ATTORNEY-CLIENT PRIVILEGED AND CONFIDENTIAL — ATTORNEY WORK PRODUCT
This memorandum was prepared by Calderwood & Harkness LLP at the direction of and for the benefit of Belmont Ridge Bank National Association in anticipation of regulatory proceedings and in connection with the provision of legal advice. This document contains confidential attorney-client communications and constitutes attorney work product protected under Federal Rule of Civil Procedure 26(b)(3) and its state-law equivalents. Not for distribution without prior authorization from Calderwood & Harkness LLP.
CALDERWOOD & HARKNESS LLP 1285 Avenue of the Americas, 40th Floor New York, NY 10019
MEMORANDUM
C&H Matter No. 1045-00002
TO: Gregory Nardone, Esq. General Counsel & Corporate Secretary Belmont Ridge Bank National Association 680 Lexington Avenue, 22nd Floor New York, NY 10022
FROM: Philip Hartmann Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, NY 10019
CC:
Patricia Langston, Chief Compliance Officer, Belmont Ridge Bank NA Warren Ashby, Head of Fintech Partnerships / BaaS Division, Belmont Ridge Bank NA Thomas Ikeda, BSA Officer / AML Program Director, Belmont Ridge Bank NA Melissa Chu, Chief Risk Officer, Belmont Ridge Bank NA Yuki Nakamura, Lead Associate, Calderwood & Harkness LLP Carlos Espinoza, Working Associate, Calderwood & Harkness LLP
DATE: February 28, 2025
RE: Restructured BaaS Compliance Oversight Framework — Recommendations for Belmont Ridge Bank NA
Right-click to update Table of Contents
I. Executive Summary
Calderwood & Harkness LLP ("C&H") has prepared this memorandum to present our recommendations for a comprehensive, restructured framework governing Belmont Ridge Bank National Association's ("BRB" or the "Bank") oversight of all fourteen (14) active Banking-as-a-Service ("BaaS") fintech partners. This framework has been developed in direct response to OCC Consent Order No. OCC-2025-003 (the "Consent Order"), issued January 15, 2025, and is designed to be fully consistent with OCC third-party risk management guidance, including OCC Bulletin 2023-17, as well as applicable Bank Secrecy Act/Anti-Money Laundering ("BSA/AML") and Office of Foreign Assets Control ("OFAC") compliance requirements.
The Consent Order identified significant BSA/AML and OFAC compliance deficiencies that are substantially attributable to BRB's fintech BaaS channels. Among the most critical findings were: (i) OFAC sanctions screening gaps affecting approximately twelve percent (12%) of NovaPay Technologies Inc. wire and ACH transactions, representing approximately 3,800,000 of 31,700,000 total NovaPay transactions processed during calendar year ("CY") 2023 that were not screened against the Specially Designated Nationals and blocked Persons List; (ii) Customer Due Diligence ("CDD") and Enhanced Due Diligence ("EDD") failures across approximately 47,000 high-risk accounts, the majority of which were onboarded through fintech partner platforms; and (iii) a disproportionate share of Suspicious Activity Report ("SAR") activity originating from BaaS channels, with 2,108 of 3,847 total SARs filed in CY 2024 — representing 54.8% of all SAR filings — attributable to BaaS-related activity. These findings, individually and collectively, represent serious compliance deficiencies that demand immediate and sustained remediation.
BaaS constitutes a material revenue line for BRB and its holding company, Belmont Ridge Financial Group, Inc. ("BRFG"). In CY 2024, BRB's BaaS division generated $127.4 million in total revenue — comprising interchange fees, program management fees, and interest income — across $74.3 billion in total BaaS transaction volume processed through the Bank's fourteen active fintech partners. The financial significance of this business line underscores both the urgency and the complexity of the compliance remediation effort: BRB must achieve full regulatory compliance while maintaining the commercial viability of its fintech partnerships.
This memorandum establishes the architecture for a risk-based partner tiering model, enhanced ongoing monitoring obligations differentiated by risk tier, a comprehensive compliance testing program, escalation and termination protocols for non-compliant partners, contractual framework enhancements, and governance reporting mechanisms designed to ensure adequate Board-level visibility into BaaS compliance performance. The framework is designed to satisfy the specific requirements of the Consent Order and to mitigate future regulatory risk across BRB's BaaS operations.
The recommendations contained herein should be read alongside several related C&H deliverables that together constitute the BaaS compliance component of BRB's broader remediation effort. These related deliverables include: (a) the BaaS Partner CDD/EDD Responsibility Matrix; (b) the Revised BaaS Program Agreement Template Compliance Addendum; (c) individual compliance remediation letters to key partners, specifically NovaPay Technologies Inc. and FairLend Digital LLC; and (d) the BaaS Partner BSA/AML Risk Assessment Template. Collectively, these deliverables provide the operational detail necessary to implement the framework described in this memorandum.
C&H's recommendations are informed by our review of the Consent Order, BRB's existing BaaS program agreements and compliance policies, the September 2024 independent BSA/AML test conducted by Caldera & Pope LLP, BRB's internal audit reports, OCC examination correspondence, and extensive discussions with BRB's senior management team and relevant business unit leaders. We have also considered prevailing industry practices among peer institutions operating BaaS programs and the trajectory of regulatory expectations in this rapidly evolving area.
II. Background and Regulatory Context
A. BRB's BaaS Business Model
Belmont Ridge Bank National Association operates a Banking-as-a-Service division within its broader banking operations. The BaaS division is led by Warren Ashby, Senior Vice President and Head of Fintech Partnerships / BaaS Division, and is responsible for managing the Bank's relationships with fintech companies that leverage BRB's national bank charter to offer financial products and services to their end users.
As of the date of this memorandum, fourteen (14) active fintech sponsors operate through BRB's national bank charter (OCC Charter No. 48271). These partners utilize BRB's charter authority for a range of financial products and services, including deposit products (demand deposit accounts, savings accounts, certificates of deposit), payment processing (ACH origination and receipt, wire transfers, card-based transactions, peer-to-peer transfers), consumer and small-business lending (installment loans, lines of credit, merchant cash advances), and neobanking services (full-service digital banking platforms). BRB remains the chartered institution and retains ultimate regulatory responsibility for all activities conducted through its charter, regardless of the degree to which operational functions have been delegated to or performed by fintech partners. This principle is foundational to the framework set forth in this memorandum and must be reinforced throughout BRB's compliance infrastructure.
The following three partners represent the largest share of BRB's BaaS activity by transaction volume and merit particular attention in the context of the compliance oversight framework:
NovaPay Technologies Inc. NovaPay Technologies Inc. is a Delaware corporation (CEO: Ethan Garrison) headquartered at 450 Mission Street, Suite 1200, San Francisco, California 94105. NovaPay operates a consumer payments and peer-to-peer ("P2P") transfer application, offering its end users the ability to send and receive money, make purchases, and maintain stored-value balances through accounts held at BRB. NovaPay maintains approximately 2.1 million end-user accounts at BRB and was originally onboarded as a BaaS partner in 2021. In CY 2024, NovaPay accounted for approximately 41% of total BaaS transaction volume, representing approximately $30.5 billion in processed transactions. NovaPay is the BaaS partner most directly implicated by the Consent Order's findings, particularly with respect to the OFAC screening gap affecting approximately 3,800,000 of its wire and ACH transactions during CY 2023. NovaPay is also the highest contributor to BaaS-related SAR activity.
FairLend Digital LLC. FairLend Digital LLC is a Delaware limited liability company (CEO: Aisha Okonkwo) headquartered at 100 Summer Street, Suite 800, Boston, Massachusetts 02110. FairLend operates an online small-business lending platform through which it originates loans using BRB's charter. In fiscal year 2024, FairLend originated approximately $1.4 billion in loans through BRB, serving small and medium-sized businesses across thirty-eight states. FairLend was onboarded as a BaaS partner in 2022 and accounts for approximately 28% of total BaaS transaction volume. FairLend's lending activities present elevated BSA/AML risk due to the inherent risk characteristics of small-business lending, including the potential for loan stacking, identity fraud, and misrepresentation of business purpose.
VaultEdge Inc. VaultEdge Inc. is a Delaware corporation (CEO: Marcus Tan) headquartered at 2200 Ross Avenue, Suite 3600, Dallas, Texas 75201. VaultEdge operates a digital savings and neobanking platform offering high-yield savings accounts, goal-based savings products, and basic checking functionality. VaultEdge maintains approximately 870,000 deposit accounts at BRB and was onboarded as a BaaS partner in 2023. VaultEdge accounts for approximately 18% of total BaaS transaction volume. While VaultEdge has not been the subject of specific Consent Order findings, its large consumer-facing deposit base and rapid growth since onboarding warrant enhanced attention.
The remaining eleven BaaS partners collectively represent approximately 13% of total BaaS transaction volume. These partners offer a range of products including payroll services, expense management, earned wage access, prepaid card programs, and specialized deposit products. Each of these partners will be individually assessed using the BaaS Partner BSA/AML Risk Assessment Template as part of the framework implementation.
BRB's CY 2024 BaaS financial metrics are summarized as follows:
These figures illustrate the scale and materiality of BRB's BaaS operations and underscore the imperative for a robust compliance oversight framework. The concentration of SAR activity in BaaS channels — with over half of all SARs originating from fintech partner activity — is particularly noteworthy and was a central focus of the OCC's examination findings.
B. OCC Consent Order Findings Relevant to BaaS Oversight
Consent Order No. OCC-2025-003, effective January 15, 2025, was issued by the Office of the Comptroller of the Currency, Northeastern District Office, located at 340 Madison Avenue, New York, New York 10017 (Examiner-in-Charge: Jonathan Frey). The Consent Order was the culmination of a supervisory process that included targeted BSA/AML examinations conducted during CY 2023 and CY 2024, as well as BRB's failure to adequately remediate prior supervisory actions, specifically a June 2022 Matter Requiring Attention ("MRA") regarding BSA/AML transaction monitoring deficiencies and a November 2023 Matter Requiring Immediate Attention ("MRIA") regarding OFAC screening gaps.
The Consent Order cited the following deficiencies that directly implicate BaaS channel oversight and are relevant to the framework set forth in this memorandum:
1. OFAC Sanctions Screening Failures. The OCC found that BRB's OFAC screening system failed to screen one hundred percent (100%) of transactions processed through fintech BaaS channels against the SDN List and other OFAC sanctions lists. The most significant gap was identified in NovaPay's wire and ACH transaction flows, where approximately twelve percent (12%) of transactions — approximately 3,800,000 out of 31,700,000 total NovaPay transactions processed during CY 2023 — went entirely unscreened. The screening gap was attributed to a combination of system configuration errors in BRB's transaction monitoring system (Veridian TMS v.8.3), incomplete API integration between NovaPay's payment processing platform and BRB's OFAC screening module, and inadequate validation testing at the time of integration. The OCC characterized this deficiency as posing an unacceptable risk of sanctions evasion and potential violation of 31 C.F.R. Part 501.
2. CDD/EDD Failures. The OCC found that approximately 47,000 high-risk customer accounts lacked adequate Customer Due Diligence or Enhanced Due Diligence documentation as required by the CDD Rule (31 C.F.R. § 1020.220) and BRB's own CDD/EDD policies. The majority of these accounts were onboarded through fintech partner platforms, where the delegation of customer identification and due diligence functions was not accompanied by adequate BRB oversight, quality assurance testing, or independent verification. The deficiency was particularly acute for accounts onboarded through NovaPay and FairLend Digital, where high customer acquisition volumes outpaced BRB's capacity to monitor the adequacy of partner-performed CDD processes.
3. SAR Filing Deficiencies. The OCC found that as of September 2024, a backlog of approximately 2,400 potentially suspicious activity alerts remained unreviewed in BRB's transaction monitoring queue. The backlog was attributed to inadequate staffing in BRB's BSA/AML department, which at the time consisted of 62 full-time equivalents ("FTEs"), as well as the high volume of alerts generated by BaaS transaction activity without corresponding BaaS-specific investigative expertise. BaaS-related SARs constituted a majority of BRB's overall SAR activity in CY 2024, reflecting the inherent risk concentration in the BaaS channel.
4. Board Oversight Deficiencies. The OCC found that BRB's Board of Directors did not receive key BaaS-specific compliance metrics necessary to fulfill its oversight responsibilities. Specifically, the Board was not provided with partner-level data on SAR volumes, OFAC screening hit rates, risk ratings, escalation actions, or compliance testing results disaggregated by BaaS partner. Board-level BSA/AML reporting was provided on a quarterly basis and consisted primarily of aggregate statistics that did not distinguish between BaaS and non-BaaS activity. The OCC determined that this reporting was insufficient to enable the Board to assess the Bank's compliance risk profile associated with its BaaS operations.
The Consent Order also references BRB's failure to adequately remediate prior supervisory actions. The June 2022 MRA regarding BSA/AML transaction monitoring identified deficiencies in alert disposition practices and model validation procedures. The November 2023 MRIA regarding OFAC screening gaps specifically flagged incomplete screening coverage for certain BaaS transaction flows and required immediate remediation. BRB's response to the MRIA was determined by the OCC to be inadequate, contributing to the decision to escalate to formal enforcement action.
C. Regulatory Guidance Framework
The BaaS Compliance Oversight Framework set forth in this memorandum is grounded in and designed to satisfy the requirements of the following regulatory guidance:
OCC Third-Party Risk Management Guidance. OCC Bulletin 2013-29, as updated and superseded by OCC Bulletin 2023-17, "Third-Party Relationships: Risk Management Guidance" (issued jointly with the Federal Reserve Board and the FDIC), establishes the OCC's expectations for risk management throughout the lifecycle of third-party relationships. The guidance applies heightened expectations to relationships involving "critical activities," defined as activities that could cause a bank to face significant risk if the third party fails to meet expectations, could have significant customer impacts, or require significant investment in resources to implement the third-party relationship and manage the risk. The guidance addresses planning, due diligence, contract negotiation, ongoing monitoring, and termination.
BRB's BaaS relationships unambiguously constitute "critical activities" under this guidance. Each BaaS partner relationship involves (a) significant bank functions — including deposit-taking, lending, and payment processing — performed by or facilitated through a third party; (b) activities that could cause BRB to face significant regulatory, financial, and reputational risk if the fintech partner fails to meet compliance expectations; and (c) activities that have significant impacts on a large number of consumer and business customers who access banking services through the partner's platform. Accordingly, BRB must apply the full range of heightened risk management practices described in OCC Bulletin 2023-17 to its BaaS relationships, including comprehensive due diligence, detailed contractual provisions, robust ongoing monitoring, and defined escalation and termination procedures.
FinCEN Guidance on BSA/AML Obligations in Bank-Fintech Relationships. FinCEN has consistently emphasized that banks retain full BSA/AML compliance responsibility for activities conducted through their charters, regardless of whether operational functions have been delegated to fintech partners or other third parties. BRB is the reporting entity for purposes of SAR and Currency Transaction Report ("CTR") filing obligations, and BRB bears the responsibility for implementing and maintaining an effective BSA/AML compliance program that covers all activity conducted through its charter, including activity originated, processed, or facilitated by BaaS partners. While fintech partners may be contractually required to implement first-line AML controls — such as customer identification procedures, transaction monitoring, and suspicious activity escalation — BRB cannot delegate its ultimate compliance responsibility and must maintain oversight sufficient to ensure that partner-performed functions meet regulatory standards.
OFAC Compliance Obligations. BRB is the sanctioned party for OFAC screening purposes with respect to all transactions processed through its charter. Fintech partners that utilize BRB's charter for payment processing, fund transfers, or account maintenance do not independently bear OFAC compliance obligations under the sanctions framework; rather, BRB bears the obligation to screen all transactions against OFAC sanctions lists and to block or reject transactions involving sanctioned persons, entities, or jurisdictions. This obligation is non-delegable. While BRB may implement its OFAC screening function through technology systems that interface with partner platforms, the responsibility for ensuring complete and accurate screening resides with BRB. The OFAC screening gap identified in the Consent Order — affecting approximately 3,800,000 NovaPay transactions — represents a direct failure of this non-delegable obligation.
III. Current-State Assessment: Deficiencies in BaaS Compliance Oversight
Based on C&H's review of BRB's existing compliance infrastructure, internal audit reports, the September 2024 Caldera & Pope independent BSA/AML test, OCC examination correspondence, and interviews with BRB management, we have identified the following categories of deficiencies in BRB's current BaaS compliance oversight. This assessment has informed the recommendations set forth in Section IV of this memorandum.
A. Structural and Organizational Gaps
The BaaS Division, operating under Warren Ashby's leadership, has developed and managed fintech partnerships primarily as a commercial business function, with insufficient integration of compliance oversight into its day-to-day operations. Compliance oversight of BaaS partners has been primarily reactive — triggered by specific incidents, examination findings, or escalations — rather than proactive and systematic. The BaaS Division has historically treated fintech partners as commercial clients to be serviced and managed for revenue growth, rather than as extensions of BRB's regulatory perimeter that require continuous compliance monitoring and oversight.
There is no dedicated compliance liaison or embedded compliance officer within the BaaS Division. The BaaS Division's organizational structure includes relationship managers, technology integration specialists, and business development personnel, but does not include any compliance-focused roles. As a result, compliance considerations have often been addressed on an ad hoc basis, with relationship managers serving as the primary interface between BaaS partners and BRB's compliance function — a structure that creates inherent conflicts between commercial objectives and compliance priorities.
BRB's BSA/AML department, which currently comprises 62 FTEs under the direction of Thomas Ikeda, BSA Officer and AML Program Director, lacks specialized BaaS compliance analysts. The department's analysts process transaction monitoring alerts, conduct SAR investigations, and perform CDD/EDD reviews across all of BRB's business lines without differentiation between BaaS and non-BaaS activity. There are no analysts with specialized expertise in fintech transaction patterns, P2P payment typologies, or the unique BSA/AML risks associated with BaaS relationships. This lack of specialization has contributed to the department's inability to effectively monitor and investigate the high volume of BaaS-related suspicious activity, which constitutes over half of BRB's total SAR filings.
The absence of a formal governance body responsible for BaaS compliance oversight has meant that compliance issues arising from BaaS partnerships have been addressed in an uncoordinated manner across multiple functions — legal, compliance, risk, and the BaaS Division itself — without a single point of accountability or a structured process for decision-making, escalation, and reporting.
B. Contractual and Governance Gaps
C&H's review of BRB's existing BaaS program agreements has identified significant deficiencies in the contractual framework governing compliance obligations. The current agreements, which were drafted at the time of each partner's onboarding and have not been materially updated, lack comprehensive BSA/AML and OFAC compliance addenda, specific audit rights provisions related to compliance functions, detailed data-sharing obligations necessary for BRB to perform its compliance functions, and termination triggers tied to compliance failures. In many cases, the compliance provisions in existing agreements consist of general representations and warranties regarding legal compliance, without operational specificity regarding the allocation of CDD/EDD responsibilities, SAR investigation cooperation, OFAC screening requirements, or remediation obligations.
There is no standardized compliance risk assessment methodology applied uniformly across all fourteen BaaS partners. Individual partners were assessed at the time of onboarding through a due diligence process that focused primarily on financial viability, technical capabilities, and market potential, with limited attention to BSA/AML and OFAC risk characteristics. No ongoing compliance risk assessment process has been established, and no formal reassessment has been conducted for any partner since onboarding.
BRB has not implemented a formal risk tiering system for its BaaS partners based on AML/sanctions risk profiles. All partners have been treated equivalently for compliance monitoring purposes, regardless of significant differences in transaction volumes, product types, customer risk profiles, and identified compliance concerns. This one-size-fits-all approach is inconsistent with regulatory expectations for risk-based compliance programs and has resulted in insufficient attention to the highest-risk partnerships.
C. Monitoring and Testing Gaps
BRB's ongoing monitoring of partner compliance with BSA/AML obligations has been insufficient in both scope and frequency. Monitoring has consisted primarily of periodic reviews of partner-provided reports, which are submitted on varying schedules and in inconsistent formats, without independent verification or validation by BRB compliance personnel. BRB has not established minimum monitoring standards, reporting templates, or performance benchmarks for its BaaS partners.
The OFAC screening integration was incomplete for certain BaaS transaction flows. Most critically, a configuration error in the API integration between NovaPay's payment processing platform and BRB's Veridian TMS v.8.3 OFAC screening module resulted in approximately 12% of NovaPay wire and ACH transactions bypassing OFAC screening entirely during CY 2023. This error was not detected through internal monitoring or testing and was identified during the OCC's targeted examination. The failure to detect this screening gap over an extended period reflects both a system configuration deficiency and a monitoring deficiency — BRB had no process in place to validate that 100% of BaaS transaction flows were being screened.
BRB's transaction monitoring model (Veridian TMS v.8.3) was last validated in March 2021 and last tuned in October 2022. The model was not calibrated specifically for BaaS transaction patterns, which differ materially from traditional banking activity in terms of transaction velocity, average transaction size, customer demographics, and typologies of suspicious activity. The lack of BaaS-specific rule sets and thresholds has contributed to both over-alerting (generating a high volume of false-positive alerts that strain investigative resources) and under-alerting (failing to detect suspicious patterns unique to fintech transaction flows).
The September 2024 independent BSA/AML test conducted by Caldera & Pope LLP (311 South Wacker Drive, Suite 5400, Chicago, Illinois 60606; engagement partner: Franklin Dorsey) identified multiple deficiencies in BaaS compliance oversight that were subsequently echoed in the Consent Order. Caldera & Pope's findings included: (i) inadequate OFAC screening coverage for BaaS transaction flows; (ii) insufficient CDD/EDD documentation for BaaS-onboarded accounts; (iii) absence of BaaS-specific transaction monitoring rules; and (iv) inadequate Board-level reporting on BaaS compliance metrics. BRB's response to the Caldera & Pope findings was incomplete at the time the Consent Order was issued.
D. Reporting and Escalation Gaps
Board-level BSA/AML reporting was provided on a quarterly basis and did not include partner-level metrics. The Board received aggregate BSA/AML statistics — including total SARs filed, total OFAC screening hits, and general compliance program updates — but was not provided with BaaS-specific data or partner-disaggregated information. Key metrics that should have been reported to the Board, including SAR volumes by BaaS partner, OFAC screening hit rates by partner, risk ratings by BaaS partner, escalation actions, and compliance testing results specific to BaaS relationships, were not included in Board reporting packages. This gap was specifically cited in the Consent Order and represents a governance failure that must be addressed as a priority.
No formal escalation protocol existed for partner compliance failures. When compliance deficiencies were identified in connection with specific BaaS partners, there was no defined process for escalating concerns, requiring corrective action, imposing enhanced monitoring, or initiating termination proceedings. Compliance deficiencies were addressed informally through conversations between relationship managers and partner contacts, without formal documentation, tracking, or follow-up. There were no defined termination triggers tied to compliance performance, leaving the decision to terminate a BaaS relationship entirely within the commercial discretion of the BaaS Division.
IV. Recommended BaaS Compliance Oversight Framework
Based on the current-state assessment described in Section III and the regulatory requirements established by the Consent Order and applicable regulatory guidance, C&H recommends the following comprehensive BaaS Compliance Oversight Framework. The framework is organized into nine components, each addressing a specific dimension of BaaS compliance oversight.
A. Governance Structure and Organizational Changes
1. BaaS Compliance Oversight Committee
C&H recommends the establishment of an internal BaaS Compliance Oversight Committee (the "BCOC") as the primary governance body responsible for overseeing BRB's compliance with BSA/AML, OFAC, and other regulatory requirements across all BaaS partner relationships. The BCOC should be established as a standing management committee with cross-functional membership to ensure that compliance oversight is coordinated across the relevant business and control functions.
The BCOC should be composed of the following members:
• Warren Ashby, Senior Vice President, Head of Fintech Partnerships / BaaS Division
• Patricia Langston, Chief Compliance Officer
• Thomas Ikeda, BSA Officer / AML Program Director
• Melissa Chu, Chief Risk Officer
• A designee from Linda Petrosian's IT/Technology team (at minimum, a Director-level or above representative with knowledge of BaaS technology integrations and transaction processing systems)
Patricia Langston, as CCO, should serve as the BCOC Chair, reflecting the compliance-focused mandate of the committee. The BCOC should have the authority to make recommendations to senior management and the Board regarding BaaS partner compliance matters, including risk tier assignments, escalation actions, remediation requirements, and termination recommendations.
During the remediation period — defined as the period from the establishment of the BCOC through February 15, 2026 (the date for BRB's self-certification of compliance to the OCC) — the BCOC should meet on a monthly basis. Following the completion of the remediation period, the BCOC should meet at least quarterly, with the option to convene additional meetings as circumstances require.
The BCOC should report directly to two Board-level committees: (a) the newly established Board Compliance Committee, chaired by James Rutherford, which has been designated under the Consent Order as the primary Board-level body responsible for overseeing BRB's compliance remediation efforts; and (b) the Risk Committee, chaired by Arthur Connelly, which is responsible for overseeing BRB's enterprise risk management framework. Written minutes of each BCOC meeting should be prepared and maintained, and a summary report should be provided to the Board Compliance Committee and the Risk Committee following each meeting.
2. Dedicated BaaS Compliance Function
C&H recommends the creation of a dedicated BaaS Compliance Unit within the BSA/AML department. This unit should be staffed with compliance analysts who possess specialized expertise in fintech transaction patterns, BaaS regulatory requirements, and the unique BSA/AML risks associated with bank-fintech partnerships. The BaaS Compliance Unit should be responsible for the day-to-day execution of the BaaS compliance monitoring, testing, and reporting functions described in this framework.
BRB has committed, as part of its remediation efforts, to increasing the BSA/AML department's headcount from 62 to 77 FTEs through fifteen (15) new permanent hires. C&H recommends that a minimum of five (5) of these fifteen new permanent FTE positions be dedicated to the BaaS Compliance Unit. At current market compensation levels for experienced BSA/AML compliance analysts with fintech expertise, the fully loaded cost of these five positions is estimated at approximately $750,000 annually (an average of $150,000 per FTE, inclusive of salary, benefits, and overhead), representing a proportionate share of the $2,250,000 total annual cost for all fifteen new hires.
During the remediation period, BRB has engaged Pinnacle Compliance Solutions LLC (90 Broad Street, 20th Floor, New York, New York 10004; contact: Andrea Solis) to provide thirty (30) temporary FTEs to supplement BRB's compliance workforce. C&H recommends that a minimum of eight (8) to ten (10) of these temporary Pinnacle FTEs be assigned to BaaS-related remediation work, including clearance of the BaaS-related portion of the 2,400-alert SAR backlog, CDD/EDD remediation for BaaS-onboarded accounts within the 47,000-account remediation target, and initial implementation of the ongoing monitoring and testing programs described in this framework.
The BaaS Compliance Unit should be led by a senior manager (at minimum, a Vice President-level BSA/AML professional) with direct reporting responsibility to Thomas Ikeda, BSA Officer and AML Program Director. The unit leader should also serve as the primary compliance liaison to the BCOC and should be responsible for preparing the monthly BaaS compliance dashboard described in Section V of this memorandum.
3. Compliance Liaison Embedded in BaaS Division
To address the organizational disconnect between the BaaS Division and BRB's compliance function, C&H recommends that a senior compliance officer — at minimum a Vice President-level professional — be assigned as an embedded compliance liaison within the BaaS Division. This individual should maintain a dual reporting line to Warren Ashby (BaaS Division head) and Patricia Langston (CCO).
The embedded compliance liaison should serve as the day-to-day compliance resource for the BaaS Division, participating in partner relationship management activities, reviewing proposed new partner onboardings from a compliance perspective, advising relationship managers on compliance requirements, and serving as the primary point of escalation for compliance concerns identified by BaaS Division personnel. The embedded liaison should also serve as a conduit for information flow between the BaaS Division and the BaaS Compliance Unit, ensuring that compliance-relevant information from partner interactions is communicated to the compliance monitoring and testing functions in a timely manner.
This dual-reporting structure is designed to ensure that the embedded compliance liaison maintains independence from the BaaS Division's commercial objectives while having sufficient proximity to the business to provide effective real-time compliance guidance. The CCO should have ultimate authority over the embedded liaison's compliance determinations, and the liaison's performance evaluation should give significant weight to compliance effectiveness, not solely to business facilitation.
B. Risk-Based Partner Tiering Model
1. Tiering Methodology
C&H recommends the establishment of a three-tier risk classification system for all fourteen BaaS partners. The tiering model is designed to differentiate BRB's compliance oversight intensity based on each partner's inherent risk profile, enabling the Bank to allocate its finite compliance resources most effectively and to satisfy regulatory expectations for a risk-based approach to third-party oversight.
The three tiers and their associated criteria are as follows:
Tier 1 — High Risk. Tier 1 designation is reserved for partners presenting the highest level of BSA/AML and sanctions risk. A partner should be classified as Tier 1 if it meets any of the following criteria:
(a) Annual transaction volume exceeding $10 billion;
(b) Attribution of more than 15% of total BaaS-related SARs in the preceding calendar year;
(c) Identified OFAC, BSA/AML, or other compliance deficiency, whether discovered through BRB internal monitoring, independent testing, regulatory examination, or partner self-disclosure; or
(d) Other factors, as determined by the BCOC, that indicate elevated BSA/AML or sanctions risk, including but not limited to rapid customer acquisition, high-risk product characteristics, geographic concentration in high-risk jurisdictions, or adverse media or law enforcement inquiries.
Tier 1 partners are subject to the enhanced monitoring requirements set forth in Section IV.C.1.
Tier 2 — Medium Risk. Tier 2 designation applies to partners with moderate transaction volumes and no identified compliance deficiencies, but with inherent risk characteristics that warrant enhanced attention. A partner should be classified as Tier 2 if it meets any of the following criteria without also meeting any Tier 1 criterion:
(a) Annual transaction volume between $1 billion and $10 billion; or
(b) Consumer-facing products with significant end-user volume (e.g., deposit accounts, payment services, or lending products offered directly to individual consumers or small businesses).
Tier 2 partners are subject to the standard enhanced monitoring requirements set forth in Section IV.C.2.
Tier 3 — Low Risk. Tier 3 designation applies to partners with lower transaction volumes, limited product scope, and no identified compliance concerns. A partner should be classified as Tier 3 if it meets all of the following criteria:
(a) Annual transaction volume below $1 billion; and
(b) No consumer-facing deposit or payment products (i.e., the partner's product offering is limited to business-to-business services, specialized financial products, or other offerings with a limited customer base and lower inherent BSA/AML risk).
Tier 3 partners are subject to the baseline monitoring requirements set forth in Section IV.C.3.
It is important to emphasize that the tiering methodology is risk-based, not volume-based alone. A partner with relatively low transaction volume could be classified as Tier 1 if identified compliance deficiencies or other risk factors warrant heightened oversight. Similarly, a partner with high transaction volume could potentially be classified as Tier 2 rather than Tier 1 if its risk characteristics are otherwise moderate and no compliance deficiencies have been identified, though in practice, high volume alone will typically support a Tier 1 classification.
2. Current Tier Assignments (Preliminary)
Based on available data and C&H's preliminary assessment, the following tier assignments are recommended for BRB's BaaS partners. These assignments are preliminary and should be confirmed by the BCOC following the completion of individual risk assessments using the BaaS Partner BSA/AML Risk Assessment Template.
Tier 1 — High Risk:
NovaPay Technologies Inc. — NovaPay meets multiple Tier 1 criteria: (a) $30.5 billion in CY 2024 transaction volume (41% of total BaaS volume), far exceeding the $10 billion threshold; (b) approximately 2.1 million end-user accounts representing a large consumer-facing footprint; (c) identified OFAC screening gap affecting approximately 3,800,000 transactions in CY 2023, constituting a significant compliance deficiency; and (d) highest BaaS-related SAR contributor in CY 2024. NovaPay's Tier 1 designation is unambiguous and should be maintained until the BCOC determines, based on sustained compliance performance, that a reclassification is warranted.
FairLend Digital LLC — FairLend meets Tier 1 criteria based on: (a) 28% of total BaaS transaction volume, placing it well above the $10 billion threshold; and (b) elevated BSA/AML risk inherent in small-business lending products, including risks associated with loan stacking, identity fraud, straw borrowers, and misrepresentation of business purpose. Additionally, FairLend's $1.4 billion in loan originations through BRB represents a significant credit risk as well as BSA/AML risk concentration.
Tier 2 — Medium Risk:
VaultEdge Inc. — VaultEdge meets Tier 2 criteria based on: (a) 18% of total BaaS transaction volume, placing it within or near the $1 billion–$10 billion range; and (b) consumer-facing neobanking platform with approximately 870,000 deposit accounts. VaultEdge has not been the subject of specific Consent Order findings and does not currently meet any Tier 1 criteria, though its rapid growth since onboarding in 2023 warrants close monitoring for potential reclassification.
Additional partners are to be assessed using the BaaS Partner BSA/AML Risk Assessment Template. Any partner meeting Tier 2 criteria will be classified accordingly.
Tier 3 — Low Risk:
The remaining partners collectively represent approximately 13% of BaaS transaction volume. Each will be individually assessed using the BaaS Partner BSA/AML Risk Assessment Template to confirm Tier 3 classification. Partners meeting any Tier 1 or Tier 2 criterion will be reclassified accordingly.
A comprehensive summary of all fourteen partners and their preliminary tier assignments is provided in Appendix A.
3. Reassessment Frequency
Tier assignments should be reassessed on a regular schedule and on an ad hoc basis as circumstances warrant:
(a) Quarterly reassessment: The BCOC should review tier assignments for all fourteen partners at each quarterly meeting (or monthly meeting during the remediation period), considering updated transaction volume data, SAR activity, OFAC screening metrics, compliance testing results, and any new compliance findings or concerns.
(b) Annual Board-level review: The Board Compliance Committee should review and approve the tier assignments for all fourteen partners on an annual basis, informed by the BCOC's recommendations and the results of annual risk assessments.
(c) Ad hoc reassessment: A tier reassessment should be triggered by any of the following events: (i) a material change in a partner's transaction volume, product offerings, or customer base; (ii) identification of a new compliance deficiency through monitoring, testing, or regulatory examination; (iii) adverse media, law enforcement inquiry, or regulatory action involving a partner; (iv) a change in applicable regulatory requirements or guidance affecting the risk profile of a partner's activities; or (v) a partner's acquisition, merger, or material change in ownership or management.
C. Ongoing Monitoring Requirements (Differentiated by Tier)
The ongoing monitoring program should be differentiated by risk tier, with the intensity and frequency of monitoring increasing with the partner's risk classification. The monitoring requirements set forth below represent minimum standards; the BCOC may impose additional monitoring requirements on any partner based on specific risk factors or circumstances.
1. Tier 1 (High Risk) Partners — Enhanced Monitoring
Tier 1 partners are subject to the following enhanced monitoring requirements:
Monthly Compliance Reporting. Each Tier 1 partner must provide monthly compliance reports to BRB, delivered no later than the fifteenth (15th) calendar day of the following month. The monthly report must include, at minimum: (a) total transaction volumes (by transaction type: wire, ACH, card, P2P); (b) new customer onboarding statistics (number of new accounts opened, number of applications rejected, rejection reasons); (c) customer complaint volumes and categories; (d) fraud metrics (fraud losses, fraud attempts detected, account takeover incidents); (e) cooperation with BRB's SAR investigation requests (number of requests received, number of responses provided within required timeframes, any outstanding requests); and (f) any material changes to the partner's operations, technology platform, ownership, management, or regulatory status.
Real-Time OFAC Screening. All transaction flows originating from or processed through Tier 1 partner platforms — including wire transfers, ACH transactions, card transactions, and P2P transfers — must be subject to real-time OFAC sanctions screening. No batch-only screening is permitted for Tier 1 partner transaction flows. Real-time screening requires that each transaction be screened against the SDN List and other applicable OFAC sanctions lists prior to processing, with automated interdiction of potential matches pending manual review and disposition. This requirement applies regardless of transaction value or transaction type.
Quarterly Compliance Reviews. BRB's BaaS Compliance Unit must conduct quarterly compliance reviews of each Tier 1 partner, either on-site at the partner's premises or through a virtual review process, as determined by the BCOC. The quarterly review should assess the partner's compliance with its contractual BSA/AML and OFAC obligations, the adequacy of the partner's first-line AML controls, the accuracy and completeness of the partner's monthly compliance reports, and any compliance concerns identified since the prior review. A written report of each quarterly review should be prepared and provided to the BCOC.
Semi-Annual Deep-Dive Risk Assessments. Each Tier 1 partner should be the subject of a semi-annual deep-dive risk assessment using the BaaS Partner BSA/AML Risk Assessment Template. The risk assessment should evaluate the partner's inherent BSA/AML risk profile, the adequacy of the partner's risk mitigation controls, the partner's compliance history and track record, and any changes in the partner's risk profile since the prior assessment. The results of each risk assessment should inform the BCOC's tier assignment review and should be reported to the Board Compliance Committee.
Dedicated BRB Compliance Analyst. A dedicated BRB compliance analyst should be assigned as the primary compliance contact for each Tier 1 partner. This analyst should be responsible for reviewing the partner's monthly compliance reports, coordinating quarterly compliance reviews, monitoring SAR activity attributable to the partner, and serving as the point of escalation for compliance concerns related to the partner. The dedicated analyst should be a member of the BaaS Compliance Unit and should report to the unit leader.
Enhanced CDD/EDD Requirements. Customers onboarded through Tier 1 partners are subject to enhanced CDD/EDD requirements. In addition to the CDD/EDD functions performed by the partner at the point of onboarding, BRB must perform independent verification of CDD information on a statistically significant sample of newly onboarded customers. The sample size and methodology should be determined by the BaaS Compliance Unit in consultation with the BCOC, but should be sufficient to provide a reasonable basis for assessing the adequacy of the partner's CDD/EDD processes. At minimum, a random sample of no less than five percent (5%) of new accounts opened through each Tier 1 partner in each month should be subject to independent BRB verification.
Monthly BCOC Reporting. The BaaS Compliance Unit must provide a monthly report to the BCOC on each Tier 1 partner's compliance status. This report should summarize the results of ongoing monitoring activities, highlight any compliance concerns or deficiencies identified, and recommend any escalation or remediation actions.
2. Tier 2 (Medium Risk) Partners — Standard Enhanced Monitoring
Tier 2 partners are subject to the following standard enhanced monitoring requirements:
Quarterly Compliance Reporting. Each Tier 2 partner must provide quarterly compliance reports to BRB, delivered no later than thirty (30) calendar days after the end of each calendar quarter. The report should cover the same categories as the Tier 1 monthly report but on a quarterly aggregated basis.
Real-Time OFAC Screening. All transaction flows originating from or processed through Tier 2 partner platforms must be subject to real-time or daily OFAC sanctions screening. Real-time interdiction is preferred; daily batch screening may be acceptable only for low-value ACH transactions within defined thresholds approved by the BCOC, provided that all wire transfers and card transactions are screened in real time.
Semi-Annual Compliance Reviews. BRB's BaaS Compliance Unit must conduct semi-annual compliance reviews of each Tier 2 partner, either on-site or virtual.
Annual Deep-Dive Risk Assessments. Each Tier 2 partner should be the subject of an annual deep-dive risk assessment using the BaaS Partner BSA/AML Risk Assessment Template.
Quarterly BCOC Reporting. The BaaS Compliance Unit must provide quarterly reports to the BCOC on each Tier 2 partner's compliance status.
3. Tier 3 (Low Risk) Partners — Baseline Monitoring
Tier 3 partners are subject to the following baseline monitoring requirements:
Quarterly Compliance Reporting. Each Tier 3 partner must provide quarterly compliance reports to BRB, delivered no later than thirty (30) calendar days after the end of each calendar quarter.
OFAC Screening per Standard Protocols. Tier 3 partner transaction flows are subject to OFAC screening per BRB's standard protocols. Real-time screening is required for all wire transfers. Batch screening may be acceptable for low-value ACH transactions within defined thresholds approved by the BCOC.
Annual Compliance Review. BRB's BaaS Compliance Unit must conduct an annual compliance review of each Tier 3 partner.
Annual Risk Assessment. Each Tier 3 partner should be the subject of an annual risk assessment using the BaaS Partner BSA/AML Risk Assessment Template.
Quarterly Summary Reporting to BCOC. The BaaS Compliance Unit must provide quarterly reports to the BCOC summarizing the compliance status of all Tier 3 partners in aggregate, with individual partner detail provided only for partners with identified compliance concerns or notable developments.
D. Compliance Testing Program
1. Scope. BRB's Internal Audit function, led by Derek Ballard, Head of Internal Audit, should develop a dedicated BaaS compliance testing program that is fully integrated into BRB's annual audit plan. The BaaS compliance testing program should be designed to provide independent assurance that BRB's BaaS compliance oversight framework is operating effectively and that BaaS partner activities are in compliance with applicable BSA/AML and OFAC requirements.
The scope of the BaaS compliance testing program should include the following areas:
(a) OFAC Screening Completeness and Accuracy. Testing of OFAC screening coverage across all BaaS transaction flows, including validation that 100% of transactions processed through each BaaS partner are screened against applicable OFAC sanctions lists, that screening is performed in accordance with the timing requirements specified for each tier (real-time, daily, or batch), and that potential matches are properly interdicted, investigated, and dispositioned.
(b) CDD/EDD Adequacy. Testing of the adequacy of CDD and EDD documentation for customers onboarded through BaaS partners, including verification that CDD information collected by partners meets BRB's standards, that EDD is performed when required by BRB's risk-based policies, and that BRB's independent verification processes for Tier 1 partner customers are functioning effectively.
(c) SAR Identification and Filing Timeliness. Testing of BRB's ability to identify and investigate suspicious activity originating from BaaS channels, including review of transaction monitoring alert generation, alert disposition decisions, SAR investigation quality, and SAR filing timeliness for BaaS-related activity.
(d) Transaction Monitoring Alert Generation and Disposition. Testing of the transaction monitoring system's BaaS-specific rule sets, typologies, and thresholds, including assessment of whether the system is generating appropriate alerts for BaaS transaction patterns and whether alert disposition decisions are reasonable and well-documented.
(e) Partner Contractual Compliance. Testing of BaaS partners' compliance with their contractual BSA/AML obligations as set forth in the compliance addendum, including the timeliness and completeness of compliance reporting, cooperation with SAR investigations, and adherence to CDD/EDD responsibilities.
2. Testing Frequency
The frequency of compliance testing should be differentiated by partner risk tier:
Tier 1 partners: Semi-annual compliance testing. Each Tier 1 partner should be subject to a dedicated compliance test at least twice per year, with testing cycles aligned to BRB's semi-annual risk assessment schedule.
Tier 2 partners: Annual compliance testing. Each Tier 2 partner should be subject to a dedicated compliance test at least once per year.
Tier 3 partners: Annual compliance testing on a rotating basis. All Tier 3 partners should be tested at least once over a two-year cycle, with the selection of partners for testing in each year determined by the BaaS Compliance Unit in coordination with Internal Audit, considering factors such as time since last test, any changes in the partner's risk profile, and the results of ongoing monitoring.
3. Independent Testing
In addition to BRB's internal compliance testing, the BaaS compliance oversight framework should be subject to independent testing by qualified external parties:
Caldera & Pope LLP Independent BSA/AML Test. Caldera & Pope LLP (311 South Wacker Drive, Suite 5400, Chicago, Illinois 60606; engagement partner: Franklin Dorsey), which conducts BRB's annual independent BSA/AML test (CY 2024 annual fee: $1,100,000), should be directed to include BaaS-specific testing in its annual independent test scope. The BaaS-specific testing should assess the adequacy of BRB's BaaS compliance oversight framework, including the effectiveness of the tiering model, ongoing monitoring, and compliance testing described in this memorandum. Caldera & Pope's BaaS-specific findings should be reported separately in the annual independent test report and should be provided to the BCOC, the Board Compliance Committee, and the OCC.
Thornfield Consulting Group LLC Independent Assessment. Thornfield Consulting Group LLC (engagement reference: TCG-BRB-2025-001; lead: Dr. Vivian Castellano), engaged as the independent consultant under the Consent Order, should validate the BaaS compliance testing framework as part of its independent consultant assessment. Specifically, Thornfield should assess whether BRB's BaaS compliance oversight framework is reasonably designed to address the Consent Order's findings, whether the framework is being implemented in accordance with this memorandum and the Comprehensive Remediation Action Plan, and whether the framework is effective in practice. Nathaniel Burgess, Director, Fintech & Payments Compliance at Thornfield, has been specifically assigned to the BaaS compliance assessment component.
E. Contractual Framework Enhancements
1. Revised BaaS Program Agreement — Compliance Addendum
All fourteen BaaS partner agreements must be amended to incorporate a standardized compliance addendum. The compliance addendum is being prepared as a separate C&H deliverable (the "Revised BaaS Program Agreement Template Compliance Addendum") and will be provided to BRB under separate cover. The compliance addendum will serve as the primary contractual mechanism for establishing and enforcing the compliance obligations of BaaS partners under this framework.
The key provisions of the compliance addendum are summarized below:
BSA/AML and OFAC Compliance Obligations. The addendum will require each partner to cooperate fully with BRB's BSA/AML and OFAC compliance programs. Partners must implement their own AML controls as a first-line defense, including customer identification programs, transaction monitoring, and suspicious activity escalation, while expressly recognizing that BRB retains ultimate compliance responsibility for all activities conducted through its charter. The addendum will specify the minimum standards for partner AML controls and will require partners to maintain AML compliance programs that are reasonably designed to detect and prevent money laundering, terrorist financing, and sanctions evasion in connection with their use of BRB's charter.
Data Sharing. The addendum will require each partner to provide real-time or daily data feeds of all customer onboarding data, transaction data, and suspicious activity indicators to BRB's compliance systems. The data feeds must be provided in formats and through technical interfaces specified by BRB, and must include sufficient detail to enable BRB to perform its compliance functions, including OFAC screening, transaction monitoring, CDD/EDD assessment, and SAR investigation. Partners that are unable to provide real-time data feeds at the time of addendum execution must commit to implementing real-time capability within a specified timeframe.
Audit Rights. The addendum will provide BRB and its agents — including Thornfield Consulting during the remediation period and Caldera & Pope for independent testing — with the right to conduct compliance audits of the partner's operations upon reasonable notice (generally fifteen (15) business days for routine audits, with shorter notice permitted for cause). Audit rights will extend to the partner's books and records, compliance policies and procedures, technology systems, and personnel, to the extent relevant to BSA/AML and OFAC compliance.
SAR Cooperation. The addendum will require each partner to respond to BRB's requests for information in connection with SAR investigations within specified timeframes. Standard requests for information must be responded to within five (5) business days. Urgent requests — including requests related to potential terrorist financing, significant money laundering, or situations requiring immediate transaction blocking — must be responded to within twenty-four (24) hours. The addendum will also require partners to proactively escalate to BRB any suspicious activity identified through the partner's own monitoring or controls.
CDD/EDD Responsibilities. The addendum will incorporate the defined allocation of CDD/EDD obligations set forth in the BaaS Partner CDD/EDD Responsibility Matrix (a separate C&H deliverable). The matrix specifies which CDD/EDD functions are performed by the partner, which are performed by BRB, and which are performed jointly, for each product type and customer risk category. The addendum will require each partner to collect and transmit to BRB all CDD information specified in the matrix at the time of customer onboarding and to cooperate with BRB's EDD processes for high-risk customers.
Compliance Certifications. Each partner must provide quarterly compliance certifications to BRB, signed by the partner's chief compliance officer or equivalent senior officer, attesting to the partner's compliance with the obligations set forth in the addendum, the accuracy and completeness of the partner's compliance reports, and the absence of any known compliance deficiencies not previously disclosed to BRB.
Remediation Cooperation. During the Consent Order remediation period, the addendum will require each partner to cooperate with all BRB remediation efforts, including but not limited to the CDD/EDD remediation of the approximately 47,000 high-risk accounts, OFAC screening system integration and testing, and transaction monitoring system upgrade and validation. Partners must provide timely access to customer data, respond to information requests, and participate in remediation planning and implementation as reasonably requested by BRB.
Termination Triggers. The addendum will incorporate the escalation and termination provisions described in Section IV.F of this memorandum, providing BRB with the contractual right to suspend or terminate the partnership based on defined compliance triggers.
2. Implementation Timeline
The implementation timeline for the compliance addendum is as follows:
(a) The draft compliance addendum is to be circulated to all fourteen BaaS partners within thirty (30) days of the submission of BRB's Comprehensive Remediation Action Plan to the OCC — i.e., by June 15, 2025.
(b) Tier 1 partners (NovaPay Technologies Inc. and FairLend Digital LLC) are required to execute the compliance addendum by July 31, 2025.
(c) All remaining BaaS partners are required to execute the compliance addendum by September 30, 2025.
(d) Partners that fail to execute