1045-00002 · Calderwood & Harkness LLP · documents

board-resolution-consent-order-compliance-committee.docx DOCUMENT Antitrust

9 / 84 ← → ✕

PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT

RESOLUTIONS OF THE BOARD OF DIRECTORS OF BELMONT RIDGE FINANCIAL GROUP, INC.

Acknowledgment of OCC Consent Order No. OCC-2025-003 and Establishment of the Compliance Committee of the Board of Directors

Adopted: February 28, 2025

Prepared by: Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, NY 10019 C&H Matter No. 1045-00002

PREAMBLE AND RECITALS

Identity and Background of the Company

WHEREAS, Belmont Ridge Financial Group, Inc. ("BRFG" or the "Company") is a corporation duly organized and existing under the laws of the State of Delaware, with its principal executive office located at 680 Lexington Avenue, 22nd Floor, New York, NY 10022, and its shares of common stock are listed on the New York Stock Exchange under the ticker symbol "BRFG"; and

WHEREAS, BRFG is the sole bank holding company of Belmont Ridge Bank National Association ("BRB" or the "Bank"), a national banking association duly chartered under the National Bank Act, 12 U.S.C. § 21 et seq. (OCC Charter No. 48271; FDIC Certificate No. 31845), headquartered at 680 Lexington Avenue, 22nd Floor, New York, NY 10022; and

WHEREAS, BRB operates core business lines including retail banking, commercial lending, wealth management, and financial technology Banking-as-a-Service ("BaaS") partnerships, with approximately fourteen (14) active fintech sponsors currently operating through BRB's national bank charter pursuant to individually negotiated BaaS program agreements; and

WHEREAS, as of December 31, 2024, BRB reported total assets of approximately $38.7 billion, total deposits of approximately $29.4 billion, and a Tier 1 Capital Ratio of 11.2%, as reflected in the Bank's most recently filed Call Report (FFIEC 031); and

Regulatory History and Consent Order

WHEREAS, the Office of the Comptroller of the Currency (the "OCC") issued a Matter Requiring Attention ("MRA") to BRB in June 2022 regarding deficiencies in the Bank's Bank Secrecy Act and anti-money laundering ("BSA/AML") transaction monitoring program, identifying concerns related to alert disposition processes and the timeliness of suspicious activity report filings; and

WHEREAS, the OCC subsequently issued a Matter Requiring Immediate Attention ("MRIA") to BRB in November 2023, escalating the supervisory concern and citing specific gaps in the Bank's Office of Foreign Assets Control ("OFAC") sanctions screening processes, particularly as applied to transaction flows originating from or processed through the Bank's fintech BaaS partners; and

WHEREAS, the OCC conducted a targeted BSA/AML examination of BRB commencing in March 2024 and concluding in September 2024, during which OCC examiners conducted extensive reviews of the Bank's BSA/AML compliance program, OFAC sanctions screening infrastructure, customer due diligence and enhanced due diligence procedures, transaction monitoring systems, suspicious activity reporting processes, and board-level governance and oversight mechanisms; and

WHEREAS, Caldera & Pope LLP, the Bank's external auditor and independent BSA/AML testing firm, completed an independent BSA/AML assessment in September 2024, the results of which identified multiple deficiencies and control weaknesses consistent with those subsequently cited by the OCC in its examination findings, including deficiencies in OFAC screening coverage for BaaS transaction volumes, SAR filing backlogs, and transaction monitoring model governance; and

WHEREAS, on January 15, 2025, the OCC issued Consent Order No. OCC-2025-003 (the "Consent Order") against Belmont Ridge Bank National Association, effective as of that date, citing significant deficiencies in the Bank's BSA/AML compliance program and OFAC sanctions screening framework; and

WHEREAS, the Consent Order identifies five (5) core deficiency categories, specifically:

(i) Inadequate OFAC Sanctions Screening Protocols for Fintech BaaS Transaction Flows — The Bank failed to screen approximately twelve percent (12%) of NovaPay Technologies Inc. ("NovaPay") wire transfer and Automated Clearing House ("ACH") transactions against OFAC's Specially Designated Nationals and blocked Persons List ("SDN List") and other applicable sanctions lists, resulting in approximately 3,800,000 transactions remaining unscreened out of a total of approximately 31,700,000 NovaPay transactions processed during calendar year 2023. The OCC determined that this failure resulted from a misconfigured data integration between NovaPay's payment processing platform and the Bank's OFAC screening module, which was not identified due to inadequate reconciliation and quality assurance procedures;

(ii) Deficient SAR Filing Timeliness and Quality — The Bank maintained a backlog of approximately 2,400 potentially suspicious activity alerts that remained unreviewed and undispositioned as of September 2024, and the Bank's average time to file a Suspicious Activity Report ("SAR") from the date of initial alert generation was approximately seventy-eight (78) days, significantly exceeding the regulatory expectation of approximately thirty (30) days, thereby impairing the timeliness and utility of SARs filed with the Financial Crimes Enforcement Network ("FinCEN");

(iii) Insufficient Customer Due Diligence and Enhanced Due Diligence — The Bank failed to perform adequate Customer Due Diligence ("CDD") and Enhanced Due Diligence ("EDD") for approximately 47,000 high-risk customer accounts, the majority of which were onboarded through the Bank's fintech BaaS partner channels without adequate beneficial ownership verification, risk assessment scoring, or ongoing monitoring commensurate with their risk profiles;

(iv) Inadequate Model Validation for Transaction Monitoring System — The Bank's primary transaction monitoring system, Veridian TMS v.8.3 (licensed from Veridian Analytics Inc.), had not been subjected to an independent model validation since March 2021, a period of approximately forty-two (42) months, in contravention of OCC Bulletin 2011-12 (Supervisory Guidance on Model Risk Management) and the Bank's own Model Risk Management Policy, resulting in unvalidated tuning parameters, unquantified false negative rates, and potential gaps in transaction monitoring coverage; and

(v) Board-Level Oversight Deficiencies — The Board of Directors lacked a standing Compliance Committee dedicated to overseeing regulatory compliance, BSA/AML, and sanctions programs, and the BSA/AML reports provided to the Board were limited to quarterly summaries that lacked key performance metrics, including SAR volumes and filing timeliness, OFAC screening hit rates, transaction monitoring alert volumes and SAR conversion rates, CDD/EDD remediation status, and individualized risk ratings for each BaaS partner;

and

WHEREAS, the Consent Order assesses a civil money penalty ("CMP") in the amount of Fourteen Million Five Hundred Thousand Dollars ($14,500,000) against BRB, payable to the United States Treasury within sixty (60) days of the effective date of the Consent Order (i.e., on or before March 16, 2025); and

WHEREAS, the Consent Order expressly provides that the imposition of the civil money penalty and the Bank's entry into the Consent Order do not preclude future referral by the OCC to the United States Department of Justice ("DOJ") for potential criminal prosecution or additional enforcement action by FinCEN, which is currently monitoring BRB's SAR filing remediation efforts pursuant to its independent supervisory authority under 31 U.S.C. § 5321; and

Public Disclosure and Shareholder Impact

WHEREAS, BRFG publicly disclosed the Consent Order on January 16, 2025, via a Form 8-K filed with the Securities and Exchange Commission and an accompanying press release, and such disclosure resulted in a decline in BRFG's common stock price from a closing price of approximately $47.82 per share on January 15, 2025, to a closing price of approximately $41.15 per share on January 16, 2025, representing a decline of approximately $6.67 per share, or approximately 13.9%; and

WHEREAS, as of February 7, 2025, BRFG had approximately 179,500,000 shares of common stock issued and outstanding, representing an approximate total market capitalization of approximately $8.58 billion; and

Engagement of Outside Counsel

WHEREAS, BRB's prior outside regulatory counsel, Drayton Mercer LLP, represented BRB during the 2023–2024 OCC examination cycle, including with respect to the Bank's response to the November 2023 MRIA and the Bank's interactions with OCC examiners during the targeted BSA/AML examination, and BRB terminated the engagement of Drayton Mercer LLP in January 2025 following the issuance of the Consent Order; and

WHEREAS, on February 10, 2025, BRB engaged Calderwood & Harkness LLP ("C&H") as outside regulatory counsel to advise and guide BRB through a comprehensive BSA/AML and sanctions compliance-program uplift, remediation of all findings and deficiencies identified in the Consent Order, negotiation and communication with the OCC, FinCEN, and other applicable regulatory authorities, and oversight of the independent consultant engagement mandated by the Consent Order, pursuant to an engagement letter dated February 10, 2025 (C&H Matter No. 1045-00002), with Philip Hartmann serving as the Responsible Partner for the engagement; and

WHEREAS, the C&H engagement is structured in two phases: Phase 1 (Assessment & Remediation Plan Development), spanning from February 10, 2025 through May 15, 2025, with estimated professional fees of Four Million Eight Hundred Thousand Dollars ($4,800,000); and Phase 2 (Implementation & Monitoring), spanning from May 16, 2025 through February 15, 2026, with estimated professional fees of Three Million Two Hundred Thousand Dollars ($3,200,000), for total estimated professional fees of Eight Million Dollars ($8,000,000), subject to a plus or minus fifteen percent (±15%) fee collar, such that any overruns in excess of Nine Million Two Hundred Thousand Dollars ($9,200,000) shall require the prior written approval of Gregory Nardone, General Counsel of BRFG and BRB; and

WHEREAS, a Five Hundred Thousand Dollar ($500,000) evergreen retainer was deposited by BRB with C&H on February 12, 2025, in accordance with the terms of the engagement letter; and

Independent Consultant. WHEREAS, Article VII of the Consent Order requires BRB to engage an independent consultant, acceptable to the OCC, to conduct a comprehensive assessment of the Bank's BSA/AML and OFAC compliance programs and to validate the adequacy and effectiveness of the Bank's remediation efforts; and

WHEREAS, following a competitive evaluation process, BRB selected Thornfield Consulting Group LLC ("Thornfield") as the independent consultant to fulfill the requirements of Article VII of the Consent Order, and the OCC issued its formal non-objection to Thornfield's engagement on February 5, 2025; and

WHEREAS, BRB and Thornfield executed an engagement agreement on February 10, 2025 (Thornfield Engagement Reference: TCG-BRB-2025-001), which provides for a fixed professional fee of Six Million Five Hundred Thousand Dollars ($6,500,000) for a twelve (12)-month engagement period commencing in February 2025 and concluding in February 2026, payable in equal monthly installments of Five Hundred Forty-One Thousand Six Hundred Sixty-Six Dollars and Sixty-Seven Cents ($541,666.67), plus reimbursable out-of-pocket expenses subject to a cap of Four Hundred Thousand Dollars ($400,000), for a total maximum engagement cost of Six Million Nine Hundred Thousand Dollars ($6,900,000); and

WHEREAS, Thornfield's engagement team is led by Dr. Vivian Castellano, Managing Director, Financial Crimes Advisory, and is further supported by Robert Eastman (Senior Director, AML Transaction Monitoring), Jennifer Hwang (Director, Sanctions & OFAC Compliance), and Nathaniel Burgess (Director, Fintech & Payments Compliance); and

WHEREAS, pursuant to the engagement agreement and the Consent Order, Thornfield is to commence its on-site assessment at BRB on March 1, 2025, deliver a preliminary gap assessment report to BRB and the OCC by April 15, 2025, and deliver a final validation report confirming the adequacy and effectiveness of remediation efforts by February 15, 2026; and

Remediation Budget. WHEREAS, management of BRB, in consultation with Calderwood & Harkness LLP, has prepared a comprehensive remediation budget (exclusive of the civil money penalty) totaling Forty-Two Million Five Hundred Thousand Dollars ($42,500,000) over a twelve (12)-month remediation period, comprised of the following estimated cost components:

and

WHEREAS, the total expected financial outlay in connection with the Consent Order, including the $14,500,000 civil money penalty and the $42,500,000 remediation budget, is approximately Fifty-Seven Million Dollars ($57,000,000); and

Board Governance Deficiency and Need for Compliance Committee

WHEREAS, the Consent Order specifically identifies the absence of a dedicated Compliance Committee of the Board of Directors as a material governance deficiency, noting that BSA/AML reporting to the Board was limited to quarterly reports that lacked key performance and risk metrics, including SAR filing volumes and timeliness, OFAC screening hit rates, CDD/EDD remediation status, transaction monitoring alert volumes and SAR conversion rates, and individualized risk ratings by BaaS partner; and

WHEREAS, the Board of Directors currently maintains a standing Audit Committee (chaired by Margaret Dao) and a standing Risk Committee (chaired by Arthur Connelly), but does not maintain a standing committee specifically dedicated to overseeing regulatory compliance, BSA/AML program management, and sanctions compliance; and

WHEREAS, the Consent Order requires, among other things, that the Board of Directors adopt a formal resolution within forty-five (45) days of the Consent Order's effective date (i.e., on or before February 28, 2025) formally acknowledging the Consent Order and committing to the remediation of all deficiencies identified therein; and

Key Consent Order Deadlines

WHEREAS, the Consent Order and the anticipated remediation plan establish the following key milestones and deadlines, which the Board considers essential to track and monitor:

RESOLUTIONS

NOW, THEREFORE, BE IT RESOLVED, as follows:

Resolution 1 — Acknowledgment of Consent Order

RESOLVED, that the Board of Directors of Belmont Ridge Financial Group, Inc. hereby formally acknowledges receipt and review of OCC Consent Order No. OCC-2025-003, issued on January 15, 2025, against Belmont Ridge Bank National Association, a complete copy of which has been presented to each director of the Board and has been filed with the minutes of this meeting.

RESOLVED FURTHER, that the Board of Directors hereby acknowledges the seriousness of the deficiencies identified in the Consent Order, including the five (5) core deficiency categories enumerated therein, and recognizes that the timely and complete remediation of such deficiencies is of the highest priority for the Company and the Bank. The Board commits the full resources of BRFG and BRB to achieve timely and complete compliance with all provisions, requirements, and deadlines set forth in the Consent Order.

RESOLVED FURTHER, that the Board of Directors hereby directs Diane Whitford, Chief Executive Officer of BRFG and BRB; Raymond Okoye, President and Chief Operating Officer of BRFG and BRB; Gregory Nardone, General Counsel and Corporate Secretary of BRFG and BRB; and Patricia Langston, Chief Compliance Officer of BRB, to ensure that all Consent Order deadlines are met in a timely manner and that the Board of Directors is kept fully informed of remediation progress on at least a monthly basis. Such monthly updates shall include, at a minimum, a status report on each of the key milestones identified in the Consent Order, a summary of any material communications with the OCC or FinCEN, and an assessment of any risks to the remediation timeline.

Resolution 2 — Establishment of the Compliance Committee

RESOLVED, that effective immediately, the Board of Directors of Belmont Ridge Financial Group, Inc. hereby establishes a standing Compliance Committee of the Board of Directors (the "Compliance Committee") as a permanent committee of the Board, constituted pursuant to the Company's Amended and Restated Bylaws as amended hereby and in accordance with applicable law.

RESOLVED FURTHER, that James Rutherford is hereby appointed as Chair of the Compliance Committee, effective immediately.

RESOLVED FURTHER, that the initial members of the Compliance Committee shall be as follows:

• James Rutherford — Chair

• Sandra Villarreal — Member

• Keith Yamamoto — Member

Each of the foregoing individuals has been determined by the Board to be an independent director of the Board in accordance with the applicable listing standards of the New York Stock Exchange and the Company's Corporate Governance Guidelines.

RESOLVED FURTHER, that Arthur Connelly, Lead Independent Director and Chair of the Risk Committee of the Board, and Margaret Dao, Chair of the Audit Committee of the Board, shall each serve as ex officio, non-voting liaisons to the Compliance Committee. The purpose of such liaison positions is to ensure effective coordination and information-sharing among the Risk Committee, the Audit Committee, and the Compliance Committee, and to avoid duplication of oversight efforts while maintaining the distinct mandate and independence of each committee.

RESOLVED FURTHER, that the Compliance Committee shall have the authority and responsibility to perform each of the following functions, in addition to such other functions as may be set forth in the Compliance Committee Charter:

(a) Oversee BRB's BSA/AML and sanctions compliance programs, including the Bank's policies, procedures, internal controls, and governance framework related to compliance with the Bank Secrecy Act, the USA PATRIOT Act, OFAC sanctions regulations, and all other applicable anti-money laundering and financial crimes laws and regulations;

(b) Monitor compliance with the Consent Order and the Comprehensive Remediation Action Plan, including tracking progress against all key milestones and deadlines, identifying emerging risks to the remediation timeline, and escalating issues requiring Board attention or additional resource allocation;

(c) Receive and review monthly reports from the Chief Compliance Officer (Patricia Langston) and the BSA Officer / AML Program Director (Thomas Ikeda), which reports shall include, at a minimum, the following metrics and information:

(1) SAR volumes, filing timeliness, and quality metrics;

(2) OFAC screening hit rates, false positive rates, and true match disposition statistics, broken out by BaaS partner and business line;

(3) CDD/EDD remediation progress, including the number of accounts remediated, the number of accounts remaining, and any accounts identified as requiring de-risking or exit;

(4) Transaction monitoring alert volumes, SAR conversion rates, and case investigation cycle times;

(5) Individualized risk ratings for each active BaaS partner, including any changes in risk ratings and the rationale therefor; and

(6) Such other metrics and information as the Compliance Committee may from time to time request;

(d) Receive and review reports, assessments, and recommendations from the independent consultant (Thornfield Consulting Group LLC), including the preliminary gap assessment, interim progress reports, and the final validation report;

(e) Receive and review reports and advice from outside counsel (Calderwood & Harkness LLP) regarding the status of the compliance-program uplift, regulatory engagement strategies, and legal risks;

(f) Report to the full Board of Directors at least quarterly on the status of the compliance program, remediation progress, key metrics trends, and emerging regulatory risks, with interim reporting to the Board on a more frequent basis as circumstances warrant;

(g) Meet no less frequently than monthly during the pendency of the Consent Order remediation period (through at least February 15, 2026), with additional meetings convened as necessary at the call of the Chair or any two members;

(h) Engage directly with regulators, including the OCC and FinCEN, as needed in connection with the Consent Order, the remediation program, or the Bank's ongoing supervisory relationship, with the assistance and guidance of outside counsel; and

(i) Exercise such other authority and undertake such other responsibilities as may be delegated to the Compliance Committee by the Board of Directors from time to time or as may be set forth in the Compliance Committee Charter.

RESOLVED FURTHER, that the Board of Directors hereby adopts the Compliance Committee Charter in the form attached hereto as Exhibit A, which sets forth in detail the Compliance Committee's composition requirements, authority, responsibilities, reporting obligations, meeting requirements, and procedural guidelines, and which shall become effective immediately upon adoption of these resolutions.

Resolution 3 — Amendment of Corporate Bylaws

RESOLVED, that the Board of Directors hereby approves and adopts the amendments to the Amended and Restated Bylaws of Belmont Ridge Financial Group, Inc. (the "Bylaws") to incorporate provisions establishing the Compliance Committee as a standing committee of the Board of Directors, as set forth in the redlined amendments presented to the Board and attached hereto as Exhibit B.

RESOLVED FURTHER, that Gregory Nardone, in his capacity as General Counsel and Corporate Secretary of BRFG, is hereby authorized and directed to cause such amendments to the Bylaws to be filed, recorded, and maintained as required by applicable law, the Company's Certificate of Incorporation, and the Bylaws, and to distribute copies of the amended Bylaws to all directors and officers of the Company and the Bank.

Resolution 4 — Authorization of Remediation Budget

RESOLVED, that the Board of Directors hereby authorizes management of BRFG and BRB to incur expenditures of up to Forty-Two Million Five Hundred Thousand Dollars ($42,500,000) (exclusive of the $14,500,000 civil money penalty) in connection with the BSA/AML and sanctions compliance-program remediation required by the Consent Order, as detailed in the comprehensive remediation budget presented to the Board at this meeting, which includes the following line items:

(a) Calderwood & Harkness LLP outside counsel professional fees: up to $8,000,000 (subject to the ±15% fee collar established in the engagement letter; any overruns in excess of $9,200,000 require the prior written approval of the General Counsel);

(b) Thornfield Consulting Group LLC independent consultant professional fees and reimbursable expenses: up to $6,900,000;

(c) Veridian Analytics Inc. TMS v.10.0 technology upgrade: up to $4,700,000 (comprised of $2,800,000 for one-time implementation and $1,900,000 for incremental Year 1 licensing);

(d) Pinnacle Compliance Solutions LLC temporary BSA/AML analyst staffing: up to $3,600,000 (30 full-time-equivalent temporary analysts at $10,000 per analyst per month for 12 months);

(e) Internal headcount additions (15 full-time equivalent positions in the Compliance, BSA/AML, and OFAC functions): up to $2,250,000 (at an average fully loaded cost of approximately $150,000 per FTE);

(f) SAR lookback project (retrospective review of transaction monitoring alerts and SAR filings): up to $5,500,000;

(g) CDD/EDD remediation project (re-verification and enhanced due diligence for 47,000 high-risk accounts): up to $4,300,000;

(h) Training and policy development (including enterprise-wide BSA/AML training, BaaS-specific compliance training, and comprehensive policy and procedure rewriting): up to $1,800,000;

(i) Board and governance restructuring (including Compliance Committee establishment costs, director education, and governance consulting): up to $500,000; and

(j) Contingency and other costs: the balance of the $42,500,000 remediation budget, to be allocated by management as needed to address unforeseen remediation requirements.

RESOLVED FURTHER, that Samantha Reeves, Chief Financial Officer of BRFG and BRB, is hereby authorized and directed to establish appropriate accounting controls, cost centers, and financial reporting mechanisms for tracking all remediation-related expenditures against the approved budget, and to provide the Compliance Committee and the full Board of Directors with monthly budget variance reports detailing actual expenditures, committed but unpaid amounts, and remaining budget availability by line item.

RESOLVED FURTHER, that any expenditure in excess of the aggregate $42,500,000 authorized remediation budget shall require additional Board of Directors approval prior to commitment or disbursement, provided that the reallocation of funds among approved line items within the $42,500,000 aggregate budget shall be permitted with the written approval of the Chief Financial Officer and the General Counsel, so long as no individual line item exceeds its approved amount by more than twenty percent (20%).

Resolution 5 — Authorization of Civil Money Penalty Payment

RESOLVED, that the Board of Directors hereby authorizes and directs Samantha Reeves, Chief Financial Officer of BRFG and BRB, to cause Belmont Ridge Bank National Association to remit payment of the civil money penalty in the amount of Fourteen Million Five Hundred Thousand Dollars ($14,500,000) assessed under OCC Consent Order No. OCC-2025-003 to the United States Treasury, in accordance with the payment instructions and wire transfer details provided by the OCC in the Consent Order, on or before March 16, 2025 (being the sixtieth (60th) day following the Consent Order's effective date of January 15, 2025).

RESOLVED FURTHER, that the Board acknowledges that the total combined financial outlay for the civil money penalty ($14,500,000) and the remediation program ($42,500,000) is expected to be approximately Fifty-Seven Million Dollars ($57,000,000), and that such amount has been reflected in the Company's financial planning and capital projections. The Board further directs the Chief Financial Officer to ensure that the payment of the civil money penalty and the remediation expenditures do not cause the Bank to fall below its internal capital targets or any regulatory minimum capital requirements.

Resolution 6 — Ratification of Calderwood & Harkness LLP Engagement

RESOLVED, that the Board of Directors hereby ratifies and confirms BRB's engagement of Calderwood & Harkness LLP as outside regulatory counsel for the BSA/AML and sanctions compliance-program uplift, remediation of all Consent Order findings, regulatory engagement and negotiation, and oversight of the independent consultant engagement, pursuant to the engagement letter dated February 10, 2025 (C&H Matter No. 1045-00002), with Philip Hartmann serving as the Responsible Partner.

RESOLVED FURTHER, that the Board hereby approves the engagement terms as set forth in the engagement letter, including the following:

(a) Phase 1 (Assessment & Remediation Plan Development: February 10, 2025 – May 15, 2025) estimated professional fees of $4,800,000;

(b) Phase 2 (Implementation & Monitoring: May 16, 2025 – February 15, 2026) estimated professional fees of $3,200,000;

(c) Total estimated professional fees of $8,000,000, subject to a ±15% fee collar, with overruns in excess of $9,200,000 requiring the prior written approval of the General Counsel;

(d) A $500,000 evergreen retainer deposited by BRB on February 12, 2025, to be applied against outstanding invoices and replenished as provided in the engagement letter;

(e) A reimbursable expense cap of $250,000; and

(f) The following standard hourly billing rates for the core engagement team:

• Philip Hartmann (Partner, Responsible Partner): $1,450/hour

• Marcus Delgado (Partner): $1,350/hour

• Yuki Nakamura (Senior Associate): $895/hour

• Carlos Espinoza (Associate): $725/hour

Resolution 7 — Ratification of Thornfield Consulting Group LLC Engagement

RESOLVED, that the Board of Directors hereby ratifies and confirms BRB's engagement of Thornfield Consulting Group LLC as the OCC-mandated independent consultant pursuant to Article VII of the Consent Order, under the engagement agreement dated February 10, 2025 (Thornfield Engagement Reference: TCG-BRB-2025-001), to conduct a comprehensive assessment of BRB's BSA/AML and OFAC compliance programs and to validate the adequacy and effectiveness of the Bank's remediation efforts.

RESOLVED FURTHER, that the Board hereby approves the engagement terms as set forth in the engagement agreement, including:

(a) A fixed professional fee of $6,500,000, payable in twelve (12) equal monthly installments of $541,666.67;

(b) Reimbursable out-of-pocket expenses subject to a cap of $400,000;

(d) An engagement term of twelve (12) months, from February 2025 through February 2026; and

(e) Thornfield's engagement team, led by Dr. Vivian Castellano (Managing Director, Financial Crimes Advisory), and supported by Robert Eastman (Senior Director, AML Transaction Monitoring), Jennifer Hwang (Director, Sanctions & OFAC Compliance), and Nathaniel Burgess (Director, Fintech & Payments Compliance).

The Board further notes that Thornfield has been approved by the OCC as an acceptable independent consultant pursuant to the non-objection issued on February 5, 2025, and that Thornfield is obligated under both the Consent Order and the engagement agreement to report directly to the OCC in addition to the Bank.

Resolution 8 — Direction to Management for Full Cooperation

RESOLVED, that the Board of Directors hereby directs all officers, employees, and agents of BRFG and BRB, including without limitation the following named individuals:

• Diane Whitford — Chief Executive Officer

• Raymond Okoye — President and Chief Operating Officer

• Gregory Nardone — General Counsel and Corporate Secretary

• Patricia Langston — Chief Compliance Officer

• Thomas Ikeda — BSA Officer / AML Program Director

• Melissa Chu — Chief Risk Officer

• Warren Ashby — Head of Fintech Partnerships / BaaS Division

• Linda Petrosian — Chief Information Officer / Chief Technology Officer

• Derek Ballard — Head of Internal Audit

to cooperate fully, promptly, and in good faith with each of the following:

(a) Calderwood & Harkness LLP — in connection with all aspects of the BSA/AML and sanctions compliance-program uplift, remediation of Consent Order findings, preparation and submission of regulatory reports, and engagement with the OCC, FinCEN, and other regulatory authorities;

(b) Thornfield Consulting Group LLC — in connection with its independent assessment and validation engagement, including providing full and timely access to all systems, personnel, records, data, and facilities as required under the Access & Cooperation Protocol set forth in Annex C to the Thornfield engagement agreement, and responding to all information requests within the timeframes specified therein; and

(c) The OCC and FinCEN — in connection with all examination, reporting, supervisory, and enforcement activities, including the timely production of documents and information responsive to regulatory requests, participation in supervisory meetings, and compliance with all reporting obligations under the Consent Order.

RESOLVED FURTHER, that any failure by an officer, employee, or agent of BRFG or BRB to cooperate fully and promptly with the foregoing parties in connection with the Consent Order remediation and the compliance-program uplift shall be treated as a serious performance deficiency and shall be subject to appropriate disciplinary action, up to and including termination of employment. The General Counsel and the Chief Compliance Officer are directed to communicate this expectation to all relevant personnel and to report any instances of non-cooperation to the Compliance Committee.

Resolution 9 — Authorization of Remediation Action Plan Development and Submission

RESOLVED, that the Board of Directors hereby directs management of BRFG and BRB, in coordination with Calderwood & Harkness LLP and Thornfield Consulting Group LLC, to prepare a Comprehensive Remediation Action Plan addressing all deficiencies identified in the Consent Order and to submit such plan to the OCC by May 15, 2025, in accordance with the timeline established by the Consent Order. The Comprehensive Remediation Action Plan shall address the following five (5) core workstreams:

(i) OFAC Sanctions Screening — Remediation of all OFAC screening gaps, including reconfiguration and enhancement of data integrations with all BaaS partner platforms, implementation of comprehensive reconciliation and quality assurance processes, and deployment of enhanced screening capabilities through the Veridian TMS v.10.0 OFAC module;

(ii) SAR Backlog Clearance and Process Improvement — Clearance of the existing backlog of approximately 2,400 unreviewed alerts by June 30, 2025, implementation of improved alert triage, investigation, and SAR filing workflows to achieve and sustain a target SAR filing time of thirty (30) days or less, and completion of a retrospective SAR lookback review;

(iii) CDD/EDD Remediation — Re-verification and enhanced due diligence for all 47,000 identified high-risk customer accounts, with a target of 50% completion (23,500 accounts) by July 15, 2025 and 100% completion by January 15, 2026, including the de-risking or exit of accounts that cannot be adequately verified or that present unacceptable risk;

(iv) Transaction Monitoring Model Validation and Tuning — Completion of an independent model validation of Veridian TMS v.10.0 by October 1, 2025, including threshold tuning, scenario analysis, above- and below-the-line testing, and documentation in accordance with OCC Bulletin 2011-12; and

(v) BSA/AML Program Governance and Training — Enhancement of the Bank's BSA/AML governance framework, including the establishment of the Compliance Committee, implementation of enhanced Board-level and management-level reporting, development and delivery of comprehensive BSA/AML and sanctions training for all employees, and revision of all BSA/AML and OFAC policies and procedures.

RESOLVED FURTHER, that the Board of Directors shall review and approve the Comprehensive Remediation Action Plan prior to its submission to the OCC, and that such review and approval shall occur at a special meeting of the Board or the Compliance Committee to be convened no later than May 10, 2025 for that purpose.

Resolution 10 — Authorization of Technology and Vendor Arrangements

RESOLVED, that the Board of Directors hereby authorizes management of BRB to negotiate and execute the necessary amendments to BRB's existing Master Services Agreement with Veridian Analytics Inc. (Contract No. VA-BRB-2023-0044) for the upgrade from Veridian TMS v.8.3 to Veridian TMS v.10.0, including the enhanced OFAC screening module, at an estimated total cost of Four Million Seven Hundred Thousand Dollars ($4,700,000), comprised of Two Million Eight Hundred Thousand Dollars ($2,800,000) in one-time implementation costs and One Million Nine Hundred Thousand Dollars ($1,900,000) in incremental annual licensing fees (resulting in a new total annual contract value of approximately $6,000,000), subject to final contract terms approved by the General Counsel. The upgrade shall be deployed to a user acceptance testing environment and fully operational in production no later than August 1, 2025, in accordance with the Consent Order remediation timeline.

RESOLVED FURTHER, that the Board of Directors hereby authorizes management of BRB to continue evaluating Ridgeline Data Systems LLC as an alternative transaction monitoring vendor in the event that the Veridian TMS v.10.0 upgrade proves technically or operationally insufficient to meet the Bank's compliance requirements or the standards established by the Consent Order, provided that any proposed engagement of Ridgeline Data Systems LLC as a replacement or supplemental transaction monitoring vendor shall require separate Board of Directors approval prior to execution.

RESOLVED FURTHER, that the Board of Directors hereby authorizes management of BRB to execute the Managed Services Agreement with Pinnacle Compliance Solutions LLC (SOW Reference: PCS-BRB-2025-0012) for the provision of thirty (30) full-time-equivalent temporary BSA/AML analysts to augment the Bank's compliance staff during the twelve (12)-month remediation period, at a total cost of Three Million Six Hundred Thousand Dollars ($3,600,000) (being $10,000 per analyst per month for 12 months). Such temporary analysts shall be integrated into the Bank's BSA/AML operations under the supervision of the BSA Officer, Thomas Ikeda, and shall be deployed primarily to the SAR backlog clearance, CDD/EDD remediation, and transaction monitoring alert review workstreams.

Resolution 11 — Quarterly Reporting and OCC Communication Obligations

RESOLVED, that the Board of Directors hereby directs management and the Compliance Committee to ensure the timely preparation, review, and submission of all OCC-required reports and communications in connection with the Consent Order, including but not limited to the following:

(a) Interim SAR Backlog Status Report — due to the OCC no later than March 31, 2025, detailing the current status of the SAR alert backlog, the number of alerts dispositioned since the Consent Order's effective date, projected timeline for full backlog clearance, and any impediments to timely completion;

(b) Comprehensive Remediation Action Plan — due to the OCC no later than May 15, 2025, addressing all five core deficiency categories identified in the Consent Order, as described in Resolution 9 above;

(c) First Quarterly Progress Report — due to the OCC no later than September 15, 2025, summarizing remediation progress across all workstreams, reporting on key metrics, and identifying any deviations from the approved Remediation Action Plan;

(d) Second Quarterly Progress Report — due to the OCC no later than December 15, 2025, providing an updated assessment of remediation progress, including the status of the Veridian TMS v.10.0 deployment, OFAC screening operational status, and CDD/EDD remediation progress; and

(e) Compliance Self-Certification — due to the OCC no later than February 15, 2026, certifying the Bank's full compliance with all provisions of the Consent Order and the Comprehensive Remediation Action Plan, and accompanied by the Thornfield final validation report.

RESOLVED FURTHER, that all such reports and communications shall be reviewed by outside counsel (Calderwood & Harkness LLP) prior to submission to the OCC, and that the independent consultant (Thornfield Consulting Group LLC) shall be afforded the opportunity to review and provide input on such reports where appropriate and consistent with Thornfield's independent mandate under the Consent Order.

Resolution 12 — General Authority

RESOLVED, that the officers of Belmont Ridge Financial Group, Inc. and Belmont Ridge Bank National Association, and each of them individually, are hereby authorized and empowered to take all such further actions, execute and deliver all such further agreements, instruments, certificates, and documents, and incur all such further costs and expenses, in the name and on behalf of the Company and the Bank, as such officers shall deem necessary, appropriate, or advisable to carry out the purposes and intent of the foregoing resolutions, in consultation with Calderwood & Harkness LLP, the taking of any such action to be conclusive evidence of the authority therefor.

RESOLVED FURTHER, that all actions heretofore taken by any officer or authorized representative of BRFG or BRB prior to the date of these resolutions that are consistent with the authority granted herein, including without limitation the engagement of Calderwood & Harkness LLP, the engagement of Thornfield Consulting Group LLC, the execution of the Pinnacle Compliance Solutions LLC Managed Services Agreement, and any communications with the OCC or FinCEN, are hereby ratified, confirmed, and approved in all respects.

CERTIFICATION

I, Gregory Nardone, hereby certify that:

1. I am the duly appointed General Counsel and Corporate Secretary of Belmont Ridge Financial Group, Inc., a Delaware corporation.

2. The foregoing resolutions were duly adopted by the Board of Directors of Belmont Ridge Financial Group, Inc. at a duly convened meeting of the Board of Directors held on February 28, 2025, at which a quorum of directors was present and acting throughout.

3. The resolutions were adopted by the affirmative vote of all directors present at the meeting, constituting the following directors:

• Diane Whitford — Chair of the Board and Chief Executive Officer

• Arthur Connelly — Lead Independent Director

• Margaret Dao — Independent Director

• James Rutherford — Independent Director

• Sandra Villarreal — Independent Director

• Keith Yamamoto — Independent Director

4. The resolutions have not been amended, modified, or rescinded and remain in full force and effect as of the date of this certification.

5. A copy of these resolutions has been filed with the corporate records of the Company and with the minutes of the meeting of the Board of Directors at which they were adopted.

IN WITNESS WHEREOF, I have hereunto set my hand and affixed the corporate seal of Belmont Ridge Financial Group, Inc. as of the date set forth below.

BELMONT RIDGE FINANCIAL GROUP, INC.

By: ________

Name: Gregory Nardone

Title: General Counsel & Corporate Secretary

Date: ________

[CORPORATE SEAL]

EXHIBITS

Exhibit A — Compliance Committee Charter

The Compliance Committee Charter adopted by the Board of Directors is set forth in the separate document titled Compliance Committee Charter of the Board of Directors of Belmont Ridge Financial Group, Inc., dated February 28, 2025, filed as: compliance-committee-charter-draft.docx.

The Compliance Committee Charter is incorporated herein by reference and made a part of these resolutions as if set forth in full.

Exhibit B — Amended and Restated Bylaws — Redline Showing Compliance Committee Provisions

The amendments to the Amended and Restated Bylaws of Belmont Ridge Financial Group, Inc. establishing the Compliance Committee as a standing committee of the Board of Directors are set forth in redlined form in the separate document titled Amended and Restated Bylaws of Belmont Ridge Financial Group, Inc. — Redline Showing Compliance Committee Provisions, dated February 28, 2025, filed as: amended-bylaws-compliance-committee-redline.docx.

The redlined Bylaw amendments are incorporated herein by reference and made a part of these resolutions as if set forth in full.

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT Calderwood & Harkness LLP	C&H Matter No. 1045-00002
Budget Line Item	Estimated Cost
Outside counsel (Calderwood & Harkness LLP)	$8,000,000
Independent consultant (Thornfield Consulting Group LLC: $6,500,000 fees + $400,000 expenses)	$6,900,000
Technology upgrade (Veridian Analytics Inc. TMS v.10.0: $2,800,000 one-time implementation + $1,900,000 incremental Year 1 licensing)	$4,700,000
Temporary staffing (Pinnacle Compliance Solutions LLC: 30 FTE × $10,000/month × 12 months)	$3,600,000
Internal headcount additions (15 FTEs at approximately $150,000 average fully loaded cost per FTE)	$2,250,000
SAR lookback project	$5,500,000
CDD/EDD remediation project	$4,300,000
Training and policy development	$1,800,000
Board and governance restructuring	$500,000
Contingency and other costs	$4,950,000
Total Remediation Budget (exclusive of CMP)	$42,500,000
Milestone	Deadline
Board Resolution acknowledging Consent Order	February 28, 2025
Civil money penalty payment ($14,500,000)	March 16, 2025
Interim SAR backlog status report to OCC	March 31, 2025
Thornfield preliminary gap assessment	April 15, 2025
Comprehensive Remediation Action Plan due to OCC	May 15, 2025
SAR backlog clearance (2,400 alerts fully dispositioned)	June 30, 2025
CDD/EDD 50% remediation (23,500 of 47,000 accounts)	July 15, 2025
Veridian TMS v.10.0 UAT complete and deployed to production	August 1, 2025
First quarterly progress report to OCC	September 15, 2025
Independent model validation of upgraded TMS	October 1, 2025
OFAC screening fully operational for all BaaS channels	November 1, 2025

Second quarterly progress report to OCC	December 15, 2025
CDD/EDD 100% remediation (all 47,000 accounts)	January 15, 2026
Full compliance program implementation; Thornfield final validation report; self-certification due to OCC	February 15, 2026

PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT
RESOLUTIONS OF THE BOARD OF DIRECTORS OF BELMONT RIDGE FINANCIAL GROUP, INC.
Acknowledgment of OCC Consent Order No. OCC-2025-003 and Establishment of the Compliance Committee of the Board of Directors
Adopted: February 28, 2025
Prepared by: Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, NY 10019 C&H Matter No. 1045-00002
PREAMBLE AND RECITALS
Identity and Background of the Company
WHEREAS, Belmont Ridge Financial Group, Inc. ("BRFG" or the "Company") is a corporation duly organized and existing under the laws of the State of Delaware, with its principal executive office located at 680 Lexington Avenue, 22nd Floor, New York, NY 10022, and its shares of common stock are listed on the New York Stock Exchange under the ticker symbol "BRFG"; and
WHEREAS, BRFG is the sole bank holding company of Belmont Ridge Bank National Association ("BRB" or the "Bank"), a national banking association duly chartered under the National Bank Act, 12 U.S.C. § 21 et seq. (OCC Charter No. 48271; FDIC Certificate No. 31845), headquartered at 680 Lexington Avenue, 22nd Floor, New York, NY 10022; and
WHEREAS, BRB operates core business lines including retail banking, commercial lending, wealth management, and financial technology Banking-as-a-Service ("BaaS") partnerships, with approximately fourteen (14) active fintech sponsors currently operating through BRB's national bank charter pursuant to individually negotiated BaaS program agreements; and
WHEREAS, as of December 31, 2024, BRB reported total assets of approximately $38.7 billion, total deposits of approximately $29.4 billion, and a Tier 1 Capital Ratio of 11.2%, as reflected in the Bank's most recently filed Call Report (FFIEC 031); and
Regulatory History and Consent Order
WHEREAS, the Office of the Comptroller of the Currency (the "OCC") issued a Matter Requiring Attention ("MRA") to BRB in June 2022 regarding deficiencies in the Bank's Bank Secrecy Act and anti-money laundering ("BSA/AML") transaction monitoring program, identifying concerns related to alert disposition processes and the timeliness of suspicious activity report filings; and
WHEREAS, the OCC subsequently issued a Matter Requiring Immediate Attention ("MRIA") to BRB in November 2023, escalating the supervisory concern and citing specific gaps in the Bank's Office of Foreign Assets Control ("OFAC") sanctions screening processes, particularly as applied to transaction flows originating from or processed through the Bank's fintech BaaS partners; and
WHEREAS, the OCC conducted a targeted BSA/AML examination of BRB commencing in March 2024 and concluding in September 2024, during which OCC examiners conducted extensive reviews of the Bank's BSA/AML compliance program, OFAC sanctions screening infrastructure, customer due diligence and enhanced due diligence procedures, transaction monitoring systems, suspicious activity reporting processes, and board-level governance and oversight mechanisms; and
WHEREAS, Caldera & Pope LLP, the Bank's external auditor and independent BSA/AML testing firm, completed an independent BSA/AML assessment in September 2024, the results of which identified multiple deficiencies and control weaknesses consistent with those subsequently cited by the OCC in its examination findings, including deficiencies in OFAC screening coverage for BaaS transaction volumes, SAR filing backlogs, and transaction monitoring model governance; and
WHEREAS, on January 15, 2025, the OCC issued Consent Order No. OCC-2025-003 (the "Consent Order") against Belmont Ridge Bank National Association, effective as of that date, citing significant deficiencies in the Bank's BSA/AML compliance program and OFAC sanctions screening framework; and
WHEREAS, the Consent Order identifies five (5) core deficiency categories, specifically:
(i) Inadequate OFAC Sanctions Screening Protocols for Fintech BaaS Transaction Flows — The Bank failed to screen approximately twelve percent (12%) of NovaPay Technologies Inc. ("NovaPay") wire transfer and Automated Clearing House ("ACH") transactions against OFAC's Specially Designated Nationals and blocked Persons List ("SDN List") and other applicable sanctions lists, resulting in approximately 3,800,000 transactions remaining unscreened out of a total of approximately 31,700,000 NovaPay transactions processed during calendar year 2023. The OCC determined that this failure resulted from a misconfigured data integration between NovaPay's payment processing platform and the Bank's OFAC screening module, which was not identified due to inadequate reconciliation and quality assurance procedures;
(ii) Deficient SAR Filing Timeliness and Quality — The Bank maintained a backlog of approximately 2,400 potentially suspicious activity alerts that remained unreviewed and undispositioned as of September 2024, and the Bank's average time to file a Suspicious Activity Report ("SAR") from the date of initial alert generation was approximately seventy-eight (78) days, significantly exceeding the regulatory expectation of approximately thirty (30) days, thereby impairing the timeliness and utility of SARs filed with the Financial Crimes Enforcement Network ("FinCEN");
(iii) Insufficient Customer Due Diligence and Enhanced Due Diligence — The Bank failed to perform adequate Customer Due Diligence ("CDD") and Enhanced Due Diligence ("EDD") for approximately 47,000 high-risk customer accounts, the majority of which were onboarded through the Bank's fintech BaaS partner channels without adequate beneficial ownership verification, risk assessment scoring, or ongoing monitoring commensurate with their risk profiles;
(iv) Inadequate Model Validation for Transaction Monitoring System — The Bank's primary transaction monitoring system, Veridian TMS v.8.3 (licensed from Veridian Analytics Inc.), had not been subjected to an independent model validation since March 2021, a period of approximately forty-two (42) months, in contravention of OCC Bulletin 2011-12 (Supervisory Guidance on Model Risk Management) and the Bank's own Model Risk Management Policy, resulting in unvalidated tuning parameters, unquantified false negative rates, and potential gaps in transaction monitoring coverage; and
(v) Board-Level Oversight Deficiencies — The Board of Directors lacked a standing Compliance Committee dedicated to overseeing regulatory compliance, BSA/AML, and sanctions programs, and the BSA/AML reports provided to the Board were limited to quarterly summaries that lacked key performance metrics, including SAR volumes and filing timeliness, OFAC screening hit rates, transaction monitoring alert volumes and SAR conversion rates, CDD/EDD remediation status, and individualized risk ratings for each BaaS partner;
and
WHEREAS, the Consent Order assesses a civil money penalty ("CMP") in the amount of Fourteen Million Five Hundred Thousand Dollars ($14,500,000) against BRB, payable to the United States Treasury within sixty (60) days of the effective date of the Consent Order (i.e., on or before March 16, 2025); and
WHEREAS, the Consent Order expressly provides that the imposition of the civil money penalty and the Bank's entry into the Consent Order do not preclude future referral by the OCC to the United States Department of Justice ("DOJ") for potential criminal prosecution or additional enforcement action by FinCEN, which is currently monitoring BRB's SAR filing remediation efforts pursuant to its independent supervisory authority under 31 U.S.C. § 5321; and
Public Disclosure and Shareholder Impact
WHEREAS, BRFG publicly disclosed the Consent Order on January 16, 2025, via a Form 8-K filed with the Securities and Exchange Commission and an accompanying press release, and such disclosure resulted in a decline in BRFG's common stock price from a closing price of approximately $47.82 per share on January 15, 2025, to a closing price of approximately $41.15 per share on January 16, 2025, representing a decline of approximately $6.67 per share, or approximately 13.9%; and
WHEREAS, as of February 7, 2025, BRFG had approximately 179,500,000 shares of common stock issued and outstanding, representing an approximate total market capitalization of approximately $8.58 billion; and
Engagement of Outside Counsel
WHEREAS, BRB's prior outside regulatory counsel, Drayton Mercer LLP, represented BRB during the 2023–2024 OCC examination cycle, including with respect to the Bank's response to the November 2023 MRIA and the Bank's interactions with OCC examiners during the targeted BSA/AML examination, and BRB terminated the engagement of Drayton Mercer LLP in January 2025 following the issuance of the Consent Order; and
WHEREAS, on February 10, 2025, BRB engaged Calderwood & Harkness LLP ("C&H") as outside regulatory counsel to advise and guide BRB through a comprehensive BSA/AML and sanctions compliance-program uplift, remediation of all findings and deficiencies identified in the Consent Order, negotiation and communication with the OCC, FinCEN, and other applicable regulatory authorities, and oversight of the independent consultant engagement mandated by the Consent Order, pursuant to an engagement letter dated February 10, 2025 (C&H Matter No. 1045-00002), with Philip Hartmann serving as the Responsible Partner for the engagement; and
WHEREAS, the C&H engagement is structured in two phases: Phase 1 (Assessment & Remediation Plan Development), spanning from February 10, 2025 through May 15, 2025, with estimated professional fees of Four Million Eight Hundred Thousand Dollars ($4,800,000); and Phase 2 (Implementation & Monitoring), spanning from May 16, 2025 through February 15, 2026, with estimated professional fees of Three Million Two Hundred Thousand Dollars ($3,200,000), for total estimated professional fees of Eight Million Dollars ($8,000,000), subject to a plus or minus fifteen percent (±15%) fee collar, such that any overruns in excess of Nine Million Two Hundred Thousand Dollars ($9,200,000) shall require the prior written approval of Gregory Nardone, General Counsel of BRFG and BRB; and
WHEREAS, a Five Hundred Thousand Dollar ($500,000) evergreen retainer was deposited by BRB with C&H on February 12, 2025, in accordance with the terms of the engagement letter; and
Independent Consultant.  WHEREAS, Article VII of the Consent Order requires BRB to engage an independent consultant, acceptable to the OCC, to conduct a comprehensive assessment of the Bank's BSA/AML and OFAC compliance programs and to validate the adequacy and effectiveness of the Bank's remediation efforts; and
WHEREAS, following a competitive evaluation process, BRB selected Thornfield Consulting Group LLC ("Thornfield") as the independent consultant to fulfill the requirements of Article VII of the Consent Order, and the OCC issued its formal non-objection to Thornfield's engagement on February 5, 2025; and
WHEREAS, BRB and Thornfield executed an engagement agreement on February 10, 2025 (Thornfield Engagement Reference: TCG-BRB-2025-001), which provides for a fixed professional fee of Six Million Five Hundred Thousand Dollars ($6,500,000) for a twelve (12)-month engagement period commencing in February 2025 and concluding in February 2026, payable in equal monthly installments of Five Hundred Forty-One Thousand Six Hundred Sixty-Six Dollars and Sixty-Seven Cents ($541,666.67), plus reimbursable out-of-pocket expenses subject to a cap of Four Hundred Thousand Dollars ($400,000), for a total maximum engagement cost of Six Million Nine Hundred Thousand Dollars ($6,900,000); and
WHEREAS, Thornfield's engagement team is led by Dr. Vivian Castellano, Managing Director, Financial Crimes Advisory, and is further supported by Robert Eastman (Senior Director, AML Transaction Monitoring), Jennifer Hwang (Director, Sanctions & OFAC Compliance), and Nathaniel Burgess (Director, Fintech & Payments Compliance); and
WHEREAS, pursuant to the engagement agreement and the Consent Order, Thornfield is to commence its on-site assessment at BRB on March 1, 2025, deliver a preliminary gap assessment report to BRB and the OCC by April 15, 2025, and deliver a final validation report confirming the adequacy and effectiveness of remediation efforts by February 15, 2026; and
Remediation Budget.  WHEREAS, management of BRB, in consultation with Calderwood & Harkness LLP, has prepared a comprehensive remediation budget (exclusive of the civil money penalty) totaling Forty-Two Million Five Hundred Thousand Dollars ($42,500,000) over a twelve (12)-month remediation period, comprised of the following estimated cost components:
and
WHEREAS, the total expected financial outlay in connection with the Consent Order, including the $14,500,000 civil money penalty and the $42,500,000 remediation budget, is approximately Fifty-Seven Million Dollars ($57,000,000); and
Board Governance Deficiency and Need for Compliance Committee
WHEREAS, the Consent Order specifically identifies the absence of a dedicated Compliance Committee of the Board of Directors as a material governance deficiency, noting that BSA/AML reporting to the Board was limited to quarterly reports that lacked key performance and risk metrics, including SAR filing volumes and timeliness, OFAC screening hit rates, CDD/EDD remediation status, transaction monitoring alert volumes and SAR conversion rates, and individualized risk ratings by BaaS partner; and
WHEREAS, the Board of Directors currently maintains a standing Audit Committee (chaired by Margaret Dao) and a standing Risk Committee (chaired by Arthur Connelly), but does not maintain a standing committee specifically dedicated to overseeing regulatory compliance, BSA/AML program management, and sanctions compliance; and
WHEREAS, the Consent Order requires, among other things, that the Board of Directors adopt a formal resolution within forty-five (45) days of the Consent Order's effective date (i.e., on or before February 28, 2025) formally acknowledging the Consent Order and committing to the remediation of all deficiencies identified therein; and
Key Consent Order Deadlines
WHEREAS, the Consent Order and the anticipated remediation plan establish the following key milestones and deadlines, which the Board considers essential to track and monitor:
RESOLUTIONS
NOW, THEREFORE, BE IT RESOLVED, as follows:
Resolution 1 — Acknowledgment of Consent Order
RESOLVED, that the Board of Directors of Belmont Ridge Financial Group, Inc. hereby formally acknowledges receipt and review of OCC Consent Order No. OCC-2025-003, issued on January 15, 2025, against Belmont Ridge Bank National Association, a complete copy of which has been presented to each director of the Board and has been filed with the minutes of this meeting.
RESOLVED FURTHER, that the Board of Directors hereby acknowledges the seriousness of the deficiencies identified in the Consent Order, including the five (5) core deficiency categories enumerated therein, and recognizes that the timely and complete remediation of such deficiencies is of the highest priority for the Company and the Bank. The Board commits the full resources of BRFG and BRB to achieve timely and complete compliance with all provisions, requirements, and deadlines set forth in the Consent Order.
RESOLVED FURTHER, that the Board of Directors hereby directs Diane Whitford, Chief Executive Officer of BRFG and BRB; Raymond Okoye, President and Chief Operating Officer of BRFG and BRB; Gregory Nardone, General Counsel and Corporate Secretary of BRFG and BRB; and Patricia Langston, Chief Compliance Officer of BRB, to ensure that all Consent Order deadlines are met in a timely manner and that the Board of Directors is kept fully informed of remediation progress on at least a monthly basis. Such monthly updates shall include, at a minimum, a status report on each of the key milestones identified in the Consent Order, a summary of any material communications with the OCC or FinCEN, and an assessment of any risks to the remediation timeline.
Resolution 2 — Establishment of the Compliance Committee
RESOLVED, that effective immediately, the Board of Directors of Belmont Ridge Financial Group, Inc. hereby establishes a standing Compliance Committee of the Board of Directors (the "Compliance Committee") as a permanent committee of the Board, constituted pursuant to the Company's Amended and Restated Bylaws as amended hereby and in accordance with applicable law.
RESOLVED FURTHER, that James Rutherford is hereby appointed as Chair of the Compliance Committee, effective immediately.
RESOLVED FURTHER, that the initial members of the Compliance Committee shall be as follows:
•  James Rutherford — Chair
•  Sandra Villarreal — Member
•  Keith Yamamoto — Member
Each of the foregoing individuals has been determined by the Board to be an independent director of the Board in accordance with the applicable listing standards of the New York Stock Exchange and the Company's Corporate Governance Guidelines.
RESOLVED FURTHER, that Arthur Connelly, Lead Independent Director and Chair of the Risk Committee of the Board, and Margaret Dao, Chair of the Audit Committee of the Board, shall each serve as ex officio, non-voting liaisons to the Compliance Committee. The purpose of such liaison positions is to ensure effective coordination and information-sharing among the Risk Committee, the Audit Committee, and the Compliance Committee, and to avoid duplication of oversight efforts while maintaining the distinct mandate and independence of each committee.
RESOLVED FURTHER, that the Compliance Committee shall have the authority and responsibility to perform each of the following functions, in addition to such other functions as may be set forth in the Compliance Committee Charter:
(a) Oversee BRB's BSA/AML and sanctions compliance programs, including the Bank's policies, procedures, internal controls, and governance framework related to compliance with the Bank Secrecy Act, the USA PATRIOT Act, OFAC sanctions regulations, and all other applicable anti-money laundering and financial crimes laws and regulations;
(b) Monitor compliance with the Consent Order and the Comprehensive Remediation Action Plan, including tracking progress against all key milestones and deadlines, identifying emerging risks to the remediation timeline, and escalating issues requiring Board attention or additional resource allocation;
(c) Receive and review monthly reports from the Chief Compliance Officer (Patricia Langston) and the BSA Officer / AML Program Director (Thomas Ikeda), which reports shall include, at a minimum, the following metrics and information:
(1) SAR volumes, filing timeliness, and quality metrics;
(2) OFAC screening hit rates, false positive rates, and true match disposition statistics, broken out by BaaS partner and business line;
(3) CDD/EDD remediation progress, including the number of accounts remediated, the number of accounts remaining, and any accounts identified as requiring de-risking or exit;
(4) Transaction monitoring alert volumes, SAR conversion rates, and case investigation cycle times;
(5) Individualized risk ratings for each active BaaS partner, including any changes in risk ratings and the rationale therefor; and
(6) Such other metrics and information as the Compliance Committee may from time to time request;
(d) Receive and review reports, assessments, and recommendations from the independent consultant (Thornfield Consulting Group LLC), including the preliminary gap assessment, interim progress reports, and the final validation report;
(e) Receive and review reports and advice from outside counsel (Calderwood & Harkness LLP) regarding the status of the compliance-program uplift, regulatory engagement strategies, and legal risks;
(f) Report to the full Board of Directors at least quarterly on the status of the compliance program, remediation progress, key metrics trends, and emerging regulatory risks, with interim reporting to the Board on a more frequent basis as circumstances warrant;
(g) Meet no less frequently than monthly during the pendency of the Consent Order remediation period (through at least February 15, 2026), with additional meetings convened as necessary at the call of the Chair or any two members;
(h) Engage directly with regulators, including the OCC and FinCEN, as needed in connection with the Consent Order, the remediation program, or the Bank's ongoing supervisory relationship, with the assistance and guidance of outside counsel; and
(i) Exercise such other authority and undertake such other responsibilities as may be delegated to the Compliance Committee by the Board of Directors from time to time or as may be set forth in the Compliance Committee Charter.
RESOLVED FURTHER, that the Board of Directors hereby adopts the Compliance Committee Charter in the form attached hereto as Exhibit A, which sets forth in detail the Compliance Committee's composition requirements, authority, responsibilities, reporting obligations, meeting requirements, and procedural guidelines, and which shall become effective immediately upon adoption of these resolutions.
Resolution 3 — Amendment of Corporate Bylaws
RESOLVED, that the Board of Directors hereby approves and adopts the amendments to the Amended and Restated Bylaws of Belmont Ridge Financial Group, Inc. (the "Bylaws") to incorporate provisions establishing the Compliance Committee as a standing committee of the Board of Directors, as set forth in the redlined amendments presented to the Board and attached hereto as Exhibit B.
RESOLVED FURTHER, that Gregory Nardone, in his capacity as General Counsel and Corporate Secretary of BRFG, is hereby authorized and directed to cause such amendments to the Bylaws to be filed, recorded, and maintained as required by applicable law, the Company's Certificate of Incorporation, and the Bylaws, and to distribute copies of the amended Bylaws to all directors and officers of the Company and the Bank.
Resolution 4 — Authorization of Remediation Budget
RESOLVED, that the Board of Directors hereby authorizes management of BRFG and BRB to incur expenditures of up to Forty-Two Million Five Hundred Thousand Dollars ($42,500,000) (exclusive of the $14,500,000 civil money penalty) in connection with the BSA/AML and sanctions compliance-program remediation required by the Consent Order, as detailed in the comprehensive remediation budget presented to the Board at this meeting, which includes the following line items:
(a) Calderwood & Harkness LLP outside counsel professional fees: up to $8,000,000 (subject to the ±15% fee collar established in the engagement letter; any overruns in excess of $9,200,000 require the prior written approval of the General Counsel);
(b) Thornfield Consulting Group LLC independent consultant professional fees and reimbursable expenses: up to $6,900,000;
(c) Veridian Analytics Inc. TMS v.10.0 technology upgrade: up to $4,700,000 (comprised of $2,800,000 for one-time implementation and $1,900,000 for incremental Year 1 licensing);
(d) Pinnacle Compliance Solutions LLC temporary BSA/AML analyst staffing: up to $3,600,000 (30 full-time-equivalent temporary analysts at $10,000 per analyst per month for 12 months);
(e) Internal headcount additions (15 full-time equivalent positions in the Compliance, BSA/AML, and OFAC functions): up to $2,250,000 (at an average fully loaded cost of approximately $150,000 per FTE);
(f) SAR lookback project (retrospective review of transaction monitoring alerts and SAR filings): up to $5,500,000;
(g) CDD/EDD remediation project (re-verification and enhanced due diligence for 47,000 high-risk accounts): up to $4,300,000;
(h) Training and policy development (including enterprise-wide BSA/AML training, BaaS-specific compliance training, and comprehensive policy and procedure rewriting): up to $1,800,000;
(i) Board and governance restructuring (including Compliance Committee establishment costs, director education, and governance consulting): up to $500,000; and
(j) Contingency and other costs: the balance of the $42,500,000 remediation budget, to be allocated by management as needed to address unforeseen remediation requirements.
RESOLVED FURTHER, that Samantha Reeves, Chief Financial Officer of BRFG and BRB, is hereby authorized and directed to establish appropriate accounting controls, cost centers, and financial reporting mechanisms for tracking all remediation-related expenditures against the approved budget, and to provide the Compliance Committee and the full Board of Directors with monthly budget variance reports detailing actual expenditures, committed but unpaid amounts, and remaining budget availability by line item.
RESOLVED FURTHER, that any expenditure in excess of the aggregate $42,500,000 authorized remediation budget shall require additional Board of Directors approval prior to commitment or disbursement, provided that the reallocation of funds among approved line items within the $42,500,000 aggregate budget shall be permitted with the written approval of the Chief Financial Officer and the General Counsel, so long as no individual line item exceeds its approved amount by more than twenty percent (20%).
Resolution 5 — Authorization of Civil Money Penalty Payment
RESOLVED, that the Board of Directors hereby authorizes and directs Samantha Reeves, Chief Financial Officer of BRFG and BRB, to cause Belmont Ridge Bank National Association to remit payment of the civil money penalty in the amount of Fourteen Million Five Hundred Thousand Dollars ($14,500,000) assessed under OCC Consent Order No. OCC-2025-003 to the United States Treasury, in accordance with the payment instructions and wire transfer details provided by the OCC in the Consent Order, on or before March 16, 2025 (being the sixtieth (60th) day following the Consent Order's effective date of January 15, 2025).
RESOLVED FURTHER, that the Board acknowledges that the total combined financial outlay for the civil money penalty ($14,500,000) and the remediation program ($42,500,000) is expected to be approximately Fifty-Seven Million Dollars ($57,000,000), and that such amount has been reflected in the Company's financial planning and capital projections. The Board further directs the Chief Financial Officer to ensure that the payment of the civil money penalty and the remediation expenditures do not cause the Bank to fall below its internal capital targets or any regulatory minimum capital requirements.
Resolution 6 — Ratification of Calderwood & Harkness LLP Engagement
RESOLVED, that the Board of Directors hereby ratifies and confirms BRB's engagement of Calderwood & Harkness LLP as outside regulatory counsel for the BSA/AML and sanctions compliance-program uplift, remediation of all Consent Order findings, regulatory engagement and negotiation, and oversight of the independent consultant engagement, pursuant to the engagement letter dated February 10, 2025 (C&H Matter No. 1045-00002), with Philip Hartmann serving as the Responsible Partner.
RESOLVED FURTHER, that the Board hereby approves the engagement terms as set forth in the engagement letter, including the following:
(a) Phase 1 (Assessment & Remediation Plan Development: February 10, 2025 – May 15, 2025) estimated professional fees of $4,800,000;
(b) Phase 2 (Implementation & Monitoring: May 16, 2025 – February 15, 2026) estimated professional fees of $3,200,000;
(c) Total estimated professional fees of $8,000,000, subject to a ±15% fee collar, with overruns in excess of $9,200,000 requiring the prior written approval of the General Counsel;
(d) A $500,000 evergreen retainer deposited by BRB on February 12, 2025, to be applied against outstanding invoices and replenished as provided in the engagement letter;
(e) A reimbursable expense cap of $250,000; and
(f) The following standard hourly billing rates for the core engagement team:
•  Philip Hartmann (Partner, Responsible Partner): $1,450/hour
•  Marcus Delgado (Partner): $1,350/hour
•  Yuki Nakamura (Senior Associate): $895/hour
•  Carlos Espinoza (Associate): $725/hour
Resolution 7 — Ratification of Thornfield Consulting Group LLC Engagement
RESOLVED, that the Board of Directors hereby ratifies and confirms BRB's engagement of Thornfield Consulting Group LLC as the OCC-mandated independent consultant pursuant to Article VII of the Consent Order, under the engagement agreement dated February 10, 2025 (Thornfield Engagement Reference: TCG-BRB-2025-001), to conduct a comprehensive assessment of BRB's BSA/AML and OFAC compliance programs and to validate the adequacy and effectiveness of the Bank's remediation efforts.
RESOLVED FURTHER, that the Board hereby approves the engagement terms as set forth in the engagement agreement, including:
(a) A fixed professional fee of $6,500,000, payable in twelve (12) equal monthly installments of $541,666.67;
(b) Reimbursable out-of-pocket expenses subject to a cap of $400,000;
(c) A total maximum engagement cost of $6,900,000;
(d) An engagement term of twelve (12) months, from February 2025 through February 2026; and
(e) Thornfield's engagement team, led by Dr. Vivian Castellano (Managing Director, Financial Crimes Advisory), and supported by Robert Eastman (Senior Director, AML Transaction Monitoring), Jennifer Hwang (Director, Sanctions & OFAC Compliance), and Nathaniel Burgess (Director, Fintech & Payments Compliance).
The Board further notes that Thornfield has been approved by the OCC as an acceptable independent consultant pursuant to the non-objection issued on February 5, 2025, and that Thornfield is obligated under both the Consent Order and the engagement agreement to report directly to the OCC in addition to the Bank.
Resolution 8 — Direction to Management for Full Cooperation
RESOLVED, that the Board of Directors hereby directs all officers, employees, and agents of BRFG and BRB, including without limitation the following named individuals:
•  Diane Whitford — Chief Executive Officer
•  Raymond Okoye — President and Chief Operating Officer
•  Gregory Nardone — General Counsel and Corporate Secretary
•  Patricia Langston — Chief Compliance Officer
•  Thomas Ikeda — BSA Officer / AML Program Director
•  Melissa Chu — Chief Risk Officer
•  Warren Ashby — Head of Fintech Partnerships / BaaS Division
•  Linda Petrosian — Chief Information Officer / Chief Technology Officer
•  Derek Ballard — Head of Internal Audit
to cooperate fully, promptly, and in good faith with each of the following:
(a) Calderwood & Harkness LLP — in connection with all aspects of the BSA/AML and sanctions compliance-program uplift, remediation of Consent Order findings, preparation and submission of regulatory reports, and engagement with the OCC, FinCEN, and other regulatory authorities;
(b) Thornfield Consulting Group LLC — in connection with its independent assessment and validation engagement, including providing full and timely access to all systems, personnel, records, data, and facilities as required under the Access & Cooperation Protocol set forth in Annex C to the Thornfield engagement agreement, and responding to all information requests within the timeframes specified therein; and
(c) The OCC and FinCEN — in connection with all examination, reporting, supervisory, and enforcement activities, including the timely production of documents and information responsive to regulatory requests, participation in supervisory meetings, and compliance with all reporting obligations under the Consent Order.
RESOLVED FURTHER, that any failure by an officer, employee, or agent of BRFG or BRB to cooperate fully and promptly with the foregoing parties in connection with the Consent Order remediation and the compliance-program uplift shall be treated as a serious performance deficiency and shall be subject to appropriate disciplinary action, up to and including termination of employment. The General Counsel and the Chief Compliance Officer are directed to communicate this expectation to all relevant personnel and to report any instances of non-cooperation to the Compliance Committee.
Resolution 9 — Authorization of Remediation Action Plan Development and Submission
RESOLVED, that the Board of Directors hereby directs management of BRFG and BRB, in coordination with Calderwood & Harkness LLP and Thornfield Consulting Group LLC, to prepare a Comprehensive Remediation Action Plan addressing all deficiencies identified in the Consent Order and to submit such plan to the OCC by May 15, 2025, in accordance with the timeline established by the Consent Order. The Comprehensive Remediation Action Plan shall address the following five (5) core workstreams:
(i) OFAC Sanctions Screening — Remediation of all OFAC screening gaps, including reconfiguration and enhancement of data integrations with all BaaS partner platforms, implementation of comprehensive reconciliation and quality assurance processes, and deployment of enhanced screening capabilities through the Veridian TMS v.10.0 OFAC module;
(ii) SAR Backlog Clearance and Process Improvement — Clearance of the existing backlog of approximately 2,400 unreviewed alerts by June 30, 2025, implementation of improved alert triage, investigation, and SAR filing workflows to achieve and sustain a target SAR filing time of thirty (30) days or less, and completion of a retrospective SAR lookback review;
(iii) CDD/EDD Remediation — Re-verification and enhanced due diligence for all 47,000 identified high-risk customer accounts, with a target of 50% completion (23,500 accounts) by July 15, 2025 and 100% completion by January 15, 2026, including the de-risking or exit of accounts that cannot be adequately verified or that present unacceptable risk;
(iv) Transaction Monitoring Model Validation and Tuning — Completion of an independent model validation of Veridian TMS v.10.0 by October 1, 2025, including threshold tuning, scenario analysis, above- and below-the-line testing, and documentation in accordance with OCC Bulletin 2011-12; and
(v) BSA/AML Program Governance and Training — Enhancement of the Bank's BSA/AML governance framework, including the establishment of the Compliance Committee, implementation of enhanced Board-level and management-level reporting, development and delivery of comprehensive BSA/AML and sanctions training for all employees, and revision of all BSA/AML and OFAC policies and procedures.
RESOLVED FURTHER, that the Board of Directors shall review and approve the Comprehensive Remediation Action Plan prior to its submission to the OCC, and that such review and approval shall occur at a special meeting of the Board or the Compliance Committee to be convened no later than May 10, 2025 for that purpose.
Resolution 10 — Authorization of Technology and Vendor Arrangements
RESOLVED, that the Board of Directors hereby authorizes management of BRB to negotiate and execute the necessary amendments to BRB's existing Master Services Agreement with Veridian Analytics Inc. (Contract No. VA-BRB-2023-0044) for the upgrade from Veridian TMS v.8.3 to Veridian TMS v.10.0, including the enhanced OFAC screening module, at an estimated total cost of Four Million Seven Hundred Thousand Dollars ($4,700,000), comprised of Two Million Eight Hundred Thousand Dollars ($2,800,000) in one-time implementation costs and One Million Nine Hundred Thousand Dollars ($1,900,000) in incremental annual licensing fees (resulting in a new total annual contract value of approximately $6,000,000), subject to final contract terms approved by the General Counsel. The upgrade shall be deployed to a user acceptance testing environment and fully operational in production no later than August 1, 2025, in accordance with the Consent Order remediation timeline.
RESOLVED FURTHER, that the Board of Directors hereby authorizes management of BRB to continue evaluating Ridgeline Data Systems LLC as an alternative transaction monitoring vendor in the event that the Veridian TMS v.10.0 upgrade proves technically or operationally insufficient to meet the Bank's compliance requirements or the standards established by the Consent Order, provided that any proposed engagement of Ridgeline Data Systems LLC as a replacement or supplemental transaction monitoring vendor shall require separate Board of Directors approval prior to execution.
RESOLVED FURTHER, that the Board of Directors hereby authorizes management of BRB to execute the Managed Services Agreement with Pinnacle Compliance Solutions LLC (SOW Reference: PCS-BRB-2025-0012) for the provision of thirty (30) full-time-equivalent temporary BSA/AML analysts to augment the Bank's compliance staff during the twelve (12)-month remediation period, at a total cost of Three Million Six Hundred Thousand Dollars ($3,600,000) (being $10,000 per analyst per month for 12 months). Such temporary analysts shall be integrated into the Bank's BSA/AML operations under the supervision of the BSA Officer, Thomas Ikeda, and shall be deployed primarily to the SAR backlog clearance, CDD/EDD remediation, and transaction monitoring alert review workstreams.
Resolution 11 — Quarterly Reporting and OCC Communication Obligations
RESOLVED, that the Board of Directors hereby directs management and the Compliance Committee to ensure the timely preparation, review, and submission of all OCC-required reports and communications in connection with the Consent Order, including but not limited to the following:
(a) Interim SAR Backlog Status Report — due to the OCC no later than March 31, 2025, detailing the current status of the SAR alert backlog, the number of alerts dispositioned since the Consent Order's effective date, projected timeline for full backlog clearance, and any impediments to timely completion;
(b) Comprehensive Remediation Action Plan — due to the OCC no later than May 15, 2025, addressing all five core deficiency categories identified in the Consent Order, as described in Resolution 9 above;
(c) First Quarterly Progress Report — due to the OCC no later than September 15, 2025, summarizing remediation progress across all workstreams, reporting on key metrics, and identifying any deviations from the approved Remediation Action Plan;
(d) Second Quarterly Progress Report — due to the OCC no later than December 15, 2025, providing an updated assessment of remediation progress, including the status of the Veridian TMS v.10.0 deployment, OFAC screening operational status, and CDD/EDD remediation progress; and
(e) Compliance Self-Certification — due to the OCC no later than February 15, 2026, certifying the Bank's full compliance with all provisions of the Consent Order and the Comprehensive Remediation Action Plan, and accompanied by the Thornfield final validation report.
RESOLVED FURTHER, that all such reports and communications shall be reviewed by outside counsel (Calderwood & Harkness LLP) prior to submission to the OCC, and that the independent consultant (Thornfield Consulting Group LLC) shall be afforded the opportunity to review and provide input on such reports where appropriate and consistent with Thornfield's independent mandate under the Consent Order.
Resolution 12 — General Authority
RESOLVED, that the officers of Belmont Ridge Financial Group, Inc. and Belmont Ridge Bank National Association, and each of them individually, are hereby authorized and empowered to take all such further actions, execute and deliver all such further agreements, instruments, certificates, and documents, and incur all such further costs and expenses, in the name and on behalf of the Company and the Bank, as such officers shall deem necessary, appropriate, or advisable to carry out the purposes and intent of the foregoing resolutions, in consultation with Calderwood & Harkness LLP, the taking of any such action to be conclusive evidence of the authority therefor.
RESOLVED FURTHER, that all actions heretofore taken by any officer or authorized representative of BRFG or BRB prior to the date of these resolutions that are consistent with the authority granted herein, including without limitation the engagement of Calderwood & Harkness LLP, the engagement of Thornfield Consulting Group LLC, the execution of the Pinnacle Compliance Solutions LLC Managed Services Agreement, and any communications with the OCC or FinCEN, are hereby ratified, confirmed, and approved in all respects.
CERTIFICATION
I, Gregory Nardone, hereby certify that:
1.  I am the duly appointed General Counsel and Corporate Secretary of Belmont Ridge Financial Group, Inc., a Delaware corporation.
2.  The foregoing resolutions were duly adopted by the Board of Directors of Belmont Ridge Financial Group, Inc. at a duly convened meeting of the Board of Directors held on February 28, 2025, at which a quorum of directors was present and acting throughout.
3.  The resolutions were adopted by the affirmative vote of all directors present at the meeting, constituting the following directors:
•  Diane Whitford — Chair of the Board and Chief Executive Officer
•  Arthur Connelly — Lead Independent Director
•  Margaret Dao — Independent Director
•  James Rutherford — Independent Director
•  Sandra Villarreal — Independent Director
•  Keith Yamamoto — Independent Director
4.  The resolutions have not been amended, modified, or rescinded and remain in full force and effect as of the date of this certification.
5.  A copy of these resolutions has been filed with the corporate records of the Company and with the minutes of the meeting of the Board of Directors at which they were adopted.
IN WITNESS WHEREOF, I have hereunto set my hand and affixed the corporate seal of Belmont Ridge Financial Group, Inc. as of the date set forth below.
BELMONT RIDGE FINANCIAL GROUP, INC.
By: ________
Name: Gregory Nardone
Title: General Counsel & Corporate Secretary
Date: ________
[CORPORATE SEAL]
EXHIBITS
Exhibit A — Compliance Committee Charter
The Compliance Committee Charter adopted by the Board of Directors is set forth in the separate document titled Compliance Committee Charter of the Board of Directors of Belmont Ridge Financial Group, Inc., dated February 28, 2025, filed as: compliance-committee-charter-draft.docx.
The Compliance Committee Charter is incorporated herein by reference and made a part of these resolutions as if set forth in full.
Exhibit B — Amended and Restated Bylaws — Redline Showing Compliance Committee Provisions
The amendments to the Amended and Restated Bylaws of Belmont Ridge Financial Group, Inc. establishing the Compliance Committee as a standing committee of the Board of Directors are set forth in redlined form in the separate document titled Amended and Restated Bylaws of Belmont Ridge Financial Group, Inc. — Redline Showing Compliance Committee Provisions, dated February 28, 2025, filed as: amended-bylaws-compliance-committee-redline.docx.
The redlined Bylaw amendments are incorporated herein by reference and made a part of these resolutions as if set forth in full.
PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT Calderwood & Harkness LLP | C&H Matter No. 1045-00002
Budget Line Item | Estimated Cost
Outside counsel (Calderwood & Harkness LLP) | $8,000,000
Independent consultant (Thornfield Consulting Group LLC: $6,500,000 fees + $400,000 expenses) | $6,900,000
Technology upgrade (Veridian Analytics Inc. TMS v.10.0: $2,800,000 one-time implementation + $1,900,000 incremental Year 1 licensing) | $4,700,000
Temporary staffing (Pinnacle Compliance Solutions LLC: 30 FTE × $10,000/month × 12 months) | $3,600,000
Internal headcount additions (15 FTEs at approximately $150,000 average fully loaded cost per FTE) | $2,250,000
SAR lookback project | $5,500,000
CDD/EDD remediation project | $4,300,000
Training and policy development | $1,800,000
Board and governance restructuring | $500,000
Contingency and other costs | $4,950,000
Total Remediation Budget (exclusive of CMP) | $42,500,000
Milestone | Deadline
Board Resolution acknowledging Consent Order | February 28, 2025
Civil money penalty payment ($14,500,000) | March 16, 2025
Interim SAR backlog status report to OCC | March 31, 2025
Thornfield preliminary gap assessment | April 15, 2025
Comprehensive Remediation Action Plan due to OCC | May 15, 2025
SAR backlog clearance (2,400 alerts fully dispositioned) | June 30, 2025
CDD/EDD 50% remediation (23,500 of 47,000 accounts) | July 15, 2025
Veridian TMS v.10.0 UAT complete and deployed to production | August 1, 2025
First quarterly progress report to OCC | September 15, 2025
Independent model validation of upgraded TMS | October 1, 2025
OFAC screening fully operational for all BaaS channels | November 1, 2025
Second quarterly progress report to OCC | December 15, 2025
CDD/EDD 100% remediation (all 47,000 accounts) | January 15, 2026
Full compliance program implementation; Thornfield final validation report; self-certification due to OCC | February 15, 2026

PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT

RESOLUTIONS OF THE BOARD OF DIRECTORS OF BELMONT RIDGE FINANCIAL GROUP, INC.

PREAMBLE AND RECITALS

RESOLUTIONS

CERTIFICATION

BELMONT RIDGE FINANCIAL GROUP, INC.

EXHIBITS

Record

Parties

Dates

Amounts