS partner);
(d) VaultEdge Inc. (BaaS partner);
(e) Pinnacle Compliance Solutions LLC (temporary BSA/AML staffing provider); and
(f) Caldera & Pope LLP (independent BSA/AML testing firm).
BRB shall designate Warren Ashby as the point of contact for the procurement of BaaS partner records and Linda Petrosian as the point of contact for technology vendor records. Where third-party consent or cooperation is required to produce responsive materials, BRB shall make good-faith efforts to obtain such consent and shall promptly notify Thornfield of any impediments to production.
SECTION 6: PERSONNEL INTERVIEWS
6.1 Interview Scheduling
Thornfield may request interviews with any BRB personnel reasonably relevant to the BSA/AML and OFAC assessment. Personnel interviews are a critical component of Thornfield's independent assessment methodology, and BRB shall facilitate scheduling and preparation to ensure that interviews are conducted efficiently and without undue delay.
All interview requests shall be submitted in writing to Patricia Langston (BRB Coordination Lead), with a contemporaneous copy to Yuki Nakamura (C&H Lead Associate), at least five (5) business days in advance of the proposed interview date. Each interview request shall specify:
(a) The name and title of the proposed interviewee;
(b) The subject matter to be covered in the interview, described at a level of reasonable specificity;
(c) The estimated duration of the interview; and
(d) The proposed date(s) and time(s) for the interview.
Patricia Langston shall coordinate with the proposed interviewee and his or her supervisor to confirm the interview and shall respond to the requesting Thornfield Team member with confirmed logistics within three (3) business days of receipt of the request. In the event that the proposed interviewee is unavailable on the requested date(s), Ms. Langston shall offer alternative dates within a reasonable timeframe.
6.2 Key Personnel for Interviews
The following BRB personnel are expected to be interviewed during the course of the engagement. This list is illustrative and not exhaustive; Thornfield may identify additional interviewees as the engagement progresses.
(a) Patricia Langston, Chief Compliance Officer;
(b) Thomas Ikeda, BSA Officer / AML Program Director;
(c) Warren Ashby, Head of Fintech Partnerships / BaaS Division;
(d) Linda Petrosian, Chief Information Officer / Chief Technology Officer;
(e) Melissa Chu, Chief Risk Officer;
(f) Derek Ballard, Head of Internal Audit;
(g) Gregory Nardone, General Counsel & Corporate Secretary;
(h) Samantha Reeves, Chief Financial Officer;
(i) Raymond Okoye, President & Chief Operating Officer;
(j) Diane Whitford, Chief Executive Officer & Board Chair (interviews to be scheduled through Gregory Nardone's office);
(k) BSA/AML department managers and analysts, as identified by Thomas Ikeda;
(l) BaaS partner relationship managers, as identified by Warren Ashby; and
(m) IT systems administrators responsible for Veridian TMS and OFAC screening systems, as identified by Linda Petrosian.
In addition, Thornfield may request interviews with members of BRB's Board of Directors, including Arthur Connelly, Margaret Dao, James Rutherford, Sandra Villarreal, and Keith Yamamoto. Given the scheduling demands on Board members, requests for Board member interviews shall be submitted to Gregory Nardone with advance notice of at least ten (10) business days. Mr. Nardone shall use best efforts to coordinate scheduling and confirm logistics within five (5) business days of receipt.
6.3 Interview Protocols
The following protocols shall govern the conduct of all interviews:
Cooperation and Candor. BRB personnel shall cooperate fully with Thornfield's interview process and shall provide candid, complete, and truthful responses to all questions posed by Thornfield interviewers. Interviewees shall not withhold information, provide misleading or evasive responses, or decline to answer questions within the scope of the engagement absent a legitimate basis (such as a direction from counsel regarding privilege).
Counsel Attendance. C&H counsel (Yuki Nakamura or Carlos Espinoza) may attend any interview at BRB's election, consistent with the Privilege & Confidentiality Side Letter. BRB in-house counsel (Gregory Nardone or his designee) may also attend interviews at BRB's election. The decision to have counsel attend a particular interview shall be made by Gregory Nardone in consultation with Philip Hartmann, and shall be communicated to Thornfield in advance of the interview.
Requests for Unattended Interviews. Thornfield may request that certain interviews be conducted without counsel present. Any such request shall be evaluated on a case-by-case basis by Gregory Nardone and Philip Hartmann, taking into account the subject matter of the interview, the role of the interviewee, and any privilege or confidentiality considerations. BRB reserves the right to have counsel present at any interview in its discretion.
Notes and Work Product. Thornfield may take notes during interviews. Interview summaries, memoranda, and other materials prepared by Thornfield in connection with interviews shall be treated as Thornfield work product and shall be subject to the confidentiality provisions of the Engagement Agreement and the Privilege & Confidentiality Side Letter.
No Retaliation. No BRB employee shall be retaliated against, disciplined, or subjected to adverse employment action for cooperating with Thornfield's assessment, providing information during interviews, or raising concerns about BRB's BSA/AML or OFAC compliance. BRB management shall affirmatively communicate this non-retaliation commitment to all employees who may be contacted by Thornfield during the engagement.
SECTION 7: COOPERATION OBLIGATIONS BY BRB DEPARTMENT
This Section 7 sets forth the specific cooperation obligations of each BRB department and business unit relevant to the Thornfield engagement. These obligations are in addition to the general access and cooperation requirements established elsewhere in this Protocol and in the Engagement Agreement.
7.1 BSA/AML Department (Thomas Ikeda, BSA Officer)
The BSA/AML Department, under the leadership of Thomas Ikeda, shall provide the following cooperation and access:
(a) Provide full and unrestricted access to all SAR case files, alert disposition records, and backlog data, including the 2,400 unreviewed transaction monitoring alerts identified as of September 2024 and the current status of backlog remediation efforts;
(b) Provide complete transaction monitoring alert data for calendar year 2024, totaling 41,500 alerts, together with SAR conversion analytics (overall SAR conversion rate: 9.3%), alert type distributions, and risk scoring data;
(c) Provide SAR filing statistics for calendar years 2023 and 2024 (CY 2023: 2,914 SARs; CY 2024: 3,847 SARs), together with timeliness metrics (current average time from alert to filing: 78 days), quality assurance review results, and narrative quality assessments;
(d) Provide BaaS-related SAR data for calendar year 2024, including the 2,108 BaaS-related SARs filed (representing 54.8% of total SARs), broken down by partner channel and risk typology;
(e) Provide CTR filing data for calendar year 2024 (28,612 CTRs), including any records of structured transaction monitoring and CTR exemption determinations;
(f) Facilitate access to BSA/AML analysts and managers for interviews, workflow demonstrations, and observation of live case review processes;
(g) Provide all BSA/AML policies, procedures, risk assessments, training records, and departmental governance documents;
(h) Provide records of SAR lookback activities conducted in connection with the Consent Order remediation, including the scope, methodology, and results of any lookback reviews; and
(i) Provide records of the Pinnacle Compliance Solutions LLC temporary staffing deployment (30 temporary FTEs), including the statement of work (Reference: PCS-BRB-2025-0012), onboarding records, productivity metrics, and quality assurance results.
7.2 Compliance Department (Patricia Langston, CCO)
The Compliance Department, under the leadership of Patricia Langston, shall provide the following cooperation and access: