1045-00002 · Calderwood & Harkness LLP · documents

compliance-committee-charter-draft.docx DOCUMENT Antitrust

14 / 84 ← → ✕

Contract analysis Extract to table

COMPLIANCE COMMITTEE CHARTER OF THE BOARD OF DIRECTORS OF BELMONT RIDGE FINANCIAL GROUP, INC.

DRAFT — Prepared by Calderwood & Harkness LLP for Adoption by the Board of Directors

C&H Matter No. 1045-00002

PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION

Draft Date: February \\\_, 2025 (For adoption no later than February 28, 2025)

Adopted pursuant to OCC Consent Order No. OCC-2025-003, dated January 15, 2025

Right-click to update Table of Contents

ARTICLE I — PURPOSE

Section 1.1 — Establishment. The Board of Directors (the "Board") of Belmont Ridge Financial Group, Inc. ("BRFG"), a corporation organized under the laws of the State of Delaware and registered as a bank holding company under the Bank Holding Company Act of 1956, as amended, hereby establishes the Compliance Committee (the "Committee") as a standing committee of the Board. The Committee is established effective upon the date of adoption of this Charter (the "Effective Date") and shall operate in accordance with the terms, responsibilities, authority, and procedures set forth herein.

Section 1.2 — Oversight Scope. The Committee is established to provide dedicated, focused Board-level oversight of the compliance programs of BRFG and its principal banking subsidiary, Belmont Ridge Bank National Association ("BRB"), a national banking association chartered under the laws of the United States (OCC Charter No. 48271; FDIC Certificate No. 31845), headquartered at 680 Lexington Avenue, 22nd Floor, New York, New York 10022. The Committee's oversight scope encompasses, but is not limited to, all compliance functions, programs, policies, procedures, and systems operated by or on behalf of BRFG and BRB, with a primary emphasis on the areas described in Sections 1.3 and 1.4 below.

Section 1.3 — Primary Purpose. The primary purpose of the Committee is to oversee and monitor BRB's Bank Secrecy Act / Anti-Money Laundering ("BSA/AML") compliance program, its Office of Foreign Assets Control ("OFAC") sanctions compliance program, and all related regulatory compliance functions, including but not limited to Customer Due Diligence ("CDD"), Enhanced Due Diligence ("EDD"), Suspicious Activity Report ("SAR") filing processes, Currency Transaction Report ("CTR") filing processes, transaction monitoring, sanctions screening and interdiction, beneficial ownership identification and verification, compliance risk assessment, and the development and maintenance of written policies and procedures governing the foregoing. The Committee is further charged with ensuring that BRB maintains compliance with all applicable provisions of the Bank Secrecy Act (31 U.S.C. § 5311 et seq.), its implementing regulations (31 C.F.R. Chapter X), the USA PATRIOT Act (Pub. L. 107-56), Executive Order 13224, the International Emergency Economic Powers Act ("IEEPA"), and all related federal and state laws, regulations, and regulatory guidance.

Section 1.4 — Consent Order Mandate. The Committee is established with the specific mandate to oversee the comprehensive BSA/AML and sanctions compliance-program uplift required by Consent Order No. OCC-2025-003 (the "Consent Order"), issued by the Office of the Comptroller of the Currency ("OCC") on January 15, 2025, against Belmont Ridge Bank National Association. The Committee's Consent Order oversight responsibilities include, but are not limited to:

(a) overseeing the remediation of all deficiency findings identified in the Consent Order, including deficiencies relating to (i) Board-level governance and oversight, (ii) BSA/AML risk assessment methodology and execution, (iii) transaction monitoring system adequacy and model validation, (iv) SAR filing timeliness, quality, and completeness, and (v) OFAC sanctions screening coverage and interdiction processes;

(b) overseeing the engagement and work product of the OCC-mandated independent consultant, including review and assessment of all consultant deliverables;

(c) monitoring and ensuring satisfaction of all Consent Order deadlines, including interim milestones and the final compliance program implementation deadline of February 15, 2026;

(d) reviewing and approving (or recommending to the full Board for approval, as appropriate) all submissions to the OCC required by the Consent Order, including the Comprehensive Remediation Action Plan, quarterly progress reports, and the compliance self-certification; and

(e) coordinating with outside counsel, management, and the independent consultant to ensure that all aspects of the remediation program are designed, implemented, and sustained in a manner that satisfies the terms and spirit of the Consent Order and applicable law.

Section 1.5 — Board-Level Oversight Deficiencies. The Committee is established in direct response to the Consent Order's identification of board-level oversight deficiencies as one of five core deficiency categories. Specifically, the Consent Order found that BRFG's Board of Directors had failed to provide adequate oversight of BRB's BSA/AML and OFAC compliance programs, including insufficient frequency and depth of Board-level compliance reporting, a lack of a dedicated compliance committee or equivalent governance structure, and inadequate Board-level monitoring of the performance of the BSA Officer and the Chief Compliance Officer. The establishment of this Committee, with the authority, composition, responsibilities, and reporting obligations described herein, is intended to remediate these identified board-level governance deficiencies in their entirety.

Section 1.6 — Board Resolution. The Board Resolution acknowledging the Consent Order and authorizing the establishment of this Committee was adopted on or before February 28, 2025, which date is forty-five (45) calendar days from the January 15, 2025 effective date of the Consent Order, as required by Article III, Section 2 thereof. This Charter memorializes the terms of the Committee's establishment as authorized by said Board Resolution.

ARTICLE II — COMPOSITION

Section 2.1 — Number of Members. The Committee shall consist of no fewer than three (3) members of the Board of Directors of BRFG (each, a "Committee Member" and collectively, "Committee Members"), each of whom shall be an independent director as defined under the applicable listing standards of the New York Stock Exchange ("NYSE"), as set forth in Section 303A of the NYSE Listed Company Manual, and as further defined in BRFG's Corporate Governance Guidelines, as amended from time to time. No individual who fails to satisfy the independence requirements of the NYSE listing standards and BRFG's Corporate Governance Guidelines shall be eligible to serve as a member of the Committee.

The initial members of the Committee shall be the following independent directors of the Board:

(a) James Rutherford (Chair);

(b) Sandra Villarreal; and

Each of the foregoing initial Committee Members has been determined by the Board to be independent under the applicable NYSE listing standards and BRFG's Corporate Governance Guidelines. The Board may, from time to time, increase the number of Committee Members beyond three, provided that all Committee Members satisfy the independence and qualification requirements set forth in this Article II.

Section 2.2 — Chair. James Rutherford shall serve as the initial Chair of the Committee (the "Chair"). The Chair shall be responsible for:

(a) setting the agenda for each meeting of the Committee, in consultation with other Committee Members, the Chief Compliance Officer, outside counsel, and the independent consultant as appropriate;

(b) presiding over all meetings of the Committee, including calling meetings to order, managing the conduct of business, and ensuring that all agenda items receive adequate consideration;

(c) serving as the primary liaison between the Committee, on the one hand, and management, outside counsel (including Calderwood & Harkness LLP), and the independent consultant (Thornfield Consulting Group LLC), on the other hand;

(d) reporting to the full Board following each Committee meeting in accordance with Article VI of this Charter;

(e) coordinating with the chairs of the Audit Committee and the Risk Committee on matters of overlapping jurisdiction; and

(f) performing such other duties as may be assigned to the Chair by the Committee or the Board.

In the event of the Chair's absence, temporary incapacity, or recusal from a particular matter, the Committee Members present at the relevant meeting shall designate an acting Chair from among themselves for purposes of that meeting.

Section 2.3 — Qualifications. In addition to the independence requirements set forth in Section 2.1, the following qualification requirements shall apply to Committee Members:

(a) Subject-Matter Expertise. At least one (1) member of the Committee shall have professional experience or demonstrated expertise in one or more of the following areas: banking regulation, financial crimes compliance, BSA/AML compliance, OFAC sanctions compliance, anti-money laundering program design or auditing, regulatory enforcement matters, or a closely related field. As of the Effective Date, the Board has determined that James Rutherford satisfies this requirement based on his prior service as a senior executive at a federally regulated financial institution and his extensive experience with BSA/AML regulatory matters.

(b) Time Commitment. All Committee Members shall be willing and able to devote the time and attention necessary to satisfy the Committee's responsibilities as described in this Charter, including attendance at monthly meetings during the Consent Order remediation period (January 15, 2025 through February 15, 2026), attendance at quarterly meetings thereafter, and such additional time as may be required for review of materials, engagement with management and advisors, and participation in special or emergency meetings.

(c) Independence from Management. No individual who simultaneously serves as an officer or employee of BRFG, BRB, or any subsidiary or affiliate of BRFG shall be eligible to serve as a Committee Member. Committee Members shall be non-management directors only. This requirement is in addition to, and not in lieu of, the independence requirements set forth in Section 2.1.

Section 2.4 — Appointment and Term. Committee Members shall be appointed by the Board upon the recommendation of the Nominating and Governance Committee of the Board, or, in the absence of a recommendation from the Nominating and Governance Committee, by action of the Board as a whole. Each Committee Member shall serve until the earliest to occur of: (a) the appointment and qualification of such member's successor; (b) such member's voluntary resignation from the Committee; (c) such member's removal from the Committee by the Board; or (d) such member's cessation of service as a director of BRFG for any reason. The Board shall review the composition and membership of the Committee at least annually, and more frequently as circumstances may warrant, to ensure that the Committee's composition continues to satisfy the requirements of this Charter, the Consent Order, and applicable law.

Section 2.5 — Vacancies. Any vacancy occurring on the Committee, whether by reason of resignation, removal, death, incapacity, or otherwise, shall be filled by the Board in accordance with the procedures set forth in Section 2.4. Pending the filling of any such vacancy, the remaining Committee Members shall have the authority to continue to exercise all powers and perform all duties of the Committee, provided that a quorum (as defined in Section 5.2) exists. In the event that the number of Committee Members falls below the minimum of three (3), the Board shall take prompt action to fill the vacancy, and in no event shall the Committee operate with fewer than the minimum number of members for a period exceeding thirty (30) calendar days, unless otherwise approved by the full Board.

ARTICLE III — AUTHORITY

Section 3.1 — General Authority. The Committee shall have the full authority to oversee, review, evaluate, and make recommendations to the full Board regarding all matters relating to BRB's BSA/AML compliance program, OFAC sanctions compliance program, and regulatory compliance programs as described in this Charter. Without limiting the generality of the foregoing, the Committee shall have the authority to:

(a) direct management of BRFG and BRB to take corrective actions to address identified compliance deficiencies, including but not limited to requiring changes to policies, procedures, systems, controls, staffing levels, organizational structures, and reporting lines;

(b) make recommendations to the full Board regarding compliance-related budgets, resource allocations, capital expenditures, and staffing levels, including recommendations regarding the adequacy of funding for the remediation program;

(c) require management to provide timely, accurate, and complete information regarding all matters within the Committee's oversight scope;

(d) establish subcommittees or working groups, comprised of Committee Members and such other persons as the Committee deems appropriate, to address specific issues or workstreams within the Committee's scope;

(e) adopt such rules and procedures for the conduct of its activities as it deems appropriate, consistent with this Charter, BRFG's Bylaws, and applicable law; and

(f) take such other actions as the Committee deems necessary or advisable to fulfill its responsibilities under this Charter and the Consent Order.

Section 3.2 — Access to Information and Personnel. The Committee shall have full, unrestricted, and unfettered access to all books, records, documents, data, systems, facilities, and personnel of BRFG, BRB, and their subsidiaries and affiliates as the Committee deems relevant to the discharge of its responsibilities. All officers and employees of BRFG and BRB shall cooperate fully and promptly with the Committee and its advisors in connection with any inquiry, investigation, review, or request for information made by or at the direction of the Committee.

The Committee's key management contacts shall include, but not be limited to, the following individuals:

(a) Patricia Langston, Chief Compliance Officer ("CCO");

(b) Thomas Ikeda, BSA Officer / AML Program Director;

(d) Warren Ashby, Head of Fintech Partnerships / Banking-as-a-Service ("BaaS") Division;

(e) Linda Petrosian, Chief Information Officer / Chief Technology Officer ("CIO/CTO");

(f) Derek Ballard, Head of Internal Audit; and

(g) Gregory Nardone, General Counsel & Corporate Secretary.

Each of the foregoing individuals shall be available to the Committee and its Chair at all reasonable times and shall provide such information, reports, analyses, and other materials as the Committee may request. The Committee may also require presentations from, or access to, any other officer, employee, or agent of BRFG or BRB, including without limitation personnel in the compliance, operations, technology, risk management, legal, internal audit, finance, and business line functions.

Section 3.3 — Authority to Engage Advisors. The Committee shall have the sole and exclusive authority to retain, compensate, oversee, evaluate, and terminate outside legal counsel, compliance consultants, forensic accountants, technology advisors, and other advisors as the Committee deems necessary or advisable to fulfill its responsibilities under this Charter and the Consent Order. The Committee's authority to engage advisors is independent of, and in addition to, management's authority to engage advisors in the ordinary course of business, and shall not require the prior approval of the full Board or any other committee of the Board, except as may be required by BRFG's Bylaws or applicable law.

As of the Effective Date, the Committee is authorized to oversee the following engagements:

(a) Calderwood & Harkness LLP — Outside regulatory counsel. Engagement opened February 10, 2025. Responsible partner: Philip Hartmann. Estimated total fees of Eight Million Dollars ($8,000,000) across Phase 1 (Consent Order response, preliminary remediation planning, and regulatory engagement; estimated fees of $3,200,000) and Phase 2 (remediation implementation, ongoing regulatory engagement, and compliance self-certification; estimated fees of $4,800,000). Calderwood & Harkness LLP has been engaged to provide legal advice and representation to BRFG and BRB in connection with the Consent Order, the remediation program, regulatory communications, and related matters.

(b) Thornfield Consulting Group LLC — OCC-mandated independent consultant. Engagement reference: TCG-BRB-2025-001. OCC non-objection received February 5, 2025. Engagement agreement executed February 10, 2025. Fixed fee of Six Million Five Hundred Thousand Dollars ($6,500,000) plus expenses capped at Four Hundred Thousand Dollars ($400,000), for a total not-to-exceed engagement cost of Six Million Nine Hundred Thousand Dollars ($6,900,000). Engagement lead: Dr. Vivian Castellano. The engagement of Thornfield Consulting Group LLC is required by Article V of the Consent Order, which mandates the retention of a qualified independent consultant, acceptable to the OCC, to conduct a comprehensive gap assessment of BRB's BSA/AML and OFAC compliance programs and to validate the effectiveness of BRB's remediation efforts upon completion.

BRFG shall provide appropriate and adequate funding for the activities of the Committee, including the compensation of any advisors engaged by the Committee, as determined by the Committee in its sole discretion. Neither BRFG nor BRB management shall deny, delay, or condition the funding of any Committee-approved engagement or expenditure.

Section 3.4 — Authority to Investigate. The Committee shall have the authority to conduct or authorize investigations into any matter within its scope of responsibilities, including but not limited to potential compliance violations, control failures, employee misconduct, vendor performance issues, and regulatory reporting deficiencies. The Committee may direct the engagement of outside advisors to assist in any such investigation. All officers, employees, and agents of BRFG and BRB shall cooperate fully with any investigation conducted by or at the direction of the Committee, and failure to cooperate shall be grounds for disciplinary action, up to and including termination of employment. The Committee shall report the findings and conclusions of any material investigation to the full Board and, where appropriate, to the relevant regulatory authorities.

Section 3.5 — Spending Authority. The Committee shall oversee the Board-approved remediation budget of Forty-Two Million Five Hundred Thousand Dollars ($42,500,000) (the "Remediation Budget"), which is exclusive of the Fourteen Million Five Hundred Thousand Dollars ($14,500,000) civil money penalty ("CMP") assessed under Article II of the Consent Order. The Remediation Budget encompasses the following estimated cost categories:

The total estimated financial outlay arising from the Consent Order, inclusive of the CMP, is Fifty-Seven Million Dollars ($57,000,000).

The Committee shall monitor expenditures against the Remediation Budget on at least a monthly basis and shall promptly report to the full Board any actual or projected material variances. Any reallocation of funds among Remediation Budget categories in excess of Five Hundred Thousand Dollars ($500,000) shall require the approval of the Committee. Any increase to the aggregate Remediation Budget shall require the approval of the full Board upon recommendation of the Committee.

ARTICLE IV — RESPONSIBILITIES AND DUTIES

The Committee shall have the following responsibilities and duties, in addition to such other responsibilities as may be delegated to the Committee by the Board from time to time. In performing its oversight role, the Committee recognizes that management is responsible for the day-to-day design, implementation, operation, and maintenance of BRB's compliance programs, and that the Committee's role is one of informed, active oversight rather than operational management. Notwithstanding the foregoing, the Committee's oversight responsibilities, particularly during the Consent Order remediation period, require a level of engagement, inquiry, and challenge that goes beyond routine board committee oversight.

Section 4.1 — BSA/AML Program Oversight. The Committee shall oversee the design, implementation, effectiveness, and continuous improvement of BRB's BSA/AML compliance program, including the following specific areas:

(a) Suspicious Activity Report (SAR) Filing. The Committee shall oversee the processes, timeliness, and quality of BRB's SAR filing practices. The Committee notes the following baseline metrics as of the Effective Date:

(i) Calendar Year 2024 SAR filings: 3,847 total SARs filed (an increase of 32.0% over the prior year);

(ii) Calendar Year 2023 SAR filings: 2,914 total SARs filed;

(iii) Current average filing time: approximately 78 calendar days from the date of initial alert generation to the date of FinCEN filing, which significantly exceeds the regulatory expectation of filing within 30 calendar days of the identification of suspicious activity warranting a report;

(iv) As of September 30, 2024, a backlog of approximately 2,400 unreviewed transaction monitoring alerts awaiting initial triage and investigation, representing a material backlog that was cited as a specific deficiency in the Consent Order.

The Committee shall monitor management's progress in reducing SAR filing timelines to within the 30-day expectation, clearing the alert backlog (targeted for completion by June 30, 2025), and enhancing SAR narrative quality in accordance with FinCEN guidance.

(b) Currency Transaction Report (CTR) Filing. The Committee shall monitor the accuracy, completeness, and timeliness of BRB's CTR filing processes. In Calendar Year 2024, BRB filed a total of 28,612 CTRs. The Committee shall review any identified deficiencies in CTR filing and ensure corrective action is taken.

(c) Transaction Monitoring System Performance. The Committee shall oversee the performance, adequacy, and remediation of BRB's transaction monitoring system, including the Veridian Transaction Monitoring System ("Veridian TMS"), currently operating on version 8.3, with an upgrade to version 10.0 planned, with User Acceptance Testing ("UAT") completion targeted by August 1, 2025, as further described in Section 4.6 of this Charter.

(d) Alert Volumes and SAR Conversion Rates. The Committee shall review transaction monitoring alert volumes and SAR conversion rates as key indicators of the effectiveness and calibration of BRB's monitoring models. In Calendar Year 2024, the Veridian TMS generated approximately 41,500 alerts, of which approximately 3,847 resulted in SAR filings, reflecting a SAR conversion rate of approximately 9.3%. The Committee shall evaluate whether alert volumes and conversion rates are reasonable in light of BRB's risk profile, product mix, and customer base, and shall oversee the recalibration of monitoring scenarios and thresholds as part of the remediation program.

(e) Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD) Programs. The Committee shall oversee the remediation of BRB's CDD and EDD programs, including the remediation of the approximately 47,000 high-risk customer accounts identified as having deficient or incomplete CDD/EDD documentation. The Consent Order identified BRB's failure to maintain adequate CDD/EDD records for a substantial population of high-risk accounts, including accounts associated with BaaS fintech partners, correspondent banking relationships, and privately held business entities, as a core deficiency. The Committee shall monitor progress against the remediation milestones of 50% completion (23,500 accounts) by July 15, 2025, and 100% completion (47,000 accounts) by January 15, 2026.

(f) BSA/AML Staffing. The Committee shall review BSA/AML staffing levels to ensure that adequate resources are in place to support BRB's compliance program. Current BSA/AML compliance staffing consists of 62 full-time equivalent employees ("FTEs"). The post-remediation target is 77 FTEs, representing an increase of 15 FTEs. During the remediation period, an additional 30 temporary FTEs from Pinnacle Compliance Solutions LLC ("Pinnacle") have been engaged to supplement permanent staff for alert review, SAR filing, and CDD/EDD remediation activities.

Section 4.2 — OFAC Sanctions Compliance Oversight. The Committee shall oversee the design, implementation, and effectiveness of BRB's OFAC sanctions screening and interdiction program across all business lines, including retail banking, commercial lending, wealth management, and all Banking-as-a-Service ("BaaS") channels. Specific responsibilities include:

(a) OFAC Screening Gap Remediation. The Committee shall monitor the remediation of the OFAC screening gap identified in the Consent Order, which found that BRB had failed to screen approximately 12% of NovaPay Technologies Inc. ("NovaPay") transaction flows through BRB's OFAC sanctions screening system. This gap affected approximately 3,800,000 of the approximately 31,700,000 total NovaPay transactions processed through BRB in Calendar Year 2023, primarily relating to certain peer-to-peer payment and stored-value transactions that were not routed through BRB's primary OFAC screening engine due to a systems integration failure in the NovaPay API gateway implementation.

(b) OFAC Screening Metrics. The Committee shall review OFAC screening metrics on a regular basis, including:

(i) Hit rates: In Calendar Year 2024, BRB's OFAC screening systems generated 14,320 initial hits across all business lines;

(ii) True match rates: Of the 14,320 initial hits, 12 were determined to be true matches requiring interdiction or blocking action, representing a true-match rate of approximately 0.08%;

(iii) False-positive rate: Approximately 99.9% of initial hits were resolved as false positives, indicating the need for continued tuning and optimization of screening filters;

(iv) Interdiction and blocking actions taken in response to true matches; and

(v) Screening coverage rates across all BaaS partners and business lines.

(c) BaaS OFAC Screening Operationalization. The Committee shall oversee the November 1, 2025 deadline for full OFAC screening operationalization across all BaaS channels, as required by Article IV, Section 7 of the Consent Order. This deadline requires that all transactions processed through or on behalf of BRB by its BaaS partners, without exception, be subjected to real-time or near-real-time OFAC sanctions screening prior to settlement.

(d) OFAC Voluntary Self-Disclosure. The Committee shall monitor the assessment and resolution of any OFAC voluntary self-disclosure considerations arising from the NovaPay screening gap or any other identified OFAC compliance deficiency. The Committee shall coordinate with outside counsel (Calderwood & Harkness LLP) and the General Counsel regarding the advisability, timing, and content of any potential voluntary self-disclosure to OFAC.

Section 4.3 — Consent Order Compliance Monitoring. The Committee shall serve as the principal Board-level body responsible for monitoring compliance with all provisions, requirements, and deadlines of OCC Consent Order No. OCC-2025-003. The Committee shall maintain a comprehensive master timeline tracker of all Consent Order obligations and shall review progress against this timeline at each regularly scheduled meeting. The Consent Order's key milestones and deadlines include, but are not limited to, the following:

The Committee shall ensure that management develops and maintains detailed project plans for each milestone, that progress is tracked and reported at each Committee meeting, and that any actual or anticipated delays are promptly identified, escalated, and addressed. In the event that any milestone is at risk of delay, the Committee shall require management to present a remediation plan with a revised timeline and shall assess whether notification to the OCC is warranted.

Section 4.4 — Independent Consultant Oversight. The Committee shall oversee the engagement, work, deliverables, and findings of the OCC-mandated independent consultant, Thornfield Consulting Group LLC ("Thornfield"), in accordance with Article V of the Consent Order. Specific responsibilities include:

(a) Engagement Oversight. Thornfield was selected by BRFG and received OCC non-objection on February 5, 2025. The engagement agreement was executed on February 10, 2025, under engagement reference TCG-BRB-2025-001. The engagement lead is Dr. Vivian Castellano, a recognized expert in BSA/AML compliance with more than twenty years of experience in regulatory compliance consulting. The Thornfield engagement team also includes Robert Eastman (senior manager, transaction monitoring specialist), Jennifer Hwang (senior manager, CDD/EDD and OFAC specialist), and Nathaniel Burgess (senior associate, data analytics). Thornfield's on-site assessment commenced on March 1, 2025.

(b) Deliverable Review. The Committee shall review and assess Thornfield's preliminary gap assessment, which is due to the OCC by April 15, 2025, and Thornfield's final validation report, which is due by February 15, 2026. The Committee shall also review any interim reports, findings, or recommendations issued by Thornfield during the course of its engagement.

(c) Cooperation. The Committee shall ensure that BRFG and BRB provide full, timely, and unrestricted cooperation to Thornfield and its personnel in accordance with the Access & Cooperation Protocol executed between BRFG, BRB, and Thornfield as of the engagement date. The Committee shall receive reports from management regarding any disputes, impediments, or delays in Thornfield's access to information, personnel, or facilities, and shall take prompt action to resolve any such issues.

(d) Independence. The Committee shall monitor the independence of Thornfield throughout the engagement and shall promptly report to the Board and the OCC any circumstances that could compromise, or create an appearance of compromise of, Thornfield's independence or objectivity.

Section 4.5 — Fintech / BaaS Partner Compliance Oversight. The Committee shall oversee BRB's BSA/AML and OFAC compliance obligations as they relate to BRB's Banking-as-a-Service program. As of the Effective Date, BRB maintains 14 active BaaS fintech partnership arrangements through which BRB provides banking services, including deposit accounts, payment processing, lending, and card issuance, to the end-user customers of third-party fintech companies. Specific responsibilities include:

(a) Top Partner Monitoring. The Committee shall exercise particular oversight of BRB's compliance obligations in connection with its three largest BaaS partners by transaction volume:

(i) NovaPay Technologies Inc. — Representing approximately 41% of BaaS transaction volume; approximately $30.5 billion in transaction volume in Calendar Year 2024; approximately 2.1 million end-user accounts; Chief Executive Officer: Ethan Garrison. NovaPay was identified in the Consent Order in connection with the OFAC screening gap described in Section 4.2(a).

(ii) FairLend Digital LLC — Representing approximately 28% of BaaS transaction volume; approximately $1.4 billion in loan originations through BRB in Fiscal Year 2024; Chief Executive Officer: Aisha Okonkwo.

(iii) VaultEdge Inc. — Representing approximately 18% of BaaS transaction volume; approximately 870,000 deposit accounts; Chief Executive Officer: Marcus Tan.

(b) BaaS SAR Activity. The Committee shall monitor SAR activity associated with BaaS channels. In Calendar Year 2024, BRB filed 2,108 BaaS-related SARs, representing approximately 54.8% of BRB's total 3,847 SARs filed during that period. The disproportionate concentration of SAR activity in BaaS channels is a matter of significant regulatory concern and shall receive focused attention from the Committee.

(c) BaaS Volume and Revenue Context. The Committee shall evaluate BaaS-related compliance risks in the context of the scale of BRB's BaaS program. Total BaaS transaction volume was approximately $74.3 billion in Calendar Year 2024, and BaaS revenue was approximately $127.4 million in Calendar Year 2024. The Committee shall assess whether compliance resources, controls, and oversight mechanisms are commensurate with the volume, complexity, and risk profile of BaaS activities.

(d) BaaS Compliance Oversight Framework. The Committee shall review and approve (or recommend to the Board for approval) the BaaS Compliance Oversight Framework, including the methodology and criteria for conducting and updating BaaS partner risk assessments. The Committee shall also review individual BaaS partner risk assessments, particularly for high-risk partners, and shall monitor management's implementation of risk-based controls, enhanced monitoring, and contractual compliance requirements for each BaaS partnership.

Section 4.6 — Technology and Model Risk Oversight. The Committee shall oversee the technology and model risk dimensions of BRB's BSA/AML and OFAC compliance programs, including the following:

(a) Transaction Monitoring System Upgrade. The Committee shall oversee the upgrade of BRB's primary transaction monitoring system from Veridian TMS version 8.3 to version 10.0. The Veridian TMS is provided by Veridian Analytics Inc. under Contract No. VA-BRB-2023-0044. The estimated implementation cost of the upgrade is $2,800,000, with incremental annual licensing costs of $1,900,000, bringing the new annual contract value ("ACV") to approximately $6,000,000 per year. The upgrade to version 10.0 is a critical remediation deliverable and is required to be completed (through UAT) by August 1, 2025.

(b) Model Validation Deficiency. The Consent Order cited BRB's failure to conduct an independent validation of the Veridian TMS since March 2021 — a period of more than three years — as a specific deficiency. Additionally, the Consent Order noted that the last tuning of model parameters (scenarios, thresholds, and rules) was performed in October 2022. These failures were identified as contributing to the system's inability to generate timely and appropriate alerts, resulting in both under-detection of suspicious activity and excessive false-positive rates. The Committee shall ensure that these deficiencies are remediated through the system upgrade and subsequent model validation.

(c) Independent Model Validation. The Committee shall oversee the engagement and completion of an independent model validation of the upgraded Veridian TMS v.10.0, targeted for completion by October 1, 2025. The model validation shall be performed by a qualified independent party in accordance with OCC Bulletin 2011-12 (Supervisory Guidance on Model Risk Management) and any applicable OCC or FFIEC guidance.

(d) Contingency Vendor Evaluation. The Committee shall monitor the evaluation of Ridgeline Data Systems LLC as a contingency vendor alternative to the Veridian TMS. The proposed Ridgeline engagement would carry an ACV of approximately $7,200,000 on a five-year term, with an estimated total contract value of $36,000,000. The contingency evaluation is being conducted to ensure that BRB has a viable alternative in the event that the Veridian TMS upgrade encounters material delays or performance issues that cannot be resolved within the Consent Order timeline.

(e) Technology Implementation Coordination. The Committee shall coordinate with the CIO/CTO (Linda Petrosian) regarding technology implementation timelines, risks, resource requirements, and dependencies, and shall receive regular updates on the status of all technology-related remediation workstreams.

Section 4.7 — Regulatory Engagement Oversight. The Committee shall oversee BRB's engagement, communications, and relationship with its primary regulators in connection with BSA/AML and OFAC compliance matters. Specific responsibilities include:

(a) Office of the Comptroller of the Currency (OCC). The Committee shall oversee BRB's engagement and communications with the OCC, including the OCC's Northeastern District Office located at 340 Madison Avenue, New York, New York 10017. The OCC's Examiner-in-Charge assigned to BRB is Jonathan Frey. The Committee shall review all submissions to the OCC required by or in connection with the Consent Order, including the Comprehensive Remediation Action Plan (due May 15, 2025), quarterly progress reports (due September 15, 2025 and December 15, 2025), the compliance self-certification (due February 15, 2026), and any other written communications to the OCC regarding the remediation program or BRB's BSA/AML and OFAC compliance programs.

(b) Financial Crimes Enforcement Network (FinCEN). The Committee shall monitor BRB's engagement with the Financial Crimes Enforcement Network ("FinCEN"), noting that FinCEN is conducting parallel monitoring of BRB's SAR filing remediation and has reserved its independent enforcement rights. The FinCEN liaison for this matter is Angela Drummond, Associate Director, Enforcement Division. The Committee shall coordinate with outside counsel regarding the scope and nature of any communications with FinCEN and shall be promptly informed of any FinCEN inquiry, request for information, or enforcement-related communication.

(c) DOJ Criminal Referral Risk. The Committee shall monitor the risk of a potential referral by the OCC or FinCEN to the United States Department of Justice ("DOJ") for criminal investigation or prosecution. As of February 10, 2025, no criminal referral has been made. The Consent Order does not contain a non-prosecution agreement or declination and expressly does not preclude future criminal referral. The Committee shall coordinate with outside counsel regarding the assessment and management of DOJ referral risk and shall be promptly informed of any developments in this regard.

Section 4.8 — Compliance Staffing and Resources. The Committee shall review and assess the adequacy of BSA/AML and compliance staffing and resources on a regular basis. Specific responsibilities include:

(a) Permanent Headcount. The Committee shall monitor progress toward achieving the target BSA/AML compliance staffing level of 77 FTEs, an increase of 15 FTEs from the current level of 62 FTEs. The estimated fully loaded annual cost of the 15 new positions is approximately $2,250,000 (inclusive of salary, benefits, and overhead). The Committee shall review the qualifications, experience levels, and role allocations of new hires to ensure alignment with the remediation program's requirements.

(b) Temporary Staffing. The Committee shall monitor the performance and utilization of the 30 temporary FTEs engaged from Pinnacle Compliance Solutions LLC at an estimated cost of $3,600,000 for a twelve-month engagement period. The Committee shall assess whether the temporary staffing level is adequate to support the SAR backlog clearance, CDD/EDD remediation, and other remediation workstreams on the required timelines.

(c) Key Personnel. The Committee shall oversee the qualifications and performance of key compliance personnel, including the BSA Officer, Thomas Ikeda (appointed March 2023), and the CCO, Patricia Langston (appointed January 2024; her predecessor was terminated in connection with the compliance deficiencies identified by the OCC). The Committee shall receive reports regarding the performance of the BSA Officer and CCO on at least a semi-annual basis and shall make recommendations to the Board or management regarding the retention, replacement, or supplementation of key compliance personnel as the Committee deems appropriate.

Section 4.9 — Training Oversight. The Committee shall oversee BRB's BSA/AML and OFAC compliance training program. Specific responsibilities include:

(a) reviewing and approving the enterprise-wide BSA/AML and OFAC training program, including the training curriculum, audience segmentation (by role, business line, and risk exposure), delivery schedule, and completion-tracking mechanisms;

(b) reviewing and approving tailored BSA/AML and OFAC training content designed for members of the Board of Directors and senior management, which shall address the heightened oversight responsibilities arising from the Consent Order;

(c) monitoring training completion rates across all required audiences and ensuring that non-completion is promptly addressed through appropriate escalation mechanisms; and

(d) overseeing the training and policy development budget of One Million Eight Hundred Thousand Dollars ($1,800,000), which encompasses the development of training materials, delivery costs, learning management system enhancements, and the comprehensive revision and development of BSA/AML, OFAC, CDD/EDD, and SAR-related policies and procedures.

Section 4.10 — Policy Review and Approval. The Committee shall review, and recommend to the full Board for approval, all revised and newly developed BSA/AML, OFAC, CDD/EDD, SAR, CTR, and related compliance policies and procedures developed during and as part of the remediation program. The Committee shall:

(a) review the consolidated BSA/AML & Sanctions Policy Suite prepared by management in coordination with outside counsel (Calderwood & Harkness LLP) and the independent consultant (Thornfield Consulting Group LLC);

(b) ensure that all policies and procedures are cross-referenced to the specific articles and provisions of the Consent Order that they are intended to address, and that no Consent Order requirement is left unaddressed by the policy suite;

(c) assess whether policies and procedures are appropriately tailored to BRB's risk profile, product offerings, customer base, geographic footprint, and BaaS business model; and

(d) establish a schedule for periodic review and updating of all compliance policies and procedures following the completion of the remediation program.

Section 4.11 — Internal Audit Coordination. The Committee shall coordinate with BRB's internal audit function and the Audit Committee of the Board regarding BSA/AML and OFAC compliance audit matters. Specific responsibilities include:

(a) coordinating with the Head of Internal Audit, Derek Ballard, and the Audit Committee (chaired by Margaret Dao) regarding BSA/AML audit findings, independent testing results, and corrective action tracking;

(b) reviewing the results of the most recent independent BSA/AML testing engagement performed by Caldera & Pope LLP (engagement partner: Franklin Dorsey), which was completed in September 2024 at a fee of $1,100,000, and monitoring management's remediation of findings identified therein;

(c) ensuring that Internal Audit's BSA/AML testing plan for the remediation period and beyond is adequate in scope, depth, and frequency, and is aligned with the remediation program, the Consent Order requirements, and regulatory expectations; and

(d) reviewing Internal Audit's assessment of the effectiveness of remediation actions taken by management, including validation that corrective actions have been fully implemented, are operating effectively, and are sustainable.

Section 4.12 — Escalation to Full Board. The Committee shall promptly report to the full Board any matter that, in the Committee's judgment, requires the attention, deliberation, or action of the entire Board. Without limiting the Committee's discretion in this regard, matters warranting escalation to the full Board shall include:

(a) significant regulatory developments, including new regulatory actions, examinations, inquiries, or enforcement proceedings;

(b) material compliance failures or control breakdowns identified during the remediation period or thereafter;

(d) material changes to the remediation timeline, including any actual or anticipated failure to meet a Consent Order deadline;

(e) material changes to the Remediation Budget, including any actual or projected overruns in excess of Ten Percent (10%) of the aggregate budget;

(f) significant findings or recommendations of the independent consultant (Thornfield Consulting Group LLC);

(g) any circumstance that, in the Committee's judgment, poses a material risk to BRB's safety and soundness, its charter, or BRFG's status as a bank holding company; and

(h) any other matter that the Committee determines, in the exercise of its business judgment, warrants the full Board's attention.

ARTICLE V — MEETINGS

Section 5.1 — Frequency. The Committee shall meet with the regularity and frequency necessary to fulfill its responsibilities under this Charter and the Consent Order. Specifically:

(a) During the Remediation Period. During the Consent Order remediation period, which extends from January 15, 2025 (the effective date of the Consent Order) through February 15, 2026 (the date by which full compliance program implementation and self-certification must be completed), the Committee shall meet no less frequently than once per calendar month. Monthly meetings shall be scheduled in advance and included on the Committee's annual calendar. The Chair may schedule additional meetings as circumstances require.

(b) Following the Remediation Period. Following the conclusion of the remediation period (after February 15, 2026), the Committee shall meet no less frequently than once per calendar quarter, or more often as circumstances require or as the Chair determines is necessary to fulfill the Committee's ongoing oversight responsibilities.

(c) Special Meetings. Special meetings of the Committee may be called at any time by the Chair, by any two (2) Committee Members, or at the request of the General Counsel (Gregory Nardone) or the Chief Compliance Officer (Patricia Langston). Notice of special meetings shall be given to all Committee Members as far in advance as practicable under the circumstances, and in no event less than twenty-four (24) hours before the meeting, unless waived by all Committee Members.

Section 5.2 — Quorum. A majority of the Committee Members then in office shall constitute a quorum for the transaction of business at any meeting of the Committee. With respect to the initial three-member Committee, a quorum shall consist of two (2) Committee Members. All actions of the Committee shall be taken by the affirmative vote of a majority of the Committee Members present at a meeting at which a quorum is present, except as otherwise provided by this Charter, BRFG's Bylaws, or applicable law. The Committee may also act by unanimous written consent in lieu of a meeting, to the extent permitted by BRFG's Bylaws and applicable law.

Section 5.3 — Attendance. The Committee may invite any director, officer, employee, advisor, or other person to attend all or any portion of a Committee meeting and to provide information, presentations, or responses to questions as the Committee deems appropriate. The following individuals shall be designated as regular attendees (in a non-voting capacity) at Committee meetings:

(a) Patricia Langston, Chief Compliance Officer;

(b) Thomas Ikeda, BSA Officer / AML Program Director;

(d) Philip Hartmann, Partner, Calderwood & Harkness LLP (outside regulatory counsel).

Dr. Vivian Castellano, engagement lead of Thornfield Consulting Group LLC, or her designees (including Robert Eastman, Jennifer Hwang, or Nathaniel Burgess), may be invited to attend Committee meetings as appropriate, particularly in connection with the presentation or discussion of Thornfield deliverables, findings, or recommendations.

The Committee shall meet periodically in executive session without management present to facilitate candid discussion among the independent Committee Members regarding the performance of management, the adequacy of management's remediation efforts, and other sensitive matters. During the remediation period, the Committee shall conduct an executive session at each regularly scheduled monthly meeting. Outside counsel (Philip Hartmann or his designee from Calderwood & Harkness LLP) may be invited to attend executive sessions at the Chair's discretion.

Section 5.4 — Minutes. The Corporate Secretary or his designee shall prepare written minutes of each meeting of the Committee, which shall record the date, time, and place of the meeting; the names of Committee Members and other attendees present; a summary of the matters discussed; the actions taken and recommendations made; and any dissenting views expressed by Committee Members. Draft minutes shall be circulated to Committee Members for review within ten (10) business days following each meeting and shall be approved by the Committee at its next regularly scheduled meeting. Approved minutes shall be distributed to all members of the full Board and maintained in BRB's corporate records. Minutes shall be prepared with appropriate consideration of attorney-client privilege and work product protections, in consultation with outside counsel.

ARTICLE VI — REPORTING

Section 6.1 — Reporting to the Board. The Chair shall report to the full Board of Directors following each Committee meeting, summarizing the key discussions, findings, recommendations, decisions, and actions taken by the Committee. Such reports shall be provided in writing and may be supplemented by oral presentations at regularly scheduled Board meetings. During the Consent Order remediation period, written reports shall be provided to the Board at least monthly. Following the remediation period, written reports shall be provided to the Board at least quarterly. The Committee's reports to the Board shall include, at a minimum:

(a) a summary of the status of compliance with the Consent Order, including progress against milestones;

(b) a summary of key compliance metrics, as described in Section 6.2;

(d) a summary of actions taken or directed by the Committee;

(e) a description of any recommendations requiring Board approval or action; and

(f) an update on budget utilization and any projected variances.

Section 6.2 — Key Reporting Metrics. The Committee shall receive and review the following compliance and remediation metrics on a regular basis. During the remediation period, these metrics shall be reported to the Committee at least monthly. Following the remediation period, these metrics shall be reported at least quarterly, unless the Committee determines that more frequent reporting is warranted.

(a) SAR Filing Volumes — Total SARs filed, broken out by channel (retail banking, commercial lending, wealth management, and BaaS), including BaaS-related SARs by individual partner;

(b) SAR Filing Timeliness — Average number of calendar days from initial alert generation to FinCEN filing, with a target of filing within 30 calendar days;

(c) SAR Backlog Status — Number of unreviewed alerts, investigations in progress, and SARs pending filing, measured against the June 30, 2025 backlog clearance target;

(d) OFAC Screening Hit Rates — Total number of initial OFAC screening hits, true-match rate, and false-positive rate, broken out by business line and BaaS partner;

(e) OFAC Screening Coverage Rates — Percentage of transactions screened against OFAC lists, by business line and BaaS partner, with a target of 100% coverage;

(f) Transaction Monitoring Alert Volumes and SAR Conversion Rates — Total alerts generated by the Veridian TMS, disposition of alerts (true positive, false positive, escalated to investigation, closed without action), and SAR conversion rate;

(g) CDD/EDD Remediation Progress — Number of accounts remediated, number remaining, and percentage complete, measured against the target of 47,000 accounts (50% by July 15, 2025; 100% by January 15, 2026);

(h) BSA/AML Risk Ratings by BaaS Partner — Current risk rating for each of BRB's 14 active BaaS partners, including any rating changes and the rationale therefor;

(i) Remediation Milestone Status — Status of each milestone identified in the master timeline tracker referenced in Section 4.3, including on-track, at-risk, and delayed designations;

(j) Staffing Levels and Training Completion Rates — Current BSA/AML staffing levels (permanent and temporary FTEs), hiring pipeline status, and training completion rates by audience segment;

(k) Independent Consultant Status and Deliverables — Status of Thornfield Consulting Group LLC's engagement, including key activities completed, deliverables received, and findings communicated;

(l) Technology Implementation Progress — Status of the Veridian TMS v.10.0 upgrade, including completion of design, development, testing (including UAT), deployment, and model validation milestones; and

(m) Budget Utilization — Actual expenditures to date against the $42,500,000 Remediation Budget, broken out by cost category, with projections of remaining costs and any anticipated variances.

Section 6.3 — Management Reporting Obligations. Management shall provide the Committee with timely, accurate, and complete reports as necessary to support the Committee's oversight responsibilities. Specifically:

(a) The Chief Compliance Officer (Patricia Langston) and the BSA Officer (Thomas Ikeda) shall jointly provide the Committee with monthly written reports containing the metrics specified in Section 6.2 above, along with narrative discussion of key trends, issues, risks, and management actions. During the remediation period, these reports shall be distributed to Committee Members no less than five (5) business days before each scheduled Committee meeting.

(b) The Chief Risk Officer (Melissa Chu) shall provide supplemental reports to the Committee regarding enterprise risk management implications of BSA/AML and OFAC compliance matters, third-party risk assessments for BaaS partners and technology vendors, and any changes to BRB's overall risk profile related to compliance matters, as requested by the Committee.

(c) The Head of Fintech Partnerships (Warren Ashby) shall provide supplemental reports regarding the operational and compliance performance of BaaS partners, partner relationship developments, and BaaS transaction volume and activity trends, as requested by the Committee.

(d) The Chief Information Officer / Chief Technology Officer (Linda Petrosian) shall provide supplemental reports regarding the status, risks, and issues associated with the Veridian TMS upgrade, OFAC screening system enhancements, and other technology-related remediation workstreams, as requested by the Committee.

ARTICLE VII — RELATIONSHIP TO OTHER BOARD COMMITTEES

Section 7.1 — Audit Committee. The Committee shall coordinate with the Audit Committee of the Board of Directors (chaired by Margaret Dao) on matters of overlapping jurisdiction. Areas of coordination shall include, but not be limited to:

(a) Independent Testing. BSA/AML independent testing results produced by Caldera & Pope LLP (engagement partner: Franklin Dorsey). The annual BSA/AML independent testing fee is approximately $1,100,000, and the annual external audit fee paid to Caldera & Pope LLP is approximately $3,400,000. The Audit Committee retains sole authority over the engagement and oversight of BRB's external auditors, including Caldera & Pope LLP in its capacity as external auditor; however, the Committee shall have the authority to review BSA/AML-specific testing results and to communicate its expectations regarding the scope and depth of BSA/AML testing to the Audit Committee.

(b) Internal Audit Findings. Internal Audit findings related to BSA/AML and OFAC compliance, including findings arising from the Internal Audit department's BSA/AML testing program, shall be reported to both the Committee and the Audit Committee. The Committee shall have primary responsibility for overseeing management's remediation of BSA/AML-specific Internal Audit findings, while the Audit Committee retains overall responsibility for the Internal Audit function.

(c) Financial Statement Implications. The financial statement and disclosure implications of the remediation program, the $14,500,000 CMP, and any related contingent liabilities or loss reserves shall be coordinated between the Committee and the Audit Committee, with the Audit Committee retaining primary jurisdiction over financial reporting matters.

The Committee and the Audit Committee shall hold at least one (1) joint session per calendar quarter during the Consent Order remediation period to coordinate oversight activities, share relevant information, and avoid unnecessary duplication of effort. Joint sessions may be conducted as part of, or in addition to, regularly scheduled meetings of either committee. The chairs of the Committee and the Audit Committee shall maintain open communication between joint sessions regarding any matters requiring coordination.

Section 7.2 — Risk Committee. The Committee shall coordinate with the Risk Committee of the Board of Directors (chaired by Arthur Connelly, Lead Independent Director) on matters of overlapping jurisdiction. Areas of coordination shall include, but not be limited to:

(a) Enterprise Risk Management. The enterprise risk management implications of BSA/AML and OFAC compliance deficiencies, including the impact on BRB's overall risk profile and risk appetite framework.

(b) Third-Party Risk Management. Third-party risk management matters related to BaaS fintech partnerships (including NovaPay Technologies Inc., FairLend Digital LLC, and VaultEdge Inc.) and technology vendors (including Veridian Analytics Inc. and, potentially, Ridgeline Data Systems LLC), to the extent that such matters implicate both compliance risk and broader third-party risk management policies and frameworks.

(c) Reputational Risk. Reputational risk arising from the Consent Order, the public disclosure thereof, potential further enforcement actions by the OCC, FinCEN, OFAC, or the DOJ, and adverse media coverage related to BRB's BSA/AML and OFAC compliance deficiencies.

(d) Model Risk Management. Model risk management matters related to the Veridian TMS and any successor or supplemental transaction monitoring systems, to the extent that such matters implicate both compliance risk and the enterprise-wide model risk management framework.

The Committee retains primary jurisdiction over all matters directly relating to BSA/AML and OFAC compliance program design, implementation, and effectiveness. The Risk Committee retains primary jurisdiction over the enterprise-wide risk management frameworks within which compliance risk is embedded, including the enterprise risk appetite framework, the enterprise risk assessment methodology, and the overall third-party risk management program. Both committees shall endeavor to coordinate their activities to avoid gaps in oversight, minimize duplication, and ensure consistent messaging to management.

Section 7.3 — Delineation of Authority. In the event of any disagreement between the Committee and any other Board committee regarding jurisdiction over, or the appropriate allocation of responsibility for, a particular matter, the full Board of Directors shall determine the appropriate allocation of responsibility. Pending such determination, both committees may exercise concurrent oversight over the disputed matter to ensure that no gap in oversight exists.

ARTICLE VIII — ANNUAL REVIEW

The Committee shall conduct an annual self-assessment of its own performance, effectiveness, and the adequacy of this Charter. The self-assessment shall evaluate whether the Committee has fulfilled its responsibilities as described

COMPLIANCE COMMITTEE CHARTER OF THE BOARD OF DIRECTORS OF BELMONT RIDGE FINANCIAL GROUP, INC.
DRAFT — Prepared by Calderwood & Harkness LLP for Adoption by the Board of Directors
C&H Matter No. 1045-00002
PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION
Draft Date: February \\\_, 2025 (For adoption no later than February 28, 2025)
Adopted pursuant to OCC Consent Order No. OCC-2025-003, dated January 15, 2025
Right-click to update Table of Contents
ARTICLE I — PURPOSE
Section 1.1 — Establishment. The Board of Directors (the "Board") of Belmont Ridge Financial Group, Inc. ("BRFG"), a corporation organized under the laws of the State of Delaware and registered as a bank holding company under the Bank Holding Company Act of 1956, as amended, hereby establishes the Compliance Committee (the "Committee") as a standing committee of the Board. The Committee is established effective upon the date of adoption of this Charter (the "Effective Date") and shall operate in accordance with the terms, responsibilities, authority, and procedures set forth herein.
Section 1.2 — Oversight Scope. The Committee is established to provide dedicated, focused Board-level oversight of the compliance programs of BRFG and its principal banking subsidiary, Belmont Ridge Bank National Association ("BRB"), a national banking association chartered under the laws of the United States (OCC Charter No. 48271; FDIC Certificate No. 31845), headquartered at 680 Lexington Avenue, 22nd Floor, New York, New York 10022. The Committee's oversight scope encompasses, but is not limited to, all compliance functions, programs, policies, procedures, and systems operated by or on behalf of BRFG and BRB, with a primary emphasis on the areas described in Sections 1.3 and 1.4 below.
Section 1.3 — Primary Purpose. The primary purpose of the Committee is to oversee and monitor BRB's Bank Secrecy Act / Anti-Money Laundering ("BSA/AML") compliance program, its Office of Foreign Assets Control ("OFAC") sanctions compliance program, and all related regulatory compliance functions, including but not limited to Customer Due Diligence ("CDD"), Enhanced Due Diligence ("EDD"), Suspicious Activity Report ("SAR") filing processes, Currency Transaction Report ("CTR") filing processes, transaction monitoring, sanctions screening and interdiction, beneficial ownership identification and verification, compliance risk assessment, and the development and maintenance of written policies and procedures governing the foregoing. The Committee is further charged with ensuring that BRB maintains compliance with all applicable provisions of the Bank Secrecy Act (31 U.S.C. § 5311 et seq.), its implementing regulations (31 C.F.R. Chapter X), the USA PATRIOT Act (Pub. L. 107-56), Executive Order 13224, the International Emergency Economic Powers Act ("IEEPA"), and all related federal and state laws, regulations, and regulatory guidance.
Section 1.4 — Consent Order Mandate. The Committee is established with the specific mandate to oversee the comprehensive BSA/AML and sanctions compliance-program uplift required by Consent Order No. OCC-2025-003 (the "Consent Order"), issued by the Office of the Comptroller of the Currency ("OCC") on January 15, 2025, against Belmont Ridge Bank National Association. The Committee's Consent Order oversight responsibilities include, but are not limited to:
(a) overseeing the remediation of all deficiency findings identified in the Consent Order, including deficiencies relating to (i) Board-level governance and oversight, (ii) BSA/AML risk assessment methodology and execution, (iii) transaction monitoring system adequacy and model validation, (iv) SAR filing timeliness, quality, and completeness, and (v) OFAC sanctions screening coverage and interdiction processes;
(b) overseeing the engagement and work product of the OCC-mandated independent consultant, including review and assessment of all consultant deliverables;
(c) monitoring and ensuring satisfaction of all Consent Order deadlines, including interim milestones and the final compliance program implementation deadline of February 15, 2026;
(d) reviewing and approving (or recommending to the full Board for approval, as appropriate) all submissions to the OCC required by the Consent Order, including the Comprehensive Remediation Action Plan, quarterly progress reports, and the compliance self-certification; and
(e) coordinating with outside counsel, management, and the independent consultant to ensure that all aspects of the remediation program are designed, implemented, and sustained in a manner that satisfies the terms and spirit of the Consent Order and applicable law.
Section 1.5 — Board-Level Oversight Deficiencies. The Committee is established in direct response to the Consent Order's identification of board-level oversight deficiencies as one of five core deficiency categories. Specifically, the Consent Order found that BRFG's Board of Directors had failed to provide adequate oversight of BRB's BSA/AML and OFAC compliance programs, including insufficient frequency and depth of Board-level compliance reporting, a lack of a dedicated compliance committee or equivalent governance structure, and inadequate Board-level monitoring of the performance of the BSA Officer and the Chief Compliance Officer. The establishment of this Committee, with the authority, composition, responsibilities, and reporting obligations described herein, is intended to remediate these identified board-level governance deficiencies in their entirety.
Section 1.6 — Board Resolution. The Board Resolution acknowledging the Consent Order and authorizing the establishment of this Committee was adopted on or before February 28, 2025, which date is forty-five (45) calendar days from the January 15, 2025 effective date of the Consent Order, as required by Article III, Section 2 thereof. This Charter memorializes the terms of the Committee's establishment as authorized by said Board Resolution.
ARTICLE II — COMPOSITION
Section 2.1 — Number of Members. The Committee shall consist of no fewer than three (3) members of the Board of Directors of BRFG (each, a "Committee Member" and collectively, "Committee Members"), each of whom shall be an independent director as defined under the applicable listing standards of the New York Stock Exchange ("NYSE"), as set forth in Section 303A of the NYSE Listed Company Manual, and as further defined in BRFG's Corporate Governance Guidelines, as amended from time to time. No individual who fails to satisfy the independence requirements of the NYSE listing standards and BRFG's Corporate Governance Guidelines shall be eligible to serve as a member of the Committee.
The initial members of the Committee shall be the following independent directors of the Board:
(a) James Rutherford (Chair);
(b) Sandra Villarreal; and
(c) Keith Yamamoto.
Each of the foregoing initial Committee Members has been determined by the Board to be independent under the applicable NYSE listing standards and BRFG's Corporate Governance Guidelines. The Board may, from time to time, increase the number of Committee Members beyond three, provided that all Committee Members satisfy the independence and qualification requirements set forth in this Article II.
Section 2.2 — Chair. James Rutherford shall serve as the initial Chair of the Committee (the "Chair"). The Chair shall be responsible for:
(a) setting the agenda for each meeting of the Committee, in consultation with other Committee Members, the Chief Compliance Officer, outside counsel, and the independent consultant as appropriate;
(b) presiding over all meetings of the Committee, including calling meetings to order, managing the conduct of business, and ensuring that all agenda items receive adequate consideration;
(c) serving as the primary liaison between the Committee, on the one hand, and management, outside counsel (including Calderwood & Harkness LLP), and the independent consultant (Thornfield Consulting Group LLC), on the other hand;
(d) reporting to the full Board following each Committee meeting in accordance with Article VI of this Charter;
(e) coordinating with the chairs of the Audit Committee and the Risk Committee on matters of overlapping jurisdiction; and
(f) performing such other duties as may be assigned to the Chair by the Committee or the Board.
In the event of the Chair's absence, temporary incapacity, or recusal from a particular matter, the Committee Members present at the relevant meeting shall designate an acting Chair from among themselves for purposes of that meeting.
Section 2.3 — Qualifications. In addition to the independence requirements set forth in Section 2.1, the following qualification requirements shall apply to Committee Members:
(a) Subject-Matter Expertise. At least one (1) member of the Committee shall have professional experience or demonstrated expertise in one or more of the following areas: banking regulation, financial crimes compliance, BSA/AML compliance, OFAC sanctions compliance, anti-money laundering program design or auditing, regulatory enforcement matters, or a closely related field. As of the Effective Date, the Board has determined that James Rutherford satisfies this requirement based on his prior service as a senior executive at a federally regulated financial institution and his extensive experience with BSA/AML regulatory matters.
(b) Time Commitment. All Committee Members shall be willing and able to devote the time and attention necessary to satisfy the Committee's responsibilities as described in this Charter, including attendance at monthly meetings during the Consent Order remediation period (January 15, 2025 through February 15, 2026), attendance at quarterly meetings thereafter, and such additional time as may be required for review of materials, engagement with management and advisors, and participation in special or emergency meetings.
(c) Independence from Management. No individual who simultaneously serves as an officer or employee of BRFG, BRB, or any subsidiary or affiliate of BRFG shall be eligible to serve as a Committee Member. Committee Members shall be non-management directors only. This requirement is in addition to, and not in lieu of, the independence requirements set forth in Section 2.1.
Section 2.4 — Appointment and Term. Committee Members shall be appointed by the Board upon the recommendation of the Nominating and Governance Committee of the Board, or, in the absence of a recommendation from the Nominating and Governance Committee, by action of the Board as a whole. Each Committee Member shall serve until the earliest to occur of: (a) the appointment and qualification of such member's successor; (b) such member's voluntary resignation from the Committee; (c) such member's removal from the Committee by the Board; or (d) such member's cessation of service as a director of BRFG for any reason. The Board shall review the composition and membership of the Committee at least annually, and more frequently as circumstances may warrant, to ensure that the Committee's composition continues to satisfy the requirements of this Charter, the Consent Order, and applicable law.
Section 2.5 — Vacancies. Any vacancy occurring on the Committee, whether by reason of resignation, removal, death, incapacity, or otherwise, shall be filled by the Board in accordance with the procedures set forth in Section 2.4. Pending the filling of any such vacancy, the remaining Committee Members shall have the authority to continue to exercise all powers and perform all duties of the Committee, provided that a quorum (as defined in Section 5.2) exists. In the event that the number of Committee Members falls below the minimum of three (3), the Board shall take prompt action to fill the vacancy, and in no event shall the Committee operate with fewer than the minimum number of members for a period exceeding thirty (30) calendar days, unless otherwise approved by the full Board.
ARTICLE III — AUTHORITY
Section 3.1 — General Authority. The Committee shall have the full authority to oversee, review, evaluate, and make recommendations to the full Board regarding all matters relating to BRB's BSA/AML compliance program, OFAC sanctions compliance program, and regulatory compliance programs as described in this Charter. Without limiting the generality of the foregoing, the Committee shall have the authority to:
(a) direct management of BRFG and BRB to take corrective actions to address identified compliance deficiencies, including but not limited to requiring changes to policies, procedures, systems, controls, staffing levels, organizational structures, and reporting lines;
(b) make recommendations to the full Board regarding compliance-related budgets, resource allocations, capital expenditures, and staffing levels, including recommendations regarding the adequacy of funding for the remediation program;
(c) require management to provide timely, accurate, and complete information regarding all matters within the Committee's oversight scope;
(d) establish subcommittees or working groups, comprised of Committee Members and such other persons as the Committee deems appropriate, to address specific issues or workstreams within the Committee's scope;
(e) adopt such rules and procedures for the conduct of its activities as it deems appropriate, consistent with this Charter, BRFG's Bylaws, and applicable law; and
(f) take such other actions as the Committee deems necessary or advisable to fulfill its responsibilities under this Charter and the Consent Order.
Section 3.2 — Access to Information and Personnel. The Committee shall have full, unrestricted, and unfettered access to all books, records, documents, data, systems, facilities, and personnel of BRFG, BRB, and their subsidiaries and affiliates as the Committee deems relevant to the discharge of its responsibilities. All officers and employees of BRFG and BRB shall cooperate fully and promptly with the Committee and its advisors in connection with any inquiry, investigation, review, or request for information made by or at the direction of the Committee.
The Committee's key management contacts shall include, but not be limited to, the following individuals:
(a) Patricia Langston, Chief Compliance Officer ("CCO");
(b) Thomas Ikeda, BSA Officer / AML Program Director;
(c) Melissa Chu, Chief Risk Officer ("CRO");
(d) Warren Ashby, Head of Fintech Partnerships / Banking-as-a-Service ("BaaS") Division;
(e) Linda Petrosian, Chief Information Officer / Chief Technology Officer ("CIO/CTO");
(f) Derek Ballard, Head of Internal Audit; and
(g) Gregory Nardone, General Counsel & Corporate Secretary.
Each of the foregoing individuals shall be available to the Committee and its Chair at all reasonable times and shall provide such information, reports, analyses, and other materials as the Committee may request. The Committee may also require presentations from, or access to, any other officer, employee, or agent of BRFG or BRB, including without limitation personnel in the compliance, operations, technology, risk management, legal, internal audit, finance, and business line functions.
Section 3.3 — Authority to Engage Advisors. The Committee shall have the sole and exclusive authority to retain, compensate, oversee, evaluate, and terminate outside legal counsel, compliance consultants, forensic accountants, technology advisors, and other advisors as the Committee deems necessary or advisable to fulfill its responsibilities under this Charter and the Consent Order. The Committee's authority to engage advisors is independent of, and in addition to, management's authority to engage advisors in the ordinary course of business, and shall not require the prior approval of the full Board or any other committee of the Board, except as may be required by BRFG's Bylaws or applicable law.
As of the Effective Date, the Committee is authorized to oversee the following engagements:
(a) Calderwood & Harkness LLP — Outside regulatory counsel. Engagement opened February 10, 2025. Responsible partner: Philip Hartmann. Estimated total fees of Eight Million Dollars ($8,000,000) across Phase 1 (Consent Order response, preliminary remediation planning, and regulatory engagement; estimated fees of $3,200,000) and Phase 2 (remediation implementation, ongoing regulatory engagement, and compliance self-certification; estimated fees of $4,800,000). Calderwood & Harkness LLP has been engaged to provide legal advice and representation to BRFG and BRB in connection with the Consent Order, the remediation program, regulatory communications, and related matters.
(b) Thornfield Consulting Group LLC — OCC-mandated independent consultant. Engagement reference: TCG-BRB-2025-001. OCC non-objection received February 5, 2025. Engagement agreement executed February 10, 2025. Fixed fee of Six Million Five Hundred Thousand Dollars ($6,500,000) plus expenses capped at Four Hundred Thousand Dollars ($400,000), for a total not-to-exceed engagement cost of Six Million Nine Hundred Thousand Dollars ($6,900,000). Engagement lead: Dr. Vivian Castellano. The engagement of Thornfield Consulting Group LLC is required by Article V of the Consent Order, which mandates the retention of a qualified independent consultant, acceptable to the OCC, to conduct a comprehensive gap assessment of BRB's BSA/AML and OFAC compliance programs and to validate the effectiveness of BRB's remediation efforts upon completion.
BRFG shall provide appropriate and adequate funding for the activities of the Committee, including the compensation of any advisors engaged by the Committee, as determined by the Committee in its sole discretion. Neither BRFG nor BRB management shall deny, delay, or condition the funding of any Committee-approved engagement or expenditure.
Section 3.4 — Authority to Investigate. The Committee shall have the authority to conduct or authorize investigations into any matter within its scope of responsibilities, including but not limited to potential compliance violations, control failures, employee misconduct, vendor performance issues, and regulatory reporting deficiencies. The Committee may direct the engagement of outside advisors to assist in any such investigation. All officers, employees, and agents of BRFG and BRB shall cooperate fully with any investigation conducted by or at the direction of the Committee, and failure to cooperate shall be grounds for disciplinary action, up to and including termination of employment. The Committee shall report the findings and conclusions of any material investigation to the full Board and, where appropriate, to the relevant regulatory authorities.
Section 3.5 — Spending Authority. The Committee shall oversee the Board-approved remediation budget of Forty-Two Million Five Hundred Thousand Dollars ($42,500,000) (the "Remediation Budget"), which is exclusive of the Fourteen Million Five Hundred Thousand Dollars ($14,500,000) civil money penalty ("CMP") assessed under Article II of the Consent Order. The Remediation Budget encompasses the following estimated cost categories:
The total estimated financial outlay arising from the Consent Order, inclusive of the CMP, is Fifty-Seven Million Dollars ($57,000,000).
The Committee shall monitor expenditures against the Remediation Budget on at least a monthly basis and shall promptly report to the full Board any actual or projected material variances. Any reallocation of funds among Remediation Budget categories in excess of Five Hundred Thousand Dollars ($500,000) shall require the approval of the Committee. Any increase to the aggregate Remediation Budget shall require the approval of the full Board upon recommendation of the Committee.
ARTICLE IV — RESPONSIBILITIES AND DUTIES
The Committee shall have the following responsibilities and duties, in addition to such other responsibilities as may be delegated to the Committee by the Board from time to time. In performing its oversight role, the Committee recognizes that management is responsible for the day-to-day design, implementation, operation, and maintenance of BRB's compliance programs, and that the Committee's role is one of informed, active oversight rather than operational management. Notwithstanding the foregoing, the Committee's oversight responsibilities, particularly during the Consent Order remediation period, require a level of engagement, inquiry, and challenge that goes beyond routine board committee oversight.
Section 4.1 — BSA/AML Program Oversight. The Committee shall oversee the design, implementation, effectiveness, and continuous improvement of BRB's BSA/AML compliance program, including the following specific areas:
(a) Suspicious Activity Report (SAR) Filing. The Committee shall oversee the processes, timeliness, and quality of BRB's SAR filing practices. The Committee notes the following baseline metrics as of the Effective Date:
(i) Calendar Year 2024 SAR filings: 3,847 total SARs filed (an increase of 32.0% over the prior year);
(ii) Calendar Year 2023 SAR filings: 2,914 total SARs filed;
(iii) Current average filing time: approximately 78 calendar days from the date of initial alert generation to the date of FinCEN filing, which significantly exceeds the regulatory expectation of filing within 30 calendar days of the identification of suspicious activity warranting a report;
(iv) As of September 30, 2024, a backlog of approximately 2,400 unreviewed transaction monitoring alerts awaiting initial triage and investigation, representing a material backlog that was cited as a specific deficiency in the Consent Order.
The Committee shall monitor management's progress in reducing SAR filing timelines to within the 30-day expectation, clearing the alert backlog (targeted for completion by June 30, 2025), and enhancing SAR narrative quality in accordance with FinCEN guidance.
(b) Currency Transaction Report (CTR) Filing. The Committee shall monitor the accuracy, completeness, and timeliness of BRB's CTR filing processes. In Calendar Year 2024, BRB filed a total of 28,612 CTRs. The Committee shall review any identified deficiencies in CTR filing and ensure corrective action is taken.
(c) Transaction Monitoring System Performance. The Committee shall oversee the performance, adequacy, and remediation of BRB's transaction monitoring system, including the Veridian Transaction Monitoring System ("Veridian TMS"), currently operating on version 8.3, with an upgrade to version 10.0 planned, with User Acceptance Testing ("UAT") completion targeted by August 1, 2025, as further described in Section 4.6 of this Charter.
(d) Alert Volumes and SAR Conversion Rates. The Committee shall review transaction monitoring alert volumes and SAR conversion rates as key indicators of the effectiveness and calibration of BRB's monitoring models. In Calendar Year 2024, the Veridian TMS generated approximately 41,500 alerts, of which approximately 3,847 resulted in SAR filings, reflecting a SAR conversion rate of approximately 9.3%. The Committee shall evaluate whether alert volumes and conversion rates are reasonable in light of BRB's risk profile, product mix, and customer base, and shall oversee the recalibration of monitoring scenarios and thresholds as part of the remediation program.
(e) Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD) Programs. The Committee shall oversee the remediation of BRB's CDD and EDD programs, including the remediation of the approximately 47,000 high-risk customer accounts identified as having deficient or incomplete CDD/EDD documentation. The Consent Order identified BRB's failure to maintain adequate CDD/EDD records for a substantial population of high-risk accounts, including accounts associated with BaaS fintech partners, correspondent banking relationships, and privately held business entities, as a core deficiency. The Committee shall monitor progress against the remediation milestones of 50% completion (23,500 accounts) by July 15, 2025, and 100% completion (47,000 accounts) by January 15, 2026.
(f) BSA/AML Staffing. The Committee shall review BSA/AML staffing levels to ensure that adequate resources are in place to support BRB's compliance program. Current BSA/AML compliance staffing consists of 62 full-time equivalent employees ("FTEs"). The post-remediation target is 77 FTEs, representing an increase of 15 FTEs. During the remediation period, an additional 30 temporary FTEs from Pinnacle Compliance Solutions LLC ("Pinnacle") have been engaged to supplement permanent staff for alert review, SAR filing, and CDD/EDD remediation activities.
Section 4.2 — OFAC Sanctions Compliance Oversight. The Committee shall oversee the design, implementation, and effectiveness of BRB's OFAC sanctions screening and interdiction program across all business lines, including retail banking, commercial lending, wealth management, and all Banking-as-a-Service ("BaaS") channels. Specific responsibilities include:
(a) OFAC Screening Gap Remediation. The Committee shall monitor the remediation of the OFAC screening gap identified in the Consent Order, which found that BRB had failed to screen approximately 12% of NovaPay Technologies Inc. ("NovaPay") transaction flows through BRB's OFAC sanctions screening system. This gap affected approximately 3,800,000 of the approximately 31,700,000 total NovaPay transactions processed through BRB in Calendar Year 2023, primarily relating to certain peer-to-peer payment and stored-value transactions that were not routed through BRB's primary OFAC screening engine due to a systems integration failure in the NovaPay API gateway implementation.
(b) OFAC Screening Metrics. The Committee shall review OFAC screening metrics on a regular basis, including:
(i) Hit rates: In Calendar Year 2024, BRB's OFAC screening systems generated 14,320 initial hits across all business lines;
(ii) True match rates: Of the 14,320 initial hits, 12 were determined to be true matches requiring interdiction or blocking action, representing a true-match rate of approximately 0.08%;
(iii) False-positive rate: Approximately 99.9% of initial hits were resolved as false positives, indicating the need for continued tuning and optimization of screening filters;
(iv) Interdiction and blocking actions taken in response to true matches; and
(v) Screening coverage rates across all BaaS partners and business lines.
(c) BaaS OFAC Screening Operationalization. The Committee shall oversee the November 1, 2025 deadline for full OFAC screening operationalization across all BaaS channels, as required by Article IV, Section 7 of the Consent Order. This deadline requires that all transactions processed through or on behalf of BRB by its BaaS partners, without exception, be subjected to real-time or near-real-time OFAC sanctions screening prior to settlement.
(d) OFAC Voluntary Self-Disclosure. The Committee shall monitor the assessment and resolution of any OFAC voluntary self-disclosure considerations arising from the NovaPay screening gap or any other identified OFAC compliance deficiency. The Committee shall coordinate with outside counsel (Calderwood & Harkness LLP) and the General Counsel regarding the advisability, timing, and content of any potential voluntary self-disclosure to OFAC.
Section 4.3 — Consent Order Compliance Monitoring. The Committee shall serve as the principal Board-level body responsible for monitoring compliance with all provisions, requirements, and deadlines of OCC Consent Order No. OCC-2025-003. The Committee shall maintain a comprehensive master timeline tracker of all Consent Order obligations and shall review progress against this timeline at each regularly scheduled meeting. The Consent Order's key milestones and deadlines include, but are not limited to, the following:
The Committee shall ensure that management develops and maintains detailed project plans for each milestone, that progress is tracked and reported at each Committee meeting, and that any actual or anticipated delays are promptly identified, escalated, and addressed. In the event that any milestone is at risk of delay, the Committee shall require management to present a remediation plan with a revised timeline and shall assess whether notification to the OCC is warranted.
Section 4.4 — Independent Consultant Oversight. The Committee shall oversee the engagement, work, deliverables, and findings of the OCC-mandated independent consultant, Thornfield Consulting Group LLC ("Thornfield"), in accordance with Article V of the Consent Order. Specific responsibilities include:
(a) Engagement Oversight. Thornfield was selected by BRFG and received OCC non-objection on February 5, 2025. The engagement agreement was executed on February 10, 2025, under engagement reference TCG-BRB-2025-001. The engagement lead is Dr. Vivian Castellano, a recognized expert in BSA/AML compliance with more than twenty years of experience in regulatory compliance consulting. The Thornfield engagement team also includes Robert Eastman (senior manager, transaction monitoring specialist), Jennifer Hwang (senior manager, CDD/EDD and OFAC specialist), and Nathaniel Burgess (senior associate, data analytics). Thornfield's on-site assessment commenced on March 1, 2025.
(b) Deliverable Review. The Committee shall review and assess Thornfield's preliminary gap assessment, which is due to the OCC by April 15, 2025, and Thornfield's final validation report, which is due by February 15, 2026. The Committee shall also review any interim reports, findings, or recommendations issued by Thornfield during the course of its engagement.
(c) Cooperation. The Committee shall ensure that BRFG and BRB provide full, timely, and unrestricted cooperation to Thornfield and its personnel in accordance with the Access & Cooperation Protocol executed between BRFG, BRB, and Thornfield as of the engagement date. The Committee shall receive reports from management regarding any disputes, impediments, or delays in Thornfield's access to information, personnel, or facilities, and shall take prompt action to resolve any such issues.
(d) Independence. The Committee shall monitor the independence of Thornfield throughout the engagement and shall promptly report to the Board and the OCC any circumstances that could compromise, or create an appearance of compromise of, Thornfield's independence or objectivity.
Section 4.5 — Fintech / BaaS Partner Compliance Oversight. The Committee shall oversee BRB's BSA/AML and OFAC compliance obligations as they relate to BRB's Banking-as-a-Service program. As of the Effective Date, BRB maintains 14 active BaaS fintech partnership arrangements through which BRB provides banking services, including deposit accounts, payment processing, lending, and card issuance, to the end-user customers of third-party fintech companies. Specific responsibilities include:
(a) Top Partner Monitoring. The Committee shall exercise particular oversight of BRB's compliance obligations in connection with its three largest BaaS partners by transaction volume:
(i) NovaPay Technologies Inc. — Representing approximately 41% of BaaS transaction volume; approximately $30.5 billion in transaction volume in Calendar Year 2024; approximately 2.1 million end-user accounts; Chief Executive Officer: Ethan Garrison. NovaPay was identified in the Consent Order in connection with the OFAC screening gap described in Section 4.2(a).
(ii) FairLend Digital LLC — Representing approximately 28% of BaaS transaction volume; approximately $1.4 billion in loan originations through BRB in Fiscal Year 2024; Chief Executive Officer: Aisha Okonkwo.
(iii) VaultEdge Inc. — Representing approximately 18% of BaaS transaction volume; approximately 870,000 deposit accounts; Chief Executive Officer: Marcus Tan.
(b) BaaS SAR Activity. The Committee shall monitor SAR activity associated with BaaS channels. In Calendar Year 2024, BRB filed 2,108 BaaS-related SARs, representing approximately 54.8% of BRB's total 3,847 SARs filed during that period. The disproportionate concentration of SAR activity in BaaS channels is a matter of significant regulatory concern and shall receive focused attention from the Committee.
(c) BaaS Volume and Revenue Context. The Committee shall evaluate BaaS-related compliance risks in the context of the scale of BRB's BaaS program. Total BaaS transaction volume was approximately $74.3 billion in Calendar Year 2024, and BaaS revenue was approximately $127.4 million in Calendar Year 2024. The Committee shall assess whether compliance resources, controls, and oversight mechanisms are commensurate with the volume, complexity, and risk profile of BaaS activities.
(d) BaaS Compliance Oversight Framework. The Committee shall review and approve (or recommend to the Board for approval) the BaaS Compliance Oversight Framework, including the methodology and criteria for conducting and updating BaaS partner risk assessments. The Committee shall also review individual BaaS partner risk assessments, particularly for high-risk partners, and shall monitor management's implementation of risk-based controls, enhanced monitoring, and contractual compliance requirements for each BaaS partnership.
Section 4.6 — Technology and Model Risk Oversight. The Committee shall oversee the technology and model risk dimensions of BRB's BSA/AML and OFAC compliance programs, including the following:
(a) Transaction Monitoring System Upgrade. The Committee shall oversee the upgrade of BRB's primary transaction monitoring system from Veridian TMS version 8.3 to version 10.0. The Veridian TMS is provided by Veridian Analytics Inc. under Contract No. VA-BRB-2023-0044. The estimated implementation cost of the upgrade is $2,800,000, with incremental annual licensing costs of $1,900,000, bringing the new annual contract value ("ACV") to approximately $6,000,000 per year. The upgrade to version 10.0 is a critical remediation deliverable and is required to be completed (through UAT) by August 1, 2025.
(b) Model Validation Deficiency. The Consent Order cited BRB's failure to conduct an independent validation of the Veridian TMS since March 2021 — a period of more than three years — as a specific deficiency. Additionally, the Consent Order noted that the last tuning of model parameters (scenarios, thresholds, and rules) was performed in October 2022. These failures were identified as contributing to the system's inability to generate timely and appropriate alerts, resulting in both under-detection of suspicious activity and excessive false-positive rates. The Committee shall ensure that these deficiencies are remediated through the system upgrade and subsequent model validation.
(c) Independent Model Validation. The Committee shall oversee the engagement and completion of an independent model validation of the upgraded Veridian TMS v.10.0, targeted for completion by October 1, 2025. The model validation shall be performed by a qualified independent party in accordance with OCC Bulletin 2011-12 (Supervisory Guidance on Model Risk Management) and any applicable OCC or FFIEC guidance.
(d) Contingency Vendor Evaluation. The Committee shall monitor the evaluation of Ridgeline Data Systems LLC as a contingency vendor alternative to the Veridian TMS. The proposed Ridgeline engagement would carry an ACV of approximately $7,200,000 on a five-year term, with an estimated total contract value of $36,000,000. The contingency evaluation is being conducted to ensure that BRB has a viable alternative in the event that the Veridian TMS upgrade encounters material delays or performance issues that cannot be resolved within the Consent Order timeline.
(e) Technology Implementation Coordination. The Committee shall coordinate with the CIO/CTO (Linda Petrosian) regarding technology implementation timelines, risks, resource requirements, and dependencies, and shall receive regular updates on the status of all technology-related remediation workstreams.
Section 4.7 — Regulatory Engagement Oversight. The Committee shall oversee BRB's engagement, communications, and relationship with its primary regulators in connection with BSA/AML and OFAC compliance matters. Specific responsibilities include:
(a) Office of the Comptroller of the Currency (OCC). The Committee shall oversee BRB's engagement and communications with the OCC, including the OCC's Northeastern District Office located at 340 Madison Avenue, New York, New York 10017. The OCC's Examiner-in-Charge assigned to BRB is Jonathan Frey. The Committee shall review all submissions to the OCC required by or in connection with the Consent Order, including the Comprehensive Remediation Action Plan (due May 15, 2025), quarterly progress reports (due September 15, 2025 and December 15, 2025), the compliance self-certification (due February 15, 2026), and any other written communications to the OCC regarding the remediation program or BRB's BSA/AML and OFAC compliance programs.
(b) Financial Crimes Enforcement Network (FinCEN). The Committee shall monitor BRB's engagement with the Financial Crimes Enforcement Network ("FinCEN"), noting that FinCEN is conducting parallel monitoring of BRB's SAR filing remediation and has reserved its independent enforcement rights. The FinCEN liaison for this matter is Angela Drummond, Associate Director, Enforcement Division. The Committee shall coordinate with outside counsel regarding the scope and nature of any communications with FinCEN and shall be promptly informed of any FinCEN inquiry, request for information, or enforcement-related communication.
(c) DOJ Criminal Referral Risk. The Committee shall monitor the risk of a potential referral by the OCC or FinCEN to the United States Department of Justice ("DOJ") for criminal investigation or prosecution. As of February 10, 2025, no criminal referral has been made. The Consent Order does not contain a non-prosecution agreement or declination and expressly does not preclude future criminal referral. The Committee shall coordinate with outside counsel regarding the assessment and management of DOJ referral risk and shall be promptly informed of any developments in this regard.
Section 4.8 — Compliance Staffing and Resources. The Committee shall review and assess the adequacy of BSA/AML and compliance staffing and resources on a regular basis. Specific responsibilities include:
(a) Permanent Headcount. The Committee shall monitor progress toward achieving the target BSA/AML compliance staffing level of 77 FTEs, an increase of 15 FTEs from the current level of 62 FTEs. The estimated fully loaded annual cost of the 15 new positions is approximately $2,250,000 (inclusive of salary, benefits, and overhead). The Committee shall review the qualifications, experience levels, and role allocations of new hires to ensure alignment with the remediation program's requirements.
(b) Temporary Staffing. The Committee shall monitor the performance and utilization of the 30 temporary FTEs engaged from Pinnacle Compliance Solutions LLC at an estimated cost of $3,600,000 for a twelve-month engagement period. The Committee shall assess whether the temporary staffing level is adequate to support the SAR backlog clearance, CDD/EDD remediation, and other remediation workstreams on the required timelines.
(c) Key Personnel. The Committee shall oversee the qualifications and performance of key compliance personnel, including the BSA Officer, Thomas Ikeda (appointed March 2023), and the CCO, Patricia Langston (appointed January 2024; her predecessor was terminated in connection with the compliance deficiencies identified by the OCC). The Committee shall receive reports regarding the performance of the BSA Officer and CCO on at least a semi-annual basis and shall make recommendations to the Board or management regarding the retention, replacement, or supplementation of key compliance personnel as the Committee deems appropriate.
Section 4.9 — Training Oversight. The Committee shall oversee BRB's BSA/AML and OFAC compliance training program. Specific responsibilities include:
(a) reviewing and approving the enterprise-wide BSA/AML and OFAC training program, including the training curriculum, audience segmentation (by role, business line, and risk exposure), delivery schedule, and completion-tracking mechanisms;
(b) reviewing and approving tailored BSA/AML and OFAC training content designed for members of the Board of Directors and senior management, which shall address the heightened oversight responsibilities arising from the Consent Order;
(c) monitoring training completion rates across all required audiences and ensuring that non-completion is promptly addressed through appropriate escalation mechanisms; and
(d) overseeing the training and policy development budget of One Million Eight Hundred Thousand Dollars ($1,800,000), which encompasses the development of training materials, delivery costs, learning management system enhancements, and the comprehensive revision and development of BSA/AML, OFAC, CDD/EDD, and SAR-related policies and procedures.
Section 4.10 — Policy Review and Approval. The Committee shall review, and recommend to the full Board for approval, all revised and newly developed BSA/AML, OFAC, CDD/EDD, SAR, CTR, and related compliance policies and procedures developed during and as part of the remediation program. The Committee shall:
(a) review the consolidated BSA/AML & Sanctions Policy Suite prepared by management in coordination with outside counsel (Calderwood & Harkness LLP) and the independent consultant (Thornfield Consulting Group LLC);
(b) ensure that all policies and procedures are cross-referenced to the specific articles and provisions of the Consent Order that they are intended to address, and that no Consent Order requirement is left unaddressed by the policy suite;
(c) assess whether policies and procedures are appropriately tailored to BRB's risk profile, product offerings, customer base, geographic footprint, and BaaS business model; and
(d) establish a schedule for periodic review and updating of all compliance policies and procedures following the completion of the remediation program.
Section 4.11 — Internal Audit Coordination. The Committee shall coordinate with BRB's internal audit function and the Audit Committee of the Board regarding BSA/AML and OFAC compliance audit matters. Specific responsibilities include:
(a) coordinating with the Head of Internal Audit, Derek Ballard, and the Audit Committee (chaired by Margaret Dao) regarding BSA/AML audit findings, independent testing results, and corrective action tracking;
(b) reviewing the results of the most recent independent BSA/AML testing engagement performed by Caldera & Pope LLP (engagement partner: Franklin Dorsey), which was completed in September 2024 at a fee of $1,100,000, and monitoring management's remediation of findings identified therein;
(c) ensuring that Internal Audit's BSA/AML testing plan for the remediation period and beyond is adequate in scope, depth, and frequency, and is aligned with the remediation program, the Consent Order requirements, and regulatory expectations; and
(d) reviewing Internal Audit's assessment of the effectiveness of remediation actions taken by management, including validation that corrective actions have been fully implemented, are operating effectively, and are sustainable.
Section 4.12 — Escalation to Full Board. The Committee shall promptly report to the full Board any matter that, in the Committee's judgment, requires the attention, deliberation, or action of the entire Board. Without limiting the Committee's discretion in this regard, matters warranting escalation to the full Board shall include:
(a) significant regulatory developments, including new regulatory actions, examinations, inquiries, or enforcement proceedings;
(b) material compliance failures or control breakdowns identified during the remediation period or thereafter;
(c) potential additional enforcement actions by the OCC, FinCEN, OFAC, the DOJ, or any other governmental authority;
(d) material changes to the remediation timeline, including any actual or anticipated failure to meet a Consent Order deadline;
(e) material changes to the Remediation Budget, including any actual or projected overruns in excess of Ten Percent (10%) of the aggregate budget;
(f) significant findings or recommendations of the independent consultant (Thornfield Consulting Group LLC);
(g) any circumstance that, in the Committee's judgment, poses a material risk to BRB's safety and soundness, its charter, or BRFG's status as a bank holding company; and
(h) any other matter that the Committee determines, in the exercise of its business judgment, warrants the full Board's attention.
ARTICLE V — MEETINGS
Section 5.1 — Frequency. The Committee shall meet with the regularity and frequency necessary to fulfill its responsibilities under this Charter and the Consent Order. Specifically:
(a) During the Remediation Period. During the Consent Order remediation period, which extends from January 15, 2025 (the effective date of the Consent Order) through February 15, 2026 (the date by which full compliance program implementation and self-certification must be completed), the Committee shall meet no less frequently than once per calendar month. Monthly meetings shall be scheduled in advance and included on the Committee's annual calendar. The Chair may schedule additional meetings as circumstances require.
(b) Following the Remediation Period. Following the conclusion of the remediation period (after February 15, 2026), the Committee shall meet no less frequently than once per calendar quarter, or more often as circumstances require or as the Chair determines is necessary to fulfill the Committee's ongoing oversight responsibilities.
(c) Special Meetings. Special meetings of the Committee may be called at any time by the Chair, by any two (2) Committee Members, or at the request of the General Counsel (Gregory Nardone) or the Chief Compliance Officer (Patricia Langston). Notice of special meetings shall be given to all Committee Members as far in advance as practicable under the circumstances, and in no event less than twenty-four (24) hours before the meeting, unless waived by all Committee Members.
Section 5.2 — Quorum. A majority of the Committee Members then in office shall constitute a quorum for the transaction of business at any meeting of the Committee. With respect to the initial three-member Committee, a quorum shall consist of two (2) Committee Members. All actions of the Committee shall be taken by the affirmative vote of a majority of the Committee Members present at a meeting at which a quorum is present, except as otherwise provided by this Charter, BRFG's Bylaws, or applicable law. The Committee may also act by unanimous written consent in lieu of a meeting, to the extent permitted by BRFG's Bylaws and applicable law.
Section 5.3 — Attendance. The Committee may invite any director, officer, employee, advisor, or other person to attend all or any portion of a Committee meeting and to provide information, presentations, or responses to questions as the Committee deems appropriate. The following individuals shall be designated as regular attendees (in a non-voting capacity) at Committee meetings:
(a) Patricia Langston, Chief Compliance Officer;
(b) Thomas Ikeda, BSA Officer / AML Program Director;
(c) Gregory Nardone, General Counsel & Corporate Secretary; and
(d) Philip Hartmann, Partner, Calderwood & Harkness LLP (outside regulatory counsel).
Dr. Vivian Castellano, engagement lead of Thornfield Consulting Group LLC, or her designees (including Robert Eastman, Jennifer Hwang, or Nathaniel Burgess), may be invited to attend Committee meetings as appropriate, particularly in connection with the presentation or discussion of Thornfield deliverables, findings, or recommendations.
The Committee shall meet periodically in executive session without management present to facilitate candid discussion among the independent Committee Members regarding the performance of management, the adequacy of management's remediation efforts, and other sensitive matters. During the remediation period, the Committee shall conduct an executive session at each regularly scheduled monthly meeting. Outside counsel (Philip Hartmann or his designee from Calderwood & Harkness LLP) may be invited to attend executive sessions at the Chair's discretion.
Section 5.4 — Minutes. The Corporate Secretary or his designee shall prepare written minutes of each meeting of the Committee, which shall record the date, time, and place of the meeting; the names of Committee Members and other attendees present; a summary of the matters discussed; the actions taken and recommendations made; and any dissenting views expressed by Committee Members. Draft minutes shall be circulated to Committee Members for review within ten (10) business days following each meeting and shall be approved by the Committee at its next regularly scheduled meeting. Approved minutes shall be distributed to all members of the full Board and maintained in BRB's corporate records. Minutes shall be prepared with appropriate consideration of attorney-client privilege and work product protections, in consultation with outside counsel.
ARTICLE VI — REPORTING
Section 6.1 — Reporting to the Board. The Chair shall report to the full Board of Directors following each Committee meeting, summarizing the key discussions, findings, recommendations, decisions, and actions taken by the Committee. Such reports shall be provided in writing and may be supplemented by oral presentations at regularly scheduled Board meetings. During the Consent Order remediation period, written reports shall be provided to the Board at least monthly. Following the remediation period, written reports shall be provided to the Board at least quarterly. The Committee's reports to the Board shall include, at a minimum:
(a) a summary of the status of compliance with the Consent Order, including progress against milestones;
(b) a summary of key compliance metrics, as described in Section 6.2;
(c) a description of any material compliance issues, risks, or developments identified since the prior report;
(d) a summary of actions taken or directed by the Committee;
(e) a description of any recommendations requiring Board approval or action; and
(f) an update on budget utilization and any projected variances.
Section 6.2 — Key Reporting Metrics. The Committee shall receive and review the following compliance and remediation metrics on a regular basis. During the remediation period, these metrics shall be reported to the Committee at least monthly. Following the remediation period, these metrics shall be reported at least quarterly, unless the Committee determines that more frequent reporting is warranted.
(a) SAR Filing Volumes — Total SARs filed, broken out by channel (retail banking, commercial lending, wealth management, and BaaS), including BaaS-related SARs by individual partner;
(b) SAR Filing Timeliness — Average number of calendar days from initial alert generation to FinCEN filing, with a target of filing within 30 calendar days;
(c) SAR Backlog Status — Number of unreviewed alerts, investigations in progress, and SARs pending filing, measured against the June 30, 2025 backlog clearance target;
(d) OFAC Screening Hit Rates — Total number of initial OFAC screening hits, true-match rate, and false-positive rate, broken out by business line and BaaS partner;
(e) OFAC Screening Coverage Rates — Percentage of transactions screened against OFAC lists, by business line and BaaS partner, with a target of 100% coverage;
(f) Transaction Monitoring Alert Volumes and SAR Conversion Rates — Total alerts generated by the Veridian TMS, disposition of alerts (true positive, false positive, escalated to investigation, closed without action), and SAR conversion rate;
(g) CDD/EDD Remediation Progress — Number of accounts remediated, number remaining, and percentage complete, measured against the target of 47,000 accounts (50% by July 15, 2025; 100% by January 15, 2026);
(h) BSA/AML Risk Ratings by BaaS Partner — Current risk rating for each of BRB's 14 active BaaS partners, including any rating changes and the rationale therefor;
(i) Remediation Milestone Status — Status of each milestone identified in the master timeline tracker referenced in Section 4.3, including on-track, at-risk, and delayed designations;
(j) Staffing Levels and Training Completion Rates — Current BSA/AML staffing levels (permanent and temporary FTEs), hiring pipeline status, and training completion rates by audience segment;
(k) Independent Consultant Status and Deliverables — Status of Thornfield Consulting Group LLC's engagement, including key activities completed, deliverables received, and findings communicated;
(l) Technology Implementation Progress — Status of the Veridian TMS v.10.0 upgrade, including completion of design, development, testing (including UAT), deployment, and model validation milestones; and
(m) Budget Utilization — Actual expenditures to date against the $42,500,000 Remediation Budget, broken out by cost category, with projections of remaining costs and any anticipated variances.
Section 6.3 — Management Reporting Obligations. Management shall provide the Committee with timely, accurate, and complete reports as necessary to support the Committee's oversight responsibilities. Specifically:
(a) The Chief Compliance Officer (Patricia Langston) and the BSA Officer (Thomas Ikeda) shall jointly provide the Committee with monthly written reports containing the metrics specified in Section 6.2 above, along with narrative discussion of key trends, issues, risks, and management actions. During the remediation period, these reports shall be distributed to Committee Members no less than five (5) business days before each scheduled Committee meeting.
(b) The Chief Risk Officer (Melissa Chu) shall provide supplemental reports to the Committee regarding enterprise risk management implications of BSA/AML and OFAC compliance matters, third-party risk assessments for BaaS partners and technology vendors, and any changes to BRB's overall risk profile related to compliance matters, as requested by the Committee.
(c) The Head of Fintech Partnerships (Warren Ashby) shall provide supplemental reports regarding the operational and compliance performance of BaaS partners, partner relationship developments, and BaaS transaction volume and activity trends, as requested by the Committee.
(d) The Chief Information Officer / Chief Technology Officer (Linda Petrosian) shall provide supplemental reports regarding the status, risks, and issues associated with the Veridian TMS upgrade, OFAC screening system enhancements, and other technology-related remediation workstreams, as requested by the Committee.
ARTICLE VII — RELATIONSHIP TO OTHER BOARD COMMITTEES
Section 7.1 — Audit Committee. The Committee shall coordinate with the Audit Committee of the Board of Directors (chaired by Margaret Dao) on matters of overlapping jurisdiction. Areas of coordination shall include, but not be limited to:
(a) Independent Testing. BSA/AML independent testing results produced by Caldera & Pope LLP (engagement partner: Franklin Dorsey). The annual BSA/AML independent testing fee is approximately $1,100,000, and the annual external audit fee paid to Caldera & Pope LLP is approximately $3,400,000. The Audit Committee retains sole authority over the engagement and oversight of BRB's external auditors, including Caldera & Pope LLP in its capacity as external auditor; however, the Committee shall have the authority to review BSA/AML-specific testing results and to communicate its expectations regarding the scope and depth of BSA/AML testing to the Audit Committee.
(b) Internal Audit Findings. Internal Audit findings related to BSA/AML and OFAC compliance, including findings arising from the Internal Audit department's BSA/AML testing program, shall be reported to both the Committee and the Audit Committee. The Committee shall have primary responsibility for overseeing management's remediation of BSA/AML-specific Internal Audit findings, while the Audit Committee retains overall responsibility for the Internal Audit function.
(c) Financial Statement Implications. The financial statement and disclosure implications of the remediation program, the $14,500,000 CMP, and any related contingent liabilities or loss reserves shall be coordinated between the Committee and the Audit Committee, with the Audit Committee retaining primary jurisdiction over financial reporting matters.
The Committee and the Audit Committee shall hold at least one (1) joint session per calendar quarter during the Consent Order remediation period to coordinate oversight activities, share relevant information, and avoid unnecessary duplication of effort. Joint sessions may be conducted as part of, or in addition to, regularly scheduled meetings of either committee. The chairs of the Committee and the Audit Committee shall maintain open communication between joint sessions regarding any matters requiring coordination.
Section 7.2 — Risk Committee. The Committee shall coordinate with the Risk Committee of the Board of Directors (chaired by Arthur Connelly, Lead Independent Director) on matters of overlapping jurisdiction. Areas of coordination shall include, but not be limited to:
(a) Enterprise Risk Management. The enterprise risk management implications of BSA/AML and OFAC compliance deficiencies, including the impact on BRB's overall risk profile and risk appetite framework.
(b) Third-Party Risk Management. Third-party risk management matters related to BaaS fintech partnerships (including NovaPay Technologies Inc., FairLend Digital LLC, and VaultEdge Inc.) and technology vendors (including Veridian Analytics Inc. and, potentially, Ridgeline Data Systems LLC), to the extent that such matters implicate both compliance risk and broader third-party risk management policies and frameworks.
(c) Reputational Risk. Reputational risk arising from the Consent Order, the public disclosure thereof, potential further enforcement actions by the OCC, FinCEN, OFAC, or the DOJ, and adverse media coverage related to BRB's BSA/AML and OFAC compliance deficiencies.
(d) Model Risk Management. Model risk management matters related to the Veridian TMS and any successor or supplemental transaction monitoring systems, to the extent that such matters implicate both compliance risk and the enterprise-wide model risk management framework.
The Committee retains primary jurisdiction over all matters directly relating to BSA/AML and OFAC compliance program design, implementation, and effectiveness. The Risk Committee retains primary jurisdiction over the enterprise-wide risk management frameworks within which compliance risk is embedded, including the enterprise risk appetite framework, the enterprise risk assessment methodology, and the overall third-party risk management program. Both committees shall endeavor to coordinate their activities to avoid gaps in oversight, minimize duplication, and ensure consistent messaging to management.
Section 7.3 — Delineation of Authority. In the event of any disagreement between the Committee and any other Board committee regarding jurisdiction over, or the appropriate allocation of responsibility for, a particular matter, the full Board of Directors shall determine the appropriate allocation of responsibility. Pending such determination, both committees may exercise concurrent oversight over the disputed matter to ensure that no gap in oversight exists.
ARTICLE VIII — ANNUAL REVIEW
The Committee shall conduct an annual self-assessment of its own performance, effectiveness, and the adequacy of this Charter. The self-assessment shall evaluate whether the Committee has fulfilled its responsibilities as described

COMPLIANCE COMMITTEE CHARTER OF THE BOARD OF DIRECTORS OF BELMONT RIDGE FINANCIAL GROUP, INC.

Record

Parties

Dates

Amounts