ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT THIS DOCUMENT AND ITS CONTENTS ARE PROTECTED BY THE ATTORNEY-CLIENT PRIVILEGE AND CONSTITUTE ATTORNEY WORK PRODUCT. THIS DOCUMENT IS PREPARED IN CONNECTION WITH THE PROVISION OF LEGAL ADVICE TO BELMONT RIDGE FINANCIAL GROUP, INC. AND BELMONT RIDGE BANK NATIONAL ASSOCIATION. DO NOT DISTRIBUTE, COPY, OR DISCLOSE WITHOUT THE PRIOR WRITTEN CONSENT OF CALDERWOOD & HARKNESS LLP.
BOARD & SENIOR MANAGEMENT BSA/AML TRAINING OUTLINE
Prepared By: Calderwood & Harkness LLP 1285 Avenue of the Americas, 40th Floor New York, New York 10019
C&H Matter No. 1045-00002
Prepared For: Board of Directors and Senior Management Belmont Ridge Financial Group, Inc. Belmont Ridge Bank National Association 680 Lexington Avenue, 22nd Floor New York, New York 10022
February 2025
DOCUMENT INFORMATION
Intended Audience:
BRFG Board of Directors:
• Diane Whitford, Chair of the Board
• Arthur Connelly, Lead Independent Director
• Margaret Dao, Independent Director
• James Rutherford, Independent Director
• Sandra Villarreal, Independent Director
• Keith Yamamoto, Independent Director
C-Suite Executives:
• Raymond Okoye, Chief Executive Officer
• Samantha Reeves, President and Chief Operating Officer
• Gregory Nardone, General Counsel
• Patricia Langston, Chief Compliance Officer
• Thomas Ikeda, BSA Officer / AML Program Director
• Melissa Chu, Chief Risk Officer
• Warren Ashby, Head of Fintech Partnerships / BaaS Division
• Linda Petrosian, Chief Information Officer / Chief Technology Officer
• Derek Ballard, Head of Internal Audit
Right-click to update Table of Contents
I. INTRODUCTION AND TRAINING OBJECTIVES
1.1 Purpose of This Training
This training has been developed and is being delivered by Calderwood & Harkness LLP ("C&H") at the direction and for the benefit of the Board of Directors and Senior Management of Belmont Ridge Financial Group, Inc. ("BRFG") and its wholly owned banking subsidiary, Belmont Ridge Bank National Association ("BRB" or the "Bank"). The training is delivered pursuant to the engagement letter dated February 10, 2025 between BRFG, BRB, and C&H, and all communications made in connection with this training and related remediation activities are protected by the attorney-client privilege and constitute attorney work product.
The immediate catalyst for this training is the issuance of Consent Order No. OCC-2025-003, entered by the Office of the Comptroller of the Currency ("OCC") on January 15, 2025, against Belmont Ridge Bank National Association (OCC Charter No. 48271; FDIC Certificate No. 31845). The Consent Order imposes a civil money penalty of $14,500,000 and mandates a comprehensive program of remediation addressing deficiencies identified in BRB's Bank Secrecy Act / Anti-Money Laundering ("BSA/AML") compliance program and its sanctions compliance under the regulations administered by the Office of Foreign Assets Control ("OFAC").
The Consent Order specifically cited board-level oversight deficiencies as one of five core deficiency categories identified by the OCC during its targeted BSA/AML examination conducted between March 2024 and September 2024. In particular, the OCC found that BSA/AML reporting to the Board was infrequent (quarterly only), lacked key compliance metrics, and did not provide the Board with sufficient information to exercise effective oversight over the Bank's BSA/AML compliance program — especially with respect to the rapidly growing Banking-as-a-Service ("BaaS") and fintech partnership channel.
This training is a component of Workstream 5 (BSA/AML Program Governance & Training Enhancement) of the Comprehensive Remediation Action Plan ("RAP") that BRB is required to submit to the OCC by May 15, 2025. The RAP is being developed collaboratively by C&H, BRB management, and the independent consultant, Thornfield Consulting Group LLC ("Thornfield"), whose engagement was approved by the OCC on February 5, 2025. The training is designed to satisfy the Consent Order's explicit requirement for enhanced Board engagement in BSA/AML compliance oversight, as articulated in Articles V and VIII of the Consent Order.
The training program as a whole is funded under the $1,800,000 training and policy development remediation budget line item within the Board-authorized $42,500,000 remediation budget. This written outline is intended to serve as a comprehensive reference document for Board members and senior management to supplement the in-person presentation.
1.2 Training Objectives
This training is designed to accomplish the following specific objectives for all Board members and senior management attendees:
1. Regulatory Framework Comprehension. Equip Board members and senior management with a working understanding of the BSA/AML regulatory framework, including the Bank Secrecy Act, the USA PATRIOT Act, the Anti-Money Laundering Act of 2020, and OFAC sanctions obligations. Attendees should leave this training with a clear understanding of the key statutes, regulations, and supervisory expectations that govern BRB's BSA/AML and sanctions compliance obligations.
2. Personal Liability Awareness. Clarify the personal liability exposure that directors and officers face under federal banking enforcement statutes, including the potential for individual civil money penalties, cease and desist orders, removal and prohibition orders, and, in cases of willful violations, criminal prosecution. Each attendee should understand that BSA/AML compliance failures can give rise to personal consequences that extend beyond the institution.
3. Consent Order Comprehension. Explain the specific findings, requirements, and deadlines of Consent Order No. OCC-2025-003, so that each Board member and senior officer can articulate the nature and scope of the deficiencies identified by the OCC, the remediation requirements imposed, and the critical milestones and deadlines that must be met over the ensuing twelve-month period.
4. Governance Oversight Clarity. Define the governance oversight responsibilities that the Consent Order imposes upon the Board, including the role and charter of the newly established Compliance Committee, the required reporting cadences and metrics, and the standard of engagement that the OCC expects from directors of a national bank under an active consent order.
5. Red Flag Identification. Enable Board members and senior management to identify key BSA/AML and OFAC compliance red flags relevant to BRB's business lines, with particular emphasis on the risks presented by the BaaS/fintech partnership channel — the channel from which the most significant deficiencies identified in the Consent Order originated.
6. Remediation Engagement. Establish clear expectations for ongoing Board and senior management engagement throughout the twelve-month remediation period, which runs from the Consent Order effective date of January 15, 2025 through the self-certification and final validation report due date of February 15, 2026. Attendees should leave this training with a concrete understanding of what is expected of them, individually and collectively, over the coming year.
1.3 Training Schedule and Completion Requirements
The training program for Board members and senior management has been structured to provide the appropriate level of depth for each audience while ensuring compliance with the Consent Order's requirements and the remediation timeline.
Initial Board Training Session. The initial training session for the full Board of Directors is to be delivered by C&H attorneys, led by Philip Hartmann (Responsible Partner), with the participation of Yuki Nakamura (Lead Associate) and Carlos Espinoza (Working Associate). This session will be conducted in conjunction with a regularly scheduled or special meeting of the Board of Directors, and will cover the full scope of this written outline. The session is anticipated to require approximately three hours, including time for questions and discussion.
C-Suite Executive Session. A separate training session for C-suite executives will be conducted with deeper operational detail, including a more granular review of the remediation workstreams, technology upgrade requirements, SAR backlog clearance procedures, CDD/EDD remediation methodology, and BaaS partner compliance oversight protocols. This session will be led by Yuki Nakamura and Carlos Espinoza, with Philip Hartmann available for questions regarding legal exposure and regulatory engagement strategy.
Annual Recertification Requirement. Going forward, all Board members and senior management personnel will be required to complete an annual BSA/AML recertification training. This requirement is being incorporated into the BSA/AML Training Policy currently under development as part of Workstream 5 of the RAP. The annual recertification training will be updated each year to reflect changes in the regulatory environment, emerging risks, and the status of BRB's compliance program.
Documentation and Recordkeeping. Attendance and completion of all training sessions will be documented and maintained in BRB's compliance records. Each attendee will be required to sign the Training Acknowledgment and Certification Form attached as Appendix E to this document. These records will be maintained for OCC examination readiness and will be made available to the OCC upon request.
Completion Deadline. All Board members and C-suite officers must complete their initial training sessions prior to the May 15, 2025 RAP submission deadline. This deadline is firm, as the OCC will expect to see documentation of completed Board and senior management training as part of its review of the RAP. Any Board member or senior officer who is unable to attend the scheduled session must complete a make-up session, to be arranged by BRB General Counsel Gregory Nardone and documented in the same manner.
II. BSA/AML REGULATORY FRAMEWORK OVERVIEW
2.1 The Bank Secrecy Act (BSA)
The Bank Secrecy Act, formally known as the Currency and Foreign Transactions Reporting Act, was enacted in 1970 and is codified at 31 U.S.C. §§ 5311–5332. The implementing regulations promulgated by the Financial Crimes Enforcement Network ("FinCEN") are found at 31 C.F.R. Chapter X. The BSA is the foundational federal statute governing anti-money laundering compliance for financial institutions in the United States.
The core purpose of the BSA is to require financial institutions to assist government agencies in the detection and prevention of money laundering, terrorist financing, and other financial crimes. The BSA accomplishes this by imposing a series of recordkeeping and reporting obligations on financial institutions, and by requiring institutions to establish and maintain compliance programs designed to ensure adherence to those obligations. Congress recognized that financial institutions, by virtue of their role as intermediaries in the flow of funds, occupy a unique position from which they can identify and report suspicious financial activity.
For national banks such as BRB, the BSA imposes the following key obligations:
Establishment and Maintenance of an Effective BSA/AML Compliance Program. Every national bank is required to establish and maintain a BSA/AML compliance program that is reasonably designed to ensure and monitor compliance with the BSA and its implementing regulations. The components of an effective compliance program — commonly referred to as the "Five Pillars" — are discussed in detail in Section 2.6 below. The program must be tailored to the bank's specific risk profile, taking into account the nature, size, complexity, and risk of the bank's products, services, customers, and geographic locations.
Currency Transaction Reports (CTRs). National banks are required to file Currency Transaction Reports with FinCEN for each transaction in currency (cash) exceeding $10,000. Multiple transactions conducted by or on behalf of the same person during a single business day must be aggregated if they total more than $10,000 in the aggregate. CTRs must be filed within 15 calendar days of the transaction. BRB filed 28,612 CTRs in calendar year 2024, reflecting the volume of cash transactions processed across its retail banking operations.
Suspicious Activity Reports (SARs). National banks are required to file Suspicious Activity Reports with FinCEN for any known or suspected violation of federal law, or any suspicious transaction relevant to a possible violation of law or regulation. A SAR must be filed for any transaction (or pattern of transactions) involving $5,000 or more that the bank knows, suspects, or has reason to suspect involves funds derived from illegal activity, is designed to evade BSA reporting requirements, has no business or apparent lawful purpose, or involves the use of the bank to facilitate criminal activity. SARs must be filed no later than 30 calendar days after the initial detection of facts that may constitute a basis for filing. BRB filed 3,847 SARs in calendar year 2024, up from 2,914 SARs in calendar year 2023 — an increase of approximately 32% that reflects both the growth of the BaaS channel and the increased scrutiny that followed the November 2023 MRIA.
Recordkeeping Requirements. The BSA requires national banks to maintain records of certain transactions, including records of wire transfers of $3,000 or more and records related to the purchase of monetary instruments. These records must be maintained for a period of five years and must be made available to regulators and law enforcement upon request.
Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD) Requirements. National banks are required to implement risk-based procedures for conducting ongoing customer due diligence, which includes identifying and verifying the identity of customers, understanding the nature and purpose of customer relationships, and conducting ongoing monitoring to identify and report suspicious transactions. For higher-risk customers, enhanced due diligence is required, including more intensive monitoring and more detailed documentation of the customer relationship.
2.2 The USA PATRIOT Act (Title III)
The Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism ("USA PATRIOT") Act was enacted on October 26, 2001, in the aftermath of the September 11, 2001 terrorist attacks. Title III of the USA PATRIOT Act, the International Money Laundering Abatement and Anti-Terrorist Financing Act of 2001, significantly expanded the BSA's obligations for financial institutions and strengthened the government's tools for combating money laundering and terrorist financing.
Key provisions of Title III that are relevant to BRB's obligations include the following:
Section 312: Special Due Diligence for Correspondent Accounts and Private Banking Accounts. Section 312 requires financial institutions to establish, maintain, and administer programs of special due diligence for correspondent accounts maintained for foreign financial institutions and for private banking accounts maintained for non-U.S. persons. These programs must include reasonable procedures to detect and report known or suspected money laundering activity conducted through or involving such accounts.
Section 314: Information Sharing Between Government and Financial Institutions. Section 314 established two critical information-sharing mechanisms. Section 314(a) allows federal law enforcement agencies, through FinCEN, to reach out to financial institutions to locate accounts and transactions of individuals or entities suspected of engaging in terrorism or money laundering. Section 314(b) provides a safe harbor for financial institutions to share information with one another for the purpose of identifying and reporting potential money laundering or terrorist financing. BRB participates in both Section 314(a) and Section 314(b) information-sharing programs.
Section 326: Customer Identification Program (CIP) Requirements. Section 326 requires financial institutions to implement reasonable procedures for verifying the identity of any person seeking to open an account, maintaining records of the information used to verify a customer's identity, and determining whether the person appears on any list of known or suspected terrorists or terrorist organizations. The CIP requirements are foundational to the broader CDD framework and are particularly relevant to BRB's BaaS operations, where customer onboarding is frequently performed by fintech partners rather than by the Bank directly.
2.3 The Anti-Money Laundering Act of 2020 (AMLA)
The Anti-Money Laundering Act of 2020 ("AMLA") was enacted on January 1, 2021 as part of the National Defense Authorization Act for Fiscal Year 2021. AMLA represents the most significant modernization of the BSA framework since the USA PATRIOT Act and reflects Congress's recognition that the financial crimes landscape has evolved substantially in the two decades since 2001.
AMLA modernized the BSA framework in several important respects. First, it expanded whistleblower protections and established a new whistleblower award program under which individuals who provide original information leading to successful BSA enforcement actions may receive awards of up to 30% of monetary sanctions exceeding $1,000,000. This provision is particularly relevant to BRB's current situation, as it incentivizes current and former employees to report potential BSA violations directly to the government.
Second, AMLA introduced beneficial ownership reporting requirements, which have been implemented through FinCEN's Corporate Transparency Act regulations. These regulations require certain entities to report their beneficial ownership information to FinCEN, creating a centralized database that financial institutions and law enforcement can access to verify the identities of the natural persons who ultimately own or control their business customers.
Third, AMLA enhanced penalties for BSA violations, broadening the scope of conduct that can give rise to criminal prosecution and increasing the maximum penalties for certain categories of violations. The enhanced penalty provisions underscore the importance of maintaining a robust BSA/AML compliance program and responding promptly and effectively to identified deficiencies.
2.4 FinCEN's Role
The Financial Crimes Enforcement Network ("FinCEN") is a bureau of the U.S. Department of the Treasury with a dual mission: to safeguard the financial system from illicit use and to combat money laundering and promote national security through the collection, analysis, and dissemination of financial intelligence and the strategic use of financial authorities.
FinCEN administers the BSA regulations and serves as the primary collector and analyst of the financial intelligence generated by the reporting obligations imposed on financial institutions. FinCEN receives and maintains the CTR, SAR, and other BSA filings submitted by financial institutions, and it makes this information available to federal, state, local, and foreign law enforcement agencies for use in criminal investigations and other authorized purposes.
FinCEN also possesses independent enforcement authority. Under 31 U.S.C. § 5321, FinCEN can impose civil money penalties on financial institutions and individuals for willful violations of BSA requirements. FinCEN's enforcement actions can be brought in addition to, and independently from, actions taken by an institution's primary federal regulator. FinCEN penalties can be substantial: in recent years, FinCEN has imposed penalties in excess of $100,000,000 on financial institutions with systemic BSA compliance failures.
With respect to BRB's current situation, FinCEN is actively monitoring the Bank's SAR filing remediation. FinCEN Associate Director Angela Drummond of the Enforcement Division is the designated monitoring official. FinCEN has coordinated with the OCC regarding the Consent Order and has reserved its independent enforcement rights. This means that FinCEN has not foreclosed the possibility of bringing a separate enforcement action against BRB (or against individuals associated with BRB) based on the same underlying conduct that gave rise to the OCC Consent Order. No separate FinCEN enforcement action has been filed as of February 10, 2025, but the reservation of rights means that the Board should treat FinCEN's posture as an active risk that must be managed throughout the remediation process.
2.5 OCC's Supervisory Role
The Office of the Comptroller of the Currency ("OCC") is the primary federal regulator of national banks, including BRB (OCC Charter No. 48271). The OCC charters, regulates, and supervises all national banks and federal savings associations, as well as federal branches and agencies of foreign banks operating in the United States.
The OCC conducts BSA/AML examinations of national banks on a regular basis, applying the examination procedures set forth in the Federal Financial Institutions Examination Council ("FFIEC") BSA/AML Examination Manual. Based on examination findings, the OCC has a range of supervisory and enforcement tools available to it, escalating in severity as follows:
• Matters Requiring Attention (MRAs): Formal supervisory recommendations that the bank address identified weaknesses. While not formal enforcement actions, MRAs represent the OCC's expectation that the bank will take corrective action within a specified timeframe.
• Matters Requiring Immediate Attention (MRIAs): Supervisory determinations that identified weaknesses are of such severity that they require immediate corrective action. MRIAs represent a higher level of urgency and supervisory concern than MRAs.
• Consent Orders and Cease & Desist Orders: Formal enforcement actions that compel the bank to take specified corrective actions. Consent Orders are agreed-to by the institution; Cease & Desist Orders are imposed unilaterally. Both carry the force of law.
• Civil Money Penalties (CMPs): Monetary penalties imposed on the institution and/or individuals for violations of law, regulations, or supervisory orders.
• Removal and Prohibition Orders: Orders removing individuals from their positions and prohibiting them from participating in the affairs of any insured depository institution.
BRB's supervisory history with the OCC on BSA/AML matters reflects an escalating pattern of findings that ultimately culminated in the issuance of the Consent Order:
• June 2022: The OCC issued a Matter Requiring Attention (MRA) regarding deficiencies in BRB's BSA/AML transaction monitoring program. The MRA identified gaps in the transaction monitoring system's scenario coverage, particularly with respect to the then-nascent BaaS channel.
• November 2023: The OCC escalated to a Matter Requiring Immediate Attention (MRIA) regarding OFAC screening gaps. The MRIA identified that BRB had not implemented adequate OFAC screening for transactions processed through certain fintech BaaS partners, and required the Bank to take immediate corrective action.
• March 2024 – September 2024: The OCC conducted a targeted BSA/AML examination of BRB over a six-month cycle. This extended examination reflected the OCC's heightened concern about the adequacy of BRB's remediation of the prior MRA and MRIA findings.
• January 15, 2025: The OCC issued Consent Order No. OCC-2025-003 with a civil money penalty of $14,500,000. The Consent Order identified five core deficiency categories and imposed a comprehensive remediation program with a twelve-month implementation timeline.
The Examiner-in-Charge assigned to BRB is Jonathan Frey, National Bank Examiner, OCC Northeastern District Office, 340 Madison Avenue, New York, NY 10017. All Board members and senior management should be familiar with Mr. Frey's role and should understand that he will remain actively involved in monitoring BRB's remediation progress throughout the twelve-month period.
2.6 The Five Pillars of an Effective BSA/AML Compliance Program
Federal banking regulators, including the OCC, expect every national bank to maintain a BSA/AML compliance program built on five foundational elements, commonly referred to as the "Five Pillars." These five pillars collectively define the minimum expectations for an effective program. The adequacy of a bank's compliance program is evaluated by examining the strength and effectiveness of each pillar, both individually and in their interaction as an integrated whole.
Pillar 1: Internal Policies, Procedures, and Controls. The bank must establish and maintain written policies, procedures, and internal controls that are reasonably designed to ensure compliance with the BSA, its implementing regulations, and OFAC sanctions requirements. These policies must be tailored to the bank's specific risk profile and must be updated regularly to reflect changes in the bank's business, the regulatory environment, and the risk landscape. Policies must address, at a minimum, customer identification and verification, customer due diligence, suspicious activity monitoring and reporting, currency transaction reporting, OFAC screening, and information sharing.
Pillar 2: Designation of a BSA Officer. The bank must designate a qualified individual as the BSA Compliance Officer, responsible for coordinating and monitoring day-to-day compliance with the BSA/AML program. The BSA Officer must have sufficient authority, resources, and access to senior management and the Board to carry out these responsibilities effectively. BRB's current BSA Officer is Thomas Ikeda, who was appointed in March 2023 and also holds the title of AML Program Director. The Consent Order requires BRB to ensure that Mr. Ikeda (or his successor, if applicable) has adequate staffing, technology, and budgetary resources to fulfill his responsibilities.
Pillar 3: Employee Training Program. The bank must provide comprehensive BSA/AML training to all employees whose duties require knowledge of BSA requirements, as well as to Board members and senior management. Training must be tailored to the specific duties and responsibilities of each employee group, must be updated regularly, and must be documented. This training session is part of BRB's compliance with Pillar 3.
Pillar 4: Independent Testing/Audit Function. The bank must subject its BSA/AML compliance program to independent testing at regular intervals. This testing must be conducted by qualified personnel who are independent of the compliance function — either the bank's internal audit department or an outside firm. The most recent independent test of BRB's BSA/AML program was completed in September 2024 by Caldera & Pope LLP (Franklin Dorsey, Engagement Partner), at a cost of $1,100,000. As discussed in Section XI below, Caldera & Pope's findings were largely consistent with the deficiencies identified by the OCC in the Consent Order, underscoring the fact that the Board should have been more actively engaged in responding to those findings.
Pillar 5: Risk-Based Customer Due Diligence and Enhanced Due Diligence Procedures. The bank must implement risk-based procedures for conducting initial and ongoing customer due diligence, including the identification and verification of beneficial owners of legal entity customers. For higher-risk customers, the bank must conduct enhanced due diligence that is commensurate with the level of risk presented. This fifth pillar was added to the regulatory framework in 2018 through FinCEN's CDD Rule and reflects the critical importance of understanding who a bank's customers are and why they are using the bank's products and services.
The Consent Order found deficiencies across all five pillars of BRB's BSA/AML compliance program. This comprehensive failure is what distinguishes BRB's situation from a more targeted supervisory action addressing an isolated weakness. The breadth of the deficiencies underscores the need for a similarly comprehensive remediation effort — and for active, sustained Board and senior management oversight of that effort over the twelve-month remediation period.
III. OFAC SANCTIONS COMPLIANCE OBLIGATIONS
3.1 Overview of the OFAC Sanctions Framework
The Office of Foreign Assets Control ("OFAC") is a bureau of the U.S. Department of the Treasury responsible for administering and enforcing economic and trade sanctions programs based on U.S. foreign policy and national security goals. OFAC sanctions are among the most powerful tools available to the U.S. government for combating threats to national security, foreign policy, and the economy, including terrorism, narcotics trafficking, weapons proliferation, and other malicious activities.
OFAC sanctions programs are authorized by Executive Orders and Congressional legislation and are implemented through regulations published in Title 31 of the Code of Federal Regulations. OFAC maintains several sanctions lists that financial institutions are required to screen against. The key lists include:
• The Specially Designated Nationals and blocked Persons List (SDN List). The SDN List identifies individuals and entities whose assets must be blocked (frozen) and with whom U.S. persons are generally prohibited from dealing. The SDN List currently contains approximately 12,000 entries and is updated on a rolling basis.
• The Sectoral Sanctions Identifications (SSI) List. The SSI List identifies persons operating in certain sectors of designated economies (such as Russia) with whom U.S. persons are prohibited from engaging in certain categories of transactions.
• The Consolidated Sanctions List. A compilation of OFAC's various sanctions lists that facilitates screening by financial institutions.
• Non-SDN Lists. Additional lists including the Non-SDN Menu-Based Sanctions List, the Foreign Sanctions Evaders List, and the Non-SDN Palestinian Legislative Council List.
A critically important feature of the OFAC sanctions regime is that it operates on a strict liability basis. This means that OFAC violations can result in the imposition of civil penalties regardless of whether the institution or individual knew that the transaction involved a sanctioned party. While knowledge and willfulness are factors that affect the amount of any penalty — and voluntary self-disclosure can significantly reduce penalties — the absence of intent is not a defense to liability. This strict liability framework has profound implications for financial institutions and imposes a heightened obligation to maintain effective, comprehensive sanctions screening programs.
3.2 OFAC Obligations for National Banks
National banks such as BRB are subject to the full range of OFAC compliance obligations. These obligations include, but are not limited to, the following:
Transaction and Customer Screening. Banks must screen all transactions and customer relationships against the applicable OFAC sanctions lists. This screening must be conducted in real time (or as close to real time as practicable) for transactions, and must be performed at onboarding and on an ongoing basis for customer relationships. The screening process must be designed to identify potential matches with sanctions list entries and to escalate potential matches for human review and disposition.
blocking and Freezing. When a bank identifies property or an interest in property of an SDN-listed person or entity, the bank must block (freeze) the property. Blocked property must be placed in a segregated, interest-bearing account and may not be released without authorization from OFAC.
Rejection of Prohibited Transactions. When a bank identifies a transaction that is prohibited under OFAC sanctions (but does not involve blockable property), the bank must reject the transaction and not process it.
blocking Reports. Banks must file blocking reports with OFAC within 10 business days of blocking any property. Blocking reports must identify the blocked property, the sanctioned party, and the circumstances of the blocking.
Recordkeeping. Banks must maintain records of sanctions screening results, blocked and rejected transactions, and all related documentation for a period of at least five years.
Risk-Based OFAC Compliance Program. Banks are expected to implement a risk-based OFAC compliance program that is commensurate with the nature, size, and complexity of the bank's business. OFAC has published guidance, "A Framework for OFAC Compliance Commitments," that outlines the essential components of an effective compliance program, including management commitment, risk assessment, internal controls, testing and auditing, and training.
3.3 BRB's OFAC Deficiencies (Per Consent Order)
The Consent Order identified significant deficiencies in BRB's OFAC sanctions screening program, specifically with respect to the BaaS/fintech partnership channel. The most critical finding was that BRB's OFAC screening system failed to screen 100% of transactions processed through certain fintech BaaS channels.
The specific gap identified by the OCC related to transactions processed through NovaPay Technologies Inc. ("NovaPay"), BRB's largest BaaS partner. Approximately 12% of NovaPay wire and ACH transactions were unscreened during calendar year 2023. To contextualize the magnitude of this gap:
• NovaPay processed approximately 31,700,000 total transactions through BRB during CY 2023.
• Approximately 3,800,000 of those transactions were not subjected to OFAC screening.
• NovaPay represents approximately 41% of BRB's total BaaS transaction volume, having processed approximately $30.5 billion out of $74.3 billion in total BaaS volume during CY 2024.
The screening gap was attributable to a technical integration failure between NovaPay's payment processing platform and BRB's OFAC screening system. Specifically, a subset of ACH and wire transactions that were initiated through NovaPay's consumer mobile application were routed through a secondary processing pathway that was not connected to BRB's sanctions screening system. The gap was identified during the OCC's targeted examination, and BRB implemented a temporary manual screening process in August 2024 pending a permanent technology fix.
BRB's overall OFAC screening statistics for CY 2024 were as follows:
• Total OFAC screening hits: 14,320
• True matches requiring blocking or rejection: 12
• False-positive rate: approximately 99.9%
The extremely high false-positive rate — while common in the industry — is itself a supervisory concern, as it suggests that the screening system's calibration and filtering algorithms may require refinement to reduce the operational burden of dispositioning large volumes of false-positive alerts and to ensure that true matches are not lost in the noise.
The Consent Order requires that OFAC screening must be fully operational for all BaaS channels by November 1, 2025. This deadline is firm and represents one of the most critical milestones in the remediation timeline.
3.4 OFAC Enforcement Risk and Voluntary Self-Disclosure Considerations
Board members and senior management should understand that BRB's OFAC screening deficiencies give rise to enforcement risk that is independent from and additional to the risk addressed by the OCC Consent Order. OFAC has its own enforcement authority and can bring civil enforcement actions for apparent sanctions violations regardless of any action taken by the OCC or other regulators.
OFAC's enforcement framework, as set forth in its Enforcement Guidelines (31 C.F.R. Part 501, Appendix A), establishes a structured analysis for determining whether to bring an enforcement action and, if so, the appropriate penalty amount. The key factors that OFAC considers include:
• Whether the conduct was authorized by a general or specific license
• Whether the institution filed a voluntary self-disclosure
• Whether the violation was willful or the result of recklessness
• The pattern of conduct (isolated incident vs. systemic failure)
• The harm to the relevant sanctions program objectives
• The adequacy of the institution's sanctions compliance program at the time of the violation
• The nature and adequacy of the institution's remedial response
• The level of cooperation with OFAC
Voluntary self-disclosure is a particularly significant factor. OFAC's Enforcement Guidelines provide that the filing of a voluntary self-disclosure is a substantial mitigating factor that can result in a significantly reduced penalty — typically a reduction of up to 50% from the base amount of the applicable penalty. Conversely, the failure to file a voluntary self-disclosure when the institution is aware of apparent violations can be treated as an aggravating factor.
C&H is currently analyzing whether BRB should file a voluntary self-disclosure with OFAC regarding the NovaPay screening gaps. This analysis involves a careful assessment of the scope and nature of the unscreened transactions, the likelihood that any unscreened transactions involved sanctioned parties, the institution's remedial response, and the potential benefits and risks of voluntary disclosure. C&H will provide the Board with a formal recommendation on this issue within the coming weeks. In the meantime, Board members should understand that OFAC exposure exists as a separate and distinct risk that must be managed in parallel with the OCC remediation process.
IV. CONSENT ORDER NO. OCC-2025-003: KEY PROVISIONS AND DEADLINES
4.1 Consent Order Overview
Consent Order No. OCC-2025-003 was issued by the Office of the Comptroller of the Currency on January 15, 2025 — the effective date of the order. The Consent Order was entered into by the OCC and Belmont Ridge Bank National Association following the OCC's targeted BSA/AML examination conducted between March 2024 and September 2024.
The Consent Order imposes a civil money penalty of $14,500,000, which is due and payable within 60 days of the effective date — i.e., by March 16, 2025. The penalty is payable to the U.S. Treasury. Board members and senior management should be aware that this penalty is not tax-deductible under 26 U.S.C. § 162(f), which disallows deductions for amounts paid or incurred to a government or governmental entity in relation to the violation of any law or the investigation or inquiry by such government or entity into the potential violation of any law. The full $14,500,000 therefore represents a dollar-for-dollar reduction in BRB's after-tax earnings.
It is important for the Board to note that, as of February 10, 2025, no criminal referral to the U.S. Department of Justice ("DOJ") has been made in connection with the conduct underlying the Consent Order. However, the Consent Order does not contain any provision precluding future criminal referral, and the OCC retains the discretion to refer matters to the DOJ at any time. The Board should be aware that the existence of the Consent Order and the underlying factual findings could form the basis for a future criminal investigation, particularly if the remediation process reveals evidence of willful or knowing violations.
4.2 Five Core Deficiency Categories
The Consent Order identifies five core categories of deficiency in BRB's BSA/AML and OFAC compliance programs. Each deficiency category is discussed in detail below, together with context regarding the scope and significance of the findings.
1. OFAC Sanctions Screening. As discussed in Section III above, BRB's OFAC screening system failed to screen 100% of transactions processed through its BaaS channels. Approximately 12% of NovaPay Technologies transactions — representing approximately 3,800,000 individual transactions in CY 2023 — were not subjected to OFAC screening. This gap represented a fundamental failure in BRB's sanctions compliance architecture and created the risk that transactions involving sanctioned parties could have been processed without detection. The OCC characterized this deficiency as among the most serious findings of the examination.
2. SAR Filing Deficiencies. BRB had accumulated a backlog of approximately 2,400 unreviewed transaction monitoring alerts as of September 2024, the conclusion of the targeted examination. These were alerts generated by the Veridian TMS that had not been investigated, dispositioned, and, where warranted, converted to SAR filings. In addition, the average time from alert generation to SAR filing was 78 days — more than two and a half times the 30-day regulatory expectation. The SAR backlog and filing delays reflected inadequate staffing, outdated technology, and insufficient management attention to the alert-to-SAR pipeline.
3. CDD/EDD Failures. Approximately 47,000 high-risk customer accounts — primarily accounts onboarded through BaaS/fintech partners — lacked adequate CDD or EDD documentation. These accounts had been opened with either incomplete or absent beneficial ownership information, inadequate source-of-funds documentation, or insufficient risk assessment documentation. The 47,000-account figure represents a significant compliance gap, as each of these accounts represents a customer relationship for which BRB, as the chartered bank, is unable to demonstrate that it has met its regulatory obligations to know its customer.
4. Model Validation. BRB's transaction monitoring system, Veridian TMS v.8.3, had not been independently validated since March 2021 — more than three years prior to the examination. Industry standards and regulatory expectations call for independent model validation at least annually, or more frequently when there are significant changes to the model, the data environment, or the risk profile. In addition, the tuning parameters of the Veridian TMS had not been updated since October 2022, meaning that the system's detection scenarios and alert-generation thresholds had not been calibrated to reflect the significant growth in BaaS transaction volumes and the evolving risk profile of BRB's customer base. The lack of current validation and tuning undermined confidence in the effectiveness of BRB's transaction monitoring program as a whole.
5. Board Oversight. The OCC found that BRB's Board of Directors had not maintained adequate oversight of the Bank's BSA/AML compliance program. Specifically, the OCC identified the following governance deficiencies: (a) no dedicated Board Compliance Committee existed, and BSA/AML oversight was subsumed within the broader Audit Committee and Risk Committee mandates without adequate focus; (b) BSA/AML reporting to the Board occurred only on a quarterly basis, which was insufficient given the Bank's risk profile and the rapid growth of the BaaS channel; and (c) the quarterly reports that were provided to the Board lacked key compliance metrics, including SAR filing volumes and timeliness data, OFAC screening hit rates, and risk ratings for individual BaaS partners. The absence of these metrics deprived the Board of the information necessary to exercise meaningful oversight.
4.3 Key Deadlines and Milestones
The Consent Order establishes a structured remediation timeline with specific deadlines and milestones spanning a twelve-month period from the effective date of January 15, 2025 through the final compliance implementation and self-certification date of February 15, 2026. The following table sets forth all critical deadlines and milestones, together with their current status as of the date of this training outline.
The Board should pay particular attention to the most immediately upcoming deadlines. The Board Resolution due February 28, 2025 is the first Board-level deliverable and requires formal Board action to acknowledge the Consent Order, establish the Compliance Committee, and authorize the remediation budget. The CMP payment of $14,500,000 is due March 16, 2025 and must be timely. The interim SAR backlog status report due March 31, 2025 will be the first substantive filing with the OCC following the Consent Order and will establish the baseline against which future progress will be measured. The Board should ensure that management has the resources and support necessary to meet each deadline.
4.4 Independent Consultant Requirement (Article VII)
Article VII of the Consent Order requires BRB to retain an independent consultant, acceptable to the OCC, to conduct a comprehensive assessment of BRB's BSA/AML and OFAC compliance programs, to validate remediation efforts, and to deliver a final validation report confirming that BRB has achieved full compliance with the Consent Order's requirements.
Thornfield Consulting Group LLC ("Thornfield") has been engaged for this purpose pursuant to Engagement Letter No. TCG-BRB-2025-001, dated February 10, 2025. The OCC provided its non-objection to Thornfield's engagement on February 5, 2025, following a thorough review of Thornfield's qualifications, independence, and proposed scope of work.
The Thornfield engagement team is led by Dr. Vivian Castellano, Managing Director, Financial Crimes Advisory, who brings more than twenty years of experience in BSA/AML compliance assessment, remediation, and regulatory engagement. The core team members include:
• Robert Eastman — AML Transaction Monitoring Lead, responsible for assessing and validating the Veridian TMS upgrade and the SAR backlog clearance project.
• Jennifer Hwang — Sanctions & OFAC Compliance Lead, responsible for assessing and validating BRB's OFAC screening remediation, including the NovaPay integration fix and the extension of screening to all BaaS channels.
• Nathaniel Burgess — Fintech & Payments Compliance Lead, responsible for assessing BRB's BaaS partner oversight framework, CDD/EDD remediation, and the adequacy of third-party risk management controls.
The financial terms of the Thornfield engagement are as follows:
• Fixed Fee: $6,500,000
• Payment Schedule: Monthly installments of $541,666.67
• Expense Cap: $400,000
• Total Engagement Cost: $6,900,000
Thornfield will conduct its comprehensive BSA/AML and OFAC program assessment commencing with on-site work beginning March 1, 2025. The preliminary gap assessment is due to be delivered by April 15, 2025, which will inform the final development of the Comprehensive Remediation Action Plan prior to its May 15, 2025 submission to the OCC. The final validation report is due February 15, 2026, and will serve as the basis for BRB's self-certification of compliance with the Consent Order.
Board members should be aware that they may be interviewed by Thornfield as part of the assessment process. Such interviews are a standard component of an independent consultant's governance assessment and are designed to evaluate the Board's understanding of the institution's BSA/AML risk profile, the adequacy of the information provided to the Board, and the nature and quality of Board-level oversight. Board members should cooperate fully with any Thornfield interview requests and should coordinate with C&H (Philip Hartmann) and BRB General Counsel (Gregory Nardone) regarding the scheduling and preparation for such interviews.
4.5 Remediation Budget Overview
The Board has been presented with a proposed remediation budget of $42,500,000, exclusive of the civil money penalty. When the CMP is included, the total financial outlay associated with the Consent Order and the remediation effort is $57,000,000. The Board will be asked to formally authorize this budget as part of the Board Resolution due February 28, 2025.
The budget is composed of the following line items:
To place this outlay in financial context, BRB reported net income of $412,000,000 for fiscal year 2024, total assets of $38.7 billion, and total deposits of $29.4 billion. The total remediation outlay of $57,000,000 represents approximately 13.8% of FY 2024 net income. While this is a significant expenditure, it is within BRB's financial capacity to absorb without impairment to its capital adequacy or safety and soundness. The Board should nonetheless recognize that the remediation expenditure will have a material impact on near-term earnings and should be disclosed in BRB's financial statements and public filings.
V. PERSONAL LIABILITY EXPOSURE FOR DIRECTORS AND OFFICERS
5.1 Statutory Framework for Personal Liability
Board members and senior management should understand that BSA/AML and OFAC compliance failures can give rise to personal liability for the individuals responsible for the institution's governance and operations. The relevant statutory provisions are summarized below.
12 U.S.C. § 1818(b) — Cease and Desist Orders. The OCC has the authority to issue cease and desist orders not only against insured depository institutions, but also against any "institution-affiliated party." This term is defined broadly and includes directors, officers, employees, agents, and other persons who have participated in the affairs of the institution. A cease and desist order can compel an individual to take or refrain from taking specific actions.
12 U.S.C. § 1818(e) — Removal and Prohibition Orders. The OCC has the authority to remove an institution-affiliated party from his or her position and to prohibit the individual from participating in the affairs of any insured depository institution for a specified period or permanently. Grounds for removal include violations of law, regulations, or orders; unsafe or unsound practices; and breaches of fiduciary duty. A removal and prohibition order is among the most severe administrative sanctions available to the OCC and effectively ends the individual's career in banking.
12 U.S.C. § 1818(i) — Civil Money Penalties Against Individuals. The OCC has the authority to impose civil money penalties on institution-affiliated parties, including directors and officers, in three tiers of escalating severity:
Tier 1: Up to approximately $10,000 per day for violations of law or regulations, violations of any condition imposed by the OCC in writing, violations of any written agreement between the institution and the OCC, or violations of any written condition imposed by the OCC in connection with the granting of any application or other request.
Tier 2: Up to approximately $55,000 per day for any violation described in Tier 1 that (a) is part of a pattern of misconduct, (b) causes or is likely to cause more than a minimal loss to the institution, or (c) results in pecuniary gain to the party. This tier also applies to any violation that involves a reckless disregard for the law or applicable regulations.
Tier 3: Up to approximately $2,200,000 per day for any violation described in Tier 1 that (a) was committed knowingly and (b) as a consequence of such violation, the institution suffered or probably would suffer a substantial financial loss or other damage, or the person derived substantial pecuniary gain from the violation. Tier 3 penalties are reserved for the most egregious conduct.
31 U.S.C. § 5321 — FinCEN Civil Money Penalties. Independently from the OCC, FinCEN has the authority to impose civil money penalties on individuals — including directors, officers, and employees — for willful violations of BSA requirements. FinCEN penalties can be substantial and can be assessed against individuals even if no penalty is assessed against the institution itself.
31 U.S.C. § 5322 — Criminal Liability. Willful violations of the BSA are punishable as federal crimes. A person who willfully violates the BSA or its implementing regulations is subject to a fine of up to $250,000 and imprisonment for up to five years. If the violation occurs while violating another law of the United States or as part of a pattern of any illegal activity involving more than $100,000 in a 12-month period, the maximum term of imprisonment increases to ten years. Directors and officers who knowingly participate in, direct, or willfully fail to prevent BSA violations can be subject to criminal prosecution under this provision.
5.2 Standards of Director and Officer Conduct
Federal banking regulators expect directors and officers of national banks to exercise active, informed, and ongoing oversight of the institution's BSA/AML compliance program. This standard goes well beyond mere "rubber stamping" of management's compliance reports. Directors are expected to engage substantively with the information they receive, to ask probing questions, to challenge management's assumptions and conclusions when warranted, and to ensure that the institution devotes adequate resources to compliance.
Specifically, the following standards of conduct are expected:
Duty to Ensure Adequate Resources. Directors have a duty to ensure that the bank devotes adequate financial, human, and technological resources to its BSA/AML compliance program. A bank's compliance program cannot be effective if it is inadequately staffed, if its technology is outdated, or if its budget does not keep pace with the institution's risk profile and business growth. BRB's BSA/AML budget of $18,200,000 for FY 2024 must be evaluated in light of the institution's $74.3 billion in BaaS transaction volume and $38.7 billion in total assets.
Duty to Ensure Timely and Effective Response to Deficiencies. Directors have a duty to ensure that the institution responds promptly and effectively to identified deficiencies, whether those deficiencies are identified through internal audit, independent testing, management self-assessment, or regulatory examination. The failure to remediate prior supervisory findings — specifically, the June 2022 MRA regarding transaction monitoring deficiencies and the November 2023 MRIA regarding OFAC screening gaps — is a specific risk factor cited in the Consent Order. The OCC's escalation from MRA to MRIA to Consent Order was driven in significant part by the OCC's perception that BRB had not responded with sufficient urgency or effectiveness to the earlier findings.
Duty to Receive and Act Upon Adequate Reporting. Directors are expected to receive, review, and act upon compliance reports with sufficient granularity and frequency to enable meaningful oversight. The Consent Order specifically found that the Board's prior quarterly-only BSA/AML reporting cadence was inadequate, and that the reports lacked key metrics — including SAR filing volumes and timeliness data, OFAC screening hit rates, and risk ratings by individual BaaS partner — that are necessary for the Board to assess the effectiveness of the compliance program.
Duty to Document Oversight. Directors should document their oversight activities, including meeting attendance, questions raised during Board and committee meetings, requests for additional information, and actions taken in response to compliance reports and findings. This documentation serves two important purposes: first, it demonstrates to regulators that the Board is actively engaged in oversight; and second, it provides evidence that may be critical in defending against potential personal liability claims.
5.3 Shareholder Derivative Suit Risk
In addition to regulatory liability, directors and officers face potential civil liability arising from shareholder claims related to the Consent Order and its financial consequences.
The Consent Order was publicly disclosed on January 16, 2025 — the day after its issuance. Following the disclosure, BRFG's stock price declined from approximately $47.82 to $41.15 per share, representing a decline of approximately $6.67 per share, or 13.9%. The stock price decline reflected the market's reaction to the disclosure of the Consent Order, the $14,500,000 civil money penalty, the anticipated remediation costs, and the reputational damage associated with a formal enforcement action.
At its post-disclosure low, the stock price decline translated to a loss in market capitalization of approximately $1.2 billion. While the stock price has partially recovered — to approximately $47.82 per share as of February 7, 2025 — the initial decline is relevant because it establishes the predicate for potential shareholder litigation.
A significant institutional shareholder, Brindoval Capital Partners LP (Julian Whitmore, Managing Partner), has expressed concern regarding the remediation costs, potential additional fines, and reputational impact of the Consent Order. Brindoval holds approximately 8.3% of BRFG's outstanding shares — approximately 14.9 million shares out of 179,500,000 shares outstanding. Brindoval is represented by Amberly Knox LLP (Steven Briggs, Partner), a firm known for shareholder activism and governance-related litigation.
The most likely derivative suit theory would be a Caremark claim — a claim for breach of the fiduciary duty of oversight. Under In re Caremark International Inc. Derivative Litigation, 698 A.2d 959 (Del. Ch. 1996), and its progeny, including Marchand v. Barnhill, 212 A.3d 805 (Del. 2019), directors can be held personally liable for failing to implement an adequate system of internal controls and reporting designed to ensure that the board is informed of significant compliance risks, or for failing to respond to red flags indicating that the institution's compliance program was inadequate.
The facts of BRB's situation present potential exposure under both prongs of the Caremark framework. The escalating pattern of regulatory findings — from the June 2022 MRA to the November 2023 MRIA to the January 2025 Consent Order — could be characterized as a series of red flags that should have prompted more aggressive Board engagement and remediation. A derivative plaintiff could argue that the Board's failure to establish a dedicated Compliance Committee, to require more frequent and detailed compliance reporting, and to ensure that the prior MRA and MRIA were adequately remediated constituted a breach of the duty of oversight.
Directors should understand that active engagement in the remediation process and documented oversight are critical not only to satisfying the Consent Order's requirements, but also to defending against potential Caremark claims. The steps that the Board is taking now — including the establishment of the Compliance Committee, the adoption of monthly reporting with comprehensive metrics, and the authorization of the remediation budget — are precisely the types of actions that demonstrate the Board's commitment to oversight and that can serve as evidence in defense of any future shareholder claims.
5.4 D&O Insurance Coverage Considerations
Board members and executives should be aware that the adequacy of BRFG's existing directors' and officers' ("D&O") liability insurance coverage is being assessed in light of the Consent Order and the total $57,000,000 remediation outlay. D&O insurance is designed to protect directors and officers against claims arising from their service in those capacities, including claims related to regulatory enforcement actions and shareholder litigation.