CALDERWOOD & HARKNESS LLP 1285 Avenue of the Americas, 40th Floor New York, NY 10019
BaaS Partner CDD/EDD Responsibility Matrix
Delineation of Customer Due Diligence and Enhanced Due Diligence Obligations Between Belmont Ridge Bank NA and Banking-as-a-Service Partners
C&H Matter No.: 1045-00002
Date: March 2025
Prepared for:
Belmont Ridge Bank National Association 680 Lexington Avenue, 22nd Floor New York, NY 10022
Prepared by:
Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, NY 10019
Authors:
Yuki Nakamura, Lead Associate Carlos Espinoza, Working Associate Under the supervision of Philip Hartmann, Responsible Partner
Status: Draft — Attorney-Client Privileged & Confidential
Cross-References:
OCC Consent Order No. OCC-2025-003 (January 15, 2025) Workstream 3: CDD/EDD Remediation Plan Revised CDD/EDD Policy (Draft) BaaS Compliance Oversight Framework Memorandum
CONFIDENTIAL TREATMENT REQUESTED — This document is protected by the attorney-client privilege and the work product doctrine. It was prepared by Calderwood & Harkness LLP at the direction of Belmont Ridge Bank National Association in connection with legal advice relating to regulatory compliance obligations arising from OCC Consent Order No. OCC-2025-003. Any disclosure, distribution, or copying of this document or any portion thereof, without the prior written consent of Calderwood & Harkness LLP, is strictly prohibited. This document is not intended for production to third parties, including regulators, without a prior privilege review.
Right-click to update Table of Contents
1. Purpose and Background
1.1 Purpose of This Matrix
This BaaS Partner CDD/EDD Responsibility Matrix (the "Matrix") establishes a comprehensive RACI (Responsible, Accountable, Consulted, Informed) framework delineating the obligations and respective roles of Belmont Ridge Bank National Association ("BRB" or the "Bank"), as the chartered national bank holding OCC Charter No. 48271, and each of its fourteen (14) active Banking-as-a-Service ("BaaS") fintech partners (each, a "BaaS Partner" and, collectively, the "BaaS Partners") for all aspects of Customer Due Diligence ("CDD") and Enhanced Due Diligence ("EDD"). The Matrix is intended to provide a clear, operationally actionable allocation of duties across the full customer lifecycle — from initial onboarding and account opening through ongoing monitoring, periodic review, trigger-event review, and, where necessary, account restriction, suspension, and closure.
Under applicable federal banking law — including the Bank Secrecy Act ("BSA"), as amended by the USA PATRIOT Act, and the implementing regulations of the Financial Crimes Enforcement Network ("FinCEN") and the Office of the Comptroller of the Currency ("OCC") — BRB retains ultimate regulatory responsibility for BSA/AML compliance, including CDD and EDD, for all accounts held on its national bank charter, regardless of the channel through which end-user customers are onboarded or the extent to which operational tasks are performed by third-party BaaS Partners. This principle is foundational to the Matrix and is reflected throughout its provisions: while BRB may delegate the performance of certain CDD/EDD tasks to BaaS Partners, the Bank may not delegate — and does not delegate — its regulatory accountability for those tasks or their outcomes.
The Matrix is designed to be incorporated by reference into the following documents, which are being developed concurrently as part of the Bank's broader remediation effort:
(a) The Revised BaaS Program Agreement — Template Compliance Addendum, which will be appended to each existing and future BaaS program agreement;
(b) The individual compliance remediation letters issued to each BaaS Partner pursuant to the Bank's remediation action plan; and
(c) The Comprehensive Remediation Action Plan to be submitted to the OCC on or before May 15, 2025.
The Matrix serves multiple functions simultaneously. It operates as a governance document, establishing the chain of responsibility and accountability within BRB and between BRB and its BaaS Partners. It also serves as a compliance tool, providing a clear and auditable record of how CDD/EDD obligations are allocated and performed. Finally, it functions as a remediation instrument, directly addressing the OCC's findings regarding the absence of clear demarcation between BRB-retained duties and partner-delegated duties — a deficiency that contributed materially to the compliance failures identified in the Consent Order.
1.2 Regulatory Context
On January 15, 2025, the OCC issued Consent Order No. OCC-2025-003 (the "Consent Order") against Belmont Ridge Bank National Association. The Consent Order identified CDD/EDD failures as one of five core deficiency categories in the Bank's BSA/AML compliance program. The CDD/EDD deficiencies were found to be particularly pronounced in connection with the Bank's BaaS operations, where the vast majority of end-user customer accounts are onboarded by fintech partners rather than directly by the Bank.
The scope of the identified CDD/EDD deficiencies is substantial. As of the conclusion of the OCC's September 2024 examination, approximately 47,000 high-risk customer accounts — the overwhelming majority of which were onboarded through fintech BaaS Partners — were identified as lacking adequate CDD or EDD documentation. These accounts spanned multiple BaaS Partners and product types, including consumer payments, peer-to-peer transfers, digital savings and deposit accounts, and online lending products. The deficiencies ranged from incomplete Customer Identification Program ("CIP") records to entirely absent beneficial ownership documentation for legal entity customers to failure to perform EDD on accounts that had been risk-rated as high-risk or that exhibited transaction patterns warranting enhanced scrutiny.
The Consent Order mandates phased remediation of these deficient accounts on the following timeline:
• First Milestone (July 15, 2025): Remediation of not less than 50% of the 47,000 identified accounts (i.e., 23,500 accounts), with priority given to the highest-risk accounts as determined by the Bank's risk-based prioritization methodology.
• Second Milestone (January 15, 2026): Complete remediation of 100% of the 47,000 identified accounts.
The present Matrix addresses a critical root cause of these deficiencies: the absence, under the Bank's prior BaaS compliance framework, of a clear and enforceable demarcation between CDD/EDD responsibilities retained by BRB and those delegated to BaaS Partners. The OCC's examination findings indicate that, under the prior framework, responsibility for CDD/EDD was effectively diffuse — with both BRB and its BaaS Partners assuming that the other party was performing certain tasks, resulting in significant gaps where neither party performed the work. This "accountability gap" was compounded by the absence of adequate quality assurance testing, independent verification, and oversight of partner-performed CDD/EDD activities.
It is important to note that the CDD/EDD deficiencies identified in the Consent Order were not the first regulatory signal. A Matter Requiring Attention ("MRA") was issued in June 2022, identifying concerns related to the Bank's oversight of CDD performed by BaaS Partners. A Matter Requiring Immediate Attention ("MRIA") followed in November 2023, escalating those concerns and noting that the Bank had failed to adequately remediate the 2022 MRA. The Consent Order specifically cites BRB's failure to adequately address these prior supervisory actions as an aggravating factor.
In connection with the Consent Order, the Bank has engaged Thornfield Consulting Group LLC ("Thornfield") as the independent consultant required under Article VII of the Consent Order. The Thornfield engagement (reference TCG-BRB-2025-001) is led by Dr. Vivian Castellano, Managing Director, with Nathaniel Burgess, Director, Fintech & Payments Compliance, serving as the day-to-day engagement lead. Thornfield will validate the adequacy of the CDD/EDD responsibility framework set forth in this Matrix as part of its broader assessment of the Bank's remediation efforts. Thornfield's preliminary gap assessment is due on April 15, 2025, and the final validation report is due on February 15, 2026.
1.3 Scope
This Matrix covers the following scope of activities, persons, entities, and products:
BaaS Partners. The Matrix applies to all fourteen (14) active BaaS Partners currently operating through BRB's national bank charter. These partners are classified into three tiers (Tier 1, Tier 2, and Tier 3) based on transaction volume, account count, and risk profile, as described in Section 2.2 below. The three Tier 1 partners — NovaPay Technologies Inc., FairLend Digital LLC, and VaultEdge Inc. — collectively represent approximately 87% of total BaaS transaction volume and are the subject of individualized detail in Section 5. The remaining eleven (11) Tier 2 and Tier 3 partners are addressed in Section 6.
Customer Types. The Matrix addresses CDD/EDD obligations for all customer types onboarded through BaaS channels, including individual consumers, small businesses, legal entities (including corporations, limited liability companies, partnerships, and trusts), and beneficial owners of legal entity customers. Each customer type presents distinct CDD/EDD challenges and requirements, and the Matrix addresses these distinctions where relevant.
Customer Lifecycle. The Matrix spans the full customer lifecycle, from initial onboarding and account opening through ongoing transaction monitoring, periodic review, trigger-event review, and account closure or offboarding. The lifecycle approach ensures that CDD/EDD responsibility allocation is defined not only for the point of customer acquisition but for the entirety of the customer relationship, including the critical post-onboarding period during which ongoing monitoring and risk reassessment occur.
Product Types. The Matrix applies to all BaaS product types currently offered through BRB's charter, including consumer payments and P2P transfer products, digital savings and deposit accounts, online lending products (including small-business lending), and any other products offered through BaaS channels. The product-type dimension is important because different products present different CDD/EDD risk profiles — for example, online lending to legal entity borrowers implicates beneficial ownership requirements that do not apply to individual consumer deposit accounts.
Scale of BaaS Operations. To contextualize the significance of this Matrix, the following metrics summarize the scale of BRB's BaaS operations:
• Total BaaS transaction volume in CY 2024: Approximately $74.3 billion across all 14 BaaS Partners.
• Total BaaS-related revenue to BRB in CY 2024: Approximately $127.4 million, comprising interchange revenue, program fees, and interest income. BaaS revenue represents a material portion of the Bank's total revenue base.
• BaaS-related SARs in CY 2024: 2,108 of 3,847 total SARs filed by the Bank (54.8%), underscoring the outsized compliance risk concentration in BaaS channels relative to the Bank's traditional banking operations. The disproportionate share of SARs attributable to BaaS channels further underscores the necessity of a clear and enforceable CDD/EDD responsibility framework for these channels.
2. Definitions and Key Terms
2.1 Key Definitions
For purposes of this Matrix, the following terms shall have the meanings set forth below. Where a term is defined by reference to a statute or regulation, the definition shall be construed consistently with the applicable statutory or regulatory provision, including any amendments thereto.
"CDD" or "Customer Due Diligence" refers to the procedures required for identifying and verifying the identity of customers at the time of account opening, understanding the nature and purpose of customer relationships in order to develop a customer risk profile, and assessing customer risk profiles on an ongoing basis. CDD is required under the FinCEN Customer Due Diligence Requirements for Financial Institutions, codified at 31 C.F.R. § 1020.210(b)(2) (the "CDD Rule"), which became effective on May 11, 2018. CDD encompasses both the initial due diligence performed at account opening and the ongoing monitoring and periodic review of customer relationships.
"EDD" or "Enhanced Due Diligence" refers to additional due diligence measures applied to customers identified as presenting elevated risk, beyond the baseline CDD requirements. EDD measures include, but are not limited to, enhanced investigation into the customer's source of funds and source of wealth, the purpose of the account or relationship, the expected transaction activity profile, and enhanced identity verification. EDD is applied to categories of customers identified as high-risk, including but not limited to: senior foreign political figures (i.e., Politically Exposed Persons or "PEPs"), customers in high-risk jurisdictions (as identified by the Financial Action Task Force, the State Department, or BRB's own jurisdiction risk assessment), customers exhibiting unusual transaction patterns, customers flagged through adverse media screening, customers with sanctions screening alerts, and customers whose businesses or activities present inherently elevated BSA/AML risk.
"CIP" or "Customer Identification Program" refers to the minimum identity verification procedures required under Section 326 of the USA PATRIOT Act and its implementing regulations at 31 C.F.R. § 1020.220. The CIP requires, at a minimum, the collection of the customer's name, date of birth (for individuals), address, and identification number (e.g., Social Security number or Tax Identification Number), and the verification of the customer's identity through documentary means (e.g., government-issued identification), non-documentary means (e.g., credit bureau data), or a combination thereof.
"Beneficial Ownership" refers to the identification and verification of the natural persons who, directly or indirectly, own 25% or more of the equity interests of a legal entity customer, and the identification of a single individual with significant responsibility to control, manage, or direct the legal entity, as required by FinCEN's beneficial ownership rule at 31 C.F.R. § 1010.230. The beneficial ownership requirements apply to all legal entity customers, including but not limited to corporations, limited liability companies, partnerships, and other entities formed under the laws of any state or jurisdiction.
"BaaS Partner" or "Fintech Partner" refers to a third-party technology company that offers financial products and services to end-user customers through BRB's national bank charter under a BaaS program agreement. BaaS Partners are not themselves banks, do not hold bank charters, and rely on BRB's charter, regulatory approvals, and FDIC insurance for the provision of banking products. The relationship between BRB and each BaaS Partner is governed by a BaaS Program Agreement, which is being supplemented by the Revised BaaS Program Agreement — Template Compliance Addendum.
"RACI" refers to the responsibility assignment framework used throughout this Matrix, in which each task or function is assigned one or more of the following designations:
• R (Responsible): The party that performs the work or executes the task. A task may have multiple Responsible parties.
• A (Accountable): The party that has ultimate ownership and decision-making authority for the task and its outcome. For all CDD/EDD-related tasks, the Accountable designation cannot be delegated beyond BRB for regulatory purposes, regardless of which party performs the work. Only one party may be Accountable for each task.
• C (Consulted): A party whose input is sought before a decision or action is taken. Consultation implies two-way communication.
• I (Informed): A party that is notified after a decision or action is taken. Information flow is one-way.
"BSA Officer" refers to Thomas Ikeda, BSA Officer and AML Program Director of BRB, who serves as the designated BSA compliance officer responsible for the day-to-day management and oversight of BRB's BSA/AML compliance program, including CDD/EDD activities.
"CCO" refers to Patricia Langston, Chief Compliance Officer of BRB, appointed in January 2024, who has enterprise-wide compliance oversight authority, including oversight of the BSA/AML program and CDD/EDD remediation efforts.
"BaaS Division Head" refers to Warren Ashby, Head of Fintech Partnerships and BaaS Division of BRB, who is responsible for managing the Bank's relationships with BaaS Partners and coordinating between the business line and compliance functions.
"Consent Order" refers to OCC Consent Order No. OCC-2025-003, issued January 15, 2025, against Belmont Ridge Bank National Association.
"Veridian TMS" refers to the Bank's transaction monitoring system, provided by Veridian Analytics LLC, currently operating at version 8.3 and scheduled for upgrade to version 10.0, which serves as the primary platform for BSA/AML transaction monitoring and OFAC screening across all of BRB's banking channels, including BaaS channels.
2.2 BaaS Partner Tier Classification
BRB classifies its BaaS Partners into three tiers based on the partner's relative share of total BaaS transaction volume, end-user account count, and overall risk profile. The tier classification determines the intensity of BRB's independent oversight, verification sampling rates, and direct operational involvement in CDD/EDD activities. All tiers are subject to the same minimum CDD/EDD standards; the tiering framework affects the degree of independent BRB verification and oversight layered on top of partner-performed activities.
Tier 1 — High Volume / High Risk. Partners representing more than 15% of total BaaS transaction volume or having more than 500,000 end-user accounts. Tier 1 partners are subject to the most intensive BRB oversight, the highest independent verification sampling rates, and the greatest degree of direct BRB operational involvement in CDD/EDD activities. The current Tier 1 partners are:
(a) NovaPay Technologies Inc. — Approximately 41% of total BaaS transaction volume (approximately $30.5 billion in CY 2024); approximately 2.1 million end-user accounts. NovaPay is BRB's largest BaaS Partner by both volume and account count and represents the highest concentration of compliance risk within the BaaS portfolio.
(b) FairLend Digital LLC — Approximately 28% of total BaaS transaction volume; approximately $1.4 billion in loan originations through BRB in FY 2024. FairLend's small-business lending products involve legal entity customers and beneficial ownership complexity that elevates the CDD/EDD risk profile.
(c) VaultEdge Inc. — Approximately 18% of total BaaS transaction volume; approximately 870,000 deposit accounts. VaultEdge is the most recently onboarded Tier 1 partner (2023) and has experienced rapid account growth, presenting heightened identity verification and money laundering layering risks.
Tier 2 — Moderate Volume / Moderate Risk. Partners representing between 5% and 15% of total BaaS transaction volume or having between 100,000 and 500,000 end-user accounts. Tier 2 partners are subject to moderate BRB oversight intensity and intermediate independent verification sampling rates.
Tier 3 — Low Volume / Lower Risk. Partners representing less than 5% of total BaaS transaction volume and having fewer than 100,000 end-user accounts. Tier 3 partners are subject to baseline BRB oversight, including minimum independent verification sampling rates and periodic quality assurance testing.
The remaining eleven (11) BaaS Partners are collectively classified as Tier 2 or Tier 3 and together represent approximately 13% of total BaaS transaction volume (approximately $9.66 billion in CY 2024). Individual tier classifications for these partners will be documented in the partner-specific addenda described in Section 6.2.
Tier classifications are subject to review and adjustment on at least an annual basis, or more frequently if warranted by changes in a partner's volume, account count, risk profile, or compliance performance. Tier reclassification decisions are made by the BSA Officer (Thomas Ikeda) in consultation with the BaaS Division Head (Warren Ashby) and the CCO (Patricia Langston).
3. Governing Principles
3.1 BRB's Non-Delegable Regulatory Responsibilities
The foundational principle underlying this Matrix is that BRB, as a nationally chartered bank (OCC Charter No. 48271, FDIC Certificate No. 31845), is the regulated entity accountable to the OCC, FinCEN, the Office of Foreign Assets Control ("OFAC"), and all other applicable federal and state regulatory authorities for all aspects of BSA/AML compliance — including CDD, EDD, CIP, beneficial ownership identification, sanctions screening, transaction monitoring, suspicious activity reporting, and all related recordkeeping — for all accounts held on its charter. This accountability is non-delegable.
The non-delegable nature of BRB's regulatory accountability means that, while the Bank may delegate the performance of certain CDD/EDD tasks to BaaS Partners as part of its BaaS operating model, the Bank cannot delegate accountability for the adequacy, accuracy, and completeness of those tasks or their outcomes. In the event that a BaaS Partner fails to perform a delegated CDD/EDD task, or performs it inadequately, BRB remains fully responsible to its regulators for the resulting compliance deficiency. This principle is well-established in OCC guidance, including OCC Bulletin 2013-29 (Third-Party Relationships: Risk Management Guidance) and its successor, OCC Bulletin 2023-17 (Third-Party Relationships: Risk Management Guidance — Interagency Guidance), as well as the OCC's community bank and fintech-related supervisory guidance.
Consistent with this principle, BRB must maintain the following capabilities at all times, independent of any BaaS Partner:
(a) The ability to independently verify any CDD/EDD work performed by a BaaS Partner, including by obtaining and reviewing source documentation, conducting independent identity verification, and performing independent risk assessments;
(b) The ability to audit any BaaS Partner's CDD/EDD processes, systems, data, and records, with or without prior notice, and to require the BaaS Partner's full cooperation in such audits;
(c) The ability to override any CDD/EDD determination made by a BaaS Partner, including customer risk ratings, EDD decisions, and account status decisions;
(d) Sole authority over all customer risk rating assignments and adjustments;
(e) Sole authority over all EDD trigger decisions — i.e., the decision to apply EDD to a particular customer or account;
(f) Sole authority over all SAR filing decisions, including the determination of whether suspicious activity exists and the content and filing of SARs with FinCEN;
(g) Sole authority over all OFAC compliance decisions, including the disposition of sanctions screening alerts and the decision to block, reject, or release transactions; and
(h) Sole authority over all account restriction, suspension, and closure decisions made for BSA/AML reasons.
3.2 Partner Obligations
Each BaaS Partner is contractually required, under its BaaS Program Agreement and the Revised BaaS Program Agreement — Template Compliance Addendum, to perform delegated CDD/EDD tasks in strict accordance with BRB's policies, procedures, and standards, as set forth in the Revised CDD/EDD Policy and any supplementary guidance issued by BRB's BSA/AML Department or Compliance Department.
The core obligations of each BaaS Partner with respect to CDD/EDD include:
(a) Performance of Delegated Tasks. Performing all CDD/EDD tasks delegated to it by BRB, in accordance with BRB's specified procedures, quality standards, and timelines, using only BRB-approved vendor tools and methodologies.
(b) Data Access. Providing BRB with real-time or near-real-time access to all CDD/EDD data, customer records, and supporting documentation. This includes, but is not limited to, customer identity data, onboarding records, verification results, beneficial ownership certifications, EDD documentation, transaction data, and customer communications.
(c) Data Transmission. Transmitting all CDD/EDD data to BRB in the standardized formats and at the frequencies specified by BRB IT, as described in Section 7.1 of this Matrix.
(d) Escalation. Promptly escalating to BRB any information or observations suggesting elevated customer risk, including but not limited to unusual transaction patterns, customer disclosures of high-risk activities or jurisdictions, adverse media, and any customer inquiries that may suggest involvement in illicit activity.
(e) Cooperation with Audits and Examinations. Fully cooperating with BRB internal audits, BRB quality assurance testing, Thornfield Consulting Group assessments, Caldera & Pope LLP independent testing, and OCC examinations, including by providing timely access to personnel, systems, data, and records.
(f) Remediation Cooperation. Cooperating fully with BRB in the retrospective CDD/EDD remediation of the 47,000 deficient accounts identified in connection with the Consent Order, including by facilitating direct customer outreach by BRB and Pinnacle Compliance Solutions staff and by providing all requested customer data and documentation.
It is expressly noted that BaaS Partners bear no independent BSA/AML filing obligations. All regulatory filings — including Suspicious Activity Reports ("SARs"), Currency Transaction Reports ("CTRs"), OFAC blocking reports, and FinCEN 314(a) responses — are the exclusive responsibility of BRB. No BaaS Partner is authorized to file, or to decide whether to file, any BSA/AML regulatory report on behalf of BRB or with respect to any account held on BRB's charter.
3.3 Allocation Principles by Partner Tier
While all BaaS Partners are subject to the same minimum CDD/EDD standards and the same fundamental RACI framework, the intensity of BRB's independent oversight and direct operational involvement varies by partner tier, as follows:
Tier 1 Partners (NovaPay, FairLend, VaultEdge). For Tier 1 partners, BRB retains a greater degree of direct operational involvement in CDD/EDD activities. This includes higher independent verification sampling rates (e.g., 5% random sample of CIP for NovaPay, 100% beneficial ownership verification for FairLend), more frequent quality assurance testing, and, in certain cases, direct BRB performance of specific CDD/EDD functions rather than delegation to the partner. Tier 1 partners are also subject to more granular reporting requirements and more frequent compliance review meetings with BRB.
Tier 2 Partners. For Tier 2 partners, BRB may rely more heavily on partner-collected CDD/EDD data, with independent verification at a moderate sampling rate (minimum 2% for CIP, minimum 10% for EDD outreach). Tier 2 partners are subject to quarterly quality assurance testing and regular compliance review meetings.
Tier 3 Partners. For Tier 3 partners, BRB applies baseline independent verification sampling (minimum 1% for CIP, minimum 10% for EDD outreach), with quarterly quality assurance testing. Tier 3 partners are subject to scheduled compliance review meetings and periodic on-site reviews.
The sampling rates specified above represent minimum thresholds. BRB reserves the right — and the obligation — to increase sampling rates and oversight intensity for any partner at any time, without prior notice, based on the results of quality assurance testing, internal audit findings, regulatory examination results, or any other information suggesting that a partner's CDD/EDD performance is deficient.
All tiers are subject to the same override authority: BRB retains sole authority over customer risk ratings, EDD trigger decisions, SAR filing decisions, and account restriction/closure decisions, regardless of partner tier.
4. Master RACI Matrix — CDD/EDD Lifecycle Activities
This Section 4 sets forth the detailed RACI allocation for each CDD/EDD activity across the full customer lifecycle. The Matrix is organized by lifecycle phase: Customer Onboarding / Account Opening (Section 4.1), Enhanced Due Diligence for High-Risk Customers (Section 4.2), Ongoing Monitoring (Section 4.3), Periodic Review (Section 4.4), and Account Closure / Offboarding for BSA/AML Reasons (Section 4.5). Within each phase, individual activities are identified and assigned RACI designations.
4.1 Customer Onboarding / Account Opening
The customer onboarding phase encompasses all CDD activities performed at the time of initial account opening or the establishment of a customer relationship through a BaaS Partner's platform. This phase includes CIP, beneficial ownership identification (for legal entity customers), initial customer risk rating, and sanctions and watchlist screening.
4.1.1 Customer Identification Program (CIP)
The CIP is the foundational element of CDD at onboarding and requires the collection and verification of minimum identifying information for each customer.
Collection of Identifying Information. The collection of minimum identifying information — including the customer's full legal name, date of birth (for individuals), residential or business address, and identification number (e.g., Social Security number for U.S. persons; passport number, country of issuance, and alien identification number for non-U.S. persons) — is performed by the BaaS Partner through its customer-facing onboarding platform (e.g., mobile application, web application, or other digital interface). The BaaS Partner is Responsible for the accurate and complete collection of this information in accordance with BRB's CIP procedures. BRB is Accountable for the adequacy of the CIP, including the completeness and accuracy of the information collected. The BRB BSA/AML Department is Consulted on CIP standards and procedures and provides the BaaS Partner with the required data fields, formats, and validation rules.
Documentary and Non-Documentary Identity Verification. The BaaS Partner is Responsible for performing the initial identity verification, which may include documentary verification (e.g., capture and validation of government-issued photo identification) and non-documentary verification (e.g., credit bureau data matching, knowledge-based authentication, or device-based verification), using only vendor tools that appear on BRB's approved vendor list. BRB is Accountable for maintaining the approved vendor list and establishing minimum verification thresholds (e.g., minimum match scores for non-documentary verification, acceptable forms of documentary identification). BRB Compliance is Consulted on the adequacy of verification methods and thresholds. The approved vendor list is maintained by BRB's BSA/AML Department in coordination with BRB IT and is reviewed no less than annually.
Resolution of CIP Exceptions / Unable-to-Verify Cases. In cases where initial identity verification fails — i.e., where the BaaS Partner's verification processes are unable to verify the customer's identity to the required threshold — the matter is escalated to the BRB BSA/AML Department, which is both Responsible and Accountable for the resolution of CIP exceptions. The BaaS Partner is Consulted in this process and is required to obtain and transmit additional documentation or information from the customer as directed by BRB. The CCO (Patricia Langston) is Informed of the volume and resolution of CIP exceptions on a periodic basis through standard reporting channels. Accounts that remain unable to be verified are not opened or, if already opened on a provisional basis, are restricted and ultimately closed in accordance with BRB's procedures.
Recordkeeping of CIP Data. BRB is Accountable for the retention of all CIP records for a minimum of five (5) years after the date the account is closed, as required by 31 C.F.R. § 1020.220(a)(3). While the BaaS Partner is Responsible for transmitting CIP records to BRB in the required formats and timeframes, BRB must maintain these records in its own systems, independent of the BaaS Partner's systems, to ensure continuity of records in the event of partner system failures, contract termination, or regulatory examination. BRB IT (led by Linda Petrosian, Chief Information Officer / Chief Technology Officer) is Consulted on the data architecture, storage infrastructure, and retrieval capabilities of BRB's CIP recordkeeping systems.
4.1.2 Beneficial Ownership Identification (Legal Entity Customers)
For all legal entity customers — including corporations, limited liability companies, general and limited partnerships, business trusts, and other entities formed under the laws of any state or foreign jurisdiction — BRB is required to identify and verify the beneficial owners of the entity, as defined by FinCEN's beneficial ownership rule at 31 C.F.R. § 1010.230.
Collection of Beneficial Ownership Information. The BaaS Partner is Responsible for collecting beneficial ownership information from legal entity customers at the time of account opening, including the identity (name, date of birth, address, identification number) of each individual who owns 25% or more of the equity interests of the entity and the identity of a single individual who has significant responsibility to control, manage, or direct the entity (the "control person"). BRB is Accountable for the completeness and accuracy of the beneficial ownership information collected.
Verification of Beneficial Ownership Information. The BRB BSA/AML Department is both Responsible and Accountable for the independent verification of beneficial ownership information for all legal entity accounts opened through BaaS channels. This is a critical distinction from CIP for individual customers, where the BaaS Partner performs initial verification: for beneficial ownership, BRB performs the verification directly, reflecting the heightened complexity and risk associated with legal entity structures and the potential for beneficial ownership information to be manipulated or inaccurate. The BaaS Partner is Consulted in the verification process and may be asked to obtain additional documentation from the customer.
Certification Form Collection and Retention. The BaaS Partner is Responsible for collecting the beneficial ownership certification form (or electronic equivalent) from the legal entity customer at the time of account opening. BRB is Accountable for maintaining and archiving all beneficial ownership certification forms, consistent with its recordkeeping obligations.
4.1.3 Initial Customer Risk Rating
The assignment of a customer risk rating is a critical CDD function that determines the level of ongoing monitoring and the potential application of EDD. Under BRB's Revised CDD/EDD Policy, risk rating assignment is a non-delegable function — BRB performs all risk rating assignments using its proprietary risk-scoring methodology.
Assignment of Initial Risk Rating. The BRB BSA/AML Department is both Responsible and Accountable for the assignment of the initial customer risk rating to all customers onboarded through BaaS channels. Risk ratings are assigned using BRB's proprietary risk-scoring methodology, which considers factors including but not limited to: customer type, geographic location, product type, anticipated transaction volume, source of funds, occupation or business type, PEP status, and adverse media or sanctions screening results. This function is non-delegable: no BaaS Partner is authorized to assign or modify a customer risk rating.
Provision of Customer Data Inputs for Risk Scoring. The BaaS Partner is Responsible for providing all customer data required as inputs to BRB's risk-scoring methodology, including the data collected through the CIP process, the beneficial ownership certification (for legal entities), and any additional information collected from the customer during the onboarding process. BRB is Consulted to ensure that the data provided is sufficient and in the correct format.
Elevated Risk Rating Triggering EDD. When BRB's risk-scoring methodology produces a risk rating at or above the threshold for elevated risk, the BRB BSA/AML Department is Responsible for initiating the EDD process described in Section 4.2 below. The BSA Officer (Thomas Ikeda) is Accountable for all EDD trigger decisions. The BaaS Partner is Informed of the EDD requirement and any resulting restrictions on the customer's account, such as transaction limits, holds, or activity restrictions pending completion of EDD.
4.1.4 Sanctions and Watchlist Screening at Onboarding
Sanctions and watchlist screening at onboarding is a critical compliance control that must be performed prior to or contemporaneously with account opening. This function is retained entirely by BRB.
OFAC SDN and Consolidated Sanctions List Screening. BRB is both Responsible and Accountable for performing screening of all prospective BaaS customers against the Office of Foreign Assets Control's Specially Designated Nationals and blocked Persons List ("SDN List"), the Consolidated Sanctions List, and all other applicable OFAC sanctions programs. This screening is performed through the Veridian screening platform, which is being enhanced under the Veridian TMS v.10.0 OFAC module upgrade, targeted to be fully operational by November 1, 2025. The BaaS Partner is Informed of the results of OFAC screening as relevant to its platform operations (e.g., whether a prospective customer has been blocked or rejected).
Screening Against Other Watchlists. BRB is both Responsible and Accountable for screening prospective BaaS customers against other relevant watchlists, including PEP databases, adverse media sources, FinCEN 314(a) lists, and other government and law enforcement lists. The BaaS Partner is Consulted and may provide supplementary screening data from its own risk-management tools, but BRB retains independent screening capability and decision-making authority over all watchlist hits.
It is noted that OFAC screening gaps were identified as a core deficiency under the Consent Order. The OCC examination determined that approximately 3.8 million NovaPay transactions went unscreened against OFAC lists during CY 2023, representing approximately 12% of the 31.7 million total NovaPay transactions processed in that year. This screening gap resulted from a failure to integrate NovaPay's transaction data feed into the Veridian OFAC screening module. The remediation plan requires 100% OFAC screening of all BaaS transactions, without exception, effective immediately, with full system integration completed no later than the Veridian TMS v.10.0 deployment date.
4.2 Enhanced Due Diligence (EDD) — High-Risk Customers
Enhanced Due Diligence is the heightened scrutiny applied to customers identified as presenting elevated BSA/AML risk. The EDD process is triggered by specific risk indicators and involves the collection and review of additional documentation and information beyond baseline CDD requirements. All EDD trigger and approval decisions are retained by BRB.
4.2.1 EDD Trigger Identification
Identification of EDD Triggers. The BRB BSA/AML Department is both Responsible and Accountable for the identification of EDD triggers across all BaaS customer accounts. EDD triggers include, but are not limited to: customer location in or significant transactions with high-risk jurisdictions (as identified by FATF, the State Department, or BRB's jurisdiction risk assessment); PEP status (foreign or domestic); adverse media hits indicating potential involvement in financial crime, corruption, or other illicit activity; unusual or suspicious transaction patterns; high transaction volume or rapid escalation in volume; law enforcement inquiries or subpoenas related to the customer; and any other factors identified in BRB's Revised CDD/EDD Policy as warranting enhanced scrutiny.
The BaaS Partner is Consulted in this process and bears an affirmative obligation to immediately escalate to BRB any information suggesting that a customer may present elevated risk. This escalation obligation is ongoing and applies throughout the customer relationship, not only at onboarding. Failure by a BaaS Partner to promptly escalate risk-relevant information constitutes a material breach of its CDD/EDD obligations under the BaaS Program Agreement.
Decision to Apply EDD. The decision to apply EDD to a specific customer or account is made by the BRB BSA/AML Department, which is Responsible for the assessment, and the BSA Officer (Thomas Ikeda), who is Accountable for the decision. This decision is non-delegable and may not be made by a BaaS Partner.
4.2.2 EDD Information Collection
Collection of Additional EDD Documentation. Once the decision to apply EDD has been made, additional documentation and information must be collected from the customer. The types of documentation and information required for EDD include, but are not limited to: source of funds (i.e., the origin of the specific funds used in or expected to be used in the account), source of wealth (i.e., the origin of the customer's overall financial resources), the stated purpose of the account, the expected activity profile (including anticipated transaction types, volumes, and counterparties), enhanced identification documentation, and any other information specified by BRB's BSA/AML Department based on the specific risk factors present.
The BaaS Partner is Responsible for customer-facing collection of EDD documentation at BRB's direction. This means that the BaaS Partner serves as the primary point of contact for the customer and facilitates the collection of the required documentation through its platform or direct communication with the customer. However, the BRB BSA/AML Department is Accountable for specifying the required documentation, reviewing the documentation for adequacy, and determining whether additional information is needed. The BaaS Partner does not have discretion to determine what EDD documentation is required or to determine that collected documentation is sufficient — these are BRB-retained functions.
Independent BRB Outreach for Tier 1 Partners. For EDD cases involving customers of Tier 1 partners (NovaPay Technologies, FairLend Digital, VaultEdge), the BRB BSA/AML Department performs independent outreach directly to the customer for EDD collection on a sample basis, with a minimum sampling rate of 25% of all EDD cases. This independent outreach serves as both a quality assurance control (verifying that partner-collected EDD documentation is accurate and complete) and a substantive EDD measure (enabling BRB analysts to directly assess the customer's responses and risk profile).
Independent BRB Outreach for Tier 2 and Tier 3 Partners. For EDD cases involving customers of Tier 2 and Tier 3 partners, BRB performs independent outreach on a minimum 10% sample of EDD cases. The lower sampling rate for Tier 2 and Tier 3 partners reflects the smaller volume and generally lower risk profile of these partners' customer bases, but BRB retains the right to increase the sampling rate at any time based on quality assurance results or other risk factors.
4.2.3 EDD Review and Approval
Review and Approval of EDD Package. The review and approval of each EDD package — comprising all documentation and information collected from the customer and any independent research conducted by BRB — is performed by the BRB BSA/AML Department at the senior analyst level or above. A senior analyst or above is Responsible for the substantive review, and the BSA Officer (Thomas Ikeda) is Accountable for the adequacy of the EDD review and the resulting decision. The BaaS Partner is Informed of the outcome of the EDD review, including any resulting account restrictions, enhanced monitoring requirements, or account closure decisions.
Escalation of Unresolved EDD Cases. EDD cases that cannot be resolved at the analyst or senior analyst level — for example, cases where the customer fails to provide requested documentation, where the documentation raises additional concerns, or where complex legal or factual questions arise — are escalated through the following chain:
(a) BSA Officer (Thomas Ikeda) — initial escalation for senior review and decision;
(b) CCO (Patricia Langston) — further escalation where the BSA Officer determines that the matter requires enterprise-level compliance consideration;
(c) Chief Risk Officer (Melissa Chu) — escalation for matters involving significant risk exposure or potential reputational impact to the Bank;
(d) General Counsel (Gregory Nardone) — escalation for matters involving legal questions, including the application of sanctions regulations, law enforcement requests, or potential litigation exposure;
(e) Board Compliance Committee (James Rutherford, Chair) — escalation for matters of the highest significance, as determined by the CCO or Chief Risk Officer.
The BaaS Partner is Informed of any account restrictions imposed as a result of unresolved EDD cases and is required to implement such restrictions on its platform in accordance with BRB's instructions.
4.2.4 EDD for the 47,000 Remediation Accounts
The retrospective CDD/EDD remediation of the approximately 47,000 accounts identified as deficient in the Consent Order represents a critical remediation workstream. This sub-section addresses the RACI allocation specifically for this remediation effort.
Retrospective EDD Remediation. The BRB BSA/AML Department, supplemented by temporary staff provided by Pinnacle Compliance Solutions LLC (30 full-time equivalent analysts, engaged under Statement of Work Ref. PCS-BRB-2025-0012), is Responsible for the retrospective remediation of the 47,000 deficient accounts. The BSA Officer (Thomas Ikeda) is Accountable for the remediation effort, including adherence to the phased milestones established by the Consent Order.
Each BaaS Partner is Responsible for cooperating in the remediation of its proportionate share of the 47,000 deficient accounts, including by providing all requested customer data and documentation, facilitating direct customer outreach by BRB and Pinnacle Compliance Solutions analysts, and implementing any account restrictions or modifications directed by BRB during the remediation process. BaaS partner cooperation is mandatory under both existing program agreements and the amended compliance addenda being executed in connection with the remediation.
The phased remediation milestones are as follows:
• July 15, 2025: Remediation of 23,500 accounts (50% of the 47,000 total), with priority given to the highest-risk accounts as determined by the CDD/EDD Remediation Methodology & Prioritization Memorandum.
• January 15, 2026: Remediation of all 47,000 accounts (100%).
The approved budget for the CDD/EDD remediation project is $4,300,000, which covers Pinnacle Compliance Solutions staffing, technology and data costs, and related expenses. Budget oversight is maintained by the CCO (Patricia Langston) in coordination with the Chief Financial Officer.
4.3 Ongoing Monitoring
Ongoing monitoring encompasses all CDD/EDD activities performed after the initial onboarding phase, on a continuous or periodic basis, to detect changes in customer risk profile, suspicious transaction patterns, and sanctions list updates.
4.3.1 Transaction Monitoring
Operation and Maintenance of Transaction Monitoring System. BRB IT (led by Linda Petrosian) and the BRB BSA/AML Department are jointly Responsible for the operation, maintenance, and optimization of the Veridian transaction monitoring system ("Veridian TMS"), which is the Bank's primary platform for detecting potentially suspicious transactions across all banking channels, including BaaS channels. BRB is Accountable for the effectiveness and adequacy of its transaction monitoring program. The Veridian TMS is currently operating at version 8.3 and is being upgraded to version 10.0, with targeted deployment by August 1, 2025, under Contract No. VA-BRB-2023-0044 amendment. The BaaS Partner is Responsible for transmitting complete and accurate transaction data to BRB in the required formats and timeframes, as specified by BRB IT, to enable effective transaction monitoring. Failure by a BaaS Partner to transmit complete and timely transaction data constitutes a material compliance failure and will be escalated in accordance with Section 8.5.
Alert Review and Disposition. The BRB BSA/AML Department is both Responsible and Accountable for the review and disposition of all transaction monitoring alerts generated by the Veridian TMS. In CY 2024, the Veridian TMS generated approximately 41,500 transaction monitoring alerts, of which approximately 9.3% resulted in SAR filings (a SAR conversion rate of approximately 3,847 SARs from the combination of TM alerts and other referral channels). The BaaS Partner is Consulted on specific alerts as needed — for example, BRB may request that the BaaS Partner provide contextual information regarding a flagged customer or transaction to assist in the alert disposition process.
SAR Filing Determination. The determination of whether suspicious activity exists and whether a SAR should be filed with FinCEN is the exclusive responsibility of BRB. The BSA Officer (Thomas Ikeda) is Accountable for all SAR filing decisions, and the BRB BSA/AML Department is Responsible for preparing and filing SARs. In CY 2024, BRB filed 3,847 SARs, of which 2,108 (54.8%) were related to activity in BaaS customer accounts. No BaaS Partner is authorized to make SAR filing decisions or to access SAR-related information, consistent with the confidentiality requirements of 31 U.S.C. § 5318(g)(2).
4.3.2 Ongoing Customer Risk Reassessment
Monitoring for Changes in Customer Risk Profile. The BRB BSA/AML Department is both Responsible and Accountable for monitoring all BaaS customer accounts for changes in risk profile that may warrant a risk rating adjustment or the application or removal of EDD. Monitored factors include changes in transaction patterns, adverse media developments, sanctions list updates, law enforcement inquiries, changes in customer-disclosed information (e.g., change of address to a high-risk jurisdiction), and other risk indicators. The BaaS Partner is Responsible for promptly reporting to BRB any material changes in customer information or activity observed through the partner's platform, including changes in customer-provided information, significant changes in account activity patterns, and any customer communications that may suggest involvement in suspicious activity.
Risk Rating Adjustment Decisions. All decisions to adjust a customer's risk rating — whether upward (indicating increased risk) or downward (indicating decreased risk) — are made by the BRB BSA/AML Department, which is Responsible for the analysis, and the BSA Officer (Thomas Ikeda), who is Accountable for the decision. Risk rating adjustments are documented in BRB's customer risk management system and are reflected in the ongoing monitoring parameters applied to the customer's account.
4.3.3 Ongoing OFAC and Watchlist Screening
Rescreening Against Updated OFAC Lists. BRB is both Responsible and Accountable for rescreening all BaaS customer accounts and pending transactions against updated OFAC lists (including the SDN List, the Consolidated Sanctions List, and all sectoral sanctions programs) each time the lists are updated. Rescreening is automated through the Veridian platform and occurs upon publication of each OFAC list update.
Dispositioning of Rescreening Hits. The BRB BSA/AML Department is both Responsible and Accountable for the review and disposition of all rescreening hits. In CY 2024, OFAC screening (including both initial and rescreening) generated approximately 14,320 hits across all channels, of which 12 were determined to be true matches requiring blocking or rejection — a false-positive rate of approximately 99.9%. The BaaS Partner is Informed of any blocking actions, transaction rejections, or account freezes resulting from OFAC matches and is required to implement such actions on its platform immediately upon notification from BRB. The remediated Veridian TMS v.10.0 system must ensure comprehensive and uninterrupted rescreening coverage across all BaaS channels.
4.4 Periodic Review
Periodic review refers to the scheduled refresh of CDD and EDD documentation on a risk-based schedule, as well as reviews triggered by specific events.
4.4.1 Scheduled CDD/EDD Refresh
BRB's Revised CDD/EDD Policy establishes the following risk-based schedule for periodic CDD/EDD refreshes:
High-Risk Customers — Full CDD/EDD Refresh Every 12 Months. For customers rated as high-risk under BRB's risk-scoring methodology, a full CDD/EDD refresh is required every twelve (12) months. The refresh includes re-verification of customer identity, updated beneficial ownership information (for legal entity customers), review of source of funds and source of wealth, updated activity profile, and a fresh assessment of all risk factors. The BRB BSA/AML Department is both Responsible and Accountable for performing and documenting the high-risk refresh. The BaaS Partner is Responsible for facilitating updated information collection from customers at BRB's direction, including by initiating customer contact through the partner's platform and transmitting collected documentation to BRB.
Medium-Risk Customers — CDD Refresh Every 24 Months. For customers rated as medium-risk, a CDD refresh is required every twenty-four (24) months. The refresh includes updated identity verification, review of account activity, and reassessment of risk factors. The same RACI allocation applies: BRB BSA/AML Department is Responsible and Accountable; the BaaS Partner is Responsible for facilitating information collection.
Low-Risk Customers — CDD Refresh Every 36 Months. For customers rated as low-risk, a CDD refresh is required every thirty-six (36) months. The BaaS Partner is Responsible for collecting updated information from customers and transmitting it to BRB. The BRB BSA/AML Department is Accountable for the refresh program and reviews a sample of partner-collected refreshes for quality assurance.
4.4.2 Trigger-Event Review
In addition to scheduled periodic reviews, CDD/EDD reviews may be triggered by specific events that suggest a change in the customer's risk profile or the potential for suspicious activity.
Review Triggered by Specific Events. Events that trigger an ad hoc CDD/EDD review include, but are not limited to: receipt of a law enforcement inquiry, subpoena, or grand jury subpoena relating to a customer; negative or adverse media reporting regarding a customer; a significant and unexplained change in the customer's transaction volume or patterns; the filing of a SAR relating to the customer; a customer's request to engage in a new type of transaction or product that presents heightened risk; and any other event identified in BRB's Revised CDD/EDD Policy as a trigger event. The BRB BSA/AML Department is both Responsible and Accountable for performing trigger-event reviews. The BaaS Partner is Consulted (may be asked to provide additional information or context) and Informed of any resulting account actions.
Decision to Restrict, Suspend, or Close Account. The decision to restrict, suspend, or close a customer account as a result of a trigger-event review — or for any other BSA/AML reason — is made exclusively by BRB. BRB is Accountable for this decision, and sole decision authority rests with BRB. The BSA Officer (Thomas Ikeda) and the CCO (Patricia Langston) serve as co-approving authorities for account restriction, suspension, or closure decisions. The BaaS Partner is Informed of the decision and is required to execute BRB's instructions on its platform, including implementing account restrictions, blocking transactions, and closing accounts, within the timeframes specified by BRB (typically five (5) business days, or immediately in the case of OFAC matches or imminent risk).
4.5 Account Closure / Offboarding for BSA/AML Reasons
The closure or offboarding of a customer account for BSA/AML reasons — including but not limited to confirmed suspicious activity, inability to complete required EDD, confirmed sanctions match, or failure to provide required CDD documentation — is a sensitive process that must be conducted in compliance with applicable legal requirements, including the prohibition on tipping off (31 U.S.C. § 5318(g)(2)).
Decision to Close Account for BSA/AML Reasons. BRB is Accountable for all decisions to close accounts for BSA/AML reasons and retains sole decision authority. The BSA Officer (Thomas Ikeda) and the CCO (Patricia Langston) are co-approvers for all BSA/AML account closures. The BaaS Partner is Informed of the closure decision and must execute the closure on its platform within the BRB-specified timeframe, typically five (5) business days from notification. The BaaS Partner does not have the authority to prevent, delay, or override a BRB-directed account closure for BSA/AML reasons.
Customer Notification of Closure. The BaaS Partner is Responsible for drafting and delivering the customer notification of account closure, using a BRB-approved template that complies with all applicable legal requirements, including the prohibition on disclosing the existence of a SAR or the fact that the closure is related to a SAR filing. BRB is Accountable for the adequacy of the notification and reviews all closure communications before issuance to ensure compliance with anti-tipping-off requirements. BRB Compliance reviews all draft notifications.
Recordkeeping Post-Closure. BRB is Accountable for the retention of all records relating to closed accounts, including CDD/EDD documentation, transaction records, SAR filings, and correspondence, for a minimum of five (5) years after the date of account closure, as required by 31 C.F.R. § 1020.320(d) (for SAR-related records). The BaaS Partner is Responsible for preserving all customer data in its systems and transmitting complete records to BRB at or prior to the time of account closure. BRB must maintain these records independently of the BaaS Partner's systems.
5. Partner-Specific Detail — Tier 1 Partners
This Section 5 provides individualized CDD/EDD responsibility detail for each of BRB's three Tier 1 BaaS Partners. These three partners collectively represent approximately 87% of total BaaS transaction volume and the overwhelming majority of BaaS-related compliance risk. The general RACI framework set forth in Section 4 applies to all Tier 1 partners; this Section 5 supplements that framework with partner-specific provisions reflecting each partner's unique product type, risk profile, and operational characteristics.
5.1 NovaPay Technologies Inc.
Entity: NovaPay Technologies Inc., a corporation organized under the laws of the State of Delaware.
CEO / Primary Contact: Ethan Garrison, Chief Executive Officer.
Address: 450 Mission Street, Suite 1200, San Francisco, CA 94105.
Product Type: Consumer payments and peer-to-peer (P2P) transfer application. NovaPay operates a consumer-facing mobile application that enables users to send and receive payments, make purchases, and manage funds. All NovaPay customer accounts are individual consumer accounts held on BRB's charter.
End-User Accounts: Approximately 2.1 million active accounts as of December 31, 2024.
BaaS Transaction Volume (CY 2024): Approximately $30.5 billion, representing approximately 41% of BRB's total BaaS transaction volume of $74.3 billion. NovaPay is the single largest BaaS Partner by both transaction volume and account count.
Date Onboarded: 2021.
Risk Profile: