PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT
MEMORANDUM
March 14, 2025
FROM: Philip Hartmann, Partner, Calderwood & Harkness LLP Yuki Nakamura, Associate, Calderwood & Harkness LLP
TO: Patricia Langston, Chief Compliance Officer, Belmont Ridge Bank NA Thomas Ikeda, BSA Officer / AML Program Director, Belmont Ridge Bank NA
CC: Gregory Nardone, General Counsel & Corporate Secretary, Belmont Ridge Bank NA / Belmont Ridge Financial Group Linda Petrosian, CIO / CTO, Belmont Ridge Bank NA Warren Ashby, Head of Fintech Partnerships / BaaS Division, Belmont Ridge Bank NA Melissa Chu, Chief Risk Officer, Belmont Ridge Bank NA Carlos Espinoza, Counsel, Calderwood & Harkness LLP
RE: Design Specifications for CDD/EDD Remediation Progress Tracking Dashboard — Consent Order No. OCC-2025-003
C&H Matter No.: 1045-00002
— PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT
This memorandum constitutes a privileged and confidential attorney-client communication and attorney work product prepared by Calderwood & Harkness LLP ("C&H") in connection with its representation of Belmont Ridge Bank NA ("BRB") and Belmont Ridge Financial Group ("BRFG") in relation to OCC Consent Order No. OCC-2025-003. This memorandum is not intended for distribution to any person or entity outside the distribution list identified above without the prior written consent of C&H. Receipt of this memorandum by any unauthorized person does not constitute a waiver of any applicable privilege or protection.
Right-click to update Table of Contents
I. Executive Summary
The purpose of this memorandum is to set forth Calderwood & Harkness LLP's recommended design specifications and reporting requirements for a real-time reporting dashboard (the "Dashboard") to track Belmont Ridge Bank NA's remediation of approximately 47,000 high-risk customer accounts that have been identified as lacking adequate Customer Due Diligence ("CDD") or Enhanced Due Diligence ("EDD") documentation. These accounts represent one of the most significant remediation challenges facing BRB in connection with the comprehensive enforcement action imposed by the Office of the Comptroller of the Currency ("OCC").
As BRB's management and Board are aware, these 47,000 accounts were predominantly onboarded through BRB's fintech Banking-as-a-Service ("BaaS") partner channels and were cited as a core deficiency category in OCC Consent Order No. OCC-2025-003, which was issued on January 15, 2025. The Consent Order identified pervasive failures in CDD and EDD processes across BRB's BaaS operations, reflecting systemic weaknesses in the Bank's know-your-customer ("KYC") framework that accumulated over a multi-year period during which supervisory concerns escalated from Matters Requiring Attention ("MRA") to Matters Requiring Immediate Attention ("MRIA") to, ultimately, the current consent order.
The Dashboard recommended in this memorandum is designed to serve as the primary instrument for tracking, managing, and reporting on BRB's progress toward two critical regulatory milestones imposed by the Consent Order:
(i) First Milestone — July 15, 2025: Completion of CDD/EDD remediation for 50% of the 47,000 identified accounts (i.e., 23,500 accounts); and
(ii) Second Milestone — January 15, 2026: Completion of CDD/EDD remediation for 100% of the 47,000 identified accounts (i.e., all remaining accounts).
These milestones are non-negotiable regulatory deadlines. Failure to meet them would represent a material violation of the Consent Order, potentially exposing BRB and BRFG to additional enforcement actions, further civil money penalties, and heightened supervisory scrutiny including potential downgrade in the Bank's composite and component CAMELS ratings.
The Dashboard will serve multiple stakeholders with differing information needs and access requirements. It will function as the primary reporting tool for the newly established Compliance Committee of the BRFG Board of Directors (chaired by James Rutherford), the Audit Committee (chaired by Margaret Dao), and senior management. It will also support the independent consultant engagement — Thornfield Consulting Group LLC, led by Dr. Vivian Castellano — which is conducting the independent validation required under the Consent Order. Additionally, data extracted from the Dashboard will underpin the quarterly progress reports that BRB is required to submit to the OCC, with the first such report due on September 15, 2025, and the second due on December 15, 2025.
The total CDD/EDD remediation project budget is $4,300,000, which is drawn from the broader $42,500,000 board-approved remediation budget (exclusive of the $14,500,000 civil money penalty). Dashboard development and deployment costs are estimated to range from $150,000 to $250,000, depending on the implementation approach.
C&H recommends that the Dashboard be developed in close coordination with BRB's CIO/CTO, Linda Petrosian, and designed for seamless integration with BRB's existing enterprise systems. These include, in particular, the Veridian Analytics Inc. transaction monitoring platform (currently deployed as version 8.3, with a planned upgrade to version 10.0 scheduled for August 1, 2025), BRB's core banking system, and the customer onboarding platforms used across BRB's BaaS partner channels. In our recommendation, the optimal approach is to build the Dashboard as a module within BRB's existing enterprise reporting infrastructure, establishing automated data feeds from the CDD/EDD remediation case management system, BaaS partner data integrations, and BRB's customer risk rating engine. This approach will minimize development time, reduce integration risk, and leverage infrastructure investments already made by BRB.
This memorandum provides detailed specifications across the following dimensions: key performance indicators and metrics, data sources and integration requirements, visualization and reporting requirements, reporting frequency and distribution schedules, milestone alert and escalation frameworks, audit trail and evidentiary documentation requirements, implementation timeline, information security and access controls, and budget considerations.
II. Background and Regulatory Context
A. Consent Order Findings on CDD/EDD
OCC Consent Order No. OCC-2025-003, which became effective on January 15, 2025, identified significant and pervasive deficiencies in BRB's Customer Due Diligence and Enhanced Due Diligence processes as one of five core deficiency categories warranting formal enforcement action. The Consent Order followed an extensive targeted BSA/AML examination conducted by the OCC between March 2024 and September 2024, during which examiners documented systemic failures in the Bank's CDD/EDD framework.
The examination identified approximately 47,000 high-risk customer accounts that lacked adequate CDD or EDD documentation at the time of the examination. The nature of the deficiencies varied across the affected account population, but commonly included: absent or incomplete beneficial ownership certifications; failure to obtain or update customer identification program ("CIP") documentation for individuals and entities associated with higher-risk jurisdictions, product types, or transaction patterns; insufficient EDD for customers whose risk profiles warranted enhanced scrutiny; failure to conduct periodic CDD reviews for high-risk accounts consistent with BRB's own policies; and missing or inadequate source-of-funds and source-of-wealth documentation for accounts with elevated risk indicators.
These deficiencies were concentrated overwhelmingly in accounts onboarded through BRB's Banking-as-a-Service ("BaaS") fintech partnerships. As of the date of the examination, BRB maintained 14 active BaaS partner relationships. Of these 14 partners, the three largest by transaction volume — NovaPay Technologies Inc., FairLend Digital LLC, and VaultEdge Inc. — account for the substantial majority of the affected accounts. Specifically:
• NovaPay Technologies Inc. (Ethan Garrison, CEO): NovaPay represented approximately 41% of BRB's total BaaS transaction volume in calendar year 2024, accounting for approximately $30.5 billion in aggregate transaction activity. NovaPay-originated accounts constitute the largest single concentration of CDD/EDD-deficient accounts within the 47,000-account remediation population.
• FairLend Digital LLC (Aisha Okonkwo, CEO): FairLend Digital represented approximately 28% of BRB's total BaaS transaction volume in calendar year 2024. FairLend's digital lending platform generated a significant number of high-risk accounts with incomplete EDD documentation, particularly with respect to source-of-funds analysis and employment verification.
• VaultEdge Inc. (Marcus Tan, CEO): VaultEdge represented approximately 18% of BRB's total BaaS transaction volume in calendar year 2024. VaultEdge-originated accounts presented particular CDD challenges related to international customers and customers engaged in cryptocurrency-adjacent activities.
Together, these three partners accounted for approximately 87% of BRB's BaaS transaction volume and a correspondingly disproportionate share of the CDD/EDD-deficient accounts.
The Consent Order requires comprehensive remediation of all identified CDD/EDD gaps within a phased timeline, with clear milestones and associated reporting obligations. The CDD/EDD deficiency finding did not stand alone; it was one of five core deficiency categories identified in the Consent Order, alongside SAR filing backlog and quality issues, OFAC screening program deficiencies, transaction monitoring system effectiveness concerns, and BSA/AML governance and oversight failures. However, the CDD/EDD remediation is among the most resource-intensive and operationally complex of the required workstreams, given the sheer volume of affected accounts and the necessity of engaging with 14 separate BaaS partner organizations to obtain required documentation.
It bears noting that the OCC's examination findings did not emerge in a vacuum. Caldera & Pope LLP, retained as BRB's independent external auditor for BSA/AML compliance testing, had previously identified multiple CDD/EDD deficiencies in its September 2024 independent BSA/AML test. Those findings echoed and, in many cases, presaged the deficiencies later formalized in the Consent Order. Furthermore, the OCC's supervisory history with BRB reflected escalating concern over BRB's CDD/EDD posture over a multi-year period. An MRA was issued in June 2022 citing emerging weaknesses in BRB's CDD processes for BaaS-originated accounts. When remediation proved inadequate, the OCC escalated to an MRIA in November 2023, signaling the heightened urgency and severity of the identified deficiencies. Under BRB's former outside counsel, Drayton Mercer LLP, the Bank failed to adequately remediate the issues identified in the MRA and MRIA, contributing directly to the progression to the current Consent Order.
B. Remediation Milestones
The Consent Order establishes a clear remediation timeline with specific, quantitative milestones that BRB must achieve. These milestones are as follows:
First Milestone — July 15, 2025: BRB must complete CDD/EDD remediation for at least 50% of the 47,000 identified accounts — that is, no fewer than 23,500 accounts must have fully completed and quality-reviewed CDD/EDD documentation by this date. Completion requires not only the collection and assembly of required documentation, but also quality review sign-off confirming that the remediated account file meets BRB's CDD/EDD standards and applicable regulatory requirements.
Second Milestone — January 15, 2026: BRB must complete CDD/EDD remediation for 100% of the 47,000 identified accounts. All remaining accounts must be fully remediated, with completed documentation and quality review sign-off, by this date. For accounts that cannot be remediated due to customer non-responsiveness, inability to obtain required documentation, or adverse findings during the EDD process, BRB must have completed an appropriate disposition determination (including account closure or relationship termination where warranted) by this date.
Full Compliance Implementation Date — February 15, 2026: By this date, the full remediation and compliance program implementation must be complete. Thornfield Consulting Group LLC, as the OCC-approved independent consultant, is required to deliver its final validation report. BRB must submit a compliance self-certification to the OCC affirming that the Bank has fully complied with all requirements of the Consent Order.
In addition to these primary milestones, the Consent Order requires BRB to submit interim quarterly progress reports to the OCC. The first quarterly progress report is due on September 15, 2025, and the second quarterly progress report is due on December 15, 2025. These reports must contain detailed quantitative data on remediation progress, broken down by BaaS partner, risk tier, and account status, along with narrative commentary describing the Bank's remediation efforts, challenges encountered, and corrective actions taken. The Dashboard is intended to serve as the primary data source for these quarterly submissions.
C. Stakeholder Reporting Needs
The CDD/EDD remediation effort involves a complex ecosystem of internal and external stakeholders, each with distinct reporting needs, frequencies, and access requirements. The Dashboard must be designed to serve all of these stakeholders effectively. We summarize the key reporting requirements by stakeholder group below.
Compliance Committee of the BRFG Board of Directors. The Compliance Committee, chaired by James Rutherford, was established in direct response to the Consent Order's governance requirements. The Committee is responsible for active oversight of the remediation effort and requires monthly reporting during the remediation period. The Committee's reporting needs include account-level completion metrics (in summary form), risk distribution analysis, partner-specific breakdowns, milestone tracking against the Consent Order timeline, and identification of any material risks or impediments to timely completion. The Dashboard should generate a concise executive summary suitable for presentation at monthly Committee meetings, with the ability to drill into supporting detail as needed.
Audit Committee and Risk Committee. The Audit Committee, chaired by Margaret Dao, and the Risk Committee, chaired by Arthur Connelly, require quarterly summary reporting for board-level oversight purposes. These committees do not require the same level of granular operational detail as the Compliance Committee, but they do require assurance that the remediation is on track, that quality standards are being maintained, and that risks to milestone attainment are being appropriately identified and managed. Derek Ballard, Head of Internal Audit, will serve as a key conduit for Audit Committee reporting and will require full read-only access to the Dashboard for independent audit testing purposes.
Senior Management. The senior management team responsible for day-to-day oversight and execution of the CDD/EDD remediation includes Patricia Langston (CCO), Thomas Ikeda (BSA Officer / AML Program Director), Warren Ashby (Head of Fintech Partnerships / BaaS Division), and Melissa Chu (CRO). These individuals require weekly — and in many cases, daily — operational reporting with full drill-down capability. They must be able to monitor remediation progress in near-real-time, identify bottlenecks and emerging issues, track analyst productivity and staffing adequacy, and make informed resource allocation decisions. The Dashboard should provide these users with live access to operational views, including account-level detail, escalation queues, and quality assurance metrics.
Thornfield Consulting Group LLC (Independent Consultant). Dr. Vivian Castellano, as the engagement leader for the Thornfield Consulting engagement, and Nathaniel Burgess, Director of Fintech & Payments Compliance at Thornfield, require regular access to the Dashboard for purposes of independent validation. Under the Access & Cooperation Protocol executed in connection with the Consent Order, BRB is obligated to provide Thornfield with reasonable and timely access to all information, data, and personnel necessary for Thornfield to fulfill its independent validation mandate. Dashboard access for Thornfield must be read-only, with the ability to export data for independent validation analyses. A separate view should be available showing validation testing results and independent sampling outcomes. The scope and nature of Thornfield's Dashboard access must be consistent with the Privilege & Confidentiality Side Letter to ensure that privileged work product is not inadvertently disclosed through the Dashboard platform.
OCC. Jonathan Frey, Examiner-in-Charge for the OCC's ongoing supervision of BRB, will receive CDD/EDD remediation progress data through the quarterly progress reports submitted by BRB via C&H. The Dashboard must support the generation of pre-formatted data extracts and summary reports in formats compatible with the quarterly reporting requirements, enabling efficient preparation of the September 15, 2025, and December 15, 2025, submissions. While the OCC is not expected to have direct live access to the Dashboard, the data extracts must be comprehensive and auditable.
Pinnacle Compliance Solutions LLC. Pinnacle, under the leadership of Andrea Solis, has been engaged to deploy 30 temporary full-time equivalent ("FTE") compliance analysts to support the CDD/EDD remediation effort. These analysts require task-queue visibility through the Dashboard, enabling them to view assigned accounts, priority rankings, required actions, deadlines, and links to supporting documentation. The analyst-level Dashboard view is a critical operational tool for managing the day-to-day execution of the remediation workstream.
III. Dashboard Scope and Objectives
A. Primary Objectives
The Dashboard must be designed and implemented to achieve the following primary objectives, each of which is critical to BRB's ability to demonstrate timely and effective remediation to the OCC, the Thornfield independent consultant, and BRB's own Board and senior management:
1. Real-Time Remediation Visibility. The Dashboard must provide real-time (or, at minimum, near-real-time with daily updates) visibility into the remediation status of all 47,000 CDD/EDD-deficient accounts identified in connection with the Consent Order. Every account in the remediation population must be represented in the Dashboard at all times, with its current status clearly indicated. The Dashboard should serve as the definitive, authoritative source of remediation status data, eliminating the need for manual tracking, spreadsheet-based reporting, or other ad hoc mechanisms that introduce risk of error, inconsistency, and delay.
2. Milestone Tracking and Pace Analysis. The Dashboard must track progress against both the July 15, 2025 (50% / 23,500 accounts) and January 15, 2026 (100% / 47,000 accounts) milestones with automated countdown functionality and pace/trajectory analysis. Users should be able to see, at a glance, whether the remediation effort is on track to meet each milestone, the projected completion date based on the current remediation pace ("burn rate"), and the specific variance between actual and planned progress. The pace analysis functionality should be dynamic, recalculating projections as actual performance data is updated.
3. Multi-Level Drill-Down Capability. The Dashboard must enable users to drill down from enterprise-level summary views to progressively more granular levels of detail, including by individual BaaS partner, by account risk tier, and ultimately to the individual account level. This drill-down capability is essential for identifying patterns, concentrations, and partner-specific issues that may require targeted management attention or resource reallocation.
4. Audit Trail and Evidentiary Support. The Dashboard must maintain a comprehensive audit trail that supports evidentiary documentation requirements for OCC examination, Thornfield independent validation, and potential FinCEN inquiries. Every status change, data entry, and user action must be logged with sufficient detail to reconstruct the complete history of each account's remediation journey. This audit trail will serve as a critical component of BRB's evidence base in demonstrating compliance with the Consent Order.
5. Bottleneck and Quality Issue Identification. The Dashboard must facilitate the real-time identification of bottlenecks, overdue accounts, resource constraints, and remediation quality issues. Accounts that are aging beyond expected cycle times, analysts whose productivity is lagging, BaaS partners whose cooperation is inadequate, and quality review failures must all be surfaced through automated alerts and visual indicators, enabling proactive management intervention before issues compound into milestone-threatening delays.
6. Single Source of Truth. The Dashboard must serve as the single, authoritative source of truth for all CDD/EDD remediation reporting across all stakeholder groups. All reporting — whether to the Board, to senior management, to Thornfield, or to the OCC — must be derived from the same underlying data set, ensuring consistency and eliminating the risks inherent in manual report compilation from disparate sources. The Dashboard must be the "one number" that everyone looks to.
B. Scope Boundaries
It is important to clearly delineate the scope of the Dashboard to ensure that the development effort remains focused and that expectations are appropriately calibrated among all stakeholders.
The Dashboard covers only the CDD/EDD remediation workstream, which is designated as Workstream 3 of the Comprehensive Remediation Action Plan. While the Consent Order encompasses multiple remediation workstreams — including SAR backlog clearance (Workstream 1), OFAC screening remediation (Workstream 2), transaction monitoring system model validation (Workstream 4), and governance and training enhancements (Workstream 5) — the detailed tracking of those workstreams falls outside the scope of this Dashboard. Cross-references to other workstreams may be incorporated as summary links within the Dashboard interface (e.g., a panel showing the number of CDD/EDD-deficient accounts that have also generated SARs, linking to the SAR backlog tracking system), but the Dashboard is not designed to serve as a comprehensive remediation program management tool.
Additionally, while the Dashboard is being designed primarily to serve the immediate needs of the Consent Order remediation, C&H recommends that the Dashboard architecture be designed with forward-looking extensibility in mind. Specifically, the Dashboard should be capable of evolving post-remediation into an ongoing CDD/EDD monitoring and compliance management tool, supporting BRB's sustained compliance obligations under the BSA/AML framework and the heightened expectations that will accompany BRB's post-Consent Order supervisory posture. This extensibility consideration should inform technology and architecture decisions but should not delay the initial build-out targeted for the implementation timeline set forth in Section X below.
IV. Recommended Key Performance Indicators and Metrics
This section sets forth the key performance indicators ("KPIs") and metrics that the Dashboard should track and display. These metrics have been organized into logical groupings reflecting different dimensions of the remediation effort. Each metric group should be accessible from the Dashboard interface, with the ability to filter and cross-tabulate across dimensions.
A. Primary Remediation Progress Metrics
The following metrics constitute the core of the Dashboard and should be prominently displayed in all views:
1. Total Accounts in Scope. The total number of accounts in the remediation population, which is 47,000. This serves as the fixed denominator for all percentage-based calculations. The scope should not be adjusted without formal approval from both the CCO and C&H, documented through the Dashboard's administrative controls, and any scope adjustments should be reported to the OCC. We note that reconciliation of this figure against the OCC examination record is a critical early step (see Section XIII, Recommendation 4).
2. Accounts Remediated (Cumulative). The cumulative count and percentage of accounts for which CDD/EDD remediation has been completed. "Completed" should be defined as accounts for which all required CDD/EDD documentation has been obtained, the documentation has been reviewed for completeness and accuracy, and the account has received quality review sign-off from an authorized reviewer. This is the single most important metric in the Dashboard and should be displayed prominently — ideally as both a raw count (e.g., "14,250 of 47,000") and a percentage (e.g., "30.3%").
3. Accounts In Progress. The count and percentage of accounts that are currently in active remediation. This category should encompass accounts at various stages of the remediation workflow, including accounts for which documentation has been requested from the customer or BaaS partner, accounts for which documentation has been partially received and is under review, accounts undergoing analyst review and documentation assembly, and accounts in the quality review queue. Where possible, sub-statuses within the "In Progress" category should be defined and tracked to provide additional granularity.
4. Accounts Not Yet Started. The count and percentage of accounts that remain in the remediation queue but have not yet been assigned to an analyst or otherwise initiated. This metric serves as a critical indicator of remediation pipeline health and will be particularly important in the early months of the remediation effort as the 47,000-account population is progressively absorbed into the remediation workflow.
5. Accounts Requiring Escalation. The count and percentage of accounts that have been flagged for escalation due to complicating factors, including customer non-responsiveness to repeated documentation requests, a determination that additional EDD is needed beyond the standard remediation scope, identification of adverse information or suspicious activity during the remediation process, or accounts where relationship termination or account closure is being considered. Escalated accounts represent the highest-risk subset of the remediation population and require dedicated senior management attention.
6. Accounts Closed / Exited. The count and percentage of accounts for which remediation has resulted in account closure or relationship termination. Closures may occur where the customer remains non-responsive after exhaustion of all reasonable outreach efforts, where the EDD process reveals information that is incompatible with continued account maintenance (e.g., unresolvable beneficial ownership opacity, adverse law enforcement information, or sanctions concerns), or where the risk profile of the account exceeds BRB's risk appetite. Account closures should be counted as "resolved" for purposes of milestone attainment, provided that the closure was executed in accordance with the CDD/EDD Remediation Methodology and appropriately documented.
7. Pace Indicator (Burn Rate). The number of accounts completed per week and per month, plotted against the required pace to meet the July 15, 2025, and January 15, 2026, milestones. By way of illustration, to meet the first milestone of 23,500 remediated accounts by July 15, 2025, assuming remediation activities commence in earnest on approximately April 1, 2025 (following Dashboard go-live and full analyst deployment), BRB will have approximately 15 working weeks, requiring a minimum sustained pace of approximately 1,567 accounts per week. When measured from the March 14, 2025 date of this memorandum to the July 15, 2025 milestone — a period of approximately 18 calendar weeks — the required pace would be approximately 1,306 accounts per week. The Pace Indicator should be displayed as both a numerical burn rate and a visual trajectory line plotted against the planned pace, enabling users to immediately discern whether the effort is keeping up, pulling ahead, or falling behind.
B. Milestone Tracking Metrics
In addition to the primary progress metrics, the Dashboard should include dedicated milestone tracking functionality:
1. Days Remaining to July 15, 2025, Milestone. A countdown indicator showing the number of calendar days remaining until the first milestone date, along with the projected completion date based on the current burn rate. If the projected completion date falls after July 15, 2025, the indicator should display in red with the projected overshoot duration.
2. Days Remaining to January 15, 2026, Milestone. The same countdown and projection functionality for the second milestone date. Although the second milestone is further in the future, it should be displayed from the outset of Dashboard operations to maintain organizational awareness of the full remediation timeline.
3. Projected Milestone Attainment Status. A Green / Yellow / Red status indicator for each milestone:
• Green: The current remediation pace, if sustained, is projected to result in timely attainment of the milestone (i.e., the projected completion date is on or before the milestone date, with remediation on pace at ≥100% of the planned trajectory).
• Yellow (Early Warning): The current remediation pace is within 10% of the planned trajectory, indicating that the milestone is at risk but recoverable with moderate corrective action. For example, if 90% to 99% of the planned cumulative remediation count has been achieved as of any given date, the status would be Yellow.
• Red (Escalation): The current remediation pace is more than 10% behind the planned trajectory, indicating that the milestone is at significant risk and that material corrective action is required immediately. Red status triggers the escalation framework described in Section VIII below.
4. Variance Analysis. A detailed variance analysis comparing actual versus planned remediation counts on both a weekly incremental and cumulative basis. This analysis should be displayed in both tabular and graphical formats, enabling users to identify trends, inflection points, and periods of acceleration or deceleration in the remediation effort. The variance analysis should be exportable for inclusion in OCC quarterly progress reports and Thornfield validation materials.
C. BaaS Partner Breakdown Metrics
Given that the CDD/EDD deficiencies are concentrated in BaaS-originated accounts, partner-specific tracking is essential:
1. Accounts by BaaS Partner. The number and percentage of the 47,000 in-scope accounts attributable to each of the 14 active BaaS partners. The three largest partners should be individually identified and prominently displayed:
• NovaPay Technologies Inc. (Ethan Garrison, CEO)
• FairLend Digital LLC (Aisha Okonkwo, CEO)
• VaultEdge Inc. (Marcus Tan, CEO)
Each of the remaining 11 BaaS partners should also be individually listed with account counts and percentages. A "BaaS Partner Summary" table should provide a consolidated view of all 14 partners ranked by account volume.
2. Remediation Status by Partner. For each of the 14 BaaS partners, the Dashboard should display the number and percentage of accounts in each remediation status category: Completed, In Progress, Not Yet Started, Escalated, and Closed/Exited. This partner-level breakdown is critical for identifying partner-specific remediation challenges, evaluating partner cooperation, and informing decisions about resource allocation and partner engagement strategy.
3. Partner Cooperation Score. The Dashboard should include a qualitative and/or quantitative rating of each BaaS partner's responsiveness and cooperation with the remediation effort. Relevant factors for this score include the timeliness of the partner's response to documentation requests, the quality and completeness of documentation provided, error rates in partner-submitted data, the partner's willingness to engage directly with customers to facilitate documentation collection, and the partner's compliance with remediation demand letters and contractual cooperation obligations. The cooperation score methodology should be developed in coordination with Warren Ashby (Head of Fintech Partnerships) and should be calibrated to trigger the BaaS Partner Non-Cooperation Alert framework described in Section VIII.C below.
4. BaaS-Related SARs Correlation. The Dashboard should include a cross-reference metric identifying the number and percentage of CDD/EDD-deficient accounts that have also been associated with filed or pending Suspicious Activity Reports ("SARs"). This metric provides important context for prioritization and risk assessment. We note that in calendar year 2024, BRB filed 2,108 BaaS-related SARs, representing approximately 54.8% of the Bank's total 3,847 SARs filed during that period. Accounts that are both CDD/EDD-deficient and SAR-associated represent the highest-priority subset of the remediation population and should be visually flagged in the Dashboard.
D. Risk-Tier Distribution Metrics
The Dashboard must reflect the risk-based prioritization approach outlined in the CDD/EDD Remediation Methodology & Prioritization Memorandum:
1. Accounts by Risk Rating. The distribution of the 47,000 in-scope accounts across BRB's customer risk rating tiers (e.g., high, medium-high, elevated, or other categories consistent with BRB's customer risk rating methodology). This distribution should be displayed as both a table and a visual chart, enabling users to understand the risk composition of the remediation population at a glance.
2. Remediation by Risk Tier. Completion rates broken out by risk tier, showing the percentage of accounts remediated within each tier relative to the total number of accounts in that tier. This metric is critical for ensuring that the remediation effort is appropriately prioritizing the highest-risk accounts, consistent with both the Consent Order's expectations and prudent risk management principles. The Dashboard should flag any risk tier where remediation progress significantly lags the overall average.
3. Risk Rating Changes. The Dashboard should track and display accounts whose customer risk rating has been upgraded or downgraded as a result of findings during the remediation process. For example, an account initially rated as "medium-high" risk may be upgraded to "high" risk if the EDD process reveals previously unidentified risk factors, or downgraded if documentation obtained during remediation mitigates previously identified concerns. Risk rating changes during remediation are significant data points for Thornfield's independent validation and for BRB's ongoing risk assessment processes.
E. Quality Assurance Metrics
Quality assurance is integral to the remediation effort. Remediating accounts quickly but poorly would not satisfy the Consent Order's requirements and could expose BRB to additional criticism from the OCC and Thornfield. The Dashboard should track the following quality metrics:
1. First-Pass Quality Rate. The percentage of remediated accounts that pass the initial quality review without requiring rework. A high first-pass quality rate indicates that analysts are performing thorough and accurate remediation work. A declining first-pass quality rate may indicate inadequate training, unrealistic productivity targets, or systemic documentation gaps that need to be addressed. This metric should be tracked at both the aggregate level and the individual analyst level.
2. Rework Rate. The percentage of accounts that are returned for additional documentation, correction, or supplemental review after failing the initial quality review. This is the inverse complement of the first-pass quality rate and provides a direct measure of remediation inefficiency. The rework rate should be tracked over time to identify trends and should be broken out by common rework reasons (e.g., missing beneficial ownership certification, incomplete source-of-funds documentation, inadequate EDD narrative).
3. Average Remediation Cycle Time. The average number of calendar days from the date an account is assigned to an analyst to the date the account receives final quality review sign-off. This metric provides insight into the efficiency of the remediation workflow and enables identification of process bottlenecks. The cycle time should be broken out by remediation status (e.g., average cycle time for completed accounts, average time in each intermediate status), by BaaS partner (since partner responsiveness directly affects cycle time), and by risk tier.
4. QA Sample Results. Summary results from quality review sampling, including both random samples (drawn from the overall remediated population to estimate the aggregate quality rate) and risk-based samples (targeted at higher-risk accounts, accounts from specific partners, or accounts remediated by specific analysts where quality concerns have been identified). The sample methodology, sample sizes, and results should be documented and available for Thornfield review.
F. Staffing and Resource Metrics
The CDD/EDD remediation effort requires significant human capital, and staffing adequacy is a key risk factor for milestone attainment:
1. Analyst Productivity. The number of accounts remediated per analyst per week, tracked separately for Pinnacle Compliance Solutions temporary FTE analysts and BRB permanent compliance staff. Productivity metrics should be displayed at both the aggregate team level and the individual analyst level. Productivity outliers — both high performers and underperformers — should be identifiable through the Dashboard, enabling management to recognize strong performance, provide targeted coaching, and make informed staffing decisions.
2. Staffing Deployment Status. The current number of Pinnacle FTEs deployed against the 30 FTE contractual commitment, and the current number of BRB permanent FTEs assigned to the CDD/EDD remediation workstream against both the current complement of 62 staff and the 15 planned new hires. Staffing shortfalls — e.g., delays in Pinnacle onboarding, attrition among BRB permanent staff, or delays in the hiring of the 15 planned new positions — should be prominently flagged as risk factors for milestone attainment.
3. Workload Queue Depth. The number of accounts assigned but not yet completed per analyst and per team. Excessive queue depth may indicate staffing insufficiency or individual capacity constraints, while shallow queue depth may indicate opportunities to accelerate the pace by reassigning idle capacity.
G. Financial / Budget Metrics
Financial tracking ensures that the remediation effort remains within budget and that cost overruns are identified early:
1. CDD/EDD Remediation Budget. The total project budget of $4,300,000, displayed alongside actual spend to date, committed but unexpended amounts, and remaining budget. Budget consumption should be tracked against the remediation timeline to identify whether spending is running ahead of or behind plan.
2. Cost per Account Remediated. Total cost to date divided by the number of accounts completed. This metric provides a unit cost indicator that enables projection of total cost at completion and comparison against the budgeted cost per account implied by the $4,300,000 total budget (approximately $91.49 per account if all 47,000 are remediated within budget).
3. Projected Total Cost at Completion. Based on the current cost-per-account run rate and the total number of accounts remaining, this metric projects the total cost to fully remediate all 47,000 accounts. If the projected total cost exceeds the $4,300,000 budget, the Dashboard should flag the projected overrun amount and percentage, enabling timely management action to request additional budget authorization from the Board.
V. Data Sources and Integration Requirements
The Dashboard's value is entirely dependent on the quality, completeness, and timeliness of the underlying data. This section specifies the data sources that must be integrated into the Dashboard and the associated data quality and technical requirements.
A. Primary Data Sources
The Dashboard should draw data from the following primary sources:
1. CDD/EDD Remediation Case Management System. This system will serve as the central system of record for account-level remediation status, workflow management, document storage, and quality review tracking. It is the most critical data source for the Dashboard. BRB's IT team, under Linda Petrosian's direction, must either designate an existing system or establish a new purpose-built system for this function. C&H's recommendation is to configure the CDD/EDD remediation case management workflow within BRB's existing governance, risk, and compliance ("GRC") platform, which already supports other compliance workflow functions and offers the advantage of a mature role-based access control framework, document management capabilities, and audit trail functionality. The case management system must capture, at a minimum: account identifier, customer name (masked in certain views), BaaS partner identifier, assigned analyst, current remediation status, status change history with timestamps, documentation checklist status, quality review results, escalation flags, and closure/exit determinations.
2. Core Banking System. BRB's core banking system contains the master customer data, including account opening dates, account types and product classifications, current balances, transaction activity summaries, geographic and demographic information, and relationship history. Integration with the core banking system is necessary to provide contextual information for the remediation effort and to enable risk-tier segmentation and prioritization. The core banking system integration should be read-only from the Dashboard's perspective; the Dashboard should not write data back to the core banking system.
3. BaaS Partner Data Feeds. Each of the 14 active BaaS partners maintains its own customer onboarding data, identity verification results, and customer documentation repositories. The remediation effort will require obtaining significant amounts of documentation and data from these partners. The Dashboard should integrate feeds from each partner showing the status of documentation requests, documentation received, and any data quality issues identified. Particular emphasis should be placed on integration with the three largest partners — NovaPay Technologies Inc., FairLend Digital LLC, and VaultEdge Inc. — which represent the majority of affected accounts and, consequently, the largest volume of partner data integration activity. The integration methodology for each partner will need to be tailored to the partner's technical capabilities, which vary significantly across the 14-partner portfolio.
4. Customer Risk Rating Engine. BRB's customer risk rating engine generates the risk scores and tier assignments used to segment and prioritize the remediation population. The Dashboard must integrate with the risk rating engine to display current risk ratings for all 47,000 in-scope accounts and to reflect any rating changes that occur during the remediation process. The risk rating engine integration should also support the risk-tier distribution metrics described in Section IV.D above.
5. Veridian Analytics Transaction Monitoring System ("TMS"). The Veridian Analytics TMS, currently deployed as version 8.3 with a planned upgrade to version 10.0 scheduled for deployment on August 1, 2025, generates transaction monitoring alerts that may be associated with CDD/EDD-deficient accounts. Integration with the TMS enables the Dashboard to cross-reference remediation status with transaction monitoring alert activity, identifying accounts where CDD/EDD deficiencies coincide with suspicious transaction patterns. This cross-referencing capability is important for both prioritization purposes and for supporting the SAR correlation metric described in Section IV.C.4 above. C&H notes that the planned TMS upgrade from version 8.3 to version 10.0 may require modifications to the data integration interface; coordination with Veridian Analytics (Priya Subramanian, VP of Client Solutions) on this point should begin early in the Dashboard development process.
6. SAR Filing Database. BRB's SAR filing database contains records of all filed and pending Suspicious Activity Reports. Integration with this database enables the Dashboard to identify and flag CDD/EDD-deficient accounts that are associated with SAR filings, supporting the SAR correlation metric and informing remediation prioritization.
7. OFAC Screening System. BRB's OFAC screening system contains records of screening hits, including both false positives and true matches. Integration with this system enables the Dashboard to cross-reference CDD/EDD-deficient accounts with OFAC screening results. We note that BRB's OFAC screening system generated 14,320 hits in calendar year 2024, of which 12 were determined to be true matches. While the OFAC screening remediation workstream is outside the scope of this Dashboard, the cross-reference is valuable for ensuring that accounts with OFAC-related concerns are appropriately prioritized within the CDD/EDD remediation workflow.
B. Data Quality Requirements
The integrity of the Dashboard depends on rigorous data quality standards:
• Refresh Frequency. The Dashboard should refresh data from all primary sources at a minimum of once daily. For operational dashboard views used by senior management and analysts, near-real-time data refresh (i.e., refresh cycles of no more than 15 to 30 minutes) is strongly preferred to ensure that decision-making is based on current information. The executive and board-level summary views may operate on a daily refresh cycle without material loss of utility.
• Automated Validation Rules. The Dashboard system should implement automated data validation rules to flag inconsistencies and anomalies. Examples include: status changes that occur without supporting documentation; accounts that appear to regress in status without an accompanying explanation; accounts that remain in a single status for an anomalously long period; and discrepancies between the case management system and the core banking system (e.g., an account recorded as "closed" in the Dashboard but still showing as "active" in the core banking system).
• Master List Reconciliation. A foundational data quality requirement is the ongoing reconciliation of the Dashboard's account population against the master list of 47,000 accounts identified in the OCC examination. At no point should the total number of accounts tracked in the Dashboard differ from 47,000 (or such adjusted figure as may be approved through the formal scope adjustment process referenced above) without a documented and approved explanation. No accounts should be inadvertently lost, omitted, or double-counted.
• Comprehensive Audit Trail. Every status change recorded in the Dashboard must be accompanied by a complete audit trail entry, including a timestamp, the user ID of the individual making the change, the prior status value, the new status value, a reason or comment field explaining the change, and a link to any supporting documentation. This audit trail is not merely a "nice to have" — it is an essential component of BRB's evidentiary record and will be subject to examination by the OCC, review by Thornfield Consulting, and scrutiny by BRB's Internal Audit function.
C. Technical Integration Points
The following technical integration considerations should guide the Dashboard's architectural design, in coordination with Linda Petrosian (CIO/CTO) and BRB's IT infrastructure team:
• Integration Architecture. Data feeds from the primary sources described above should be established using API-based integrations where available, supplemented by ETL (extract-transform-load) processes where API connectivity is not feasible. API-based integrations are preferred for their ability to support near-real-time data refresh. ETL-based integrations are acceptable for data sources that are updated on a batch basis (e.g., daily extracts from the core banking system). Each integration point should be documented in a technical integration specification, including data mapping, transformation rules, error handling procedures, and refresh schedules.
• Role-Based Access Control ("RBAC"). The Dashboard must implement differentiated access levels aligned with stakeholder roles and information needs. At a minimum, the following RBAC tiers should be established:
• Board / Committee Level (Summary Access): Compliance Committee members, Audit Committee members, and Risk Committee members should have access to executive summary views only. No customer personally identifiable information ("PII") should be displayed in these views.
• Senior Management Level (Detailed Operational Access): The CCO, BSA Officer, Head of Fintech Partnerships, CRO, and other designated senior management should have access to detailed operational views, including account-level detail (with PII), escalation queues, quality metrics, and staffing reports.
• Thornfield Consulting (Read-Only Analytical Access): Thornfield team members (Dr. Vivian Castellano, Nathaniel Burgess, and designated staff) should have read-only access to all Dashboard views, consistent with the Access & Cooperation Protocol. Thornfield users should not have the ability to modify any data in the Dashboard. Export capabilities should be enabled for Thornfield users to support independent validation analyses.
• Analyst Level (Task-Queue and Case Access): Pinnacle Compliance Solutions FTE analysts and BRB permanent compliance staff assigned to the CDD/EDD remediation should have access to their individual work queues, assigned account files, and relevant supporting data. Analyst-level access should include the ability to update account status and upload documentation within the case management system, subject to supervisory review and approval.
• Internal Audit (Full Read-Only Access): Derek Ballard and his Internal Audit team should have full read-only access to all Dashboard views and the underlying data for independent audit testing purposes.
• Administrative Access: BRB IT administrators and designated system owners should have administrative access for system configuration, user management, data integration management, and troubleshooting.
• Export Capabilities. The Dashboard must support data export in multiple formats to accommodate the diverse reporting needs of its stakeholders. At a minimum, exports should be available in Excel/CSV format (for analytical purposes), PDF format (for formal reporting), and Word-compatible format (for incorporation into narrative reports, including OCC quarterly progress reports). Pre-formatted export templates aligned with the OCC quarterly reporting requirements should be developed and tested prior to the September 15, 2025, submission deadline.
• Information Security Coordination. All technical design decisions must be coordinated with Linda Petrosian (CIO/CTO) and vetted against BRB's information security policies, including requirements for data encryption at rest and in transit, network segmentation, vulnerability management, and access logging. Additional information security requirements are detailed in Section XI below.
VI. Visualization and Reporting Requirements
The Dashboard must accommodate multiple stakeholder groups with differing information needs, analytical sophistication, and access frequency. Accordingly, C&H recommends a multi-view architecture in which each stakeholder group has access to a purpose-built Dashboard view tailored to its specific requirements.
A. Executive Dashboard View (Board / Compliance Committee)
The Executive Dashboard View is designed for consumption by the Compliance Committee (James Rutherford, Chair), the Audit Committee (Margaret Dao, Chair), the Risk Committee (Arthur Connelly, Chair), and the CEO, COO, CFO, and General Counsel. This view should present a concise, single-page summary of the overall CDD/EDD remediation status, optimized for rapid comprehension and high-level decision-making.
The Executive Dashboard View should display the following elements on a single screen:
• Total Remediated vs. Remaining. A large-format gauge chart or donut chart showing the total number of accounts remediated to date and the percentage of the 47,000-account population that has been completed. The visual should clearly communicate whether the effort is past the halfway mark and how much work remains.
• Milestone Progress Bars. Horizontal progress bars for each of the two regulatory milestones (July 15, 2025, and January 15, 2026), showing the current completion percentage relative to the milestone requirement. The July 15 milestone bar should fill to 100% at 23,500 completed accounts; the January 15 milestone bar should fill to 100% at 47,000 completed accounts.
• Pace Indicator. A clear, prominent indicator showing whether the remediation effort is "On Track," "At Risk," or "Behind" relative to the planned trajectory, using the Green / Yellow / Red color coding described in Section IV.B.3.
• BaaS Partner Breakdown. A stacked bar chart or grouped bar chart showing remediation progress by BaaS partner, with the three largest partners (NovaPay, FairLend Digital, VaultEdge) individually identified and the remaining 11 partners grouped or individually listed as space permits.
• Trend Line. A line chart plotting cumulative remediation completions over time, overlaid with the planned trajectory line showing the pace required to meet each milestone. This visualization enables Committee members to see at a glance whether the actual trend line is tracking above, on, or below the planned trajectory.
• Red / Amber / Green Status Indicators. Summary status indicators for key sub-metrics, including overall remediation pace, quality assurance pass rate, staffing adequacy, budget consumption, and partner cooperation. Each indicator should be color-coded and accompanied by a brief text label summarizing the current status.
This view should be designed for presentation at monthly Compliance Committee meetings, where it will be presented by Patricia Langston (CCO), and at quarterly Audit Committee meetings, where it may be presented by Derek Ballard (Head of Internal Audit) or Patricia Langston. The view should be printable on a single page in landscape orientation and exportable to PDF for inclusion in board materials distributed through the secure board portal.
B. Operational Dashboard View (Senior Management / BSA Officer)
The Operational Dashboard View is designed for daily use by Patricia Langston (CCO), Thomas Ikeda (BSA Officer), Warren Ashby (Head of Fintech Partnerships), Melissa Chu (CRO), and the C&H team. This view should provide a multi-panel interface with rich interactive drill-down capabilities, enabling users to explore the remediation data from multiple angles and at multiple levels of granularity.
The Operational Dashboard View should include the following panels and capabilities:
• Account-Level Detail Access. Users should be able to click on any summary chart element (e.g., a bar in a BaaS partner chart, a segment in a risk-tier distribution) and drill down to the underlying list of individual accounts, with full detail on each account's remediation status, assigned analyst, cycle time, documentation checklist status, and quality review results.
• Flexible Filtering. Users should be able to filter the Dashboard data by BaaS partner, risk tier, remediation status, assigned analyst, date range, and other relevant dimensions. Filters should be combinable (e.g., "show all NovaPay accounts in 'Escalated' status assigned to Pinnacle analysts").
• Overdue Account Heatmap. A visual heatmap highlighting accounts that have exceeded target cycle times, organized by BaaS partner and risk tier. Color intensity should reflect the degree of overdue status, with the most severely overdue accounts displayed in the darkest shade.
• Analyst Productivity Leaderboard. A ranked display of analyst productivity, showing accounts completed per analyst per week or per month. This leaderboard should be available for both Pinnacle temporary FTEs and BRB permanent staff, and should support drill-down to individual analyst detail.
• Escalation Queue with Aging Indicators. A dedicated panel showing all accounts currently in "Escalation" status, sorted by the duration they have been in escalated status, with color-coded aging bands (e.g., 0–7 days, 8–15 days, 16–30 days, >30 days). Each escalated account should display the reason for escalation and the pending action required.
• Quality Review Results Trending. A trend chart showing the first-pass quality rate, rework rate, and common deficiency categories over time, enabling management to detect quality deterioration or improvement trends.
C. Analyst / Task-Queue View
The Analyst / Task-Queue View is designed for use by the individual compliance analysts executing the remediation work, including both the 30 Pinnacle Compliance Solutions temporary FTE analysts deployed by Andrea Solis and the BRB permanent compliance staff assigned to the CDD/EDD workstream. This view should function as a personalized work management interface for each analyst, showing:
• The analyst's assigned account queue, with accounts listed in priority order based on risk tier, BaaS partner, and deadline proximity.
• For each assigned account: the required remediation actions, documentation checklist with completion status, links to supporting documentation and customer correspondence, and any applicable deadline or aging alert.
• The ability to update account status, upload received documentation, and record notes within the case management system, subject to supervisory review and approval workflows.
• A personal productivity summary showing the analyst's accounts completed to date, current week's completion count, and comparison to team averages.
This view should be intuitive and efficient, minimizing the number of clicks required to perform common workflow actions. It will be the most heavily used Dashboard view in terms of daily transaction volume and the most critical for driving remediation throughput. Thomas Ikeda (BSA Officer) should have supervisory visibility into all analyst task queues to facilitate workload balancing and performance management.
D. Thornfield Consulting Independent Consultant View
The Thornfield Consulting View is designed for use by Dr. Vivian Castellano, Nathaniel Burgess (Director, Fintech & Payments Compliance), and designated members of the Thornfield engagement team. This view must be configured in strict accordance with the Access & Cooperation Protocol and the Privilege & Confidentiality Side Letter that govern Thornfield's access to BRB information.
The Thornfield View should include:
• Read-only access to all Dashboard views described above (Executive, Operational, and Analyst/Task-Queue), enabling Thornfield to observe the same data that BRB management relies upon for remediation oversight.
• The ability to export Dashboard data — including account-level detail, status histories, quality review results, and audit trail entries — in Excel/CSV and PDF formats for use in Thornfield's independent validation analyses.
• A separa