PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT
MEMORANDUM
TO:
Gregory Nardone, General Counsel & Corporate Secretary, Belmont Ridge Bank National Association
Patricia Langston, Chief Compliance Officer, Belmont Ridge Bank National Association
Thomas Ikeda, BSA Officer / AML Program Director, Belmont Ridge Bank National Association
FROM:
Philip Hartmann, Responsible Partner, Calderwood & Harkness LLP
Yuki Nakamura, Lead Associate, Calderwood & Harkness LLP
Carlos Espinoza, Working Associate, Calderwood & Harkness LLP
DATE: March 10, 2025
RE: CDD/EDD Remediation Methodology and Prioritization Framework — Remediation of 47,000 High-Risk Customer Accounts (Workstream 3)
C&H Matter No.: 1045-00002
Reference: OCC Consent Order No. OCC-2025-003 (January 15, 2025)
Right-click to update Table of Contents
I. Executive Summary
This memorandum establishes the methodology, prioritization framework, phased timeline, and resource allocation for the remediation of approximately 47,000 high-risk customer accounts identified as lacking adequate Customer Due Diligence ("CDD") or Enhanced Due Diligence ("EDD") documentation. These deficiencies were cited in Finding (iii) of OCC Consent Order No. OCC-2025-003, issued January 15, 2025, against Belmont Ridge Bank National Association ("BRB" or the "Bank"). The remediation of these accounts constitutes Workstream 3 of the Bank's broader remediation program being developed in response to the Consent Order.
The OCC's targeted BSA/AML examination, which was conducted between March 2024 and September 2024, found that approximately 47,000 high-risk customer accounts — predominantly onboarded through BRB's fintech Banking-as-a-Service ("BaaS") partnerships — lacked adequate CDD or EDD documentation as required under the Bank Secrecy Act ("BSA"), the Financial Crimes Enforcement Network's ("FinCEN") Customer Due Diligence Rule (31 C.F.R. § 1010.230), and OCC supervisory expectations set forth in the Comptroller's Handbook and related guidance. The OCC determined that the scope and severity of these deficiencies constituted an unsafe or unsound banking practice warranting formal enforcement action.
This deficiency was previously flagged during the September 2024 independent BSA/AML test conducted by Caldera & Pope LLP (engagement partner: Franklin Dorsey, CPA; 2024 BSA/AML testing fee: $1,100,000), which identified multiple CDD/EDD deficiencies that were subsequently echoed and amplified in the OCC's Consent Order findings. The convergence of the Caldera & Pope findings with the OCC's independent examination conclusions underscores the systemic nature of the CDD/EDD gaps and the urgency of comprehensive remediation.
The Consent Order imposes two mandatory milestones for CDD/EDD remediation: (a) 50% completion — encompassing no fewer than 23,500 accounts — must be achieved by July 15, 2025; and (b) 100% completion — encompassing all 47,000 accounts — must be achieved by January 15, 2026. Failure to meet either milestone may result in additional supervisory action, including potential modification of the Consent Order to impose more restrictive conditions or additional civil money penalties.
The Comprehensive Remediation Action Plan, which is due for submission to the OCC by May 15, 2025, will incorporate this workstream as Workstream 3. The present memorandum provides the detailed operational methodology that will underpin the Workstream 3 component of that submission.
The total estimated budget for the CDD/EDD remediation effort is $4,300,000, which is included within the Board-approved total remediation budget of $42,500,000 (exclusive of the $14,500,000 civil money penalty, bringing total financial outlay to $57,000,000).
Thornfield Consulting Group LLC (engagement lead: Dr. Vivian Castellano; engagement reference TCG-BRB-2025-001), the OCC-mandated independent consultant retained pursuant to Article V of the Consent Order, will validate the remediation methodology described herein and verify milestone completion. Thornfield's on-site assessment commenced March 1, 2025, and its preliminary gap assessment is due April 15, 2025. Calderwood & Harkness recommends that this memorandum be shared with Thornfield for review and comment under the terms of the Privilege & Confidentiality Side Letter, as discussed further in Section XIV below.
II. Background and Regulatory Context
A. Consent Order Requirements
OCC Consent Order No. OCC-2025-003 was issued on January 15, 2025, against Belmont Ridge Bank National Association (OCC Charter No. 48271; FDIC Certificate No. 31845). The Consent Order was entered by stipulation following the completion of the OCC's targeted BSA/AML examination, which spanned the period from March 2024 through September 2024. The Consent Order addresses multiple areas of noncompliance within BRB's BSA/AML program, including transaction monitoring deficiencies, OFAC sanctions screening gaps, SAR filing backlogs, and — most relevant to this memorandum — CDD/EDD shortfalls.
Finding (iii) of the Consent Order specifically cites "insufficient CDD/EDD for high-risk customers onboarded through fintech partners" as a material deficiency warranting corrective action. The OCC determined that BRB failed to maintain adequate CDD and EDD documentation for a substantial population of high-risk customer accounts, the vast majority of which were onboarded through the Bank's BaaS channel partnerships. The Consent Order characterizes this deficiency as a violation of 12 U.S.C. § 1818(b) and the implementing regulations under 31 C.F.R. Part 1010, including the CDD Rule at 31 C.F.R. § 1010.230.
The Consent Order requires BRB to develop and implement a comprehensive remediation plan to bring all high-risk customer accounts into compliance with applicable CDD/EDD requirements. The plan must address (i) the identification and prioritization of deficient accounts, (ii) a methodology for remediation, (iii) a staffing and resource allocation framework, (iv) a phased timeline aligned with the Consent Order milestones, and (v) quality assurance and validation protocols, including independent consultant oversight.
Pursuant to Article III of the Consent Order, BRB's Board of Directors was required to adopt a resolution acknowledging the Consent Order and establishing a dedicated Compliance Committee by February 28, 2025. The Board passed the required resolution on February 25, 2025, establishing the Compliance Committee under the chairmanship of James Rutherford, an independent director. The Board simultaneously approved a total remediation budget of $42,500,000 (exclusive of the $14,500,000 civil money penalty imposed under Article VIII of the Consent Order), bringing the Bank's total financial outlay related to the Consent Order to approximately $57,000,000.
B. Prior Supervisory History
The issuance of the Consent Order represents the culmination of an escalating pattern of supervisory concerns regarding BRB's BSA/AML compliance program, which has been the subject of progressively more serious regulatory actions over the past three years.
In June 2022, BRB received a Matter Requiring Attention ("MRA") from the OCC regarding deficiencies in the Bank's BSA/AML transaction monitoring systems. The MRA identified inadequate tuning of the Bank's then-existing transaction monitoring scenarios, resulting in both excessive false-positive rates and unacceptable false-negative rates for certain high-risk typologies, particularly those associated with BaaS-onboarded customer populations.
In November 2023, the OCC escalated its concerns by issuing a Matter Requiring Immediate Attention ("MRIA") regarding gaps in the Bank's OFAC sanctions screening program. The MRIA noted that a significant volume of transactions processed through BaaS partner channels — subsequently identified as approximately 3,800,000 transactions in calendar year 2023 associated with NovaPay Technologies alone — had not been subjected to required OFAC screening. The MRIA required immediate corrective action and enhanced Board oversight.
The escalation from MRA to MRIA to the current Consent Order reflects the OCC's determination that BRB's prior remediation efforts were inadequate in scope and execution. It is relevant to note that BRB's former outside regulatory counsel, Drayton Mercer LLP (lead partner: Helen Frazier), advised the Bank on its responses to both the June 2022 MRA and the November 2023 MRIA. The engagement with Drayton Mercer was terminated by BRB in January 2025 following the issuance of the Consent Order, and Calderwood & Harkness was retained as successor regulatory counsel effective January 20, 2025. Calderwood & Harkness has not reviewed in detail the legal advice provided by Drayton Mercer during the prior remediation period, but the OCC's findings suggest that the remediation strategies pursued during that period were insufficient to address the identified deficiencies.
C. Scope of CDD/EDD Deficiency
The total population of deficient accounts identified through the OCC examination is approximately 47,000. These accounts have been classified as "high-risk" under BRB's existing customer risk rating methodology and are concentrated among customers onboarded through BRB's 14 active BaaS fintech partner channels. A smaller subset of approximately 2,900 accounts represents traditional BRB direct customers (retail and commercial) who were under-documented due to staffing gaps in the Bank's BSA/AML department.
The specific deficiencies identified across the 47,000-account population are varied and, in many cases, overlapping. They include, but are not limited to, the following:
• Missing or incomplete beneficial ownership information. A substantial number of business entity accounts lack the identification and verification of beneficial owners holding 25% or more equity interest, as required under 31 C.F.R. § 1010.230. In certain cases, beneficial ownership certifications were never obtained at account opening; in other cases, certifications were obtained but were incomplete, outdated, or not verified against independent sources.
• Inadequate risk rating documentation. Many accounts lack sufficient documentation supporting their assigned risk rating, including the factors considered, the rationale for the assigned rating, and any risk mitigation measures applied. This is particularly problematic for accounts where the risk rating appears inconsistent with available customer profile data.
• Absence of EDD for high-risk categories. Accounts involving politically exposed persons ("PEPs"), high-cash-volume businesses, foreign nationals, money services businesses ("MSBs"), and other high-risk customer types in many cases lacked the enhanced due diligence investigations, source of funds and source of wealth analyses, and ongoing monitoring protocols required by BRB's own policies and OCC supervisory expectations.
• Lack of periodic review documentation. A significant number of accounts had never undergone the periodic reviews required under BRB's CDD/EDD policies, which mandate annual reviews for high-risk accounts and biennial reviews for medium-high-risk accounts.
• Insufficient ongoing monitoring records. Many accounts lacked documented evidence of ongoing monitoring activity, including the disposition of transaction monitoring alerts, negative news screening results, and changes in customer risk profile.
The concentration of these deficiencies within the BaaS customer population is particularly concerning. BaaS-related Suspicious Activity Reports ("SARs") comprised 2,108 of 3,847 total SARs filed by BRB in calendar year 2024, representing 54.8% of total SAR filings. This disproportionate SAR filing rate underscores the elevated risk profile of the BaaS customer population and the urgency of comprehensive CDD/EDD remediation for this segment.
D. BaaS Channel Overview
BRB operates 14 active BaaS fintech partnerships through which it provides bank charter, deposit, lending, and payments infrastructure to technology companies serving end-user consumers and small businesses. These partnerships represent a significant and rapidly growing component of BRB's business model, generating substantial transaction volume and revenue.
Total BaaS transaction volume in calendar year 2024 was approximately $74,300,000,000. BaaS-related revenue to BRB in the same period was approximately $127,400,000, comprised of interchange income, program management fees, and interest income on BaaS-originated deposits and loans. The scale and growth trajectory of this business line make it strategically important to BRB, but also underscore the criticality of maintaining a robust compliance infrastructure commensurate with the associated risk.
The three largest BaaS partners by transaction volume are as follows:
NovaPay Technologies Inc. (CEO: Ethan Garrison; 450 Mission Street, Suite 1200, San Francisco, CA 94105). NovaPay is BRB's largest BaaS partner, accounting for approximately 41% of total BaaS transaction volume ($30,500,000,000 in CY 2024). NovaPay's platform serves approximately 2.1 million end-user accounts, offering digital payments, peer-to-peer transfers, and prepaid card products. NovaPay was onboarded by BRB in 2021 and represents the Bank's longest-standing major BaaS relationship. The extended duration of this partnership, combined with the magnitude of the end-user account population, means that NovaPay-related accounts represent the single largest source of cumulative CDD/EDD gap exposure.
FairLend Digital LLC (CEO: Aisha Okonkwo; 100 Summer Street, Suite 800, Boston, MA 02110). FairLend accounts for approximately 28% of BaaS transaction volume and operates a small-business lending platform through which approximately $1.4 billion in loans were originated through BRB in fiscal year 2024. FairLend was onboarded by BRB in 2022. The lending-centric nature of FairLend's platform presents unique CDD/EDD challenges, particularly with respect to beneficial ownership identification for business entity borrowers.
VaultEdge Inc. (CEO: Marcus Tan; 2200 Ross Avenue, Suite 3600, Dallas, TX 75201). VaultEdge accounts for approximately 18% of BaaS transaction volume and operates a digital savings and neobanking platform with approximately 870,000 deposit accounts. VaultEdge was onboarded by BRB in 2023, making it the most recently onboarded of the three major partners. As the newest major relationship, VaultEdge's CDD infrastructure has had the least time to mature, and certain onboarding deficiencies have been identified as systemic.
The remaining 11 BaaS partners collectively represent approximately 13% of BaaS transaction volume. While individually smaller in scale, several of these partners serve customer populations with elevated risk characteristics that warrant heightened CDD/EDD attention during the remediation process.
III. Remediation Objectives
A. Primary Objectives
The CDD/EDD remediation effort is organized around three primary objectives, each of which is essential to achieving full compliance with the Consent Order and restoring the integrity of BRB's BSA/AML compliance program.
1. Remediate all 47,000 identified high-risk customer accounts to achieve full CDD/EDD compliance. Each account within the identified deficient population must be brought into compliance with the requirements of 31 C.F.R. § 1010.230, applicable OCC supervisory guidance (including the Comptroller's Handbook on BSA/AML, the OCC's Guidance on Model Risk Management (OCC Bulletin 2011-12), and related issuances), and BRB's revised CDD/EDD Policy, which is currently being drafted as a separate workstream deliverable under Workstream 5. Remediation means that each account will possess complete and current CDD documentation, an accurate and well-supported risk rating, and — where applicable — a thorough EDD investigation with appropriate ongoing monitoring protocols in place.
2. Meet the two Consent Order milestones within the specified deadlines. The remediation plan must be structured and resourced to ensure that no fewer than 23,500 accounts (50% of the identified population) are fully remediated by July 15, 2025, and that all 47,000 accounts (100% of the identified population) are fully remediated by January 15, 2026. These are firm regulatory deadlines that carry significant consequences if missed, and the methodology set forth in this memorandum is designed with sufficient capacity and contingency margin to meet both milestones.
3. Establish sustainable processes for ongoing CDD/EDD compliance across all channels, including BaaS. The remediation effort should not be viewed solely as a one-time catch-up exercise. A critical objective is to ensure that the processes, staffing, technology, and governance structures put in place during remediation provide a durable foundation for ongoing CDD/EDD compliance. This includes the integration of enhanced CDD/EDD workflows into BRB's core operating procedures, the establishment of clear responsibility matrices with BaaS partners, and the deployment of technology tools that support continuous monitoring and periodic review on a sustainable basis.
B. Secondary Objectives
In addition to the primary objectives described above, the remediation effort will advance several secondary objectives that support the broader remediation program and enhance BRB's overall BSA/AML risk management.
1. Identify and escalate accounts presenting potential suspicious activity requiring SAR filing. The detailed file reviews conducted during remediation will inevitably surface accounts that present indicia of suspicious activity that may not have been previously identified or reported. A formal referral protocol will be established to route such findings to the SAR review team operating under Workstream 2 (SAR Backlog Clearance & Process Improvement Plan) for timely evaluation and, where appropriate, SAR filing. This coordination ensures that the remediation effort serves not only a compliance documentation function but also a substantive risk identification function.
2. Support the Compliance Committee's reporting requirements. The Compliance Committee, chaired by James Rutherford, is required under the Consent Order to provide quarterly progress reports to the OCC and to exercise active oversight of the remediation program. The CDD/EDD remediation effort will provide monthly remediation progress metrics — including accounts completed, quality assurance results, BaaS partner cooperation status, and escalation activity — to support the Committee's oversight and reporting obligations.
3. Align BaaS partner onboarding and ongoing due diligence responsibilities. The remediation effort provides an opportunity to clarify and formalize the respective CDD/EDD responsibilities of BRB and its fintech partners. This will be accomplished through the BaaS Partner CDD/EDD Responsibility Matrix, a separate deliverable that will delineate which CDD/EDD functions are performed by the fintech partner, which are performed by BRB, and how information flows between the two parties. The remediation process will serve as a practical test of these responsibility allocations and will inform refinements to the Matrix.
4. Produce auditable evidence of remediation for validation and supervisory review. Every remediation action taken on every account must be thoroughly documented, time-stamped, and associated with an identifiable analyst, producing an auditable trail that will support Thornfield Consulting Group's independent validation, Caldera & Pope's independent testing, and the OCC's ongoing supervisory review. The importance of maintaining robust documentation cannot be overstated, as the persuasiveness of BRB's compliance self-certification (due February 15, 2026) will depend heavily on the quality and completeness of the underlying remediation records.
IV. Account Population Analysis and Segmentation
A. Total Population Identification
The total identified population of deficient accounts is approximately 47,000. This figure is derived from the OCC's targeted BSA/AML examination findings (March 2024 – September 2024) and has been corroborated by the independent BSA/AML test conducted by Caldera & Pope LLP in September 2024. Both the OCC examination and the Caldera & Pope review identified substantially similar account populations as lacking adequate CDD/EDD documentation, lending confidence to the reliability of the 47,000-account estimate.
To verify and refine this population count, BRB's BSA/AML team — under the direction of Thomas Ikeda, BSA Officer (current departmental headcount: 62 FTEs) — has undertaken a systematic cross-referencing exercise, comparing the account identifiers included in the OCC's examination findings against BRB's core banking system records and customer information files. This exercise is intended to validate each account's inclusion in the remediation population, identify any duplicate records that may have inflated the count, and flag any accounts that have been closed since the examination period and may require modified remediation treatment.
It is anticipated that minor variance of approximately ±2% (approximately 940 accounts in either direction) may occur as this validation process concludes and as additional duplicate records or previously closed accounts are identified during the remediation process itself. Any changes to the total population count will be documented, reported to Calderwood & Harkness, and communicated to the OCC through the established reporting channels. For planning purposes, this memorandum uses the 47,000-account figure as the baseline population and structures staffing and timeline projections accordingly.
B. Segmentation by BaaS Partner
The 47,000 deficient accounts have been segmented by the BaaS partner channel through which they were onboarded, as well as by whether they represent traditional (non-BaaS) direct customers. This segmentation is critical to the prioritization and operational planning of the remediation effort, as each BaaS partner channel presents distinct challenges in terms of data availability, customer outreach logistics, and the types of deficiencies most commonly encountered.
NovaPay Technologies Inc.: Approximately 19,200 accounts, representing approximately 41% of the total deficient population. This proportion is consistent with NovaPay's 41% share of BaaS transaction volume and its position as BRB's largest BaaS partner with 2.1 million end-user accounts. NovaPay was onboarded in 2021 and represents BRB's longest-standing major BaaS relationship. The extended duration of this partnership means that the cumulative CDD/EDD gap exposure is greatest for NovaPay accounts, as many of these accounts have been active for three or more years without adequate periodic review or EDD documentation. The high volume of NovaPay's transaction activity ($30.5 billion in CY 2024) further compounds the risk associated with CDD/EDD deficiencies in this segment.
FairLend Digital LLC: Approximately 11,300 accounts, representing approximately 24% of the total deficient population. FairLend was onboarded in 2022 and operates a small-business lending platform. The nature of FairLend's product offering — commercial loans originated through BRB to business entity borrowers — presents specific challenges for beneficial ownership identification and verification. Many of the deficient FairLend accounts involve multi-layered business structures for which the identification of beneficial owners holding 25% or more equity interest was not adequately completed at origination. Given that FairLend facilitated approximately $1.4 billion in loan originations through BRB in fiscal year 2024, the remediation of these accounts carries both BSA/AML compliance significance and credit risk implications.
VaultEdge Inc.: Approximately 8,500 accounts, representing approximately 18% of the total deficient population. VaultEdge was onboarded in 2023, making it the most recently onboarded major partner. VaultEdge operates a digital savings and neobanking platform serving approximately 870,000 deposit account holders. As the newest major relationship, VaultEdge's CDD infrastructure was at an earlier stage of maturity at the time of the OCC examination, and certain systemic onboarding deficiencies have been attributed to inadequate implementation of BRB's CDD requirements within VaultEdge's customer onboarding workflow. The relative recency of these accounts means that periodic review deficiencies are less pronounced than for NovaPay accounts, but initial CDD documentation gaps are significant.
Remaining 11 BaaS Partners: Approximately 5,100 accounts collectively, representing approximately 11% of the total deficient population. These accounts are distributed across 11 smaller BaaS partner relationships, none of which individually accounts for more than approximately 2% of the total deficient population. While the individual exposure per partner is relatively modest, the aggregate population of 5,100 accounts is material and must be remediated within the same timeline and to the same standards as the larger partner segments.
Non-BaaS High-Risk Accounts (Retail/Commercial): Approximately 2,900 accounts, representing approximately 6% of the total deficient population. These are traditional BRB direct customers — both retail individuals and commercial entities — who were identified as lacking adequate CDD/EDD documentation. The deficiencies in this segment are primarily attributable to staffing gaps within BRB's BSA/AML department during 2022–2024, during which period the rapid growth of the BaaS business consumed a disproportionate share of available compliance resources, leaving traditional high-risk account reviews under-resourced.
C. Segmentation by Deficiency Type
In addition to segmentation by BaaS partner channel, the deficient account population has been categorized by the primary type of CDD/EDD deficiency affecting each account. This categorization informs the remediation approach for each account, as different deficiency types require different remediation actions, resource levels, and timeframes.
Category 1 — Missing or incomplete beneficial ownership information: Approximately 18,800 accounts (40% of the total population). These accounts lack the identification and verification of beneficial owners as required under 31 C.F.R. § 1010.230. Remediation requires obtaining updated beneficial ownership certifications from the account holder, verifying the information against independent sources, and documenting the results in BRB's customer information system. This category is heavily represented among FairLend Digital accounts, where business entity borrowers frequently have complex ownership structures.
Category 2 — Inadequate customer risk rating and EDD documentation for high-risk categories: Approximately 14,100 accounts (30% of the total population). These accounts have been identified as high-risk but lack the documentation necessary to support the assigned risk rating and/or lack the enhanced due diligence investigation required for high-risk customer types such as PEPs, MSBs, high-cash-volume businesses, and foreign nationals. Remediation requires a comprehensive re-evaluation of the customer's risk profile, preparation of a full EDD narrative where applicable, and documentation of risk mitigation measures.
Category 3 — Absence of periodic review documentation: Approximately 9,400 accounts (20% of the total population). These accounts have never undergone the periodic review required under BRB's CDD/EDD policies. For high-risk accounts, BRB policy requires annual review; for medium-high-risk accounts, biennial review. Remediation requires conducting a full periodic review, updating all CDD/EDD documentation to current standards, and establishing a forward-looking review schedule. This category is heavily represented among longer-tenured NovaPay accounts.
Category 4 — Multiple overlapping deficiencies: Approximately 4,700 accounts (10% of the total population). These accounts suffer from two or more of the deficiency types described above — for example, an account that lacks both beneficial ownership information and EDD documentation, or an account that has never undergone periodic review and also has an inadequate risk rating. Category 4 accounts will require the most intensive remediation effort per account, as each overlapping deficiency must be independently addressed and documented. These accounts are prioritized accordingly in the risk-based framework described in Section V.
It should be noted that the categorization of each account is based on the best information currently available and may be refined during the file review stage of remediation (Step 1) as analysts examine individual account files in detail. Some accounts initially categorized as single-deficiency (Categories 1–3) may be reclassified as Category 4 upon closer review, and vice versa. Any material changes in the distribution of accounts across deficiency categories will be documented and reported.
V. Risk-Based Prioritization Framework
A. Prioritization Methodology Overview
The remediation of 47,000 accounts over a twelve-month period requires a principled approach to sequencing that maximizes risk reduction in the earliest phases of the effort. The prioritization framework described in this section employs a composite risk scoring methodology that assigns each account a priority tier based on three primary factors: (1) the account's inherent customer risk score under BRB's existing risk rating model, (2) the account's transaction volume and velocity during the trailing 12-month period, and (3) the risk tier assigned to the BaaS partner through which the account was onboarded.
The composite scoring approach ensures that the highest-risk accounts — those presenting the greatest BSA/AML exposure to the Bank — are remediated first, thereby achieving the maximum possible risk reduction within the July 15, 2025, 50% milestone. This approach is consistent with OCC supervisory expectations for risk-based prioritization in remediation contexts and is designed to withstand scrutiny by both Thornfield Consulting Group and the OCC examination team.
B. Factor 1: Inherent Customer Risk Score
BRB's existing customer risk rating model assigns each account a risk tier based on a combination of customer-level and account-level attributes, including customer type, geography, product usage, industry, and other relevant factors. The model classifies accounts into four tiers: High, Medium-High, Medium, and Low.
All 47,000 accounts within the remediation population have been classified as "high-risk" by the OCC for purposes of the Consent Order. However, within this population, BRB's internal risk scoring model differentiates meaningful gradations of risk. For example, an account belonging to a PEP with business activities in a high-risk jurisdiction and transacting in cash-intensive industries will score materially higher than an account belonging to a domestic individual whose elevated risk classification stems primarily from the BaaS channel through which the account was onboarded.
For purposes of prioritization, accounts internally rated at the highest gradations of risk — including those associated with PEPs, foreign correspondent accounts, MSBs, cash-intensive businesses, entities domiciled in or transacting with FATF-identified high-risk jurisdictions, and customers with prior suspicious activity indicators — receive the highest priority score under Factor 1. This weighting ensures that the accounts presenting the most immediate and serious BSA/AML risk are addressed in the earliest remediation phases.
C. Factor 2: Transaction Volume and Velocity
The second factor in the composite risk score is the account's transaction volume and velocity during the trailing 12-month period (calendar year 2024). Transaction volume is measured in both dollar terms (aggregate transaction value) and count terms (total number of transactions), and velocity is assessed by examining patterns of activity intensity, including spikes in transaction frequency or value that may warrant heightened scrutiny.
Accounts with the highest cumulative transaction volume receive elevated priority scores under this factor. The rationale is straightforward: higher-volume accounts present greater BSA/AML risk exposure if CDD/EDD documentation is deficient, because a larger volume of financial activity is flowing through an account for which the Bank has insufficient understanding of the customer's identity, business purpose, expected transaction patterns, and source of funds. In the event that a high-volume account is involved in illicit financial activity, the potential regulatory, reputational, and financial consequences to BRB are commensurately greater.
This factor is particularly relevant to the NovaPay and FairLend account populations. NovaPay accounts are associated with $30.5 billion in aggregate CY 2024 transaction volume across 2.1 million end-user accounts, and the subset of NovaPay accounts within the 47,000 deficient population includes a disproportionate share of high-volume transactors. Similarly, FairLend accounts are associated with $1.4 billion in loan originations through BRB, and accounts with the largest individual loan balances or the most frequent drawdown and repayment activity receive elevated priority.
D. Factor 3: BaaS Partner Risk Tier
The third factor in the composite risk score reflects the risk tier assigned to the BaaS partner through which the account was onboarded. BaaS partners are tiered based on the BaaS Partner BSA/AML Risk Assessment Template (a separate deliverable), which evaluates each partner across multiple dimensions including transaction volume and complexity, product risk, geographic risk, regulatory history, and the maturity of the partner's own compliance infrastructure.
The current partner risk tiering is as follows:
Tier 1 (Highest Risk): NovaPay Technologies Inc. and FairLend Digital LLC. NovaPay is classified as Tier 1 due to its dominant share of BaaS transaction volume ($30.5 billion in CY 2024), its history of OFAC screening gaps (approximately 3,800,000 unscreened transactions identified in CY 2023, as cited in the November 2023 MRIA), the scale of its end-user account base (2.1 million accounts), and the complexity of its multi-product platform. FairLend Digital is classified as Tier 1 due to the complexity and regulatory sensitivity of its lending products, the volume of originations through BRB ($1.4 billion in FY 2024), and the inherent beneficial ownership identification challenges associated with business entity borrowers.
Tier 2 (Elevated Risk): VaultEdge Inc. VaultEdge is classified as Tier 2 due to its significant deposit account volume (870,000 accounts), its relatively recent onboarding in 2023 (which means its compliance infrastructure has had less time to mature), and certain systemic onboarding deficiencies identified during the OCC examination.
Tier 3 (Standard Enhanced Monitoring): The remaining 11 BaaS partners. These partners individually represent smaller shares of BaaS volume and have not been the subject of specific OCC findings, but their accounts are nonetheless classified as high-risk and require remediation.
Non-BaaS accounts are scored separately under Factors 1 and 2 and are not assigned a BaaS partner risk tier. However, these accounts retain elevated priority where their inherent customer risk score and transaction volume warrant, ensuring that the prioritization framework does not inadvertently deprioritize high-risk direct customers.
E. Composite Scoring and Prioritization Tiers
The three factors described above are combined using a weighted scoring algorithm to produce a composite risk score for each account. The specific weighting and scoring methodology are detailed in Appendix B (Composite Risk Scoring Matrix — Weighting Factors and Tier Definitions). Based on the composite score, each account is assigned to one of four prioritization tiers:
Priority A (Immediate — Target: remediated by May 31, 2025): Approximately 12,000 accounts. These are the accounts with the highest composite risk scores, predominantly consisting of NovaPay and FairLend accounts classified as Category 4 (multiple overlapping deficiencies) and Category 1 (missing beneficial ownership) with the highest individual transaction volumes. This tier also includes accounts associated with PEPs, MSBs, and customers with prior suspicious activity indicators, regardless of BaaS partner. Priority A accounts present the most acute BSA/AML risk to the Bank and will be remediated first to achieve maximum early risk reduction.
Priority B (Accelerated — Target: remediated by July 15, 2025): Approximately 11,500 accounts. This tier encompasses the remaining NovaPay, FairLend, and VaultEdge accounts with elevated composite scores, sufficient to reach the 23,500-account (50%) milestone by July 15, 2025 when combined with the 12,000 Priority A accounts. The combined remediation of Priority A and Priority B accounts ensures that the Bank meets its first Consent Order milestone on schedule while maintaining a rigorous risk-based sequencing approach.
Priority C (Standard — Target: remediated by October 31, 2025): Approximately 13,500 accounts. This tier includes lower composite-score BaaS-onboarded accounts and the majority of non-BaaS high-risk accounts. While these accounts present comparatively lower individual risk within the deficient population, they nonetheless require full remediation to meet the 100% completion milestone. The remediation of Priority C accounts proceeds at a sustainable run rate following the achievement of the 50% milestone.
Priority D (Completion — Target: remediated by January 15, 2026): Approximately 10,000 accounts. This tier encompasses the lowest composite-score accounts within the deficient population, requiring standard remediation effort. This tier also includes any accounts that are returned from quality review for correction, accounts affected by delayed customer response during outreach, and any accounts that may be added to the population as a result of Thornfield's gap assessment or subsequent identification of additional deficiencies. Completion of the Priority D tier achieves the 100% milestone and positions BRB to submit its compliance self-certification by February 15, 2026.
VI. Remediation Methodology
A. Overview of Remediation Process
Each of the 47,000 accounts in the deficient population will undergo a structured, five-step remediation workflow designed to ensure completeness, consistency, and auditability. The five steps are: (1) file review and gap identification, (2) customer outreach and documentation collection, (3) risk re-rating and EDD preparation, (4) quality review, and (5) completion sign-off and system documentation. The following subsections describe each step in detail.
This remediation process has been designed to accommodate the full range of deficiency types identified in Section IV.C, including accounts with multiple overlapping deficiencies (Category 4). For Category 4 accounts, all applicable steps are performed for each identified deficiency, ensuring that no gap is left unaddressed. The process is also designed to generate a complete, auditable record of every remediation action taken, which will be essential for Thornfield Consulting Group's validation, Caldera & Pope's independent testing, and the OCC's supervisory review.
B. Step 1: File Review and Gap Identification
For each account assigned for remediation, the designated analyst — whether a BRB permanent BSA/AML staff member or a temporary analyst deployed by Pinnacle Compliance Solutions LLC — will conduct a thorough review of the existing customer file. The file review encompasses all available documentation in BRB's customer information system, including account opening documentation, identification verification records, beneficial ownership certifications, risk rating worksheets, EDD narratives (if any), prior periodic review documentation (if any), transaction monitoring alert disposition records, and any prior correspondence with the customer or the BaaS partner.
The analyst will evaluate the existing file against the requirements of BRB's revised CDD/EDD policy (currently being drafted as a Workstream 5 deliverable; pending finalization, the existing policy supplemented by the OCC examination findings and FinCEN guidance will serve as the reference standard). A standardized Gap Identification Checklist will be used for each account to document the specific missing or deficient elements. The checklist will address, at a minimum, the following areas:
(a) Beneficial ownership identification and verification (for entity accounts);
(b) Customer identification program ("CIP") documentation completeness;
(c) Source of funds and source of wealth documentation;
(d) Customer risk rating and supporting rationale;
(e) EDD narrative and enhanced investigation documentation (where applicable);
(f) Periodic review documentation and compliance with review schedule;
(g) Ongoing monitoring records, including transaction monitoring alert dispositions and negative news screening;
(h) Any other deficiencies identified during the review.
The completed Gap Identification Checklist for each account will constitute the initial remediation work paper and will be retained as part of the auditable remediation record. A template of the Gap Identification Checklist is attached as Appendix C.
The expected average time per account for the file review and gap identification step is 30–45 minutes. This estimate reflects the average across all deficiency categories; Category 4 accounts with multiple overlapping deficiencies may require up to 60 minutes for thorough file review, while simpler Category 3 accounts (periodic review gap only) may be completed in 20–30 minutes.
C. Step 2: Customer Outreach and Documentation Collection
Following the identification of specific documentation gaps, BRB and its BaaS partners will issue requests for updated information to affected customers. The outreach process is a critical component of the remediation workflow, as many deficiencies — particularly missing beneficial ownership information, outdated identification documentation, and incomplete source of funds/wealth information — cannot be remediated without obtaining updated information directly from the customer.
For BaaS-onboarded accounts, customer outreach will be coordinated through the relevant fintech partner (NovaPay Technologies, FairLend Digital, VaultEdge, or the applicable smaller partner) in accordance with the BaaS Partner CDD/EDD Responsibility Matrix. Under this framework, the fintech partner is responsible for the customer-facing communication and data collection, while BRB retains oversight responsibility and must validate the sufficiency of the collected documentation. This approach leverages the fintech partner's existing customer relationship and communication channels, which are likely to achieve higher response rates than direct outreach from BRB to end-users who may have no awareness of their relationship with the underlying bank.
Compliance remediation letters have been issued, or are in the process of being issued, to the major BaaS partners demanding enhanced cooperation and data sharing in support of the remediation effort. Specifically:
• A compliance remediation letter was issued to NovaPay Technologies Inc. (attention: CEO Ethan Garrison) on February 28, 2025, demanding (a) facilitation of customer outreach for document collection across the approximately 19,200 affected NovaPay accounts, (b) sharing of all available KYC/CDD data currently held by NovaPay, (c) full cooperation with BRB's remediation timeline and information requests, and (d) implementation of enhanced onboarding controls going forward to prevent recurrence of CDD/EDD gaps.
• A parallel compliance remediation letter was issued to FairLend Digital LLC (attention: CEO Aisha Okonkwo) on March 3, 2025, with substantially similar demands tailored to FairLend's approximately 11,300 affected accounts and the specific beneficial ownership challenges associated with FairLend's small-business lending platform.
• A compliance remediation letter to VaultEdge Inc. (attention: CEO Marcus Tan) is being finalized and will be issued by March 31, 2025.
• Standardized remediation cooperation requests to the remaining 11 BaaS partners will be issued on a rolling basis, also by March 31, 2025.
For non-BaaS direct customer accounts (approximately 2,900 accounts), BRB will conduct outreach directly through its existing relationship management and operations channels.
The customer response timeline for all outreach is structured as follows:
• Initial outreach: Remediation notice issued with a 30-day response window.
• Second notice: Issued at day 30 if no response is received, reiterating the documentation request and notifying the customer that failure to respond may result in account restrictions.
• Final notice: Issued at day 60 with a formal account restriction warning, advising the customer that the account will be restricted or closed if the requested documentation is not provided within an additional 30 days.
• Escalation for non-response: For customers who remain non-responsive after 90 days from the initial outreach, the account will be escalated for restriction or closure in accordance with BRB's revised CDD/EDD policy, subject to legal review by Calderwood & Harkness and SAR filing consideration (as the non-response itself, combined with the account's high-risk profile, may constitute an indicator of suspicious activity warranting further investigation).
Templates for the First Notice, Second Notice, and Final Notice letters are attached as Appendix D.
D. Step 3: Risk Re-Rating and EDD Preparation
Upon receipt of updated documentation from the customer (or, in certain cases, from independent sources such as beneficial ownership databases, public records, or negative news screening services), each account's risk rating will be re-evaluated and documented.
The risk re-rating process involves a comprehensive reassessment of the customer's risk profile based on all available information, including the newly obtained documentation. The analyst will apply BRB's revised customer risk rating methodology (which is being enhanced under Workstream 5 to incorporate lessons learned from the OCC examination) to assign an updated risk tier and document the rationale for the assigned rating, including the specific factors considered and any mitigating or aggravating circumstances.
For accounts requiring EDD — including, but not limited to, accounts involving PEPs, high-cash-volume businesses, foreign nationals, MSBs, customers domiciled in or transacting with high-risk jurisdictions, and customers whose transaction patterns or business activities present elevated money laundering or terrorist financing risk — a full EDD narrative will be prepared. The EDD narrative will document:
(a) The enhanced investigation conducted, including the sources consulted and the information obtained;
(b) A source of funds analysis, documenting the origin of funds flowing into the account and evaluating the plausibility of the stated source against observed transaction patterns;
(c) A source of wealth analysis, documenting the customer's overall wealth and the means by which it was accumulated, where applicable;
(d) An assessment of the customer's risk profile in light of the enhanced investigation;
(e) Risk mitigation measures applied to the account, such as enhanced transaction monitoring thresholds, periodic review frequency, or account-level restrictions; and
(f) The analyst's recommendation and the supervisor's concurrence regarding continued account maintenance, subject to the identified mitigation measures.
The expected average time per account for the risk re-rating and EDD preparation step is 45–90 minutes, depending on the complexity of the account and the deficiency category. Category 1 accounts requiring only beneficial ownership documentation updates may be completed at the lower end of this range, while Category 2 accounts requiring full EDD narratives for complex high-risk customers and Category 4 accounts with multiple overlapping deficiencies may require 90 minutes or more.
E. Step 4: Quality Review
All remediated account files will undergo quality review by a senior BSA/AML analyst or supervisor to ensure that the remediation meets the required standards of completeness, accuracy, and policy compliance. The quality review is an essential control point in the remediation workflow, providing assurance that the high volume of remediation activity does not compromise the quality of individual account files.
Quality review sampling rates are calibrated to the risk tier of the accounts being remediated:
• Priority A accounts: 100% quality review. Every Priority A account file will be reviewed by a senior analyst or supervisor. This intensive review rate reflects the elevated risk profile of Priority A accounts and the importance of establishing a high standard of quality from the outset of the remediation effort.
• Priority B accounts: Minimum 50% quality review. At least half of all Priority B account files will undergo quality review. The specific accounts selected for review will be chosen using a combination of random sampling and risk-based selection (targeting the most complex accounts within the Priority B tier).
• Priority C and Priority D accounts: Minimum 25% quality review. At least one-quarter of all Priority C and Priority D account files will undergo quality review, again using a combination of random and risk-based selection.
Quality review criteria encompass the following dimensions:
(a) Completeness of documentation — all required CDD/EDD elements are present;
(b) Accuracy of risk rating — the assigned risk tier is consistent with the available customer profile data and is supported by adequate documentation;
(c) Adequacy of EDD narrative — for accounts requiring EDD, the narrative is thorough, well-sourced, and addresses all required elements;
(d) Proper system entries — all remediation actions have been correctly recorded in BRB's customer information system; and
(e) Compliance with revised CDD/EDD policy — the remediation file conforms to the requirements of BRB's revised policy.
Account files that fail quality review will be returned to the assigned analyst for correction, and the corrective action taken will be documented as part of the remediation record. Accounts returned from quality review will be tracked and counted against phase completion targets only upon successful re-review.
F. Step 5: Completion Sign-Off and System Documentation
Upon successful completion of all applicable remediation steps and passage of quality review, each account will be signed off by the responsible supervisor. The sign-off constitutes a formal attestation that the account's CDD/EDD documentation meets the required standards and that all identified deficiencies have been addressed.
The completion will be documented in BRB's customer information system with the following auditable elements:
• A remediation completion flag, clearly marking the account as having been remediated under Workstream 3;
• A date stamp recording the date of completion sign-off;
• The analyst identifier, recording the identity of the analyst who performed the remediation;
• The supervisor identifier, recording the identity of the supervisor who approved the completion; and
• A reference to the underlying remediation work papers, including the Gap Identification Checklist, customer outreach records, updated documentation, risk re-rating worksheet, and EDD narrative (where applicable).
Monthly remediation completion reports will be generated from BRB's customer information system and distributed to the Compliance Committee (James Rutherford, Chair), BRB senior management (including CEO Diane Whitford, COO Raymond Okoye, and CRO Melissa Chu), and Calderwood & Harkness. These reports will provide the data foundation for the internal and external reporting described in Section XI.
VII. Phased Timeline and Milestones
A. Phase 1: Preparation and Mobilization (February 10 – March 31, 2025)
Phase 1 encompasses the foundational activities necessary to launch the CDD/EDD remediation effort at scale. This phase is currently underway and includes the following key activities:
1. Finalize remediation methodology. This memorandum constitutes the primary deliverable for this activity. Upon review and approval by BRB management and Calderwood & Harkness, the methodology will be submitted to Thornfield Consulting Group for independent review.
2. Complete account population validation and segmentation. Thomas Ikeda's team is completing the cross-referencing exercise described in Section IV.A to validate the 47,000-account population and finalize the segmentation by BaaS partner and deficiency type. This work is expected to be substantially complete by March 20, 2025.
3. Deploy Pinnacle Compliance Solutions LLC temporary staff. Pinnacle Compliance Solutions LLC (SOW Reference: PCS-BRB-2025-0012; contract value: $3,600,000 for 12 months at $300,000/month; key contact: Andrea Solis, Director of Managed Services) will provide 30 FTE temporary analysts, of whom approximately 15 will be dedicated to CDD/EDD remediation (the remainder supporting SAR backlog clearance under Workstream 2). The initial tranche of Pinnacle analysts began onboarding on March 3, 2025, with full deployment expected by mid-March 2025. Pinnacle analysts will be embedded within BRB's BSA/AML department and will operate under BRB's supervision protocols per the Memorandum on Temporary Staff Supervision & Quality Control Protocols (separate deliverable).
4. Develop Gap Identification Checklist and standardized remediation templates. The standardized tools that will be used by all analysts (both BRB permanent staff and Pinnacle temporary staff) are being developed during Phase 1. The Gap Identification Checklist template is attached as Appendix C.
5. Issue compliance remediation letters to BaaS partners. As described in Section VI.C, compliance remediation letters have been issued to NovaPay Technologies and FairLend Digital, and letters to VaultEdge and the remaining BaaS partners will be issued by March 31, 2025.
6. Coordinate with Thornfield Consulting Group. Thornfield's on-site assessment commenced March 1, 2025, under the direction of Dr. Vivian Castellano. Calderwood & Harkness recommends providing Thornfield with a copy of this memorandum for review as part of Thornfield's preliminary gap assessment (due April 15, 2025), subject to the privilege protections afforded by the Privilege & Confidentiality Side Letter.
B. Phase 2: Priority A Remediation (April 1 – May 31, 2025)
Phase 2 marks the commencement of active account remediation, focusing on the approximately 12,000 highest-priority accounts in the Priority A tier. These accounts are predominantly NovaPay and FairLend accounts classified as Category 4 (multiple overlapping deficiencies) and Category 1 (missing beneficial ownership) with the highest individual transaction volumes and customer risk scores.
The target run rate during Phase 2 is approximately 6,000 accounts per month, or approximately 200 accounts per business day. This run rate is calculated based on the combined capacity of the BRB permanent staff members dedicated to CDD/EDD remediation (approximately 15–20 FTEs partially allocated) and the Pinnacle temporary analysts (approximately 15 FTEs dedicated to CDD/EDD). The run rate accounts for the varying time requirements per account across deficiency categories and includes time for quality review.
Phase 2 will also serve as a proving ground for the remediation methodology, allowing for identification and correction of any process inefficiencies, template gaps, or BaaS partner coordination challenges before the higher-volume Phase 3 begins. Weekly run rate and quality metrics will be closely monitored during Phase 2, and any necessary adjustments to the methodology will be implemented before Phase 3 launch.
C. Phase 3: Priority B Remediation (June 1 – July 15, 2025)
Phase 3 encompasses the remediation of approximately 11,500 additional accounts in the Priority B tier, bringing the cumulative total to 23,500 accounts (50% of the total population) by the July 15, 2025 Consent Order milestone. This tier includes the remaining NovaPay, FairLend, and VaultEdge accounts with elevated composite risk scores.
Phase 3 requires an accelerated run rate of approximately 7,700 accounts over a 6.5-week period (approximately 33 business days), equating to approximately 240 accounts per business day. This acceleration is achievable because: (a) the remediation team will have completed Phase 2 and will be operating at peak efficiency; (b) the new permanent FTE hires targeted for Q2 2025 onboarding will begin contributing to capacity; and (c) Priority B accounts are, on average, somewhat less complex than Priority A accounts (fewer Category 4 multi-deficiency accounts), allowing for faster per-account processing.
Milestone: 23,500 accounts (50%) remediated by July 15, 2025. Achievement of this milestone will be reported in the first quarterly progress report to the OCC (due September 15, 2025) and will be subject to validation by Thornfield Consulting Group.
D. Phase 4: Priority C Remediation (July 16 – October 31, 2025)
Phase 4 addresses the approximately 13,500 Priority C accounts, which include lower composite-score BaaS-onboarded accounts and the majority of the non-BaaS high-risk accounts. This phase proceeds at a standard run rate of approximately 3,850 accounts per month over a 3.5-month period.
The reduced run rate relative to Phase 3 reflects several factors: (a) the reallocation of some Pinnacle and BRB resources to support other concurrent workstreams, particularly the Veridian TMS v.10.0 UAT deployment (Workstream 4, target August 1, 2025); (b) anticipated increases in customer non-response escalations, which consume additional analyst time for account restriction/closure processing and potential SAR referrals; and (c) the deliberate pacing of later-phase remediation to maintain quality standards and avoid analyst fatigue.
E. Phase 5: Priority D Completion (November 1, 2025 – January 15, 2026)
Phase 5 is the final phase of the remediation effort, addressing the approximately 10,000 remaining Priority D accounts at a run rate of approximately 4,000 accounts per month over a 2.5-month period. This phase also encompasses the resolution of any accounts returned from quality review during earlier phases, non-responsive customer escalations that have reached the 90-day threshold, and any additional accounts identified through Thornfield's gap assessment or subsequent verification.
The Priority D tier includes the lowest composite-score accounts within the deficient population, which generally require the most straightforward remediation effort. However, this phase may also include some of the most challenging accounts from earlier phases that were deferred due to customer non-response or BaaS partner data delays, requiring close management and escalation as needed.
Milestone: 47,000 accounts (100%) remediated by January 15, 2026. Achievement of this milestone will be reported in the second quarterly progress report to the OCC (due December 15, 2025, with a final update to follow) and will be subject to Thornfield Consulting Group's final validation report (due February 15, 2026).
F. Coordination with Other Consent Order Milestones
The CDD/EDD remediation timeline has been designed to complement and ali