AMENDED AND RESTATED BYLAWS
OF
BELMONT RIDGE FINANCIAL GROUP, INC.
(A Delaware Corporation)
As Amended by Resolution of the Board of Directors
Effective February 28, 2025
Clean Version — Operative Amended Text
Incorporating New Compliance Committee Provisions
Prepared by Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, NY 10019 C&H Matter No. 1045-00002
Right-click to update Table of Contents
PREAMBLE
These Amended and Restated Bylaws (these "Bylaws") of Belmont Ridge Financial Group, Inc. (the "Corporation" or "BRFG"), a corporation duly organized and existing under the General Corporation Law of the State of Delaware (the "DGCL"), are hereby adopted by resolution of the Board of Directors of the Corporation (the "Board" or the "Board of Directors"), effective as of February 28, 2025.
These Bylaws supersede and replace in their entirety the prior Bylaws of the Corporation, as previously amended and restated, including all amendments thereto adopted prior to the date hereof. In the event of any conflict between these Bylaws and the Certificate of Incorporation of the Corporation, as amended from time to time (the "Certificate of Incorporation"), the Certificate of Incorporation shall control.
The Corporation is the sole stockholder and parent holding company of Belmont Ridge Bank National Association ("BRB" or the "Bank"), a national banking association chartered under the laws of the United States and regulated by the Office of the Comptroller of the Currency (the "OCC"), OCC Charter No. 48271, FDIC Certificate No. 31845. References in these Bylaws to BRB or the Bank shall be deemed to include all operating divisions, branches, and business units thereof.
These amendments are adopted, in part, to comply with the requirements of Consent Order No. OCC-2025-003 (the "Consent Order"), issued by the Office of the Comptroller of the Currency on January 15, 2025, which requires, among other things, the establishment of a dedicated Compliance Committee of the Board of Directors with specific authority and responsibilities relating to the oversight of BRB's Bank Secrecy Act, anti-money laundering, and sanctions compliance programs. The Board of Directors has determined that it is in the best interests of the Corporation and its stockholders to adopt these Amended and Restated Bylaws to satisfy the requirements of the Consent Order and to strengthen the governance framework of the Corporation and BRB with respect to regulatory compliance.
Nothing in these Bylaws shall be construed to limit, modify, or supersede the requirements of the Consent Order or any other supervisory directive, enforcement action, memorandum of understanding, or other regulatory requirement applicable to the Corporation or BRB.
ARTICLE I — OFFICES
Section 1.1 — Registered Office. The Corporation shall maintain a registered office in the State of Delaware as required by the DGCL. The registered office of the Corporation shall be located at such place within the State of Delaware as the Board of Directors may from time to time designate by resolution filed with the Secretary of State of the State of Delaware in accordance with applicable law. The Corporation's registered agent at such address shall be as designated in the Corporation's Certificate of Incorporation or as otherwise determined by the Board and filed with the Secretary of State.
Section 1.2 — Principal Office. The principal office of the Corporation shall be located at 680 Lexington Avenue, 22nd Floor, New York, NY 10022, or at such other place as the Board of Directors may from time to time designate by resolution. The books and records of the Corporation may be kept at such principal office or at such other place or places, within or without the State of Delaware, as the Board of Directors may from time to time determine.
Section 1.3 — Other Offices. The Corporation may have offices and places of business at such other locations, both within and without the State of Delaware, as the Board of Directors may from time to time determine or as the business and affairs of the Corporation may require. The establishment or closure of any office shall be reported to the Board at the next regular meeting following such establishment or closure.
ARTICLE II — STOCKHOLDERS
Section 2.1 — Annual Meeting. The annual meeting of the stockholders of the Corporation shall be held at such date, time, and place, if any, within or without the State of Delaware, as shall be designated from time to time by the Board of Directors and stated in the notice of the meeting. The Board of Directors may, in its sole discretion, determine that the meeting shall not be held at any place, but instead may be held solely by means of remote communication in accordance with Section 211(a)(2) of the DGCL. At each annual meeting, the stockholders shall elect directors to succeed those whose terms expire and shall transact such other business as may properly be brought before the meeting in accordance with these Bylaws and applicable law.
Section 2.2 — Special Meetings. Special meetings of the stockholders of the Corporation may be called at any time by the Chair of the Board, the Chief Executive Officer, or by a majority of the Board of Directors, and shall be called by the Corporate Secretary at the request in writing of stockholders owning not less than the percentage of the outstanding shares of capital stock of the Corporation required by the Certificate of Incorporation. Such request shall state the purpose or purposes of the proposed meeting. Business transacted at any special meeting of stockholders shall be limited to the matters stated in the notice of the meeting.
Section 2.3 — Notice of Meetings. Written notice of each annual or special meeting of stockholders, stating the place, if any, date, and hour of the meeting, the means of remote communication, if any, by which stockholders and proxy holders may be deemed to be present in person and vote at such meeting, and, in the case of a special meeting, the purpose or purposes for which the meeting is called, shall be given to each stockholder entitled to vote at such meeting not less than ten (10) nor more than sixty (60) days before the date of the meeting, unless otherwise required by the DGCL or the Certificate of Incorporation. Notice may be given personally, by mail, by electronic transmission, or by any other means permitted under the DGCL. If mailed, such notice shall be deemed given when deposited in the United States mail, postage prepaid, directed to the stockholder at such stockholder's address as it appears on the records of the Corporation.
Section 2.4 — Quorum. The holders of a majority of the shares of capital stock issued and outstanding and entitled to vote at any meeting of stockholders, present in person or represented by proxy, shall constitute a quorum for the transaction of business at such meeting, except as otherwise provided by the DGCL, the Certificate of Incorporation, or these Bylaws. If a quorum shall not be present or represented at any meeting of the stockholders, the stockholders entitled to vote thereat, present in person or represented by proxy, shall have power to adjourn the meeting from time to time, without notice other than announcement at the meeting, until a quorum shall be present or represented. At any such adjourned meeting at which a quorum shall be present or represented, any business may be transacted that might have been transacted at the meeting as originally notified. If the adjournment is for more than thirty (30) days, or if after the adjournment a new record date is fixed for the adjourned meeting, a notice of the adjourned meeting shall be given to each stockholder of record entitled to vote at the meeting.
Section 2.5 — Voting. Unless otherwise provided in the Certificate of Incorporation or as required by the DGCL, each stockholder shall be entitled to one (1) vote for each share of common stock held by such stockholder of record on the applicable record date on any matter submitted to a vote of the stockholders. The common stock of the Corporation is listed on the New York Stock Exchange under the ticker symbol "BRFG." As of the date of the adoption of these Bylaws, there are 179,500,000 shares of common stock issued and outstanding. Unless otherwise required by the DGCL, the Certificate of Incorporation, or these Bylaws, the affirmative vote of the majority of shares present in person or represented by proxy at a meeting at which a quorum is present shall be the act of the stockholders. Election of directors shall be governed by Section 3.2 of these Bylaws.
Section 2.6 — Proxies. Each stockholder entitled to vote at a meeting of stockholders may authorize another person or persons to act for such stockholder by proxy. Any such proxy shall be filed with the Corporate Secretary of the Corporation before or at the time of the meeting. No proxy shall be voted or acted upon after three (3) years from its date, unless the proxy provides for a longer period. A proxy shall be irrevocable if it states that it is irrevocable and if, and only as long as, it is coupled with an interest sufficient in law to support an irrevocable power. A stockholder may revoke any proxy which is not irrevocable by attending the meeting and voting in person, by delivering to the Corporate Secretary a revocation of the proxy, or by delivering a duly executed proxy bearing a later date.
Section 2.7 — Record Date. In order that the Corporation may determine the stockholders entitled to notice of or to vote at any meeting of stockholders or any adjournment thereof, or entitled to receive payment of any dividend or other distribution, or entitled to exercise any rights in respect of any change, conversion, or exchange of stock, or for the purpose of any other lawful action, the Board of Directors may fix a record date, which record date shall not precede the date upon which the resolution fixing the record date is adopted by the Board and shall not be more than sixty (60) nor less than ten (10) days before the date of such meeting, nor more than sixty (60) days prior to any other such action. If no record date is fixed, the record date for determining stockholders entitled to notice of or to vote at a meeting of stockholders shall be the close of business on the day next preceding the day on which notice is given, or, if notice is waived, the close of business on the day next preceding the day on which the meeting is held.
Section 2.8 — Action Without Meeting. Unless otherwise provided in the Certificate of Incorporation, any action required or permitted to be taken at any annual or special meeting of stockholders may be taken without a meeting, without prior notice, and without a vote, if a consent or consents in writing, setting forth the action so taken, shall be signed by the holders of outstanding stock having not less than the minimum number of votes that would be necessary to authorize or take such action at a meeting at which all shares entitled to vote thereon were present and voted, and shall be delivered to the Corporation by delivery to its registered office in the State of Delaware, its principal place of business, or the Corporate Secretary. Every written consent shall bear the date of signature of each stockholder who signs the consent, and no written consent shall be effective unless, within sixty (60) days of the earliest dated consent delivered in the manner required by this Section, written consents signed by a sufficient number of stockholders to take action are delivered to the Corporation.
ARTICLE III — BOARD OF DIRECTORS
Section 3.1 — General Powers. The business and affairs of the Corporation shall be managed by or under the direction of the Board of Directors, except as may be otherwise provided in the DGCL or the Certificate of Incorporation. The Board of Directors shall exercise oversight over the Corporation and its subsidiaries, including BRB, in a manner consistent with applicable law, regulation, and supervisory requirements. Without limiting the generality of the foregoing, the Board shall exercise active oversight of regulatory compliance matters and shall ensure that the Corporation and BRB comply with all applicable consent orders, enforcement actions, memoranda of understanding, supervisory directives, and other regulatory requirements issued by the OCC, the Financial Crimes Enforcement Network ("FinCEN"), the Federal Deposit Insurance Corporation ("FDIC"), the Board of Governors of the Federal Reserve System, and any other applicable regulatory authority.
Section 3.2 — Number, Election, and Term. The number of directors constituting the whole Board of Directors shall be fixed from time to time exclusively by resolution of the Board, subject to any requirements set forth in the Certificate of Incorporation. As of the date of the adoption of these Bylaws, the number of directors is fixed at six (6). The directors of the Corporation as of the effective date of these Bylaws are as follows:
(a) Diane Whitford — Chair of the Board and Chief Executive Officer;
(b) Arthur Connelly — Lead Independent Director;
(c) Margaret Dao — Independent Director;
(d) James Rutherford — Independent Director;
(e) Sandra Villarreal — Independent Director; and
(f) Keith Yamamoto — Independent Director.
Each director shall be elected at the annual meeting of stockholders and shall hold office until such director's successor is duly elected and qualified, or until such director's earlier death, resignation, or removal. Directors need not be stockholders of the Corporation.
Section 3.3 — Vacancies. Unless otherwise provided in the Certificate of Incorporation, any vacancy on the Board of Directors, whether resulting from death, resignation, removal, disqualification, an increase in the number of directors, or any other cause, may be filled by the affirmative vote of a majority of the remaining directors, though less than a quorum, or by a sole remaining director. A director elected to fill a vacancy shall hold office until the next annual meeting of stockholders and until such director's successor has been duly elected and qualified, or until such director's earlier death, resignation, or removal. No decrease in the authorized number of directors shall shorten the term of any incumbent director.
Section 3.4 — Resignation and Removal. Any director may resign at any time by giving written notice to the Chair of the Board, the Chief Executive Officer, or the Corporate Secretary. Such resignation shall take effect at the time specified therein or, if no time is specified, upon receipt thereof. Unless otherwise provided in the Certificate of Incorporation, any director or the entire Board of Directors may be removed, with or without cause, by the holders of a majority of the shares then entitled to vote at an election of directors.
Section 3.5 — Regular Meetings. Regular meetings of the Board of Directors shall be held at least quarterly, or more frequently as required by resolution of the Board or as necessitated by applicable regulatory requirements, at such places, dates, and times as the Board shall from time to time determine. Regular meetings of the Board may be held without notice if the date, time, and place of such meetings are fixed by the Board. A meeting of the Board may be held without notice immediately after the annual meeting of stockholders at the same place at which such meeting is held.
Section 3.6 — Special Meetings. Special meetings of the Board of Directors may be called at any time by the Chair of the Board, the Chief Executive Officer, or any two (2) directors, on at least twenty-four (24) hours' notice to each director, either personally, by telephone, by electronic transmission, or by other means of communication. Special meetings may be held at such place, date, and time as shall be designated in the notice of the meeting.
Section 3.7 — Notice of Meetings. Notice of any special meeting of the Board of Directors shall be given to each director at least twenty-four (24) hours before the meeting by any means permitted under the DGCL, including personal delivery, telephone, facsimile, electronic mail, or other electronic transmission. Notice of a special meeting need not be given to any director who signs a waiver of notice, whether before or after the meeting, or who attends the meeting without protesting, prior thereto or at its commencement, the lack of notice. Neither the business to be transacted at, nor the purpose of, any regular or special meeting need be specified in the notice or waiver of notice of such meeting.
Section 3.8 — Quorum and Voting. A majority of the total number of directors then in office shall constitute a quorum for the transaction of business at any meeting of the Board of Directors. The act of a majority of the directors present at a meeting at which a quorum is present shall be the act of the Board of Directors, except as otherwise specifically required by the DGCL, the Certificate of Incorporation, or these Bylaws. If a quorum shall not be present at any meeting, a majority of the directors present may adjourn the meeting from time to time without further notice other than announcement at the meeting, until a quorum shall be present. Members of the Board or any committee thereof may participate in a meeting by means of conference telephone or other communications equipment by means of which all persons participating in the meeting can hear each other, and participation by such means shall constitute presence in person at such meeting.
Section 3.9 — Action Without Meeting. Unless otherwise restricted by the Certificate of Incorporation or these Bylaws, any action required or permitted to be taken at any meeting of the Board of Directors, or any committee thereof, may be taken without a meeting if all members of the Board or such committee, as the case may be, consent thereto in writing or by electronic transmission, and the writing or writings or electronic transmission or transmissions are filed with the minutes of proceedings of the Board or committee. Such filing shall be in paper form if the minutes are maintained in paper form and shall be in electronic form if the minutes are maintained in electronic form.
Section 3.10 — Compensation. Directors shall receive such compensation for their services as directors and members of committees as the Board of Directors may determine from time to time by resolution. Directors may also be reimbursed for their expenses of attendance at each meeting of the Board or any committee thereof. Nothing herein contained shall be construed to preclude any director from serving the Corporation or its subsidiaries in any other capacity and receiving compensation therefor.
Section 3.11 — Lead Independent Director. The Board of Directors shall designate, from among the independent directors, a Lead Independent Director. As of the effective date of these Bylaws, the Lead Independent Director is Arthur Connelly. The Lead Independent Director shall serve at the pleasure of the independent directors and shall have the following responsibilities:
(a) presiding at all meetings of the Board at which the Chair is not present, including executive sessions of the independent directors;
(b) serving as the principal liaison between the independent directors and the Chair of the Board and Chief Executive Officer;
(c) approving Board meeting agendas, meeting schedules, and information sent to the Board, in consultation with the Chair;
(d) calling meetings of the independent directors; and
(e) performing such other duties as the Board may from time to time determine.
ARTICLE IV — COMMITTEES OF THE BOARD OF DIRECTORS
Section 4.1 — General Authority to Establish Committees. The Board of Directors may, by resolution adopted by a majority of the whole Board, designate one or more committees, each consisting of one or more directors of the Corporation. Each such committee shall have and may exercise such authority of the Board of Directors in the management of the business and affairs of the Corporation as shall be provided in the resolution designating such committee or in any charter adopted for such committee, subject to the limitations set forth in the DGCL and these Bylaws. No committee shall have the power or authority to: (a) approve, adopt, or recommend to the stockholders any action or matter (other than the election or removal of directors) expressly required by the DGCL to be submitted to the stockholders for approval; or (b) adopt, amend, or repeal these Bylaws.
The standing committees of the Board of Directors shall include, at a minimum, the following:
(a) Audit Committee (Section 4.2);
(b) Risk Committee (Section 4.3);
(c) Compliance Committee (Section 4.4); and
(d) such other committees as the Board may establish from time to time pursuant to Section 4.7.
The establishment of the Compliance Committee as a standing committee of the Board is mandatory and may not be eliminated, merged with another committee, or materially reduced in scope or authority without the prior written non-objection of the OCC, so long as Consent Order No. OCC-2025-003 or any successor order or supervisory directive requiring the existence of such Committee remains in effect. The foregoing requirement shall survive any amendment or restatement of these Bylaws unless the OCC provides prior written approval for the elimination or modification of such requirement.
Section 4.2 — Audit Committee
Section 4.2.1 — Composition. The Audit Committee shall consist of not fewer than three (3) members of the Board of Directors, each of whom shall be an independent director and shall satisfy the independence requirements set forth in the applicable listing standards of the New York Stock Exchange and the rules and regulations of the Securities and Exchange Commission (the "SEC"), including, without limitation, Rule 10A-3 under the Securities Exchange Act of 1934, as amended. At least one member of the Audit Committee shall be an "audit committee financial expert" as defined by the SEC. As of the effective date of these Bylaws, the Chair of the Audit Committee is Margaret Dao.
Section 4.2.2 — Responsibilities. The Audit Committee shall have the authority and responsibility to:
(a) oversee the Corporation's financial reporting processes, including the integrity of the Corporation's financial statements and related disclosures;
(b) oversee the Corporation's system of internal controls over financial reporting;
(c) oversee the qualifications, independence, and performance of the Corporation's external auditor (currently Caldera & Pope LLP, engagement partner Franklin Dorsey) and the Corporation's internal audit function;
(d) coordinate with the Compliance Committee on BSA/AML-related internal audit findings to ensure appropriate communication and remediation tracking;
(e) review the results of independent BSA/AML testing conducted by the internal audit function or external parties;
(f) oversee the external auditor relationship, including the appointment, compensation, retention, and oversight of the work of the external auditor;
(g) pre-approve all audit and permissible non-audit services provided by the external auditor;
(h) establish procedures for the receipt, retention, and treatment of complaints received by the Corporation regarding accounting, internal controls, or auditing matters, including the confidential, anonymous submission of concerns by employees; and
(i) perform such other duties and responsibilities as are set forth in the Audit Committee Charter and as may be assigned by the Board from time to time.
Section 4.2.3 — Meetings. The Audit Committee shall meet at least quarterly, or more frequently as circumstances dictate. The Audit Committee shall meet periodically in separate executive sessions with each of the Corporation's management, the head of the internal audit function, and the external auditor.
Section 4.3 — Risk Committee
Section 4.3.1 — Composition. The Risk Committee shall consist of not fewer than three (3) members of the Board of Directors, each of whom shall be an independent director. As of the effective date of these Bylaws, the Chair of the Risk Committee is Arthur Connelly, who also serves as Lead Independent Director.
Section 4.3.2 — Responsibilities. The Risk Committee shall have the authority and responsibility to:
(a) oversee the Corporation's enterprise risk management framework, including the identification, measurement, monitoring, and control of credit risk, market risk, operational risk, liquidity risk, compliance risk, strategic risk, and reputational risk;
(b) coordinate with the Compliance Committee on BSA/AML risk matters, regulatory compliance risk, and the integration of BSA/AML risk into the Corporation's overall enterprise risk management framework;
(c) receive and review reports from the Chief Risk Officer (currently Melissa Chu) on the Corporation's risk profile, risk appetite, and risk management activities;
(d) review and recommend for Board approval the Corporation's risk appetite statement, risk limits, and risk management policies;
(e) oversee management's processes for assessing and managing the Corporation's exposure to risks arising from third-party relationships, including Banking-as-a-Service partnerships;
(f) oversee stress testing and capital planning processes; and
(g) perform such other duties and responsibilities as are set forth in the Risk Committee Charter and as may be assigned by the Board from time to time.
Section 4.3.3 — Meetings. The Risk Committee shall meet at least quarterly, or more frequently as circumstances dictate. The Risk Committee shall meet periodically in executive session without management present.
Section 4.4 — Compliance Committee
Section 4.4.1 — Establishment and Purpose. The Board of Directors hereby establishes a standing Compliance Committee of the Board (the "Compliance Committee" or the "Committee").
The purpose of the Compliance Committee is to assist the Board of Directors in fulfilling its oversight responsibilities with respect to the Corporation's and BRB's compliance with:
(a) the Bank Secrecy Act and its implementing regulations (31 U.S.C. § 5311 et seq.; 31 C.F.R. Chapter X) (the "BSA");
(b) anti-money laundering laws and regulations, including applicable provisions of the USA PATRIOT Act of 2001 and the Anti-Money Laundering Act of 2020 (collectively, "AML");
(c) economic sanctions laws and regulations administered by the Office of Foreign Assets Control ("OFAC") of the U.S. Department of the Treasury, including the International Emergency Economic Powers Act (50 U.S.C. § 1701 et seq.), the Trading with the Enemy Act (50 U.S.C. App. §§ 1–44), and all executive orders and regulations implementing such statutes;
(d) customer due diligence ("CDD") and enhanced due diligence ("EDD") requirements, including the CDD Rule (31 C.F.R. § 1010.230) and beneficial ownership requirements;
(e) all applicable federal and state banking laws and regulations relating to financial crimes compliance, including provisions relating to suspicious activity reporting, currency transaction reporting, and information sharing; and
(f) any consent orders, formal or informal enforcement actions, memoranda of understanding ("MOUs"), matters requiring attention ("MRAs"), matters requiring immediate attention ("MRIAs"), or other supervisory directives issued by the OCC, FinCEN, or any other applicable regulatory authority with respect to the Corporation or BRB.
Without limiting the generality of the foregoing, the Compliance Committee has a specific mandate to oversee BRB's compliance with Consent Order No. OCC-2025-003, issued by the OCC on January 15, 2025 (the "Consent Order"), which identified deficiencies in BRB's BSA/AML and OFAC compliance programs and requires, among other things, the development and implementation of a comprehensive remediation action plan, the engagement of an independent consultant, and the establishment of enhanced board-level governance over BSA/AML and sanctions compliance.
The Compliance Committee is a standing committee of the Board and shall continue in existence unless and until dissolved by the Board of Directors; provided, however, that the Committee may not be dissolved, merged with another committee, or materially reduced in scope, authority, or membership while any consent order, formal enforcement action, or MRIA relating to BSA/AML or sanctions compliance remains outstanding with respect to BRB, without the prior written approval or non-objection of the applicable regulator.
Section 4.4.2 — Composition. The Compliance Committee shall consist of not fewer than three (3) members of the Board of Directors, each of whom shall be an independent director as defined by the applicable listing standards of the New York Stock Exchange. At least one (1) member of the Committee shall have experience or expertise in one or more of the following areas: regulatory compliance, risk management, financial crimes prevention, anti-money laundering, or banking supervision. The Board shall assess the qualifications and expertise of Committee members on an annual basis and shall disclose the relevant qualifications of Committee members in the Corporation's annual proxy statement.
Members of the Compliance Committee shall be appointed annually by the Board of Directors. Any vacancy on the Committee, whether resulting from death, resignation, removal, disqualification, or any other cause, shall be filled by the Board promptly, and in any event within thirty (30) calendar days of the date such vacancy arises. Pending the filling of any vacancy, the remaining members of the Committee shall continue to exercise the full authority of the Committee, provided that a quorum is present.
The Board of Directors shall designate one member of the Compliance Committee as Chair of the Committee. As of the effective date of these Bylaws, the Chair of the Compliance Committee is James Rutherford. The initial members of the Compliance Committee are:
(a) James Rutherford — Chair;
(b) Sandra Villarreal — Member; and
(c) Keith Yamamoto — Member;
or as otherwise designated by the Board from time to time.
No member of the Compliance Committee shall simultaneously serve as Chair of the Board of Directors. The Chief Executive Officer of the Corporation (currently Diane Whitford) shall not be a member of the Compliance Committee but may attend meetings of the Committee at the Committee's invitation.
Section 4.4.3 — Authority and Responsibilities. The Compliance Committee shall have the authority, responsibility, and specific duties described in this Section 4.4.3, in addition to such other duties as the Board of Directors may from time to time delegate to the Committee. In carrying out its responsibilities, the Committee shall act in accordance with these Bylaws, any charter adopted by the Committee and approved by the Board, the requirements of the Consent Order, and all applicable laws, regulations, and supervisory guidance.
(a) BSA/AML and Sanctions Program Oversight.
The Compliance Committee shall review and oversee BRB's BSA/AML compliance program, including all policies, procedures, systems, controls, and governance structures designed to ensure compliance with the BSA, AML laws, and applicable regulations. The Committee's oversight shall encompass the five pillars of an effective BSA/AML program: (i) internal controls, (ii) independent testing, (iii) designation of a BSA Officer, (iv) training, and (v) customer due diligence, including beneficial ownership.
The Committee shall review and oversee BRB's OFAC sanctions compliance program, including sanctions screening processes, interdiction procedures, blocking and rejection protocols, reporting obligations, and the maintenance of accurate records. The Committee shall receive periodic reports on sanctions screening performance, including hit rates, false positive ratios, true match statistics, and the timely filing of blocking and rejection reports.
The Committee shall review and approve the annual BSA/AML compliance budget for BRB. For fiscal year 2024, the BSA/AML compliance budget was $18,200,000. The Committee shall review and approve any increases to such budget that are necessary in connection with the remediation program required by the Consent Order.
The Committee shall review staffing levels for BRB's BSA/AML department to ensure that the department is adequately resourced to carry out its responsibilities effectively. As of the effective date of these Bylaws, the BSA/AML department has sixty-two (62) full-time equivalent employees ("FTEs"). The planned post-remediation staffing level is seventy-seven (77) FTEs, plus approximately thirty (30) temporary FTEs to be provided by Pinnacle Compliance Solutions LLC during the remediation period. The Committee shall receive periodic reports on hiring progress, attrition, and the utilization of temporary staffing resources.
(b) Consent Order Compliance Monitoring.
The Compliance Committee shall monitor and oversee BRB's compliance with all provisions, deadlines, and requirements of Consent Order No. OCC-2025-003, and any amendments, supplements, or successor orders thereto. The Committee shall ensure that management develops and implements appropriate workplans, assigns clear accountability, and dedicates adequate resources to achieve timely and sustainable compliance with the Consent Order.
The Committee shall review all submissions to the OCC required by the Consent Order prior to their submission, including, without limitation:
(i) the Comprehensive Remediation Action Plan, due to the OCC on or before May 15, 2025;
(ii) the first quarterly progress report, due to the OCC on or before September 15, 2025;
(iii) the second quarterly progress report, due to the OCC on or before December 15, 2025; and
(iv) the compliance self-certification of the Board of Directors, due to the OCC on or before February 15, 2026.
The Committee shall oversee remediation across all five workstreams identified in the Consent Order:
(i) OFAC Sanctions Screening — remediation of deficiencies in BRB's sanctions screening technology, processes, and staffing, including the implementation of upgraded screening capabilities;
(ii) Suspicious Activity Report ("SAR") Filing — remediation of deficiencies in SAR identification, investigation, and filing processes, including clearance of the backlog of unreviewed alerts;
(iii) Customer Due Diligence / Enhanced Due Diligence ("CDD/EDD") — remediation of deficiencies in BRB's customer identification, verification, due diligence, and enhanced due diligence programs, including re-review of existing customer accounts;
(iv) Transaction Monitoring Model Validation — remediation of deficiencies in BRB's transaction monitoring system, including independent validation of monitoring models, scenarios, and thresholds; and
(v) Board-Level Governance — establishment of enhanced board-level governance structures and processes for oversight of BSA/AML and sanctions compliance, including the establishment of this Compliance Committee.
The Committee shall review the status of SAR backlog clearance on a regular basis. As of the effective date of these Bylaws, BRB has approximately 2,400 unreviewed transaction monitoring alerts targeted for clearance by June 30, 2025. The Committee shall monitor progress against this target and shall escalate any material delays to the full Board.
The Committee shall monitor CDD/EDD remediation progress against the milestones established in the Consent Order and the Comprehensive Remediation Action Plan. The remediation requires the re-review of approximately 47,000 existing customer accounts. The milestones are as follows:
(i) 50% of accounts (approximately 23,500 accounts) to be remediated by July 15, 2025; and
(ii) 100% of accounts to be remediated by January 15, 2026.
The Committee shall monitor technology remediation efforts, including:
(i) the upgrade of BRB's transaction monitoring system to Veridian TMS v.10.0, with a target of completing user acceptance testing ("UAT") by August 1, 2025; and
(ii) the operationalization of the upgraded OFAC screening platform, with a target completion date of November 1, 2025.
(c) Reporting and Metrics.
The Compliance Committee shall receive and review reports from the Chief Compliance Officer (currently Patricia Langston) and the BSA Officer (currently Thomas Ikeda) on a monthly basis during any period in which a consent order, formal enforcement action, or MRIA relating to BSA/AML or sanctions compliance is outstanding with respect to BRB. At all other times, such reports shall be provided to the Committee on at least a quarterly basis.
Monthly reports from the Chief Compliance Officer and BSA Officer shall include, at a minimum, the following information and metrics:
(i) SAR filing volumes and timeliness, including the average number of days from alert generation to SAR filing (with a target of a thirty (30)-day average filing time, compared to the pre-remediation average of seventy-eight (78) days);
(ii) OFAC screening hit rates and true match statistics, including the number of potential matches, false positives, and confirmed true matches, and the timeliness of disposition;
(iii) CDD/EDD remediation completion rates, reported by customer segment and, where applicable, by Banking-as-a-Service ("BaaS") partner;
(iv) transaction monitoring alert volumes and SAR conversion rates (for calendar year 2024, BRB generated 41,500 transaction monitoring alerts, resulting in 3,847 SARs filed, representing a 9.3% SAR conversion rate);
(v) BaaS partner risk ratings and any changes thereto;
(vi) remediation milestone status, including progress against all workstream targets identified in the Comprehensive Remediation Action Plan;
(vii) BSA/AML department staffing levels, including open positions, time-to-fill, attrition, and utilization of temporary staffing; and
(viii) such other metrics, data, or information as the Committee may from time to time request.
The Committee shall receive quarterly reports from the Head of Internal Audit (currently Derek Ballard) on BSA/AML audit findings, the status of remediation of prior audit findings, and internal audit's independent verification of management's representations regarding remediation progress.
The Committee shall review all findings, reports, and deliverables of the independent consultant engaged pursuant to the Consent Order (currently Thornfield Consulting Group LLC, engagement reference TCG-BRB-2025-001, engagement lead Dr. Vivian Castellano), including:
(i) the preliminary gap assessment, due on or before April 15, 2025; and
(ii) the final validation report, due on or before February 15, 2026.
(d) Independent Consultant Oversight.
The Compliance Committee shall oversee the engagement and performance of any independent consultant retained pursuant to the requirements of the Consent Order or any other regulatory directive.
The Committee shall review and approve, in coordination with management and outside counsel, the scope of work, deliverables, timelines, and budget of the independent consultant. The Committee shall ensure that the independent consultant's engagement is structured to satisfy the requirements of the Consent Order and that the independent consultant has the qualifications, resources, and independence necessary to perform its work effectively.
The Committee shall receive direct reports from the independent consultant on a regular basis, and shall ensure that the independent consultant has unrestricted access to the Committee Chair at all times. The independent consultant shall have the right to request a meeting with the Committee or the Committee Chair at any time, and the Committee Chair shall accommodate such requests promptly.
(e) Regulatory Engagement.
The Compliance Committee shall oversee BRB's engagement and communications with the OCC (examiner-in-charge: Jonathan Frey), FinCEN (liaison: Angela Drummond), and any other regulatory authority in connection with BSA/AML and sanctions compliance matters.
The Committee shall be kept informed of all material regulatory communications, examination findings, supervisory letters, and other regulatory correspondence relating to BSA/AML and sanctions compliance. The Committee shall review and approve, in coordination with management and outside counsel (currently Calderwood & Harkness LLP, responsible partner Philip Hartmann), all material regulatory submissions, including the Comprehensive Remediation Action Plan, quarterly progress reports, and the Board's compliance self-certification.
The Committee Chair or the Committee's designee shall be available to meet with the OCC or other regulators, upon request, to discuss the Committee's activities and the status of the remediation program.
(f) Outside Counsel and Advisor Oversight.
The Compliance Committee shall have the sole authority to engage, at the Corporation's expense, outside counsel, consultants, advisors, and other experts as it deems necessary or advisable to carry out its responsibilities. The Committee shall not be required to obtain the approval of management or any other committee of the Board to engage such advisors, although the Committee shall inform the Board of any material engagements.
The Committee shall periodically review the performance, scope, and cost-effectiveness of outside regulatory counsel (currently Calderwood & Harkness LLP) in connection with the remediation program and ongoing BSA/AML and sanctions compliance matters.
The Committee shall periodically review the performance, scope, and cost-effectiveness of AML technology vendors (currently Veridian Analytics Inc.), staffing providers (currently Pinnacle Compliance Solutions LLC), and other third-party service providers engaged in connection with the remediation program, and shall make recommendations to management and the Board as appropriate.
(g) BaaS / Fintech Partner Oversight.
The Compliance Committee shall review and oversee BRB's compliance oversight framework for all Banking-as-a-Service fintech partnerships. As of the effective date of these Bylaws, BRB maintains fourteen (14) active BaaS partnerships. The Committee recognizes that BaaS partnerships present elevated BSA/AML and sanctions compliance risks due to the volume and nature of transactions originated through fintech partners and the limited direct customer contact between BRB and end users of BaaS-enabled products.
The Committee shall review BaaS partner risk assessments prepared by management, with particular attention to the highest-volume partners, including NovaPay Technologies Inc., FairLend Digital LLC, and VaultEdge Inc.
The Committee shall review BaaS-related SAR filing activity. For calendar year 2024, BRB filed 2,108 SARs relating to activity originating through BaaS partnerships, representing approximately 54.8% of all SARs filed by BRB during that period. The Committee shall monitor trends in BaaS-related SAR activity and shall evaluate whether BRB's oversight of BaaS partners is adequate to mitigate BSA/AML and sanctions risks.
The Committee shall receive reports from the Head of Fintech Partnerships / BaaS Division (currently Warren Ashby) on a regular basis regarding BaaS partner compliance performance, risk assessment results, and any material compliance incidents or concerns.
(h) Policy Review and Approval.
The Compliance Committee shall review and recommend for Board approval all material BSA/AML and sanctions compliance policies and procedures of BRB, including, without limitation, policies relating to:
(i) the BSA/AML compliance program;
(ii) OFAC sanctions compliance;
(iii) customer due diligence and enhanced due diligence;
(iv) suspicious activity monitoring and reporting;
(v) currency transaction reporting;
(vi) customer identification program;
(vii) beneficial ownership;
(viii) information sharing under Section 314(a) and Section 314(b) of the USA PATRIOT Act; and
(ix) BSA/AML training.
The Committee shall review all revisions to such policies as part of the remediation program required by the Consent Order and shall ensure that such policies are updated to address the deficiencies identified in the Consent Order and the independent consultant's gap assessment.
(i) Budget Oversight.
The Compliance Committee shall review and recommend for Board approval the total remediation budget in connection with the Consent Order. As of the effective date of these Bylaws, the estimated remediation budget is $42,500,000, exclusive of the $14,500,000 civil money penalty assessed by the OCC in connection with the Consent Order, for a total estimated outlay of $57,000,000.
The Committee shall monitor expenditures against the approved budget on a monthly basis during the remediation period, including the following major cost categories:
(i) outside counsel fees — Calderwood & Harkness LLP (estimated at $8,000,000);
(ii) independent consultant fees — Thornfield Consulting Group LLC (estimated at $6,900,000, inclusive of expenses);
(iii) technology costs — Veridian Analytics Inc. (estimated at $4,700,000 for implementation and incremental Year 1 licensing);
(iv) temporary staffing — Pinnacle Compliance Solutions LLC (estimated at $3,600,000); and
(v) all other remediation costs, including internal personnel costs, training, and other direct and indirect expenses.
The Committee shall promptly report to the Board any material variances from the approved budget and shall recommend adjustments as warranted.
(j) Escalation.
The Committee Chair shall promptly escalate to the full Board of Directors any matter that, in the Chair's judgment, presents a significant risk to the Corporation or BRB, including, without limitation:
(i) any material failure or anticipated failure to meet a deadline or milestone established by the Consent Order or the Comprehensive Remediation Action Plan;
(ii) any indication that the OCC or other regulatory authority is considering additional enforcement action, the issuance of a cease and desist order, the assessment of additional civil money penalties, or the initiation of a removal or prohibition action against any institution-affiliated party;
(iii) any indication of a potential criminal referral by the OCC, FinCEN, or any other regulatory authority or law enforcement agency;
(iv) any material deterioration in the effectiveness of BRB's BSA/AML or sanctions compliance program;
(v) any material deficiency identified by the independent consultant, the internal audit function, or the external auditor in connection with BSA/AML or sanctions compliance; or
(vi) any other matter that the Committee Chair believes requires the immediate attention of the full Board.
The Committee Chair's obligation to escalate matters under this Section 4.4.3(j) shall be in addition to, and not in limitation of, any other reporting obligations of the Committee under these Bylaws or any Committee charter.
Section 4.4.4 — Meetings. The Compliance Committee shall meet no less frequently than monthly during any period in which a consent order, formal enforcement action, or MRIA relating to BSA/AML or sanctions compliance is outstanding with respect to BRB. At all other times, the Committee shall meet no less frequently than quarterly. Special meetings of the Committee may be called at any time by the Committee Chair, or by any two (2) members of the Committee, on at least twenty-four (24) hours' notice.
The Committee Chair shall establish the agenda for each meeting in consultation with the Chief Compliance Officer, the BSA Officer, and outside counsel. Agenda items shall include standing items for each of the responsibility areas set forth in Section 4.4.3, together with such additional items as the Committee Chair or any Committee member may request.
The following officers and other individuals shall attend meetings of the Compliance Committee at the Committee's invitation or as standing invitees, as determined by the Committee Chair; provided, however, that such individuals shall not be members of the Committee and shall not have a vote:
(a) the Chief Compliance Officer (currently Patricia Langston);
(b) the BSA Officer (currently Thomas Ikeda);
(c) the General Counsel (currently Gregory Nardone);
(d) the Chief Risk Officer (currently Melissa Chu); and
(e) the Head of Internal Audit (currently Derek Ballard).