PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT
Annotated Summary of Consent Order Provisions — Article-by-Article Breakdown
OCC Consent Order No. OCC-2025-003
Prepared by Calderwood & Harkness LLP
February 14, 2025 C&H Matter No.: 1045-00002
Prepared for:
Belmont Ridge Bank National Association OCC Charter No. 48271; FDIC Certificate No. 31845 680 Lexington Avenue, 22nd Floor New York, NY 10022
and
Belmont Ridge Financial Group, Inc. (BRFG; NYSE: BRFG)
Addressees:
Gregory Nardone, General Counsel & Corporate Secretary Patricia Langston, Chief Compliance Officer Thomas Ikeda, BSA Officer / AML Program Director
From:
Philip Hartmann, Responsible Partner Yuki Nakamura, Lead Associate Carlos Espinoza, Working Associate
Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, NY 10019
This memorandum is protected by the attorney-client privilege and constitutes attorney work product prepared in anticipation of litigation and regulatory proceedings. It is provided solely for the use of the addressees and authorized recipients within Belmont Ridge Bank National Association and Belmont Ridge Financial Group, Inc. Any disclosure, distribution, or reproduction of this memorandum without the prior written consent of Calderwood & Harkness LLP is strictly prohibited.
Right-click to update Table of Contents
I. Purpose and Overview
This memorandum provides a detailed article-by-article annotated breakdown of OCC Consent Order No. OCC-2025-003, issued on January 15, 2025 (the "Effective Date"), against Belmont Ridge Bank National Association ("BRB" or the "Bank"). The Consent Order was issued by the Office of the Comptroller of the Currency ("OCC"), Northeastern District Office, located at 340 Madison Avenue, New York, NY 10017, following a targeted Bank Secrecy Act ("BSA") and Anti-Money Laundering ("AML") examination conducted from March 2024 through September 2024. The Examiner-in-Charge for the targeted examination was Jonathan Frey, National Bank Examiner, OCC Northeastern District Office.
The Consent Order cites significant deficiencies across five core categories of BRB's BSA/AML compliance program:
1. Inadequate OFAC sanctions screening, including screening coverage gaps affecting approximately 12% of transactions processed through BRB's largest Banking-as-a-Service ("BaaS") partner;
2. Deficient Suspicious Activity Report ("SAR") filing practices, including a substantial backlog of unreviewed alerts and excessive filing timelines;
3. Insufficient Customer Due Diligence ("CDD") and Enhanced Due Diligence ("EDD") procedures, particularly with respect to accounts onboarded through fintech BaaS partnerships;
4. Inadequate model validation of BRB's transaction monitoring system, which had not been independently validated in more than three years; and
5. Board-level oversight failures, including the absence of a dedicated Compliance Committee and insufficient BSA/AML reporting to the Board of Directors.
The Consent Order follows a pattern of prior unresolved supervisory actions. Specifically, the OCC issued a Matter Requiring Attention ("MRA") in June 2022 regarding deficiencies in BRB's BSA/AML transaction monitoring program. That MRA was not adequately remediated, leading to the issuance of a Matter Requiring Immediate Attention ("MRIA") in November 2023 regarding OFAC screening gaps identified during an interim supervisory contact. Neither the MRA nor the MRIA was satisfactorily resolved prior to the commencement of the targeted BSA/AML examination in March 2024, and the unresolved supervisory findings served as a basis for the escalation to formal enforcement action.
BRB was represented during the 2023–2024 OCC examination cycle by prior outside counsel, Drayton Mercer LLP (Helen Frazier, lead partner). That engagement was terminated in January 2025, following the issuance of the Consent Order. Calderwood & Harkness LLP ("C&H") was engaged on February 10, 2025, pursuant to an engagement letter executed by Gregory Nardone, General Counsel & Corporate Secretary of BRB, to advise BRB on comprehensive compliance-program uplift and remediation of all deficiencies identified in the Consent Order.
The purpose of this memorandum is to serve as a comprehensive reference document for BRB's management, Board of Directors, and compliance leadership. For each substantive article of the Consent Order, this memorandum identifies: (a) the OCC's specific findings; (b) the corresponding compliance obligations imposed by the Order; (c) the applicable deadlines; (d) the responsible parties at BRB assigned to each obligation; and (e) C&H annotations regarding risk factors, implementation considerations, budgetary implications, and strategic recommendations.
This memorandum cross-references the five core deficiency categories identified above to the corresponding remediation workstreams that are being developed for inclusion in the Comprehensive Remediation Action Plan ("RAP"), which BRB is required to submit to the OCC by May 15, 2025. The five remediation workstreams are as follows:
• Workstream 1: OFAC Sanctions Screening Remediation Plan (corresponding to Article III)
• Workstream 2: SAR Backlog Clearance & Process Improvement Plan (corresponding to Article IV)
• Workstream 3: CDD/EDD Remediation Plan (corresponding to Article V)
• Workstream 4: Transaction Monitoring Model Validation & Tuning Plan (corresponding to Article VI)
• Workstream 5: BSA/AML Program Governance & Training Enhancement Plan (corresponding to Article VIII)
This memorandum should be read in conjunction with C&H's other work-product memoranda prepared in connection with this engagement, including the Regulatory Risk Assessment Memorandum, the OFAC Enforcement Risk & Voluntary Self-Disclosure Analysis, the CMP Payment Logistics Memorandum, the Technology Implementation Timeline & Risk Assessment Memorandum, the D&O Liability Analysis Memorandum, and the Securities Disclosure Implications Memorandum, each of which is referenced herein where applicable.
II. Recitals and Jurisdictional Provisions
Article I — Parties and Jurisdiction
Article I of the Consent Order identifies the parties and establishes the jurisdictional basis for the OCC's supervisory and enforcement authority over BRB.
Parties. The Consent Order identifies Belmont Ridge Bank National Association as a national banking association organized and existing under the laws of the United States, chartered pursuant to 12 U.S.C. § 21 et seq., and assigned OCC Charter No. 48271. BRB is subject to the supervisory authority of the OCC as its primary federal banking regulator pursuant to the National Bank Act, 12 U.S.C. § 1 et seq., and the Federal Deposit Insurance Act, 12 U.S.C. § 1811 et seq. BRB is an insured depository institution, holding FDIC Certificate No. 31845.
BRB's holding company is Belmont Ridge Financial Group, Inc. ("BRFG"), a Delaware corporation and registered bank holding company under the Bank Holding Company Act of 1956, as amended. BRFG's common stock is listed on the New York Stock Exchange under the ticker symbol "BRFG."
BRB's headquarters are located at 680 Lexington Avenue, 22nd Floor, New York, NY 10022.
Institutional Profile. As of December 31, 2024, BRB reported total consolidated assets of approximately $38.7 billion and total deposits of approximately $29.4 billion. BRB employs approximately 5,800 individuals across its various business lines and support functions. BRB's core business lines consist of: (i) retail banking, (ii) commercial lending, (iii) wealth management, and (iv) fintech Banking-as-a-Service ("BaaS") partnerships. With respect to the BaaS business, BRB maintains approximately fourteen (14) active fintech sponsor relationships that operate through BRB's national bank charter, providing payment, deposit, and lending products to end users through fintech-branded digital platforms. The BaaS channel represents a significant and growing component of BRB's overall business and, as discussed throughout this memorandum, is the source of a disproportionate share of the compliance deficiencies identified in the Consent Order.
C&H Annotation. No jurisdictional issues have been identified. BRB is a national banking association properly subject to the OCC's supervisory and enforcement authority under the National Bank Act and applicable provisions of the Federal Deposit Insurance Act. No challenge to the OCC's jurisdiction is contemplated, and C&H does not recommend any such challenge. The jurisdictional recitals in Article I are standard and non-controversial.
Article II — Background and Findings
Article II of the Consent Order sets forth the factual background and summarizes the OCC's findings from the targeted BSA/AML examination.
Examination History. Article II recounts that the OCC conducted a targeted BSA/AML examination of BRB from March 2024 through September 2024, during which examiners identified significant deficiencies across multiple components of BRB's BSA/AML compliance program. The Article further chronicles the escalation history that preceded the Consent Order, specifically citing: (i) the MRA issued in June 2022 regarding deficiencies in BRB's BSA/AML transaction monitoring program, and (ii) the MRIA issued in November 2023 regarding OFAC screening gaps. Neither supervisory action was adequately remediated by BRB within the timeframes contemplated by the OCC, and the persistence of these deficiencies is cited as a material factor in the OCC's decision to escalate to formal enforcement.
Resource Adequacy. Article II references BRB's BSA/AML budget for fiscal year 2024 of approximately $18.2 million and notes the OCC's determination that this budgetary allocation was insufficient given the scope and complexity of BRB's operations, including the substantial transaction volumes and customer base associated with the BaaS channels. The OCC's findings in this regard are consistent with the observations of BRB's external auditor and BSA/AML independent testing firm, Caldera & Pope LLP (Franklin Dorsey, Engagement Partner), which completed an independent BSA/AML test in September 2024 that identified multiple deficiencies echoing the OCC's findings. The BSA/AML independent testing engagement was conducted at a fee of approximately $1.1 million.
Five Core Deficiency Categories. Article II identifies the five core deficiency categories that are detailed in Articles III through VII of the Consent Order. These categories correspond to the five remediation workstreams described in Section I of this memorandum and form the substantive basis for the compliance obligations imposed by the Order.
C&H Annotation. The recitals in Article II establish the factual predicate for the Consent Order and comprehensively document BRB's failure to remediate prior supervisory findings within the expected timeframes. Several aspects of these recitals warrant particular attention:
Escalation Pattern. The progression from MRA (June 2022) to MRIA (November 2023) to Consent Order (January 2025) is significant because it demonstrates a documented pattern of non-compliance over a multi-year period. This escalation trajectory is a factor that regulators consider in determining the severity of future enforcement actions. Should BRB fail to comply with the terms of the Consent Order, the documented pattern substantially increases the risk of further escalation, potentially including cease-and-desist proceedings, additional civil money penalties, removal actions against institution-affiliated parties, or referral to the Department of Justice ("DOJ") for criminal prosecution.
FinCEN Monitoring. The Financial Crimes Enforcement Network ("FinCEN"), through Associate Director Angela Drummond of FinCEN's Enforcement Division, is actively monitoring BRB's SAR filing remediation efforts. As of the date of C&H's engagement (February 10, 2025), no separate FinCEN enforcement action has been filed against BRB, but FinCEN has expressly reserved its enforcement rights in coordination with the OCC. The absence of a current FinCEN action should not be interpreted as foreclosing future enforcement, and BRB's remediation efforts — particularly with respect to the SAR backlog and filing timeliness — should be understood as having implications for FinCEN enforcement risk as well as OCC compliance.
DOJ Criminal Referral. As of February 10, 2025, no criminal referral has been made to the DOJ. However, the Consent Order does not contain any provision precluding a future criminal referral, and the OCC's reservation of rights (discussed in connection with Article XIII below) expressly preserves this possibility. C&H's separate Regulatory Risk Assessment Memorandum provides a detailed analysis of DOJ referral risk factors and mitigation strategies.
Independent Testing Findings. The convergence between the OCC's examination findings and the independent testing results from Caldera & Pope LLP underscores the pervasiveness of the identified deficiencies. The fact that BRB's own independent testing firm reached substantially similar conclusions as the OCC diminishes any argument that the regulatory findings were unexpected or unjustified, and reinforces the importance of comprehensive and timely remediation.
III. Article III — OFAC Sanctions Screening Deficiencies
Article III.A — Findings
Article III of the Consent Order addresses deficiencies in BRB's Office of Foreign Assets Control ("OFAC") sanctions screening program. The OCC's findings in this regard are among the most serious in the Consent Order, given the potential for violations of U.S. sanctions laws and regulations.
Screening Coverage Gaps. The OCC determined that BRB's OFAC screening system failed to screen 100% of transactions processed through fintech BaaS channels. The most significant gap was identified in connection with NovaPay Technologies Inc. ("NovaPay"), BRB's largest BaaS partner by transaction volume. Specifically, the OCC found that approximately 12.0% of wire and Automated Clearing House ("ACH") transactions processed through NovaPay were unscreened against applicable OFAC sanctions lists. In quantitative terms, approximately 3,800,000 transactions were unscreened in calendar year 2023 out of a total of 31,700,000 NovaPay transactions processed through BRB during that period (3,800,000 ÷ 31,700,000 ≈ 12.0%).
NovaPay Significance. NovaPay is BRB's largest BaaS partner, accounting for approximately 41% of total BaaS transaction volume. In calendar year 2024, NovaPay transactions processed through BRB totaled approximately $30.5 billion. The scale of the screening gap relative to BRB's largest partner channel represents a material compliance failure that exposes BRB to significant OFAC enforcement risk, as discussed further in the C&H Annotation below.
Screening Hit Data. The Consent Order notes that OFAC screening hits in calendar year 2024 totaled 14,320 across all BRB business lines and channels. Of these hits, only 12 were determined to be true matches requiring blocking or rejection action, yielding a false-positive rate of approximately 99.9%. While a high false-positive rate is not uncommon in sanctions screening, the rate observed at BRB indicates significant tuning deficiencies in the screening system. Excessive false positives divert analyst attention from legitimate risks, contribute to alert fatigue, and can result in delayed processing of legitimate transactions — all of which undermine the effectiveness of the overall sanctions compliance program.
Additional BaaS Partner Gaps. The OCC identified sanctions screening coverage gaps in BaaS partner channels beyond NovaPay, though NovaPay represented the most significant exposure by transaction volume and dollar value. The Consent Order does not individually quantify the screening gaps for each additional BaaS partner, but the findings make clear that the deficiency is systemic across BRB's BaaS infrastructure.
Technology Platform. BRB's OFAC screening was conducted through Veridian Analytics Inc.'s transaction monitoring and screening platform, specifically Veridian TMS version 8.3 ("Veridian TMS v.8.3"). The OCC found that Veridian TMS v.8.3 lacked proper integration with certain BaaS transaction flows, resulting in the screening coverage gaps described above. The root cause of the integration failure appears to relate to limitations in the application programming interface ("API") connections between BRB's BaaS transaction processing systems and the Veridian screening engine, which were not designed to accommodate the volume and range of transaction types flowing through the BaaS channels.
Article III.B — Compliance Obligations
Article III imposes the following compliance obligations on BRB with respect to OFAC sanctions screening:
1. Comprehensive Screening. BRB shall implement a comprehensive OFAC sanctions screening program that ensures 100% screening of all transactions across all business lines and all BaaS channels, including wire transfers, ACH transactions, card transactions, and all other payment types processed through or by BRB. No transaction category or channel may be excluded from screening.
2. Technology Upgrade or Replacement. BRB shall upgrade or replace its sanctions screening technology to eliminate the screening gaps identified in the Consent Order. The upgraded or replacement system must be capable of processing all transaction types across all channels without coverage gaps.
3. Real-Time and Batch Screening. BRB shall implement real-time screening for applicable transaction types (including wire transfers and other time-sensitive payment types) and batch screening for other transaction types, in each case with appropriate interdiction and blocking capabilities to ensure that transactions involving sanctioned parties are identified and stopped before completion.
4. Revised Policies and Procedures. BRB shall adopt revised OFAC compliance policies, procedures, and screening procedures manuals that reflect the upgraded screening capabilities and address the deficiencies identified in the Consent Order.
5. List Management Protocols. BRB shall establish enhanced list management protocols covering the Specially Designated Nationals and blocked Persons ("SDN") List, the Consolidated Sanctions List, the Sectoral Sanctions Identifications ("SSI") List, and all applicable non-SDN lists maintained by OFAC, including the Non-SDN Menu-Based Sanctions List, the Foreign Sanctions Evaders List, and other relevant lists. The protocols must ensure timely integration of list updates into the screening system.
6. Post-Remediation Testing. BRB shall conduct comprehensive testing to validate 100% BaaS transaction screening coverage following implementation of the upgraded or replacement screening system. Testing results must be documented and made available to the OCC upon request.
Article III.C — Deadline
November 1, 2025: BRB's OFAC screening must be fully operational for all BaaS channels by this date. The fully operational system must screen 100% of transactions across all business lines and channels without coverage gaps, in accordance with the requirements set forth in Article III.B above.
Interim milestones leading to the November 1, 2025 deadline are to be set forth in the Comprehensive Remediation Action Plan, which is due to the OCC by May 15, 2025 (as discussed in connection with Article X below).
Article III.D — Responsible Parties at BRB
The following BRB personnel bear responsibility for compliance with Article III:
• Thomas Ikeda, BSA Officer / AML Program Director — Primary operational responsibility for the OFAC sanctions screening remediation, including oversight of the technology upgrade, revised screening procedures, and post-remediation testing.
• Patricia Langston, Chief Compliance Officer — Oversight of OFAC compliance policies and procedures, approval of revised screening procedures manuals, and reporting to the Compliance Committee on remediation progress.
• Linda Petrosian, Chief Information Officer / Chief Technology Officer — Responsibility for the technology implementation, including the Veridian TMS upgrade (or replacement vendor implementation), API integration with BaaS transaction flows, and completion of user acceptance testing.
• Warren Ashby, Head of Fintech Partnerships / BaaS Division — BaaS channel coordination with fintech partners to ensure proper transaction flow integration with the upgraded screening system. Key fintech partner contacts include Ethan Garrison (CEO, NovaPay Technologies Inc.), Aisha Okonkwo (CEO, FairLend Digital), and Marcus Tan (CEO, VaultEdge).
C&H Annotation
Remediation Workstream Correspondence. The compliance obligations in Article III correspond to Remediation Workstream 1: OFAC Sanctions Screening Remediation Plan, which is being developed by C&H in coordination with Thomas Ikeda and Linda Petrosian for inclusion in the Comprehensive RAP.
Technology Action. The primary technology action required to remediate the OFAC screening deficiency is an upgrade of the Veridian TMS platform from version 8.3 to version 10.0. Version 10.0 includes an enhanced OFAC screening module with improved API integration capabilities designed to accommodate BaaS transaction flows. C&H has coordinated with Veridian Analytics Inc. (Priya Subramanian, Vice President of Client Solutions) regarding the upgrade timeline and costs. The estimated cost of the Veridian TMS v.10.0 upgrade is $2.8 million in one-time implementation fees, plus $1.9 million per year in incremental licensing costs, bringing BRB's total annual contract value with Veridian from $4.1 million to $6.0 million per year.
Contingency Vendor Evaluation. Given the aggressive timeline for the Veridian upgrade (user acceptance testing must be complete by August 1, 2025, and full OFAC screening must be operational by November 1, 2025), C&H is concurrently evaluating Ridgeline Data Systems LLC ("Ridgeline") as a contingency replacement vendor. David Marchetti, Chief Revenue Officer of Ridgeline (500 West Monroe Street, Suite 2800, Chicago, IL 60661), has submitted a proposal with an annual contract value of $7.2 million per year for a 5-year term, representing a total contract value of $36.0 million. Ridgeline's platform offers native BaaS transaction screening capabilities that may reduce integration risk relative to the Veridian upgrade path. C&H is preparing a Technology Implementation Timeline & Risk Assessment Memorandum that maps the Veridian upgrade milestones to Consent Order deadlines and identifies specific contingency triggers that would warrant transitioning to the Ridgeline platform.
OFAC Voluntary Self-Disclosure. The approximately 3.8 million unscreened NovaPay transactions in calendar year 2023 represent potential violations of OFAC regulations. BRB should carefully evaluate whether a voluntary self-disclosure ("VSD") to OFAC is warranted. A VSD, if pursued in a timely and thorough manner, can constitute a significant mitigating factor under OFAC's Enforcement Guidelines (31 C.F.R. Part 501, Appendix A) and may result in substantially reduced penalties in the event that apparent violations are identified. C&H is preparing a separate OFAC Enforcement Risk & Voluntary Self-Disclosure Analysis memorandum that will assess: (i) the likelihood that any of the unscreened transactions involved sanctioned parties; (ii) the applicable statutory and regulatory penalty framework; (iii) the benefits and risks of voluntary self-disclosure; and (iv) recommended next steps. This memorandum is expected to be circulated to the addressees by March 7, 2025.
False-Positive Tuning. The 99.9% false-positive rate (14,308 false positives out of 14,320 total hits) indicates that the sanctions screening system requires significant tuning in addition to the coverage remediation. Excessive false positives represent an operational burden that diverts analyst resources from genuine risks and can contribute to a compliance culture in which screening alerts are not taken seriously. The Veridian TMS v.10.0 upgrade includes enhanced fuzzy-matching algorithms and configurable scoring thresholds that are expected to reduce the false-positive rate significantly. However, tuning must be an ongoing process and should be subject to periodic review and validation as part of the model governance framework discussed in connection with Article VI below.
IV. Article IV — SAR Filing Deficiencies
Article IV.A — Findings
Article IV of the Consent Order addresses deficiencies in BRB's Suspicious Activity Report ("SAR") filing operations, which the OCC determined to be among the most significant compliance failures identified during the targeted examination.
Alert Backlog. The OCC found that BRB had a backlog of approximately 2,400 potentially suspicious activity alerts that remained unreviewed as of the examination date in September 2024. Each of these alerts was generated by BRB's transaction monitoring system but had not been dispositioned — meaning that an analyst had not reviewed the alert, determined whether the underlying activity was suspicious, and either escalated the alert for SAR filing or closed it with appropriate documentation. The existence of a substantial backlog of unreviewed alerts represents a fundamental failure in BRB's BSA/AML compliance program, as it means that potentially suspicious activity was not being identified, investigated, or reported in accordance with regulatory requirements.
Filing Timeliness. In addition to the unreviewed alert backlog, the OCC found that the average time from alert generation to SAR filing for those alerts that were reviewed and escalated was approximately 78 days. This significantly exceeds the regulatory expectation that SARs be filed in a timely manner, which in practice has been interpreted by the OCC and FinCEN to mean within 30 days of the initial determination that the activity is suspicious. A 78-day average filing time means that BRB was routinely filing SARs more than twice as slowly as the regulatory expectation, limiting the utility of those filings to law enforcement and creating an extended period during which potentially suspicious activity continued without appropriate reporting.
Filing Volumes. BRB filed a total of 2,914 SARs in calendar year 2023 and 3,847 SARs in calendar year 2024, representing a significant year-over-year increase of approximately 32.0%. However, the OCC determined that even the increased filing volume was insufficient to address the growing alert volumes generated by the transaction monitoring system, particularly with respect to alerts originating from BaaS channels.
Alert Volumes and Conversion Rate. Total transaction monitoring alerts generated in calendar year 2024 were 41,500. Of these, 3,847 were ultimately filed as SARs, yielding a SAR conversion rate of approximately 9.3% (3,847 ÷ 41,500). While SAR conversion rates vary by institution and are not subject to a single regulatory benchmark, the combination of a 9.3% conversion rate and a growing alert backlog suggests that BRB's transaction monitoring system may be generating a high volume of alerts that require manual review without adequate staffing to process them.
BaaS Channel Concentration. Of the 3,847 SARs filed in calendar year 2024, approximately 2,108 (54.8%) were related to transactions or accounts associated with BaaS fintech partnership channels. This disproportionate concentration of suspicious activity in the BaaS channel — which represents one of BRB's four core business lines but accounts for more than half of all SAR filings — underscores the elevated risk profile of the BaaS operations and the need for enhanced oversight of fintech partner activity.
Currency Transaction Reports. For context, BRB filed 28,612 Currency Transaction Reports ("CTRs") in calendar year 2024, reflecting the Bank's cash-handling operations across its retail banking network.
Staffing Deficiency. The OCC determined that staffing levels in BRB's BSA/AML department, comprising 62 full-time equivalents ("FTEs") as of January 2025, were insufficient to handle alert volumes and ensure timely SAR filing. The inadequacy of staffing levels is directly correlated with the alert backlog and filing delays identified by the OCC.
Article IV.B — Compliance Obligations
Article IV imposes the following compliance obligations on BRB:
1. Backlog Clearance. BRB shall clear the backlog of approximately 2,400 unreviewed alerts and disposition each alert with full documentation. Each alert must be reviewed by a qualified BSA/AML analyst, investigated as appropriate, and either escalated for SAR filing or closed with a documented rationale for the closure decision.
2. SAR Lookback Project. BRB shall conduct a SAR lookback project covering the relevant lookback period to identify and file any previously unfiled SARs. The lookback must include a review of transactions and accounts associated with the backlogged alerts, as well as a broader population analysis to determine whether additional SARs should have been filed during the period in which the alert backlog accumulated. The lookback period, methodology, and scope are to be defined in the Comprehensive Remediation Action Plan and coordinated with the independent consultant (Thornfield Consulting Group LLC).
3. Revised SAR Policies and Procedures. BRB shall revise its SAR filing policies and procedures to ensure timely filing, targeting a turnaround time of no more than 30 days from the initial determination that activity is suspicious. The revised policies must address alert triage, escalation protocols, investigation standards, SAR narrative quality, filing timelines, and management reporting.
4. Quality Assurance Protocols. BRB shall implement quality assurance ("QA") protocols for SAR filing, including transaction-level sampling of completed SAR filings, error tracking, and corrective action procedures. The QA function must be independent of the SAR filing operations it reviews, and QA results must be reported to the BSA Officer and the Compliance Committee.
5. Interim and Ongoing Reporting. BRB shall provide interim and ongoing reporting to the OCC on SAR backlog clearance progress, including quantitative metrics on the number of alerts reviewed, dispositioned, and escalated.
6. Staffing Augmentation. BRB shall augment BSA/AML staffing to sustainable levels sufficient to prevent the recurrence of alert backlogs and ensure timely SAR filing on an ongoing basis. Staffing plans are to be set forth in the Comprehensive RAP.
Article IV.C — Deadlines
The Consent Order establishes the following deadlines for SAR-related compliance obligations:
• March 31, 2025: Interim SAR backlog status report due to the OCC, documenting the number of alerts reviewed, dispositioned, and remaining, as well as the number of SARs filed as a result of backlog clearance efforts to date.
• June 30, 2025: SAR backlog clearance target — all approximately 2,400 unreviewed alerts must be fully dispositioned by this date.
• September 15, 2025 and December 15, 2025: Ongoing SAR filing timeliness and backlog metrics to be reported in the first and second quarterly progress reports to the OCC, respectively.
Article IV.D — Responsible Parties at BRB
• Thomas Ikeda, BSA Officer / AML Program Director — Direct management of SAR filing operations, alert disposition, lookback project execution, and backlog clearance. Mr. Ikeda is the day-to-day owner of this workstream.
• Patricia Langston, Chief Compliance Officer — Policy oversight, including review and approval of revised SAR policies and procedures and quality assurance protocols.
• Derek Ballard, Head of Internal Audit — Independent testing of remediated SAR processes to validate that the revised policies, procedures, and QA protocols are operating effectively.
C&H Annotation
Remediation Workstream Correspondence. The compliance obligations in Article IV correspond to Remediation Workstream 2: SAR Backlog Clearance & Process Improvement Plan, which is being developed by C&H in coordination with Thomas Ikeda and Patricia Langston.
Temporary Staffing. To support backlog clearance and the SAR lookback project, BRB has contracted with Pinnacle Compliance Solutions LLC ("Pinnacle"). Andrea Solis, Director of Managed Services at Pinnacle (90 Broad Street, 20th Floor, New York, NY 10004), is the engagement lead under Statement of Work Reference PCS-BRB-2025-0012. Pinnacle will provide 30 temporary FTE BSA/AML analysts at a cost of $10,000 per month per FTE for a 12-month term, resulting in a monthly cost of $300,000 and a total engagement cost of $3,600,000. The Pinnacle analysts are expected to begin work on or about March 3, 2025, and will be supervised by Thomas Ikeda and his team in accordance with the quality control protocols described in C&H's Memorandum on Temporary Staff Supervision & Quality Control Protocols.
SAR Lookback Budget. The SAR lookback project budget is estimated at $5.5 million, encompassing data extraction and analysis, alert re-review, lookback SAR preparation and filing, and project management. This budget is in addition to the Pinnacle temporary staffing cost and reflects the scope and complexity of the lookback exercise, which must cover the period during which the alert backlog accumulated and potentially an extended historical period depending on the findings of the initial lookback analysis.
FinCEN Monitoring. As noted in connection with Article II above, FinCEN (Associate Director Angela Drummond, Enforcement Division) is specifically monitoring BRB's SAR filing remediation. The timely and high-quality clearing of the alert backlog is critical to mitigating the risk of a separate FinCEN enforcement action. FinCEN's enforcement tools include civil money penalties under 31 U.S.C. § 5321, which can be assessed on a per-violation basis. Given the backlog of approximately 2,400 unreviewed alerts, the potential exposure is significant. C&H recommends that BRB prioritize Workstream 2 as one of the two most time-critical remediation tracks (along with the March 16, 2025 CMP payment).
BaaS Channel Implications. The 54.8% BaaS-related SAR proportion underscores the need for enhanced BaaS partner oversight, cooperation, and contractual obligations. As discussed in connection with Article V (CDD/EDD) and Article VIII (Board Oversight) below, BRB must establish clear accountability mechanisms with its fintech partners to ensure that suspicious activity is identified and escalated in a timely manner. C&H is evaluating amendments to BRB's existing BaaS partner agreements to incorporate enhanced BSA/AML cooperation clauses, suspicious activity escalation requirements, and contractual audit rights.
V. Article V — CDD/EDD Deficiencies
Article V.A — Findings
Article V of the Consent Order addresses deficiencies in BRB's Customer Due Diligence ("CDD") and Enhanced Due Diligence ("EDD") practices.
Scope of Deficiency. The OCC identified approximately 47,000 high-risk customer accounts that lacked adequate CDD or EDD documentation. These accounts did not meet the minimum documentation and monitoring standards required by the Bank Secrecy Act, its implementing regulations (31 C.F.R. § 1020.210 et seq.), and the OCC's related supervisory guidance. The deficient accounts were predominantly onboarded through BRB's fintech BaaS partnerships, with the highest concentrations among the following three partner channels:
• NovaPay Technologies Inc. — Approximately 2.1 million total end-user accounts, onboarded through BRB beginning in 2021. NovaPay accounts for approximately 41% of BRB's total BaaS transaction volume.
• FairLend Digital — Approximately $1.4 billion in loan originations processed through BRB in fiscal year 2024, with the partner relationship onboarded in 2022. FairLend Digital accounts for approximately 28% of BRB's BaaS transaction volume.
• VaultEdge — Approximately 870,000 deposit accounts, with the partner relationship onboarded in 2023. VaultEdge accounts for approximately 18% of BRB's BaaS transaction volume.
The remaining eleven (11) BaaS partners collectively account for approximately 13% of BaaS transaction volume.
Types of Deficiencies. The CDD/EDD deficiencies identified across the 47,000 accounts included: (i) missing or incomplete customer identification documentation under the Customer Identification Program ("CIP") requirements; (ii) inadequate risk rating of customer accounts, resulting in high-risk customers being classified at lower risk tiers and not subjected to appropriate EDD; (iii) insufficient beneficial ownership information for legal entity customers, as required by the CDD Rule (31 C.F.R. § 1010.230); and (iv) lack of periodic review or ongoing monitoring of customer relationships, resulting in stale or outdated CDD information that did not reflect current customer risk profiles.
Article V.B — Compliance Obligations
Article V imposes the following compliance obligations on BRB:
1. Account Remediation. BRB shall remediate all 47,000 identified CDD/EDD-deficient accounts using a risk-based prioritization approach. Remediation must include collection of missing CIP documentation, updated risk ratings, collection of beneficial ownership information where applicable, and establishment of ongoing monitoring profiles.
2. Revised Policies and Procedures. BRB shall adopt revised CDD/EDD policies and procedures for all customer channels, including specific requirements for customers onboarded through BaaS partnerships. The revised policies must clearly articulate the CDD/EDD standards applicable to BaaS-channel customers and ensure that those standards are no less rigorous than the standards applied to customers onboarded through BRB's direct channels.
3. Responsibility Matrix. BRB shall establish a clear responsibility matrix delineating BRB's versus fintech partners' respective obligations for customer onboarding, CDD/EDD collection, ongoing monitoring, and periodic review. The responsibility matrix must make clear that BRB, as the chartered institution, retains ultimate responsibility for BSA/AML compliance regardless of the division of operational tasks between BRB and its fintech partners.
4. Progress Tracking and Reporting. BRB shall implement a progress tracking mechanism to monitor the remediation of the 47,000 deficient accounts and shall provide regular reporting on remediation progress to the Board's Compliance Committee (once established) and to the OCC.
Article V.C — Deadlines
• July 15, 2025: 50% remediation milestone — 23,500 of the 47,000 identified deficient accounts must be fully remediated by this date.
• January 15, 2026: 100% remediation milestone — all 47,000 identified deficient accounts must be fully remediated by this date.
Article V.D — Responsible Parties at BRB
• Patricia Langston, Chief Compliance Officer — Policy and program oversight for CDD/EDD remediation, including adoption of revised policies and procedures.
• Thomas Ikeda, BSA Officer / AML Program Director — Operational execution of the account remediation project, including supervision of remediation analysts, quality control, and progress tracking.
• Warren Ashby, Head of Fintech Partnerships / BaaS Division — Coordination with fintech partners on data collection, customer outreach, and implementation of the BaaS Partner CDD/EDD Responsibility Matrix.
C&H Annotation
Remediation Workstream Correspondence. The compliance obligations in Article V correspond to Remediation Workstream 3: CDD/EDD Remediation Plan, which is being developed by C&H in coordination with Patricia Langston, Thomas Ikeda, and Warren Ashby.
Budget. The estimated budget for the CDD/EDD remediation project is $4.3 million, covering data analysis, account remediation staffing, customer outreach, system enhancements to support ongoing monitoring, and quality assurance review. This figure is inclusive of both internal and external costs associated with the remediation effort.
Risk-Based Prioritization. Consistent with the Consent Order's requirement for a risk-based approach, remediation will focus first on the highest-risk accounts associated with NovaPay Technologies, FairLend Digital, and VaultEdge, given that these three partners represent the largest BaaS partner concentrations by transaction volume. The prioritization framework will be structured around a tiered approach, with Tier 1 accounts (highest-risk characteristics, including large transaction volumes, cross-border activity, high-risk geographies, and PEP associations) remediated first, followed by Tier 2 accounts (moderate-risk characteristics), and Tier 3 accounts (lower-risk characteristics requiring only routine CDD updates). C&H is developing the detailed prioritization criteria in consultation with Thomas Ikeda and will incorporate them into the Comprehensive RAP.
BaaS Revenue Context. BRB's total BaaS transaction volume was $74.3 billion in calendar year 2024, generating approximately $127.4 million in revenue from interchange fees, program fees, and interest income. The scale of BaaS operations underscores both the commercial importance of the BaaS channel to BRB's business and the magnitude of the compliance risk associated with these relationships. Failure to adequately remediate CDD/EDD deficiencies could, in a severe scenario, result in OCC-imposed restrictions on BRB's ability to onboard new BaaS customers or enter into new fintech partnership agreements, which would have a material adverse impact on BRB's revenue and growth trajectory.
BaaS Partner CDD/EDD Responsibility Matrix. C&H will prepare a BaaS Partner CDD/EDD Responsibility Matrix that clearly delineates BRB's obligations and each fintech partner's obligations with respect to customer onboarding, CIP documentation collection, beneficial ownership verification, risk rating, ongoing monitoring, periodic review, and remediation of deficient accounts. The Responsibility Matrix will be incorporated into BRB's revised CDD/EDD policies and, where appropriate, into amended BaaS partner agreements.
Compliance Remediation Letters. C&H will draft compliance remediation letters to NovaPay Technologies, FairLend Digital, VaultEdge, and other BaaS partners, requesting cooperation in the CDD/EDD remediation effort, including provision of customer documentation and facilitation of customer outreach. These letters will be reviewed by Warren Ashby and Gregory Nardone prior to distribution.
VI. Article VI — Model Validation Deficiencies
Article VI.A — Findings
Article VI of the Consent Order addresses deficiencies in the independent validation of BRB's transaction monitoring model, which is a critical component of the Bank's BSA/AML compliance program.
Validation Gap. The OCC found that BRB's transaction monitoring model — the Veridian Analytics Inc. TMS platform, version 8.3, operating under Contract No. VA-BRB-2023-0044 — had not been independently validated since March 2021, a period of more than three years prior to the targeted examination. OCC supervisory guidance and industry best practice require that transaction monitoring models be independently validated on at least an annual basis, or more frequently if warranted by changes in the institution's risk profile, transaction volumes, customer base, or business lines. BRB's failure to validate the model for more than three years constitutes a significant departure from these standards.
Tuning Deficiency. In addition to the validation gap, the OCC found that the model's tuning parameters — the rules, scenarios, thresholds, and scoring algorithms that determine which transactions generate alerts — were last updated in October 2022, approximately two years prior to the examination. During the period since the last tuning update, BRB's BaaS operations expanded substantially, introducing new transaction patterns, customer demographics, and risk characteristics that were not reflected in the model's tuning parameters. As a result, the OCC raised concerns that the model was not effectively detecting suspicious activity, particularly across evolving BaaS transaction patterns.
Current Contract Terms. BRB's current annual contract value with Veridian Analytics is $4.1 million per year under a 3-year contract term that expires in December 2026.
Article VI.B — Compliance Obligations
Article VI imposes the following compliance obligations on BRB:
1. System Upgrade or Replacement. BRB shall upgrade or replace its transaction monitoring system to address the identified deficiencies, including both the validation gap and the tuning deficiency.
2. Independent Model Validation. BRB shall complete an independent model validation of the upgraded or replacement system. The validation must be performed by a qualified independent party with no conflicts of interest and must cover the model's conceptual soundness, data integrity, scenario coverage, threshold calibration, outcome analysis, and overall effectiveness.
3. Tuning Update and Periodic Validation. BRB shall update the model's tuning parameters to reflect current transaction patterns, customer demographics, and risk characteristics, including BaaS-specific patterns. BRB shall establish a periodic validation schedule requiring independent validation no less than annually, or more frequently as the institution's risk profile warrants.
4. Threshold Review Process. BRB shall establish above-the-line/below-the-line threshold review processes to ensure that thresholds are set at levels that appropriately balance detection effectiveness and operational feasibility. All threshold-setting decisions must be documented, including the rationale for each threshold, the data and analysis supporting the threshold level, and the approval of the BSA Officer and Chief Risk Officer.
Article VI.C — Deadlines
• August 1, 2025: Veridian TMS v.10.0 deployment — user acceptance testing ("UAT") must be complete by this date, with the upgraded system operational in BRB's production environment.
• October 1, 2025: Independent model validation of the upgraded transaction monitoring system must be complete by this date, with the validation report delivered to BRB management, the Compliance Committee, and the OCC.
Article VI.D — Responsible Parties at BRB
• Thomas Ikeda, BSA Officer / AML Program Director — Model governance and validation oversight, including coordination with the independent validation firm and oversight of tuning updates.
• Linda Petrosian, CIO/CTO — Technology implementation and UAT for the Veridian TMS v.10.0 upgrade, including infrastructure readiness, data migration, and system testing.
• Melissa Chu, Chief Risk Officer — Model risk management oversight, including review of validation methodology, threshold-setting rationale, and model governance framework.
• Derek Ballard, Head of Internal Audit — Independent testing of the model validation process and ongoing model governance to provide assurance to the Board and the Compliance Committee.
C&H Annotation
Remediation Workstream Correspondence. The compliance obligations in Article VI correspond to Remediation Workstream 4: Transaction Monitoring Model Validation & Tuning Plan, which is being developed by C&H in coordination with Thomas Ikeda, Linda Petrosian, and Melissa Chu.
Technology Costs. The Veridian TMS v.10.0 upgrade represents a significant technology investment: $2.8 million in one-time implementation fees plus $1.9 million per year in incremental licensing costs. Post-upgrade, BRB's annual contract value with Veridian will increase from $4.1 million to $6.0 million per year. These costs are shared with Workstream 1 (OFAC Sanctions Screening Remediation), as the v.10.0 upgrade addresses both the OFAC screening coverage gaps and the model validation/tuning deficiencies.
Timeline Risk. The implementation timeline for the Veridian upgrade is aggressive. The August 1, 2025 UAT deadline allows approximately five months from the date of this memorandum for the upgrade to be scoped, implemented, tested, and deployed. This timeline assumes that Veridian can mobilize its implementation team promptly, that BRB's internal IT resources are available for the integration work, and that no significant technical obstacles arise during implementation. C&H is preparing a Technology Implementation Timeline & Risk Assessment Memorandum that: (i) maps each Veridian upgrade milestone to the Consent Order deadlines; (ii) identifies key dependencies and risks (including resource constraints, data migration complexity, and BaaS partner API integration); and (iii) establishes specific contingency triggers — i.e., dates by which, if Veridian has not achieved specified milestones, BRB should pivot to the Ridgeline Data Systems platform as an alternative.
Contingency Vendor. Ridgeline Data Systems LLC (David Marchetti, Chief Revenue Officer; 500 West Monroe Street, Suite 2800, Chicago, IL 60661) has submitted a proposal to replace the Veridian platform entirely. Ridgeline's proposed annual contract value is $7.2 million per year for a 5-year term, representing a total contract value of $36.0 million. The Ridgeline platform offers native BaaS transaction monitoring and screening capabilities, which may reduce integration complexity relative to the Veridian upgrade. However, a full platform replacement would carry its own implementation risks and timeline challenges. The Ridgeline option is being evaluated as a contingency rather than a primary path at this stage, but the evaluation will be advanced in parallel with the Veridian upgrade to ensure that BRB has a viable alternative if the Veridian path encounters significant obstacles.
Model Validation. The independent model validation required by October 1, 2025 must be performed by a qualified independent party. C&H is coordinating with Thornfield Consulting Group LLC regarding the scope of the validation engagement, as Thornfield may be positioned to perform or oversee the validation as part of its broader independent consultant role under Article VII. However, care must be taken to ensure that the validation function remains independent of the remediation advisory function to satisfy OCC expectations regarding objectivity and independence.
VII. Article VII — Independent Consultant Engagement
Article VII.A — Requirements
Article VII of the Consent Order requires BRB to engage an independent consultant, acceptable to the OCC, to conduct a comprehensive assessment of BRB's BSA/AML and OFAC compliance program and to validate the Bank's remediation efforts.
Specifically, the Consent Order provides that:
1. BRB shall engage an independent consultant with demonstrated expertise in BSA/AML and OFAC compliance, risk management, and financial crimes prevention.
2. The engagement must be completed within 30 days of the Consent Order's Effective Date, i.e., by February 14, 2025.
3. Prior to engagement, BRB must submit the proposed consultant to the OCC for non-objection. The OCC retains the right to object to the proposed consultant and require BRB to select an alternative.
4. The independent consultant's mandate includes a comprehensive program assessment, identification of gaps and deficiencies, and validation of BRB's remediation actions.
Article VII.B — Compliance Actions Taken
BRB has complied with the independent consultant engagement requirement ahead of the February 14, 2025 deadline, as follows:
Consultant Selection. Thornfield Consulting Group LLC ("Thornfield") was selected as the independent consultant. The engagement is led by Dr. Vivian Castellano, Managing Director, Financial Crimes Advisory. Thornfield's offices are located at 200 Park Avenue South, 15th Floor, New York, NY 10003. The engagement is referenced as Thornfield Engagement Reference TCG-BRB-2025-001.
OCC Non-Objection. BRB submitted Thornfield's qualifications, proposed scope of work, and engagement terms to the OCC for non-objection. The OCC issued its non-objection to the Thornfield engagement on February 5, 2025.
Engagement Agreement. The Thornfield engagement agreement was executed on February 10, 2025 — four days prior to the February 14, 2025 deadline. The key commercial terms are as follows:
• Fixed fee: $6,500,000 for a 12-month engagement period (February 2025 through February 2026).
• Payment schedule: Monthly installments of $541,666.67.
• Expense cap: $400,000 for travel, materials, and other reasonable out-of-pocket expenses.
• Total engagement cost: $6,900,000 (fees plus expenses).
Thornfield Engagement Team. The Thornfield team assigned to the BRB engagement consists of:
• Dr. Vivian Castellano — Engagement Lead
• Robert Eastman — Senior Director, AML Transaction Monitoring
• Jennifer Hwang — Director, Sanctions & OFAC Compliance
• Nathaniel Burgess — Director, Fintech & Payments Compliance
Thornfield's Outside Counsel. Thornfield has engaged Hargrove & Stein PC (7 Times Square, 34th Floor, New York, NY 10036) as its outside counsel for the engagement.
Article VII.C — Key Deliverables and Deadlines
The Thornfield engagement includes the following key deliverables and deadlines:
• March 1, 2025: Thornfield commences on-site assessment at BRB headquarters (680 Lexington Avenue, New York, NY). The on-site assessment will include interviews with key personnel, review of policies and procedures, system demonstrations, and data analysis.
• April 15, 2025: Thornfield delivers its preliminary gap assessment, which will identify gaps and deficiencies in BRB's BSA/AML and OFAC compliance program and provide recommendations for remediation. The preliminary gap assessment will serve as a critical input to the Comprehensive Remediation Action Plan due to the OCC on May 15, 2025.
• February 15, 2026: Thornfield delivers its final validation report, confirming the status of BRB's remediation efforts and providing an independent assessment of whether the Bank has achieved compliance with the Consent Order's requirements. The final validation report will support BRB's compliance self-certification, which is also due on February 15, 2026.
Article VII.D — Responsible Parties at BRB