[slide 1]
Confidential — Attorney-Client Privileged
Belmont Ridge Financial Group, Inc. — Board of Directors
BSA/AML & Sanctions Compliance Program Remediation Overview
Prepared by Calderwood & Harkness LLP
C&H Matter No. 1045-00002
Presented by Philip Hartmann, Responsible Partner, Banking & Finance
Date: February 2025
ATTORNEY-CLIENT PRIVILEGED AND CONFIDENTIAL — DO NOT DISTRIBUTE
[slide 2]
Agenda
1. Executive Summary: The Consent Order and Its Implications
2. Belmont Ridge Bank — Institutional Overview and Current Posture
3. Key Findings: Five Core Deficiency Categories
4. Regulatory History — Escalation from MRA to MRIA to Consent Order
5. Remediation Action Plan: Five Workstreams
6. Timeline and Critical Milestones
7. Budget and Financial Impact
8. Engagement of Outside Counsel and Independent Consultant
9. Technology Remediation: Vendor Strategy
10. Board Governance Obligations and Compliance Committee
11. Regulatory Risk Assessment: FinCEN, OFAC, and DOJ Exposure
12. Shareholder and Disclosure Considerations
13. Immediate Action Items and Next Steps
[slide 3]
Executive Summary
OCC Consent Order No. OCC-2025-003 issued January 15, 2025, citing significant BSA/AML and OFAC sanctions compliance deficiencies
Civil money penalty of $14.5 million assessed; payable by March 16, 2025
Five core deficiency categories identified: OFAC screening, SAR filing, CDD/EDD, transaction monitoring model validation, and Board oversight
Comprehensive remediation required; full implementation deadline: February 15, 2026
Total estimated financial outlay: $57.0 million ($42.5M remediation budget + $14.5M CMP)
Calderwood & Harkness LLP engaged February 10, 2025 as outside regulatory counsel
Thornfield Consulting Group LLC engaged as OCC-mandated independent consultant (OCC non-objection received February 5, 2025)
Prior counsel Drayton Mercer LLP engagement terminated January 2025 following issuance of Consent Order
[slide 4]
Belmont Ridge Bank — Institutional Snapshot
Total assets: $38.7 billion (as of December 31, 2024)
Total deposits: $29.4 billion
Net income (FY 2024): $412 million
Tier 1 capital ratio: 11.2%
Approximately 5,800 employees across retail banking, commercial lending, wealth management, and Banking-as-a-Service (BaaS)
14 active fintech BaaS partners; BaaS revenue of $127.4 million (CY 2024)
BaaS total transaction volume: $74.3 billion (CY 2024)
BRFG (NYSE): 179.5 million shares outstanding; market cap approximately $8.58 billion (as of February 7, 2025)
CRA Rating: Satisfactory (June 2023)
[slide 5]
OCC Consent Order — Key Findings: Five Core Deficiency Categories
1. OFAC Sanctions Screening: Failed to screen 100% of BaaS channel transactions; ~12% of NovaPay wire and ACH transactions unscreened (~3.8M of 31.7M NovaPay transactions in CY 2023)
2. SAR Filing Deficiencies: Backlog of ~2,400 unreviewed suspicious activity alerts as of September 2024; average SAR filing time of 78 days (vs. 30-day regulatory expectation)
3. CDD/EDD Failures: ~47,000 high-risk customer accounts (primarily fintech-onboarded) lacked adequate Customer Due Diligence or Enhanced Due Diligence documentation
4. Transaction Monitoring Model Validation: Veridian TMS v.8.3 not independently validated since March 2021 (>3 years); tuning parameters last updated October 2022
5. Board Oversight: No dedicated Compliance Committee; BSA/AML reporting to Board was quarterly only and lacked key metrics (SAR volumes, OFAC screening hit rates, BaaS partner risk ratings)
[slide 6]
Regulatory History — Escalation of Supervisory Findings (2022–2025)
June 2022: OCC issues Matter Requiring Attention (MRA) regarding BSA/AML transaction monitoring deficiencies
October 2022: Last tuning of Veridian TMS v.8.3 parameters (limited response to MRA)
November 2023: OCC escalates to Matter Requiring Immediate Attention (MRIA) regarding OFAC screening gaps
March 2024 – September 2024: OCC conducts targeted BSA/AML examination (6-month cycle)
September 2024: Examination concludes; Caldera & Pope LLP independent BSA/AML test also identifies multiple deficiencies echoing OCC findings
January 15, 2025: OCC issues Consent Order No. OCC-2025-003, citing failure to adequately remediate prior MRA and MRIA
January 2025: Prior outside counsel Drayton Mercer LLP (lead partner Helen Frazier) terminated
[slide 7]
BSA/AML Program — Current State Metrics
BSA/AML department headcount: 62 FTEs (as of January 2025)
BSA/AML budget (FY 2024): $18.2 million
SARs filed (CY 2024): 3,847 (up from 2,914 in CY 2023; +32%)
BaaS-related SARs (CY 2024): 2,108 (54.8% of total SARs)
CTRs filed (CY 2024): 28,612
Transaction monitoring alerts (CY 2024): 41,500; SAR conversion rate: 9.3%
OFAC screening hits (CY 2024): 14,320 (12 true matches; 99.9% false-positive rate)
SAR backlog: 2,400 unreviewed alerts (as of September 2024)
Average SAR filing time: 78 days (regulatory expectation: 30 days)
High-risk accounts lacking CDD/EDD: 47,000
[slide 8]
Remediation Action Plan — Five Workstreams Overview
Workstream 1: OFAC Sanctions Screening Remediation — Achieve 100% transaction screening across all BaaS channels; full operationalization by November 1, 2025
Workstream 2: SAR Backlog Clearance & Process Improvement — Disposition all 2,400 unreviewed alerts by June 30, 2025; reduce filing time to within 30 days; complete SAR lookback
Workstream 3: CDD/EDD Remediation — Remediate 47,000 high-risk accounts; 50% by July 15, 2025; 100% by January 15, 2026
Workstream 4: Transaction Monitoring Model Validation & Tuning — Upgrade Veridian TMS to v.10.0 (UAT by August 1, 2025); independent model validation by October 1, 2025
Workstream 5: BSA/AML Program Governance & Training — Establish Compliance Committee; enhance Board reporting; enterprise-wide training; expand headcount from 62 to 77 FTEs
Comprehensive Remediation Action Plan due to OCC by May 15, 2025
Full program implementation and self-certification due February 15, 2026
[slide 9]
Workstream 1: OFAC Sanctions Screening Remediation
Root cause: Veridian TMS v.8.3 OFAC module did not cover 100% of fintech BaaS transaction flows
Approximately 3.8 million NovaPay wire and ACH transactions unscreened in CY 2023 (12% of 31.7 million total NovaPay transactions)
Remediation: Veridian OFAC module enhancement integrated with TMS v.10.0 upgrade
Real-time and batch screening workflow redesign for all 14 BaaS partner transaction flows
Full OFAC screening operationalization target: November 1, 2025
Testing plan: Validate 100% screening coverage post-implementation across all BaaS channels
OFAC voluntary self-disclosure analysis underway — strategic decision pending C&H recommendation
[slide 10]
Workstream 2: SAR Backlog Clearance & Process Improvement
2,400 unreviewed suspicious activity alerts to be fully dispositioned by June 30, 2025
SAR backlog triage protocol: Risk-ranked by transaction amount, customer risk rating, alert type, and BaaS partner association
Pinnacle Compliance Solutions LLC engaged to provide 30 temporary FTE analysts ($3.6 million, 12-month staffing contract)
SAR lookback project covering historical activity ($5.5 million budget)
Target: Reduce average SAR filing time from 78 days to within 30 days
Revised SAR policy and procedures under development; quality assurance framework being established
Interim SAR backlog status report due to OCC by March 31, 2025
[slide 11]
Workstream 3: CDD/EDD Remediation
47,000 high-risk customer accounts identified — primarily onboarded through fintech BaaS partners
Risk-based prioritization: BaaS-onboarded accounts from NovaPay, FairLend Digital, and VaultEdge prioritized by risk score and transaction volume
Milestone 1: 50% remediation (23,500 accounts) by July 15, 2025
Milestone 2: 100% remediation (47,000 accounts) by January 15, 2026
Budget: $4.3 million
Revised CDD/EDD policy and BaaS Partner Responsibility Matrix being developed
Progress tracking dashboard to be deployed for Compliance Committee and OCC reporting
[slide 12]
Workstream 4: Transaction Monitoring Model Validation & Technology Upgrade
Veridian TMS v.8.3 last independently validated: March 2021 (>3 years); tuning parameters last updated: October 2022
Upgrade to Veridian TMS v.10.0 with enhanced OFAC module
Implementation cost: $2.8 million one-time + $1.9 million/year incremental licensing (new ACV: $6.0M/year, up from $4.1M/year)
UAT completion and deployment target: August 1, 2025
Independent model validation of upgraded TMS: October 1, 2025
Alternative vendor evaluation: Ridgeline Data Systems LLC ($7.2M/year, 5-year term, $36.0M TCV) as contingency fallback
Existing Veridian contract (No. VA-BRB-2023-0044) expires December 2026
[slide 13]
Workstream 5: BSA/AML Program Governance & Training
Establishment of dedicated Compliance Committee of the Board (Chair: James Rutherford)
Compliance Committee Charter and amended corporate bylaws under development
Monthly Compliance Committee reporting during remediation; quarterly thereafter
Key reporting metrics: SAR volumes, filing timeliness, OFAC screening hit rates, CDD/EDD progress, BaaS partner risk ratings, TM alert volumes, SAR conversion rates
BSA/AML department expansion: 62 FTEs → 77 FTEs (15 new permanent hires; $2.25M annual fully loaded cost)
Enterprise-wide BSA/AML and OFAC training program with audience segmentation (front-line, BaaS, compliance, senior management, Board)
Board and senior management training on personal liability, OFAC obligations, and Consent Order requirements
Training and policy development budget: $1.8 million; Board/governance restructuring: $500,000
[slide 14]
Critical Milestones and Timeline
January 15, 2025 — Consent Order effective date
February 5, 2025 — OCC non-objection to Thornfield as independent consultant ✓
February 10, 2025 — C&H engagement opens; Thornfield engagement executed ✓
February 12, 2025 — C&H retainer ($500,000) deposited ✓
February 28, 2025 — Board Resolution: Acknowledge Consent Order; establish Compliance Committee
March 1, 2025 — Thornfield on-site assessment commences
March 16, 2025 — CMP payment of $14.5 million due
March 31, 2025 — Interim SAR backlog status report to OCC
April 15, 2025 — Thornfield preliminary gap assessment delivered
May 15, 2025 — Comprehensive Remediation Action Plan due to OCC (end of Phase 1)
June 30, 2025 — SAR backlog clearance target (2,400 alerts fully dispositioned)
July 15, 2025 — CDD/EDD 50% remediation milestone (23,500 accounts)
August 1, 2025 — Veridian TMS v.10.0 UAT complete and deployed
September 15, 2025 — First quarterly progress report to OCC
October 1, 2025 — Independent model validation of upgraded TMS
November 1, 2025 — OFAC screening fully operational for all BaaS channels
December 15, 2025 — Second quarterly progress report to OCC
January 15, 2026 — CDD/EDD 100% remediation milestone (47,000 accounts)
February 15, 2026 — Full compliance implementation; Thornfield final validation report; self-certification due
[slide 15]
Total Remediation Budget and Financial Impact
Civil money penalty: $14,500,000 (due March 16, 2025)
Outside counsel — Calderwood & Harkness LLP: $8,000,000 (Phase 1: $4.8M; Phase 2: $3.2M; ±15% fee collar; overruns above $9.2M require GC approval)
Independent consultant — Thornfield Consulting Group LLC: $6,900,000 ($6.5M fixed fee + $400K expense cap)
Technology upgrade — Veridian TMS v.10.0: $4,700,000 ($2.8M implementation + $1.9M Year 1 incremental licensing)
Temporary staffing — Pinnacle Compliance Solutions LLC: $3,600,000 (30 FTEs × 12 months)
SAR lookback project: $5,500,000
CDD/EDD remediation project: $4,300,000
Internal headcount additions (15 FTEs): $2,250,000 (annual fully loaded)
Training and policy development: $1,800,000
Board/governance restructuring: $500,000
Board-approved remediation budget (excl. CMP): $42,500,000
Total estimated outlay (incl. CMP): $57,000,000
[slide 16]
Engagement of Outside Counsel and Independent Consultant
Calderwood & Harkness LLP — Outside regulatory counsel
• Responsible Partner: Philip Hartmann (Banking & Finance; $1,450/hr)
• Billing Partner: Marcus Delgado (Intellectual Property; $1,350/hr — cross-staffed for fintech patent/licensing compliance in BaaS)
• Lead Associate: Yuki Nakamura (Litigation; $895/hr)
• Working Associate: Carlos Espinoza (Litigation; $725/hr)
Thornfield Consulting Group LLC — OCC-mandated independent consultant (Engagement Ref: TCG-BRB-2025-001)
• Managing Director: Dr. Vivian Castellano (Financial Crimes Advisory)
• Robert Eastman — AML Transaction Monitoring
• Jennifer Hwang — Sanctions & OFAC Compliance
• Nathaniel Burgess — Fintech & Payments Compliance
• Thornfield's counsel: Hargrove & Stein PC
Oversight framework: Bi-weekly status calls; privilege & confidentiality side letter in place; common-interest privilege framework established
[slide 17]
Fintech / BaaS Partnership Oversight Restructuring
14 active BaaS partners generating $127.4 million in revenue and processing $74.3 billion in transaction volume (CY 2024)
Top 3 partners: NovaPay Technologies (41% of volume; $30.5B), FairLend Digital (28%), VaultEdge (18%); remaining 11 partners: 13%
BaaS-related SARs represented 54.8% of all BRB SARs in CY 2024 (2,108 of 3,847)
Compliance remediation letters issued to NovaPay (Ethan Garrison, CEO) and FairLend Digital (Aisha Okonkwo, CEO) demanding enhanced cooperation
Revised BaaS Program Agreement template compliance addendum being developed for all 14 partners
Standardized BSA/AML risk assessment template for quarterly partner evaluation
BaaS Compliance Oversight Framework: risk-based partner tiering, ongoing monitoring, compliance testing, and escalation/termination triggers
Warren Ashby (Head of Fintech Partnerships) responsible for BaaS division coordination
[slide 18]
Board Governance Obligations Under the Consent Order
Board Resolution required by February 28, 2025: Acknowledge Consent Order; establish Compliance Committee; authorize $42.5M remediation budget; direct full cooperation with C&H and Thornfield
Compliance Committee to be chaired by James Rutherford; members to include at least two additional independent directors
Monthly Compliance Committee meetings during remediation (transitioning to quarterly post-completion)
Directors must actively oversee BSA/AML compliance — receipt and review of monthly reports on SAR volumes, OFAC metrics, CDD/EDD progress, and remediation milestones
Personal liability exposure: Civil money penalties under 12 U.S.C. § 1818; institution-affiliated party removal proceedings; shareholder derivative suit risk
D&O insurance coverage adequacy under review in light of $57.0M total remediation outlay
Compliance Committee Charter and amended bylaws to be adopted concurrently with Board Resolution
[slide 19]
Regulatory Risk Assessment: Potential Additional Exposure
FinCEN: Monitoring SAR filing remediation; liaison Angela Drummond (Associate Director, Enforcement Division) coordinating with OCC; enforcement rights reserved; no separate action as of February 10, 2025
OFAC: Potential separate enforcement related to ~3.8 million unscreened NovaPay transactions; C&H conducting privileged voluntary self-disclosure analysis — strategic decision pending