1045-00002 · Calderwood & Harkness LLP · documents

compliance-committee-reporting-framework.docx DOCUMENT Antitrust

15 / 84 ← → ✕

PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT

CALDERWOOD & HARKNESS LLP 1251 Avenue of the Americas, 42nd Floor New York, New York 10020

Telephone: (212) 555-7800 Facsimile: (212) 555-7801

COMPLIANCE COMMITTEE REPORTING FRAMEWORK

Recommended Monthly and Quarterly Reporting Metrics and cadence

PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT This memorandum is protected by the attorney-client privilege and constitutes attorney work product prepared in anticipation of litigation and regulatory enforcement proceedings. It is intended solely for the use of the addressees identified herein and should not be disclosed, distributed, or reproduced without the prior written consent of Calderwood & Harkness LLP.

From: Calderwood & Harkness LLP

Philip Hartmann, Partner (Responsible Partner) Yuki Nakamura, Associate (Lead Associate)

To: Belmont Ridge Bank National Association — Board of Directors, Compliance Committee

James Rutherford, Chair, Compliance Committee

Copies to:

Gregory Nardone, General Counsel, Belmont Ridge Financial Group, Inc. Patricia Langston, Chief Compliance Officer, Belmont Ridge Bank National Association Thomas Ikeda, BSA Officer / AML Program Director, Belmont Ridge Bank National Association Melissa Chu, Chief Risk Officer, Belmont Ridge Financial Group, Inc.

Date: February __, 2025 (to be finalized prior to February 28, 2025 Board Resolution deadline)

Re: Recommended Reporting Framework for the Newly Established Compliance Committee of the Board of Directors of Belmont Ridge Financial Group, Inc., Pursuant to OCC Consent Order No. OCC-2025-003

C&H Matter No.: 1045-00002

Right-click to update Table of Contents

I. Purpose and Background

This memorandum sets forth Calderwood & Harkness LLP's ("C&H") recommendations for the reporting framework (the "Reporting Framework") to be adopted by the newly established Compliance Committee (the "Compliance Committee" or the "Committee") of the Board of Directors (the "Board") of Belmont Ridge Financial Group, Inc. ("BRFG") and its wholly owned national bank subsidiary, Belmont Ridge Bank National Association ("BRB" and, together with BRFG, the "Bank"). The Reporting Framework is intended to define the metrics, content, cadence, and workflow necessary for the Compliance Committee to fulfill its oversight responsibilities during the remediation period and on an ongoing basis thereafter.

The Compliance Committee, chaired by independent director James Rutherford, was created pursuant to the Board Resolution acknowledging and responding to the Consent Order issued by the Office of the Comptroller of the Currency ("OCC") designated as Consent Order No. OCC-2025-003 (the "Consent Order"), issued on January 15, 2025. The Consent Order identified five core categories of deficiency in BRB's Bank Secrecy Act / Anti-Money Laundering ("BSA/AML") and sanctions compliance program: (i) board-level oversight deficiencies, (ii) BSA/AML suspicious activity reporting failures, (iii) inadequate sanctions (OFAC) screening processes, (iv) deficient customer due diligence and enhanced due diligence ("CDD/EDD") procedures, and (v) inadequate oversight of Banking-as-a-Service ("BaaS") fintech partnerships. Among these, the Consent Order specifically identified board-level oversight deficiencies as foundational, noting that the Board's prior reporting and governance structures were insufficient to ensure effective supervision of the BSA/AML compliance program.

In particular, the Consent Order found that BSA/AML reporting to the Board had been conducted on only a quarterly basis and did not include key metrics that are essential for effective board oversight, including Suspicious Activity Report ("SAR") filing volumes and timeliness, Office of Foreign Assets Control ("OFAC") sanctions screening hit rates and true match rates, risk ratings assigned to BaaS fintech partners, and other quantitative indicators of program health. The OCC determined that these reporting gaps contributed to the Board's inability to identify and address the compliance deficiencies that ultimately gave rise to the enforcement action.

This Reporting Framework is designed to provide the Compliance Committee with timely, comprehensive, and actionable information sufficient to fulfill its oversight responsibilities under the Consent Order, applicable provisions of federal banking law (including 12 U.S.C. § 1818(b) and the BSA implementing regulations at 31 C.F.R. Chapter X), the interagency guidance on BSA/AML compliance programs issued by the Federal Financial Institutions Examination Council ("FFIEC"), and the Compliance Committee Charter adopted by the Board. The Framework addresses both the substance of the information to be reported and the procedural requirements for report preparation, review, approval, and distribution, with a view toward ensuring that all reports are produced in a manner that is consistent with privilege protections and regulatory expectations.

The Reporting Framework must also support the preparation of the quarterly progress reports that BRB is required to submit to the OCC under the Consent Order. The first such quarterly progress report is due to the OCC on September 15, 2025, and the second is due on December 15, 2025. In addition, the Consent Order requires BRB to submit a final compliance self-certification to the OCC by February 15, 2026, attesting to full implementation of all required remediation measures. The metrics and data collection processes established by this Framework are designed to ensure that the information necessary for these regulatory submissions is being continuously compiled, quality-assured, and organized throughout the remediation period, thereby reducing the risk of last-minute preparation burdens and ensuring the accuracy and completeness of each submission.

Finally, the Reporting Framework reflects the scope and scale of the remediation program that BRB has undertaken in response to the Consent Order. The Board has approved a total remediation budget of $42,500,000 (exclusive of the $14,500,000 civil money penalty assessed under the Consent Order), encompassing all five remediation workstreams. The Framework provides for detailed tracking of expenditures against this budget on a line-item basis, enabling the Compliance Committee to monitor resource utilization and identify potential budget variances in a timely manner.

C&H has prepared this memorandum in its capacity as outside regulatory counsel to BRFG and BRB in connection with the Consent Order remediation. The recommendations contained herein are based on C&H's review of the Consent Order, the Compliance Committee Charter, applicable regulatory guidance, and our experience advising financial institutions on consent order compliance and BSA/AML remediation programs. We have also consulted with BRB management, including Ms. Langston, Mr. Ikeda, and Mr. Nardone, in developing these recommendations.

II. Reporting Cadence

The Reporting Framework establishes four tiers of reporting cadence: (A) monthly reporting during the active remediation period, (B) quarterly reporting aligned with OCC filing deadlines, (C) ad hoc or event-driven reporting for material developments, and (D) a recommended post-remediation cadence to be adopted following the submission of the compliance self-certification. Each tier is described below.

A. Monthly Reporting

During the active remediation period, which runs from the effective date of the Consent Order on February 10, 2025, through the compliance self-certification deadline of February 15, 2026, the Compliance Committee should receive comprehensive monthly reports from BRB management. The primary report preparers and presenters should be the Chief Compliance Officer, Patricia Langston, and the BSA Officer and AML Program Director, Thomas Ikeda, in coordination with the other report owners identified in Section V of this memorandum. Monthly reporting at this cadence represents a significant enhancement over the quarterly-only reporting that the OCC identified as deficient and is consistent with industry best practices for institutions operating under consent orders.

Monthly reports should be delivered to the Compliance Committee no later than the tenth (10th) business day of each calendar month, covering the data and activities of the immediately preceding calendar month. For example, the monthly report covering the month of March 2025 should be delivered no later than the tenth business day of April 2025. This timeline provides sufficient lead time for data collection, quality assurance, and the multi-step review and approval process described in Section V below, while ensuring that the Committee receives information that is sufficiently current to support effective oversight.

Consistent with the Compliance Committee Charter, monthly Compliance Committee meetings should be convened during the remediation period for the purpose of receiving and discussing the monthly report, among other agenda items. The Committee Chair, Mr. Rutherford, should set the meeting schedule in advance for the full remediation period, typically on a date falling within the second or third week of each calendar month, to align with the report delivery timeline. C&H recommends that the monthly meetings include sufficient time for questioning of management presenters and discussion of any issues raised in the report, and that minutes be maintained by the Committee Secretary in accordance with the Compliance Committee Charter.

B. Quarterly Reporting

In addition to the monthly reports, a comprehensive quarterly report should be prepared that consolidates the monthly data from the preceding quarter, provides trend analysis and quarter-over-quarter comparisons, and aligns with the reporting format required for the OCC quarterly progress reports. The quarterly report is intended to serve dual purposes: first, as an enhanced reporting tool for the Compliance Committee and the full Board, and second, as the primary working document from which the OCC quarterly progress report submissions are prepared.

The quarterly reports correspond to the following OCC filing deadlines established by the Consent Order:

First Quarterly Progress Report: Due to the OCC on September 15, 2025, covering the remediation period from the Consent Order effective date through the end of the second calendar quarter of 2025.

Second Quarterly Progress Report: Due to the OCC on December 15, 2025, covering the third calendar quarter of 2025 and providing an updated status through the end of that quarter.

Each quarterly report should be reviewed and approved by the Compliance Committee before submission to the OCC. C&H recommends that the Committee hold a dedicated meeting, or allocate a substantial portion of a regularly scheduled meeting, to review and discuss the quarterly report at least fifteen (15) business days prior to each OCC filing deadline. This allows time for revisions based on Committee feedback, legal review by C&H and Mr. Nardone, and final approval by the Committee Chair before filing. The additional content recommended for inclusion in the quarterly report, beyond the monthly metrics, is described in Section IV of this memorandum.

C. Ad Hoc / Event-Driven Reporting

In addition to the regularly scheduled monthly and quarterly reporting, the Reporting Framework should include a mechanism for immediate, event-driven reporting to the Committee Chair and General Counsel when material developments occur that warrant prompt attention. The obligation to provide ad hoc reporting rests with all members of BRB management who are responsible for aspects of the remediation program, and particularly with Ms. Langston (Chief Compliance Officer), Mr. Ikeda (BSA Officer), and Mr. Nardone (General Counsel).

The following categories of events should trigger immediate reporting to the Committee Chair, James Rutherford, and the General Counsel, Gregory Nardone, with prompt notification to C&H (Philip Hartmann / Yuki Nakamura):

(a) Any communication from the OCC — whether from Jonathan Frey, Examiner-in-Charge, OCC Northeastern District Office, or from any other OCC official — or from FinCEN — whether from Angela Drummond, Associate Director of the Enforcement Division, or from any other FinCEN official — indicating potential additional enforcement action, the possibility of a criminal referral to the U.S. Department of Justice, or any material change in supervisory expectations or examination priorities related to the Consent Order or BRB's BSA/AML program.

(b) Any significant delay in or failure to meet a Consent Order milestone, including situations where management determines that a milestone is materially at risk of being missed and that the risk cannot be mitigated through ordinary course corrective actions. For purposes of this provision, a delay of more than ten (10) business days beyond a stated milestone deadline, or a determination by any workstream leader that a milestone cannot be achieved by the stated deadline, should trigger immediate reporting.

(c) Identification of any new sanctions screening gaps, material SAR filing failures (including the discovery of previously unreported suspicious activity involving amounts in excess of $25,000), or any potential OFAC blocking event requiring action under 31 C.F.R. Part 501, including the filing of a blocking report with OFAC.

(d) Any findings by Thornfield Consulting Group ("Thornfield") — whether communicated by Dr. Vivian Castellano, Robert Eastman, Jennifer Hwang, Nathaniel Burgess, or any other member of the Thornfield engagement team — that materially alter the scope, cost, or timeline of the remediation plan, or that identify previously unknown compliance deficiencies of a nature that could give rise to additional regulatory or enforcement risk.

(e) Any BaaS partner compliance failure or event that constitutes a termination trigger under the applicable BaaS program agreement or that could reasonably be expected to result in regulatory scrutiny, reputational harm, or material financial loss, including but not limited to the discovery that a BaaS partner has failed to implement required compliance controls, has engaged in deceptive or unfair practices, or has been the subject of its own enforcement action.

(f) Any material litigation, subpoena, or government investigation related to BRB's BSA/AML compliance program or BaaS operations, including any grand jury subpoena, civil investigative demand, or request for information from any federal or state law enforcement agency.

Upon receipt of an ad hoc report, the Committee Chair, in consultation with the General Counsel and C&H, should determine the appropriate response, which may include convening a special meeting of the Compliance Committee, notifying the full Board, engaging with the OCC or other regulatory authority, or taking other actions as warranted by the circumstances.

D. Post-Remediation Cadence (After February 15, 2026)

Following the completion of the remediation period and the submission of the compliance self-certification to the OCC on or before February 15, 2026, C&H recommends that the Compliance Committee transition from monthly to quarterly reporting as the permanent ongoing cadence. However, the breadth and depth of metrics established during the remediation period should be maintained in their entirety in the quarterly reports to ensure sustained compliance and continued board-level visibility into BSA/AML program health. A reduction in reporting frequency should not be accompanied by a reduction in reporting substance.

The transition to quarterly reporting should be contingent upon the following conditions: (i) the OCC has accepted the compliance self-certification without objection or the requirement for additional remediation; (ii) Thornfield has issued its final validation report confirming that the remediation has been satisfactorily completed; and (iii) the Compliance Committee has affirmatively determined that the Bank's compliance posture is such that quarterly reporting provides sufficient oversight. If any of these conditions is not satisfied, or if post-remediation developments warrant enhanced oversight, the Committee should retain the option to revert to monthly reporting at the discretion of the Committee Chair.

C&H further recommends that, even after the transition to quarterly reporting, the ad hoc / event-driven reporting protocols described in Section II.C above remain in full force and effect on a permanent basis.

III. Monthly Report — Recommended Content and Metrics

This Section sets forth the recommended content and specific metrics to be included in each monthly report to the Compliance Committee during the remediation period. The monthly report should be organized into the subsections described below, each of which corresponds to a critical area of the remediation program or the Bank's ongoing BSA/AML compliance operations. A sample monthly report template reflecting this organization is provided in Appendix A.

A. Executive Dashboard Summary

Each monthly report should open with a one-page executive dashboard that provides the Compliance Committee with a high-level summary of the status of the remediation program. The dashboard should be designed to allow Committee members to rapidly assess overall program health and identify areas requiring attention or escalation. The dashboard should include the following elements:

(i) Workstream Status Indicators. A traffic-light (Red / Amber / Green) status indicator for each of the five remediation workstreams: (1) BSA/AML Suspicious Activity Reporting, (2) OFAC Sanctions Screening, (3) Transaction Monitoring System Upgrade, (4) CDD/EDD Remediation, and (5) BaaS Partner Oversight. In addition to the workstream-level indicators, each major milestone within a workstream should also carry its own traffic-light indicator. Green should indicate that the workstream or milestone is on track and within budget; Amber should indicate that a potential risk to schedule or budget has been identified but that management believes the risk can be mitigated through planned corrective actions; and Red should indicate that the workstream or milestone is behind schedule, over budget, or otherwise at significant risk, requiring Committee attention and potential escalation.

(ii) Overall Remediation Program Status Assessment. A brief narrative (no more than one paragraph) prepared by the Chief Compliance Officer summarizing the overall status of the remediation program for the reporting period, including any significant developments, accomplishments, or concerns.

(iii) Key Actions Taken. A bullet-point list of the three to five most significant actions taken during the reporting period, such as completion of a milestone, execution of a key contract, filing of a significant regulatory submission, or implementation of a new control.

(iv) Key Actions Planned. A bullet-point list of the three to five most significant actions planned for the upcoming reporting period, with expected completion dates and responsible parties.

(v) Budget Summary. A high-level summary showing total remediation expenditure to date against the $42,500,000 budget, expressed both in dollar terms and as a percentage of total budget utilized.

The executive dashboard should be designed for clarity and conciseness. It should serve as a roadmap for the remainder of the monthly report, enabling Committee members to focus their attention on the areas of greatest concern during the Committee meeting.

B. SAR Filing Metrics

Suspicious activity reporting was identified in the Consent Order as one of the most critical areas of deficiency. The monthly report should therefore include detailed metrics related to SAR filing volumes, timeliness, quality, and the status of the lookback project. The following metrics should be reported on a monthly basis:

Total SARs Filed During Reporting Period. The total number of SARs filed with FinCEN during the reporting period, including both initial filings and continuing activity reports. This metric should be presented alongside prior-year benchmarks for context: BRB filed a total of 3,847 SARs in calendar year 2024 (an average of approximately 321 SARs per month) and 2,914 SARs in calendar year 2023 (an average of approximately 243 SARs per month). The substantial increase from CY 2023 to CY 2024 reflects, in part, the backlog clearance activities and enhanced monitoring that preceded the Consent Order. The Committee should be alert to significant month-over-month changes in SAR volume, which may indicate shifts in transaction monitoring effectiveness, changes in alert thresholds, or changes in the risk profile of the Bank's customer base or BaaS partner relationships.

Average SAR Filing Time. The average number of calendar days from the generation of a transaction monitoring alert to the filing of the SAR with FinCEN. As of the most recent assessment conducted by the OCC, BRB's average SAR filing time was approximately 78 days, which significantly exceeds the 30-day regulatory filing deadline established by FinCEN. The remediation target is to reduce the average SAR filing time to 30 days or less. This metric should be tracked monthly to assess progress toward the target and to identify any bottlenecks in the alert-to-SAR workflow.

SAR Filing Time Distribution. In addition to the average filing time, the monthly report should include a distribution analysis — presented as either a histogram or a detailed table — showing the number and percentage of SARs filed within specified time-to-file bands: 0–15 days, 16–30 days, 31–60 days, and 61 or more days. This distribution provides a more granular view of filing timeliness than the average alone and helps identify whether the average is being skewed by a small number of significantly delayed filings or whether systemic delays persist across the filing population.

SAR Backlog Status. The number of unreviewed transaction monitoring alerts remaining in the backlog queue. As of September 2024, the backlog was estimated at approximately 2,400 unreviewed alerts. The Consent Order requires that the backlog be fully cleared by June 30, 2025. This metric should be tracked monthly to assess the rate of clearance and to determine whether the Bank is on track to meet the June 30, 2025 deadline. The report should also include the number of alerts cleared during the reporting period and the average time to disposition for cleared alerts.

BaaS-Related SARs as a Proportion of Total SARs. Given the central role of BaaS partnerships in the compliance deficiencies identified by the Consent Order, the monthly report should separately track the proportion of total SARs that are attributable to BaaS partner-related activity. In CY 2024, BaaS-related SARs accounted for 2,108 of 3,847 total SARs, or approximately 54.8% of total filing volume. This metric enables the Committee to assess the relative risk contribution of the BaaS portfolio and to monitor whether any particular partner or category of partners is driving disproportionate SAR activity.

SARs by BaaS Partner. A further breakdown of BaaS-related SARs by individual BaaS partner, showing SAR volumes attributable to each of the Bank's significant BaaS relationships, including NovaPay Technologies, FairLend Digital, VaultEdge, and other partners. This partner-level granularity is essential for the Committee to exercise its oversight responsibility with respect to the BaaS program and to identify partners that may warrant enhanced monitoring, remediation requirements, or termination.

SAR Quality Metrics. The results of the BSA/AML team's quality assurance ("QA") sampling of SAR filings during the reporting period, including the QA error rate (percentage of sampled SARs with identified deficiencies), a summary of the most common error types, narrative quality scores (if a scoring rubric has been implemented), and a description of any corrective actions taken in response to QA findings. SAR quality is a critical component of BSA/AML program effectiveness and has been an area of focus in recent FinCEN enforcement actions and OCC examination findings.

Lookback Project Status. A detailed update on the SAR lookback project, which involves the retrospective review of historical transactions and customer activity to identify potential suspicious activity that may not have been detected or reported due to the compliance deficiencies identified in the Consent Order. The report should include the total number of lookback cases reviewed during the reporting period, the cumulative number reviewed to date, the number of SARs filed as a result of the lookback review, and the estimated percentage of completion against the overall lookback scope. Budget utilization should be tracked against the $5,500,000 lookback project budget, including costs attributable to both internal resources and external support (including Pinnacle Compliance Solutions and any C&H involvement).

C. OFAC Sanctions Screening Metrics

The Consent Order identified significant deficiencies in BRB's OFAC sanctions screening processes, particularly with respect to the BaaS channel. The monthly report should include the following sanctions screening metrics:

Total Transactions Screened. The total number of transactions screened against the OFAC Specially Designated Nationals ("SDN") List and other applicable sanctions lists during the reporting period. This figure should be broken down by channel: retail banking, commercial banking, wealth management, and BaaS. The channel-level breakdown enables the Committee to verify that screening coverage extends across all lines of business and to identify any channels where screening volumes appear inconsistent with expected transaction volumes.

Percentage of Total Transactions Screened. The percentage of all transactions processed by the Bank during the reporting period that were subject to OFAC screening. The target is 100% screening coverage across all channels. The Consent Order specifically identified a significant screening gap in the BaaS channel: approximately 12% of NovaPay Technologies transactions, representing approximately 3,800,000 of 31,700,000 NovaPay transactions processed in CY 2023, were not subjected to OFAC screening. This metric is critical for demonstrating that the screening gap has been fully remediated.

OFAC Screening Hit Rate. The total number of potential hits generated by the OFAC screening system during the reporting period. In CY 2024, BRB's screening system generated a total of 14,320 potential hits across all channels. The hit rate should be monitored over time to assess the effectiveness of list screening algorithms and tuning efforts.

True Match Rate. The number of hits that, upon review and investigation, were determined to be true positive matches requiring blocking or rejection action under OFAC regulations. In CY 2024, BRB identified 12 true positive matches out of 14,320 total hits. The true match rate is a key indicator of the effectiveness of the Bank's sanctions compliance program and should be closely monitored.

False Positive Rate. The percentage of total hits that were determined to be false positives (i.e., not true matches). Based on CY 2024 data, the false positive rate was approximately 99.9%, calculated as (14,320 − 12) ÷ 14,320. While a high false positive rate is common in sanctions screening, the Committee should track changes in this metric over time as the Bank implements tuning improvements and enhanced screening algorithms. A significant reduction in the false positive rate, achieved without a corresponding increase in the miss rate, would indicate improved screening efficiency.

BaaS Channel Screening Coverage. Specific reporting on the OFAC screening status of each of the Bank's 14 active BaaS fintech partners, including whether each partner's transaction flows are being screened in real time or in batch mode, the percentage of each partner's transactions that are covered by screening, and the timeline for achieving 100% real-time screening coverage for any partner that has not yet been fully onboarded to the Bank's screening infrastructure. This metric is central to the remediation of the BaaS-related OFAC screening deficiency cited in the Consent Order.

OFAC blocking/Rejection Events. The number of transactions blocked or rejected during the reporting period pursuant to OFAC regulations, together with confirmation of timely reporting to OFAC and the status of any ten-day blocking reports filed under 31 C.F.R. § 501.603. Any blocking or rejection event should be accompanied by a brief narrative describing the circumstances, the sanctions program implicated, and the disposition of the blocked funds.

Progress Toward November 1, 2025 Deadline. A specific status update on BRB's progress toward the Consent Order milestone requiring full OFAC screening operationalization across all BaaS channels by November 1, 2025. This update should include a project timeline showing completed, in-progress, and remaining implementation tasks, along with a risk assessment of the Bank's ability to meet the deadline.

D. Transaction Monitoring Metrics

The effectiveness of the Bank's transaction monitoring system ("TMS") is fundamental to the BSA/AML compliance program. The monthly report should include the following transaction monitoring metrics:

Total Alerts Generated. The total number of alerts generated by the Veridian TMS during the reporting period. In CY 2024, the Veridian TMS generated a total of approximately 41,500 alerts across all scenarios and rules. Monthly alert volumes should be tracked over time to identify trends, assess the impact of threshold adjustments and tuning changes, and evaluate the system's overall sensitivity.

Alert Disposition Breakdown. A breakdown of alert dispositions during the reporting period, categorized as follows: alerts closed with no action (i.e., determined to be non-suspicious upon review), alerts escalated for further investigation, and alerts that resulted in the filing of a SAR. This breakdown enables the Committee to assess the efficiency of the alert review process and to identify potential issues such as an excessive volume of non-actionable alerts or an unusually low escalation rate.

SAR Conversion Rate. The percentage of total alerts that resulted in the filing of a SAR, calculated as the number of SARs filed divided by the total number of alerts generated. In CY 2024, the SAR conversion rate was approximately 9.3% (3,847 SARs filed ÷ 41,500 total alerts). The SAR conversion rate is a widely used benchmark for TMS effectiveness, and significant changes in this rate — in either direction — may warrant further investigation and analysis. A declining conversion rate could indicate over-alerting or a change in the risk profile of monitored activity, while an increasing rate could suggest improved targeting or a deterioration in the risk environment.

Model Performance Indicators. Detailed reporting on the performance of individual TMS scenarios and rules, including alert volumes by scenario, the results of any tuning adjustments made during the reporting period, and a history of threshold changes. This information is critical for understanding how the TMS is performing at a granular level and for supporting the independent model validation process.

TMS Upgrade Status. A progress report on the implementation of Veridian TMS version 10.0 ("v.10.0"), including the status of development, testing, data migration, and deployment activities against the Consent Order milestone requiring completion of user acceptance testing ("UAT") and deployment by August 1, 2025. The report should identify any implementation risks, resource constraints, or dependencies that could affect the timeline, together with planned mitigating actions.

Model Validation Status. A progress report on the independent model validation of the Veridian TMS, which the Consent Order requires to be completed by October 1, 2025. The report should note that the last independent model validation was conducted in March 2021 and the last model tuning exercise was completed in October 2022, representing a significant gap in the Bank's model risk management practices. The status update should include the identity of the selected model validation firm (if not Thornfield), the scope of the validation engagement, and the expected timeline for completion.

E. CDD/EDD Remediation Progress

The Consent Order identified deficient CDD/EDD procedures as a core compliance deficiency, particularly with respect to high-risk accounts onboarded through BaaS partner channels. The monthly report should include the following CDD/EDD remediation metrics:

Total Accounts Remediated During Reporting Period. The number of high-risk accounts for which CDD/EDD documentation has been obtained, reviewed, and determined to be satisfactory during the reporting period. The total population of accounts requiring remediation has been identified as approximately 47,000 high-risk accounts that were found to lack adequate CDD/EDD documentation as of the commencement of the remediation program.

Cumulative Accounts Remediated and Percentage of Completion. The total number of accounts remediated to date, expressed both as a raw number and as a percentage of the 47,000-account remediation target. This cumulative metric enables the Committee to assess whether the remediation is proceeding at a pace consistent with achieving the required milestones.

Milestone Tracking. Specific status reporting against the two CDD/EDD remediation milestones established by the Consent Order:

• 50% Milestone (23,500 accounts): Target completion date of July 15, 2025.

• 100% Milestone (47,000 accounts): Target completion date of January 15, 2026.

For each milestone, the report should indicate whether the Bank is on track, at risk, or behind schedule, together with an explanation of any variances and a description of corrective actions being taken or planned.

Remediation by BaaS Partner. A breakdown showing CDD/EDD remediation progress for accounts attributable to each of the Bank's significant BaaS partners, including NovaPay Technologies, FairLend Digital, VaultEdge, and other fintech partner-onboarded accounts. This partner-level detail is necessary to identify any partners whose account populations are proving particularly difficult to remediate and to assess partner cooperation with the remediation effort.

Account Closures / Exits. The number of accounts closed or exited during the reporting period due to the Bank's inability to obtain satisfactory CDD/EDD documentation within the required timeframes or in accordance with the Bank's enhanced risk acceptance criteria. Account closures should be tracked as a subset of the overall remediation effort and should be reported alongside the reasons for closure and any applicable regulatory notifications (e.g., SAR filings related to the closure).

Budget Utilization. Expenditures incurred during the reporting period and on a cumulative basis against the $4,300,000 CDD/EDD remediation budget, including costs attributable to internal staffing, temporary staffing, technology tools, and external support.

F. BaaS Partner Risk Ratings and Oversight

The BaaS portfolio represents a significant and growing component of BRB's business and was a central focus of the Consent Order's findings. The monthly report should include the following BaaS partner oversight metrics:

Risk Rating Summary. A summary table showing the current BSA/AML risk rating assigned to each of the Bank's 14 active BaaS fintech partners, using the standardized BSA/AML risk assessment template that is being developed as part of the remediation program. Risk ratings should reflect an assessment of each partner's transaction volumes, customer risk profiles, geographic risk factors, product and service types, regulatory history, and the adequacy of the partner's own compliance controls. The risk rating methodology and any changes thereto should be described in the report.

Top Partners by Transaction Volume. Specific data on the Bank's three largest BaaS partners by transaction volume, which currently account for the substantial majority of BaaS activity:

• NovaPay Technologies: Approximately 41% of total BaaS transaction volume, representing approximately $30.5 billion in CY 2024 transaction volume.

• FairLend Digital: Approximately 28% of total BaaS transaction volume.

• VaultEdge: Approximately 18% of total BaaS transaction volume.

• Remaining 11 partners: Collectively approximately 13% of total BaaS transaction volume.

Total BaaS Transaction Volume. The aggregate dollar volume of transactions processed through all BaaS partner channels during the reporting period. In CY 2024, total BaaS transaction volume was approximately $74.3 billion, making BaaS a material line of business for the Bank.

BaaS Revenue. The total revenue attributable to BaaS partner relationships during the reporting period. In CY 2024, BaaS revenue totaled approximately $127.4 million. Reporting on BaaS revenue alongside compliance metrics provides the Committee with a balanced view of the risk-reward profile of the BaaS program.

Compliance Addendum Execution Status. Tracking of which of the 14 active BaaS partners have executed the revised BaaS program compliance addendum that is being developed as part of the remediation program. The addendum is expected to impose enhanced compliance obligations on BaaS partners, including requirements for cooperation with BRB's compliance monitoring, data sharing, and independent testing. The report should show the execution status for each partner (executed / in negotiation / not yet sent) and the expected timeline for full execution.

Escalation Events. A description of any partner-specific compliance failures, escalated issues, or termination triggers identified during the reporting period. The report should describe the nature of the event, the partner involved, the Bank's response, and the current status of any remediation or enforcement actions being taken.

Status of Compliance Remediation Letters. An update on the status of the compliance remediation letters that have been sent to NovaPay Technologies (attention: Ethan Garrison, CEO) and FairLend Digital (attention: Aisha Okonkwo, CEO), including the date of issuance, a summary of the remediation requirements communicated to each partner, the status of each partner's response, and an assessment of each partner's progress toward meeting the stated requirements.

G. Staffing and Resource Utilization

Adequate staffing is essential to the success of the remediation program and to the ongoing effectiveness of BRB's BSA/AML compliance program. The monthly report should include the following staffing and resource utilization metrics:

BSA/AML Department Headcount. The current number of full-time equivalent ("FTE") employees in the BSA/AML department, compared against the planned post-remediation target of 77 permanent FTEs. As of January 2025, the BSA/AML department had a total of 62 FTEs, reflecting a deficit of 15 positions against the target. The Bank's remediation plan calls for the addition of 15 new permanent hires at a fully loaded cost of approximately $2,250,000. The monthly report should show the current FTE count, the number of open positions, and the staffing gap relative to the target.

Hiring Progress. A detailed update on the status of the 15 planned permanent hires, including the number of positions for which offers have been extended and accepted, the number of positions in active recruiting pipeline (with expected start dates), and the number of positions that remain vacant with no active candidates. The report should identify any positions that have proven particularly difficult to fill and any strategies being employed to accelerate hiring, such as the use of executive recruiters, relocation incentives, or adjusted compensation packages.

Temporary Staffing. The deployment status of temporary staffing provided by Pinnacle Compliance Solutions LLC ("Pinnacle"), including the number of Pinnacle analysts currently on-site and actively performing work versus the 30-FTE contracted headcount. The Pinnacle engagement is governed by a 12-month contract with a total value of $3,600,000 (Statement of Work Reference: PCS-BRB-2025-0012). The report should also describe the types of work being performed by Pinnacle analysts (e.g., alert review, SAR drafting, CDD/EDD remediation) and any quality or performance issues identified.

Attrition / Turnover. The number of departures from the BSA/AML department during the reporting period, including voluntary resignations, involuntary terminations, and transfers to other departments. Attrition should be reported alongside the reasons for departure (where known) and the impact on the Bank's ability to maintain staffing levels during the remediation period. Elevated attrition in a department undergoing intensive remediation is a significant risk factor that warrants close monitoring.

H. Independent Consultant Status

The Consent Order requires BRB to engage an independent consultant to assess the Bank's BSA/AML compliance program and to validate the remediation. BRB has engaged Thornfield Consulting Group ("Thornfield") for this purpose under engagement reference TCG-BRB-2025-001. The monthly report should include the following information regarding Thornfield's activities:

Summary of Thornfield Activities. A narrative summary of the work performed by Thornfield during the reporting period, including on-site activities, document reviews, interviews conducted, testing performed, and any other significant engagement activities. The summary should be prepared in coordination with Thornfield to ensure accuracy.

Key Findings, Observations, or Recommendations. A summary of any significant findings, observations, or recommendations communicated by Thornfield during the reporting period, whether in formal written reports or in informal communications. The engagement team includes Dr. Vivian Castellano (engagement lead), Robert Eastman, Jennifer Hwang, and Nathaniel Burgess. The report should describe the nature and significance of each finding and the Bank's planned response.

Milestone Status. A status update on Thornfield's engagement milestones:

• On-site assessment commencement: March 1, 2025.

• Preliminary gap assessment delivery: April 15, 2025.

• Final validation report delivery: February 15, 2026.

For each milestone, the report should indicate whether Thornfield is on track to deliver by the stated date, together with an explanation of any anticipated delays and their potential impact on the overall remediation timeline.

Budget Status. A summary of fees invoiced and paid to Thornfield against the engagement budget, which consists of a $6,500,000 fixed fee (payable in monthly installments of $541,666.67) and a $400,000 expense cap, for a total engagement budget of $6,900,000. The report should identify any expense overruns or projected overruns and any disputes regarding invoicing.

I. Remediation Budget Tracking

Effective financial oversight of the remediation program is a core responsibility of the Compliance Committee and the Board. The monthly report should include a comprehensive budget tracking section covering the following:

Total Remediation Budget. Confirmation of the total Board-approved remediation budget of $42,500,000, exclusive of the $14,500,000 civil money penalty. The report should show total expenditure to date and remaining budget, both in absolute dollar terms and as a percentage of the total budget.

Line-Item Budget Utilization. A detailed breakdown of expenditures by budget line item, showing spend to date versus the approved budget for each category:

• Outside Counsel (Calderwood & Harkness LLP): Spend to date versus the $8,000,000 fee estimate, broken down by Phase 1 (remediation planning and implementation, estimated at $4,800,000) and Phase 2 (regulatory submissions and ongoing advisory, estimated at $3,200,000). The report should note the ±15% fee collar applicable to the engagement and the $9,200,000 overrun threshold above which General Counsel approval is required for continued engagement.

• Independent Consultant (Thornfield Consulting Group): Spend to date versus the $6,900,000 total budget ($6,500,000 in fees plus $400,000 in expenses).

• Technology Upgrade (Veridian TMS v.10.0): Spend to date versus the $4,700,000 technology upgrade budget, consisting of $2,800,000 in implementation costs and $1,900,000 in Year 1 incremental licensing fees.

• Temporary Staffing (Pinnacle Compliance Solutions LLC): Spend to date versus the $3,600,000 contracted amount.

• Internal Headcount Additions: Spend to date versus the $2,250,000 budget for 15 new permanent BSA/AML FTEs.

• SAR Lookback Project: Spend to date versus the $5,500,000 lookback project budget.

• CDD/EDD Remediation: Spend to date versus the $4,300,000 CDD/EDD remediation budget.

• Training and Policy Development: Spend to date versus the $1,800,000 training and policy development budget.

• Board/Governance Restructuring: Spend to date versus the $500,000 board and governance restructuring budget.

CMP Payment Status. Confirmation that the $14,500,000 civil money penalty assessed under the Consent Order was paid by the March 16, 2025 payment deadline, together with confirmation of the payment method, the Bank account from which the payment was remitted, and any OCC acknowledgment of receipt.

Variance Analysis. An analysis of any budget line items that are tracking materially above or below plan, with an explanation of the reasons for the variance and a description of any proposed corrective actions. For line items tracking above plan, the report should assess whether the variance can be absorbed within the overall $42,500,000 budget through offsets from other line items or whether a budget increase request to the Board may be necessary. C&H recommends that any single line-item variance in excess of 10% of the approved line-item budget be specifically identified and discussed in the report.

IV. Quarterly Report — Additional Content Beyond Monthly Metrics

In addition to the monthly metrics described in Section III, each quarterly report should include the following additional content areas. These additions are designed to provide the Compliance Committee and the Board with deeper analytical insight, to support the preparation of the OCC quarterly progress reports, and to address topics that do not require monthly granularity but are essential for effective quarterly oversight.

A. Trend Analysis

The quarterly report should include a comprehensive trend analysis section that presents quarter-over-quarter trends for all key metrics enumerated in Section III. The trend analysis should enable the Committee to assess the trajectory of the remediation effort, identify areas of improving or deteriorating performance, and evaluate whether the pace of progress is consistent with achieving the Consent Order milestones.

Specifically, the trend analysis should include comparative analysis against pre-remediation baselines, using CY 2023 and CY 2024 data as reference points. This comparison is important because it demonstrates the distance traveled from the conditions that gave rise to the Consent Order and provides context for current performance levels.

The trend analysis should be accompanied by graphical presentations of key trends, including but not limited to: SAR filing volumes (monthly and cumulative), SAR filing timeliness (distribution and average), OFAC screening coverage percentage over time, CDD/EDD remediation trajectory (cumulative accounts remediated versus target curve), alert volumes and disposition rates, and SAR conversion rates. Charts and graphs should be clearly labeled with data sources and should include annotations highlighting significant events or changes.

B. Consent Order Milestone Compliance Status

The quarterly report should include a detailed status report on each Consent Order milestone, presented in chronological order. This section serves as the primary tool for the Committee and the Board to assess whether BRB is meeting its obligations under the Consent Order on a timely basis. The milestones, as set forth in the Consent Order, are as follows:

For each milestone, the quarterly report should include: (i) the current status (met, on track, at risk, or missed); (ii) evidence of completion, if the milestone has been met (e.g., confirmation of payment, OCC acknowledgment letter, Thornfield deliverable, or internal completion memo); and (iii) if the milestone is at risk or has been missed, a detailed explanation of the circumstances, the impact on the overall remediation program, and the corrective action plan being implemented to address the delay.

C. Regulatory Interaction Summary

The quarterly report should include a comprehensive summary of all communications between BRB and its regulators during the quarter, with a particular focus on communications with the OCC and FinCEN related to the Consent Order.

All communications with the OCC, whether with Jonathan Frey, Examiner-in-Charge, at the OCC Northeastern District Office located at 340 Madison Avenue, New York, New York 10017, or with any other OCC official, should be catalogued and summarized. Similarly, all communications with FinCEN, including any communications with Angela Drummond, Associate Director of the Enforcement Division, should be included in the summary.

The regulatory interaction summary should cover: (i) the date, format (letter, email, telephone, in-person meeting), and participants of each communication; (ii) a brief summary of the topics discussed or information exchanged; (iii) the status of any outstanding requests from the OCC or FinCEN, including document requests, information requests, and follow-up questions; (iv) the status of any open issues or action items arising from regulatory communications; and (v) C&H's assessment of the regulatory posture and any indications regarding potential additional enforcement action, the possibility of a criminal referral to the U.S. Department of Justice, or a separate FinCEN enforcement action.

This section of the quarterly report should be prepared in close coordination with C&H and the General Counsel to ensure that the summary is accurate, complete, and appropriately sensitive to privilege considerations and regulatory diplomacy.

D. Thornfield Consulting Quarterly Summary

The quarterly report should include a comprehensive summary of Thornfield Consulting Group's findings, validation activities, and recommendations for the quarter. This summary should be more detailed than the monthly Thornfield status update and should provide the Committee with a thorough understanding of Thornfield's assessment of the Bank's remediation progress.

Specifically, the quarterly summary should include: (i) a description of all significant workstreams and activities undertaken by Thornfield during the quarter; (ii) a summary of all findings, whether preliminary or final, communicated by Thornfield during the quarter; (iii) Thornfield's assessment of whether each of the five remediation workstreams is on track, at risk, or behind schedule; (iv) any recommendations from Thornfield for adjustments to the remediation plan, timeline, or resource allocation; and (v) an overall assessment of whether the remediation program is on track to achieve Thornfield's final validation and the Bank's February 15, 2026 compliance self-certification.

E. Risk Assessment Update

The quarterly report should include an updated risk assessment covering the following dimensions of risk associated with the remediation program and the Bank's BSA/AML compliance posture:

• Regulatory Risk: The risk of additional enforcement action by the OCC, FinCEN, or other regulatory bodies, including the risk of an escalation from a consent order to a more severe enforcement measure (such as a formal cease and desist order, removal or prohibition actions against individuals, or the imposition of additional civil money penalties).

• Operational Risk: The risk that the Bank's BSA/AML compliance operations will fail to detect, prevent, or report suspicious activity or sanctions violations, whether due to staffing shortages, system failures, process breakdowns, or other operational factors.

• Reputational Risk: The risk of harm to the Bank's reputation arising from public disclosure of the Consent Order, adverse media coverage, customer attrition, or the loss of BaaS partner relationships.

• Financial Risk: The risk of financial loss arising from the remediation program (including budget overruns), the civil money penalty, potential additional fines or penalties, litigation costs, or the loss of BaaS-related revenue.

The risk assessment should also evaluate the adequacy of remaining budget and resources to complete the remediation program and should identify any emerging risks that have materialized or become more likely since the prior quarterly assessment. Emerging risks might include, for example, new regulatory guidance that expands the scope of the required remediation, unexpected BaaS partner issues (such as a partner becoming the subject of its own enforcement action), technology implementation delays affecting the Veridian TMS upgrade, or staffing challenges arising from elevated attrition or a competitive hiring environment for BSA/AML professionals.

F. External Auditor and Independent Testing

The quarterly report should include a summary of any activities undertaken by the Bank's external auditor, Caldera & Pope LLP ("Caldera & Pope"), engagement partner Franklin Dorsey, that are related to BSA/AML independent testing or the financial statement audit implications of the remediation program and the Consent Order.

Specifically, the report should cover: (i) the status of any BSA/AML independent testing engagement conducted by Caldera & Pope, including the scope, methodology, and timeline of the testing; (ii) a summary of any findings or observations from completed or in-progress testing; (iii) an assessment of how the Consent Order and remediation program may affect the Bank's financial statements, including any provisions, contingent liabilities, or disclosures related to the civil money penalty, remediation costs, or other Consent Order-related expenses; and (iv) the schedule for the next BSA/AML independent test, which should be coordinated with the Compliance Committee, the Audit Committee, and the internal audit function to avoid duplication and ensure appropriate coverage.

This section should also note the role of the Head of Internal Audit, Derek Ballard, in coordinating internal audit activities related to BSA/AML compliance with external testing and Thornfield's independent consultant engagement.

V. Reporting Responsibilities and Workflow

This Section describes the roles and responsibilities of the individuals and teams involved in the preparation, review, approval, and distribution of the monthly and quarterly reports, as well as the recordkeeping requirements applicable to all reports produced under this Framework.

A. Report Preparation

The following individuals are designated as the primary report owners for the reporting areas indicated. Each report owner is responsible for ensuring the accuracy, completeness, and timeliness of the data and narratives within their designated area, and for coordinating with other report owners as necessary to produce a coherent and integrated final report.

• Patricia Langston, Chief Compliance Officer — Overall report coordinator and signatory. Ms. Langston is responsible for assembling the final report from the contributions of each report owner, ensuring consistency of presentation and messaging, and certifying the completeness and accuracy of the report prior to submission for review.

• Thomas Ikeda, BSA Officer / AML Program Director — Report owner for SAR filing metrics (Section III.B), OFAC sanctions screening metrics (Section III.C), and transaction monitoring metrics (Section III.D). Mr. Ikeda is also responsible for providing data on staffing and resource utilization for the BSA/AML department (Section III.G) and for coordinating with Pinnacle Compliance Solutions on temporary staffing metrics.

• Warren Ashby, Head of Fintech Partnerships / BaaS Division — Report owner for BaaS partner risk ratings and oversight metrics (Section III.F), including partner transaction volumes, revenue, compliance addendum execution status, escalation events, and the status of compliance remediation letters.

• Linda Petrosian, CIO / CTO — Report owner for technology upgrade status, including the Veridian TMS v.10.0 implementation (Section III.D, TMS upgrade status) and any other technology-related remediation activities such as data extraction automation and screening system enhancements.

• Samantha Reeves, CFO — Report owner for budget tracking and financial data (Section III.I), including line-item budget utilization, CMP payment confirmation, variance analysis, and any financial statement implications of the remediation program.

• Derek Ballard, Head of Internal Audit — Report owner for independent testing coordination and internal audit findings, and responsible for contributing to the quarterly external auditor and independent testing section (Section IV.F).

Each report owner should prepare their section of the report using the approved template and deliver the completed section to Ms. Langston no later than the fifth (5th) business day of each calendar month. Ms. Langston should then assemble the complete draft report and deliver it for review no later than the seventh (7th) business day of each calendar month.

B. Review and Approval Chain

The following multi-step review and approval process should be followed for each monthly and quarterly report prior to distribution to the Compliance Committee:

Step 1: Draft Preparation. Draft report sections prepared by the BSA/AML team and other report owners under the direction and coordination of Thomas Ikeda and Patricia Langston.

Step 2: First-Level Review. Review by Patricia Langston (Chief Compliance Officer) and Melissa Chu (Chief Risk Officer) for substantive accuracy, completeness, and consistency. Ms. Langston and Ms. Chu should confirm that all required metrics are included, that the data is accurate and reconciled to source systems, and that the narrative descriptions fairly represent the status of the remediation program.

Step 3: Legal Review. Review by Gregory Nardone (General Counsel) and Calderwood & Harkness LLP (Philip Hartmann and/or Yuki Nakamura) for privilege protection, regulatory messaging, accuracy of legal conclusions, and overall presentation. The legal review should ensure that the report does not contain inadvertent privilege waivers, that characterizations of regulatory interactions are accurate and appropriately nuanced, and that the report is consistent with the Bank's positions in any pending or anticipated regulatory proceedings.

Step 4: Final Approval. Final review and approval by the Compliance Committee Chair, James Rutherford, prior to distribution to the full Compliance Committee. Mr. Rutherford should confirm that the report is ready for distribution and, if applicable, for presentation at the scheduled Compliance Committee meeting.

For quarterly reports that will support the preparation of OCC quarterly progress report submissions, an additional review step should be inserted between Step 3 and Step 4, in which C&H prepares or reviews the OCC submission draft to ensure alignment between the internal quarterly report and the regulatory filing.

C. Distribution

Monthly reports should be distributed to all members of t

PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT
CALDERWOOD & HARKNESS LLP 1251 Avenue of the Americas, 42nd Floor New York, New York 10020
Telephone: (212) 555-7800 Facsimile: (212) 555-7801
COMPLIANCE COMMITTEE REPORTING FRAMEWORK
Recommended Monthly and Quarterly Reporting Metrics and cadence
PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT This memorandum is protected by the attorney-client privilege and constitutes attorney work product prepared in anticipation of litigation and regulatory enforcement proceedings. It is intended solely for the use of the addressees identified herein and should not be disclosed, distributed, or reproduced without the prior written consent of Calderwood & Harkness LLP.
From: Calderwood & Harkness LLP
Philip Hartmann, Partner (Responsible Partner) Yuki Nakamura, Associate (Lead Associate)
To: Belmont Ridge Bank National Association — Board of Directors, Compliance Committee
James Rutherford, Chair, Compliance Committee
Copies to:
Gregory Nardone, General Counsel, Belmont Ridge Financial Group, Inc. Patricia Langston, Chief Compliance Officer, Belmont Ridge Bank National Association Thomas Ikeda, BSA Officer / AML Program Director, Belmont Ridge Bank National Association Melissa Chu, Chief Risk Officer, Belmont Ridge Financial Group, Inc.
Date: February __, 2025 (to be finalized prior to February 28, 2025 Board Resolution deadline)
Re: Recommended Reporting Framework for the Newly Established Compliance Committee of the Board of Directors of Belmont Ridge Financial Group, Inc., Pursuant to OCC Consent Order No. OCC-2025-003
C&H Matter No.: 1045-00002
Right-click to update Table of Contents
I. Purpose and Background
This memorandum sets forth Calderwood & Harkness LLP's ("C&H") recommendations for the reporting framework (the "Reporting Framework") to be adopted by the newly established Compliance Committee (the "Compliance Committee" or the "Committee") of the Board of Directors (the "Board") of Belmont Ridge Financial Group, Inc. ("BRFG") and its wholly owned national bank subsidiary, Belmont Ridge Bank National Association ("BRB" and, together with BRFG, the "Bank"). The Reporting Framework is intended to define the metrics, content, cadence, and workflow necessary for the Compliance Committee to fulfill its oversight responsibilities during the remediation period and on an ongoing basis thereafter.
The Compliance Committee, chaired by independent director James Rutherford, was created pursuant to the Board Resolution acknowledging and responding to the Consent Order issued by the Office of the Comptroller of the Currency ("OCC") designated as Consent Order No. OCC-2025-003 (the "Consent Order"), issued on January 15, 2025. The Consent Order identified five core categories of deficiency in BRB's Bank Secrecy Act / Anti-Money Laundering ("BSA/AML") and sanctions compliance program: (i) board-level oversight deficiencies, (ii) BSA/AML suspicious activity reporting failures, (iii) inadequate sanctions (OFAC) screening processes, (iv) deficient customer due diligence and enhanced due diligence ("CDD/EDD") procedures, and (v) inadequate oversight of Banking-as-a-Service ("BaaS") fintech partnerships. Among these, the Consent Order specifically identified board-level oversight deficiencies as foundational, noting that the Board's prior reporting and governance structures were insufficient to ensure effective supervision of the BSA/AML compliance program.
In particular, the Consent Order found that BSA/AML reporting to the Board had been conducted on only a quarterly basis and did not include key metrics that are essential for effective board oversight, including Suspicious Activity Report ("SAR") filing volumes and timeliness, Office of Foreign Assets Control ("OFAC") sanctions screening hit rates and true match rates, risk ratings assigned to BaaS fintech partners, and other quantitative indicators of program health. The OCC determined that these reporting gaps contributed to the Board's inability to identify and address the compliance deficiencies that ultimately gave rise to the enforcement action.
This Reporting Framework is designed to provide the Compliance Committee with timely, comprehensive, and actionable information sufficient to fulfill its oversight responsibilities under the Consent Order, applicable provisions of federal banking law (including 12 U.S.C. § 1818(b) and the BSA implementing regulations at 31 C.F.R. Chapter X), the interagency guidance on BSA/AML compliance programs issued by the Federal Financial Institutions Examination Council ("FFIEC"), and the Compliance Committee Charter adopted by the Board. The Framework addresses both the substance of the information to be reported and the procedural requirements for report preparation, review, approval, and distribution, with a view toward ensuring that all reports are produced in a manner that is consistent with privilege protections and regulatory expectations.
The Reporting Framework must also support the preparation of the quarterly progress reports that BRB is required to submit to the OCC under the Consent Order. The first such quarterly progress report is due to the OCC on September 15, 2025, and the second is due on December 15, 2025. In addition, the Consent Order requires BRB to submit a final compliance self-certification to the OCC by February 15, 2026, attesting to full implementation of all required remediation measures. The metrics and data collection processes established by this Framework are designed to ensure that the information necessary for these regulatory submissions is being continuously compiled, quality-assured, and organized throughout the remediation period, thereby reducing the risk of last-minute preparation burdens and ensuring the accuracy and completeness of each submission.
Finally, the Reporting Framework reflects the scope and scale of the remediation program that BRB has undertaken in response to the Consent Order. The Board has approved a total remediation budget of $42,500,000 (exclusive of the $14,500,000 civil money penalty assessed under the Consent Order), encompassing all five remediation workstreams. The Framework provides for detailed tracking of expenditures against this budget on a line-item basis, enabling the Compliance Committee to monitor resource utilization and identify potential budget variances in a timely manner.
C&H has prepared this memorandum in its capacity as outside regulatory counsel to BRFG and BRB in connection with the Consent Order remediation. The recommendations contained herein are based on C&H's review of the Consent Order, the Compliance Committee Charter, applicable regulatory guidance, and our experience advising financial institutions on consent order compliance and BSA/AML remediation programs. We have also consulted with BRB management, including Ms. Langston, Mr. Ikeda, and Mr. Nardone, in developing these recommendations.
II. Reporting Cadence
The Reporting Framework establishes four tiers of reporting cadence: (A) monthly reporting during the active remediation period, (B) quarterly reporting aligned with OCC filing deadlines, (C) ad hoc or event-driven reporting for material developments, and (D) a recommended post-remediation cadence to be adopted following the submission of the compliance self-certification. Each tier is described below.
A. Monthly Reporting
During the active remediation period, which runs from the effective date of the Consent Order on February 10, 2025, through the compliance self-certification deadline of February 15, 2026, the Compliance Committee should receive comprehensive monthly reports from BRB management. The primary report preparers and presenters should be the Chief Compliance Officer, Patricia Langston, and the BSA Officer and AML Program Director, Thomas Ikeda, in coordination with the other report owners identified in Section V of this memorandum. Monthly reporting at this cadence represents a significant enhancement over the quarterly-only reporting that the OCC identified as deficient and is consistent with industry best practices for institutions operating under consent orders.
Monthly reports should be delivered to the Compliance Committee no later than the tenth (10th) business day of each calendar month, covering the data and activities of the immediately preceding calendar month. For example, the monthly report covering the month of March 2025 should be delivered no later than the tenth business day of April 2025. This timeline provides sufficient lead time for data collection, quality assurance, and the multi-step review and approval process described in Section V below, while ensuring that the Committee receives information that is sufficiently current to support effective oversight.
Consistent with the Compliance Committee Charter, monthly Compliance Committee meetings should be convened during the remediation period for the purpose of receiving and discussing the monthly report, among other agenda items. The Committee Chair, Mr. Rutherford, should set the meeting schedule in advance for the full remediation period, typically on a date falling within the second or third week of each calendar month, to align with the report delivery timeline. C&H recommends that the monthly meetings include sufficient time for questioning of management presenters and discussion of any issues raised in the report, and that minutes be maintained by the Committee Secretary in accordance with the Compliance Committee Charter.
B. Quarterly Reporting
In addition to the monthly reports, a comprehensive quarterly report should be prepared that consolidates the monthly data from the preceding quarter, provides trend analysis and quarter-over-quarter comparisons, and aligns with the reporting format required for the OCC quarterly progress reports. The quarterly report is intended to serve dual purposes: first, as an enhanced reporting tool for the Compliance Committee and the full Board, and second, as the primary working document from which the OCC quarterly progress report submissions are prepared.
The quarterly reports correspond to the following OCC filing deadlines established by the Consent Order:
First Quarterly Progress Report: Due to the OCC on September 15, 2025, covering the remediation period from the Consent Order effective date through the end of the second calendar quarter of 2025.
Second Quarterly Progress Report: Due to the OCC on December 15, 2025, covering the third calendar quarter of 2025 and providing an updated status through the end of that quarter.
Each quarterly report should be reviewed and approved by the Compliance Committee before submission to the OCC. C&H recommends that the Committee hold a dedicated meeting, or allocate a substantial portion of a regularly scheduled meeting, to review and discuss the quarterly report at least fifteen (15) business days prior to each OCC filing deadline. This allows time for revisions based on Committee feedback, legal review by C&H and Mr. Nardone, and final approval by the Committee Chair before filing. The additional content recommended for inclusion in the quarterly report, beyond the monthly metrics, is described in Section IV of this memorandum.
C. Ad Hoc / Event-Driven Reporting
In addition to the regularly scheduled monthly and quarterly reporting, the Reporting Framework should include a mechanism for immediate, event-driven reporting to the Committee Chair and General Counsel when material developments occur that warrant prompt attention. The obligation to provide ad hoc reporting rests with all members of BRB management who are responsible for aspects of the remediation program, and particularly with Ms. Langston (Chief Compliance Officer), Mr. Ikeda (BSA Officer), and Mr. Nardone (General Counsel).
The following categories of events should trigger immediate reporting to the Committee Chair, James Rutherford, and the General Counsel, Gregory Nardone, with prompt notification to C&H (Philip Hartmann / Yuki Nakamura):
(a) Any communication from the OCC — whether from Jonathan Frey, Examiner-in-Charge, OCC Northeastern District Office, or from any other OCC official — or from FinCEN — whether from Angela Drummond, Associate Director of the Enforcement Division, or from any other FinCEN official — indicating potential additional enforcement action, the possibility of a criminal referral to the U.S. Department of Justice, or any material change in supervisory expectations or examination priorities related to the Consent Order or BRB's BSA/AML program.
(b) Any significant delay in or failure to meet a Consent Order milestone, including situations where management determines that a milestone is materially at risk of being missed and that the risk cannot be mitigated through ordinary course corrective actions. For purposes of this provision, a delay of more than ten (10) business days beyond a stated milestone deadline, or a determination by any workstream leader that a milestone cannot be achieved by the stated deadline, should trigger immediate reporting.
(c) Identification of any new sanctions screening gaps, material SAR filing failures (including the discovery of previously unreported suspicious activity involving amounts in excess of $25,000), or any potential OFAC blocking event requiring action under 31 C.F.R. Part 501, including the filing of a blocking report with OFAC.
(d) Any findings by Thornfield Consulting Group ("Thornfield") — whether communicated by Dr. Vivian Castellano, Robert Eastman, Jennifer Hwang, Nathaniel Burgess, or any other member of the Thornfield engagement team — that materially alter the scope, cost, or timeline of the remediation plan, or that identify previously unknown compliance deficiencies of a nature that could give rise to additional regulatory or enforcement risk.
(e) Any BaaS partner compliance failure or event that constitutes a termination trigger under the applicable BaaS program agreement or that could reasonably be expected to result in regulatory scrutiny, reputational harm, or material financial loss, including but not limited to the discovery that a BaaS partner has failed to implement required compliance controls, has engaged in deceptive or unfair practices, or has been the subject of its own enforcement action.
(f) Any material litigation, subpoena, or government investigation related to BRB's BSA/AML compliance program or BaaS operations, including any grand jury subpoena, civil investigative demand, or request for information from any federal or state law enforcement agency.
Upon receipt of an ad hoc report, the Committee Chair, in consultation with the General Counsel and C&H, should determine the appropriate response, which may include convening a special meeting of the Compliance Committee, notifying the full Board, engaging with the OCC or other regulatory authority, or taking other actions as warranted by the circumstances.
D. Post-Remediation Cadence (After February 15, 2026)
Following the completion of the remediation period and the submission of the compliance self-certification to the OCC on or before February 15, 2026, C&H recommends that the Compliance Committee transition from monthly to quarterly reporting as the permanent ongoing cadence. However, the breadth and depth of metrics established during the remediation period should be maintained in their entirety in the quarterly reports to ensure sustained compliance and continued board-level visibility into BSA/AML program health. A reduction in reporting frequency should not be accompanied by a reduction in reporting substance.
The transition to quarterly reporting should be contingent upon the following conditions: (i) the OCC has accepted the compliance self-certification without objection or the requirement for additional remediation; (ii) Thornfield has issued its final validation report confirming that the remediation has been satisfactorily completed; and (iii) the Compliance Committee has affirmatively determined that the Bank's compliance posture is such that quarterly reporting provides sufficient oversight. If any of these conditions is not satisfied, or if post-remediation developments warrant enhanced oversight, the Committee should retain the option to revert to monthly reporting at the discretion of the Committee Chair.
C&H further recommends that, even after the transition to quarterly reporting, the ad hoc / event-driven reporting protocols described in Section II.C above remain in full force and effect on a permanent basis.
III. Monthly Report — Recommended Content and Metrics
This Section sets forth the recommended content and specific metrics to be included in each monthly report to the Compliance Committee during the remediation period. The monthly report should be organized into the subsections described below, each of which corresponds to a critical area of the remediation program or the Bank's ongoing BSA/AML compliance operations. A sample monthly report template reflecting this organization is provided in Appendix A.
A. Executive Dashboard Summary
Each monthly report should open with a one-page executive dashboard that provides the Compliance Committee with a high-level summary of the status of the remediation program. The dashboard should be designed to allow Committee members to rapidly assess overall program health and identify areas requiring attention or escalation. The dashboard should include the following elements:
(i) Workstream Status Indicators. A traffic-light (Red / Amber / Green) status indicator for each of the five remediation workstreams: (1) BSA/AML Suspicious Activity Reporting, (2) OFAC Sanctions Screening, (3) Transaction Monitoring System Upgrade, (4) CDD/EDD Remediation, and (5) BaaS Partner Oversight. In addition to the workstream-level indicators, each major milestone within a workstream should also carry its own traffic-light indicator. Green should indicate that the workstream or milestone is on track and within budget; Amber should indicate that a potential risk to schedule or budget has been identified but that management believes the risk can be mitigated through planned corrective actions; and Red should indicate that the workstream or milestone is behind schedule, over budget, or otherwise at significant risk, requiring Committee attention and potential escalation.
(ii) Overall Remediation Program Status Assessment. A brief narrative (no more than one paragraph) prepared by the Chief Compliance Officer summarizing the overall status of the remediation program for the reporting period, including any significant developments, accomplishments, or concerns.
(iii) Key Actions Taken. A bullet-point list of the three to five most significant actions taken during the reporting period, such as completion of a milestone, execution of a key contract, filing of a significant regulatory submission, or implementation of a new control.
(iv) Key Actions Planned. A bullet-point list of the three to five most significant actions planned for the upcoming reporting period, with expected completion dates and responsible parties.
(v) Budget Summary. A high-level summary showing total remediation expenditure to date against the $42,500,000 budget, expressed both in dollar terms and as a percentage of total budget utilized.
The executive dashboard should be designed for clarity and conciseness. It should serve as a roadmap for the remainder of the monthly report, enabling Committee members to focus their attention on the areas of greatest concern during the Committee meeting.
B. SAR Filing Metrics
Suspicious activity reporting was identified in the Consent Order as one of the most critical areas of deficiency. The monthly report should therefore include detailed metrics related to SAR filing volumes, timeliness, quality, and the status of the lookback project. The following metrics should be reported on a monthly basis:
Total SARs Filed During Reporting Period. The total number of SARs filed with FinCEN during the reporting period, including both initial filings and continuing activity reports. This metric should be presented alongside prior-year benchmarks for context: BRB filed a total of 3,847 SARs in calendar year 2024 (an average of approximately 321 SARs per month) and 2,914 SARs in calendar year 2023 (an average of approximately 243 SARs per month). The substantial increase from CY 2023 to CY 2024 reflects, in part, the backlog clearance activities and enhanced monitoring that preceded the Consent Order. The Committee should be alert to significant month-over-month changes in SAR volume, which may indicate shifts in transaction monitoring effectiveness, changes in alert thresholds, or changes in the risk profile of the Bank's customer base or BaaS partner relationships.
Average SAR Filing Time. The average number of calendar days from the generation of a transaction monitoring alert to the filing of the SAR with FinCEN. As of the most recent assessment conducted by the OCC, BRB's average SAR filing time was approximately 78 days, which significantly exceeds the 30-day regulatory filing deadline established by FinCEN. The remediation target is to reduce the average SAR filing time to 30 days or less. This metric should be tracked monthly to assess progress toward the target and to identify any bottlenecks in the alert-to-SAR workflow.
SAR Filing Time Distribution. In addition to the average filing time, the monthly report should include a distribution analysis — presented as either a histogram or a detailed table — showing the number and percentage of SARs filed within specified time-to-file bands: 0–15 days, 16–30 days, 31–60 days, and 61 or more days. This distribution provides a more granular view of filing timeliness than the average alone and helps identify whether the average is being skewed by a small number of significantly delayed filings or whether systemic delays persist across the filing population.
SAR Backlog Status. The number of unreviewed transaction monitoring alerts remaining in the backlog queue. As of September 2024, the backlog was estimated at approximately 2,400 unreviewed alerts. The Consent Order requires that the backlog be fully cleared by June 30, 2025. This metric should be tracked monthly to assess the rate of clearance and to determine whether the Bank is on track to meet the June 30, 2025 deadline. The report should also include the number of alerts cleared during the reporting period and the average time to disposition for cleared alerts.
BaaS-Related SARs as a Proportion of Total SARs. Given the central role of BaaS partnerships in the compliance deficiencies identified by the Consent Order, the monthly report should separately track the proportion of total SARs that are attributable to BaaS partner-related activity. In CY 2024, BaaS-related SARs accounted for 2,108 of 3,847 total SARs, or approximately 54.8% of total filing volume. This metric enables the Committee to assess the relative risk contribution of the BaaS portfolio and to monitor whether any particular partner or category of partners is driving disproportionate SAR activity.
SARs by BaaS Partner. A further breakdown of BaaS-related SARs by individual BaaS partner, showing SAR volumes attributable to each of the Bank's significant BaaS relationships, including NovaPay Technologies, FairLend Digital, VaultEdge, and other partners. This partner-level granularity is essential for the Committee to exercise its oversight responsibility with respect to the BaaS program and to identify partners that may warrant enhanced monitoring, remediation requirements, or termination.
SAR Quality Metrics. The results of the BSA/AML team's quality assurance ("QA") sampling of SAR filings during the reporting period, including the QA error rate (percentage of sampled SARs with identified deficiencies), a summary of the most common error types, narrative quality scores (if a scoring rubric has been implemented), and a description of any corrective actions taken in response to QA findings. SAR quality is a critical component of BSA/AML program effectiveness and has been an area of focus in recent FinCEN enforcement actions and OCC examination findings.
Lookback Project Status. A detailed update on the SAR lookback project, which involves the retrospective review of historical transactions and customer activity to identify potential suspicious activity that may not have been detected or reported due to the compliance deficiencies identified in the Consent Order. The report should include the total number of lookback cases reviewed during the reporting period, the cumulative number reviewed to date, the number of SARs filed as a result of the lookback review, and the estimated percentage of completion against the overall lookback scope. Budget utilization should be tracked against the $5,500,000 lookback project budget, including costs attributable to both internal resources and external support (including Pinnacle Compliance Solutions and any C&H involvement).
C. OFAC Sanctions Screening Metrics
The Consent Order identified significant deficiencies in BRB's OFAC sanctions screening processes, particularly with respect to the BaaS channel. The monthly report should include the following sanctions screening metrics:
Total Transactions Screened. The total number of transactions screened against the OFAC Specially Designated Nationals ("SDN") List and other applicable sanctions lists during the reporting period. This figure should be broken down by channel: retail banking, commercial banking, wealth management, and BaaS. The channel-level breakdown enables the Committee to verify that screening coverage extends across all lines of business and to identify any channels where screening volumes appear inconsistent with expected transaction volumes.
Percentage of Total Transactions Screened. The percentage of all transactions processed by the Bank during the reporting period that were subject to OFAC screening. The target is 100% screening coverage across all channels. The Consent Order specifically identified a significant screening gap in the BaaS channel: approximately 12% of NovaPay Technologies transactions, representing approximately 3,800,000 of 31,700,000 NovaPay transactions processed in CY 2023, were not subjected to OFAC screening. This metric is critical for demonstrating that the screening gap has been fully remediated.
OFAC Screening Hit Rate. The total number of potential hits generated by the OFAC screening system during the reporting period. In CY 2024, BRB's screening system generated a total of 14,320 potential hits across all channels. The hit rate should be monitored over time to assess the effectiveness of list screening algorithms and tuning efforts.
True Match Rate. The number of hits that, upon review and investigation, were determined to be true positive matches requiring blocking or rejection action under OFAC regulations. In CY 2024, BRB identified 12 true positive matches out of 14,320 total hits. The true match rate is a key indicator of the effectiveness of the Bank's sanctions compliance program and should be closely monitored.
False Positive Rate. The percentage of total hits that were determined to be false positives (i.e., not true matches). Based on CY 2024 data, the false positive rate was approximately 99.9%, calculated as (14,320 − 12) ÷ 14,320. While a high false positive rate is common in sanctions screening, the Committee should track changes in this metric over time as the Bank implements tuning improvements and enhanced screening algorithms. A significant reduction in the false positive rate, achieved without a corresponding increase in the miss rate, would indicate improved screening efficiency.
BaaS Channel Screening Coverage. Specific reporting on the OFAC screening status of each of the Bank's 14 active BaaS fintech partners, including whether each partner's transaction flows are being screened in real time or in batch mode, the percentage of each partner's transactions that are covered by screening, and the timeline for achieving 100% real-time screening coverage for any partner that has not yet been fully onboarded to the Bank's screening infrastructure. This metric is central to the remediation of the BaaS-related OFAC screening deficiency cited in the Consent Order.
OFAC blocking/Rejection Events. The number of transactions blocked or rejected during the reporting period pursuant to OFAC regulations, together with confirmation of timely reporting to OFAC and the status of any ten-day blocking reports filed under 31 C.F.R. § 501.603. Any blocking or rejection event should be accompanied by a brief narrative describing the circumstances, the sanctions program implicated, and the disposition of the blocked funds.
Progress Toward November 1, 2025 Deadline. A specific status update on BRB's progress toward the Consent Order milestone requiring full OFAC screening operationalization across all BaaS channels by November 1, 2025. This update should include a project timeline showing completed, in-progress, and remaining implementation tasks, along with a risk assessment of the Bank's ability to meet the deadline.
D. Transaction Monitoring Metrics
The effectiveness of the Bank's transaction monitoring system ("TMS") is fundamental to the BSA/AML compliance program. The monthly report should include the following transaction monitoring metrics:
Total Alerts Generated. The total number of alerts generated by the Veridian TMS during the reporting period. In CY 2024, the Veridian TMS generated a total of approximately 41,500 alerts across all scenarios and rules. Monthly alert volumes should be tracked over time to identify trends, assess the impact of threshold adjustments and tuning changes, and evaluate the system's overall sensitivity.
Alert Disposition Breakdown. A breakdown of alert dispositions during the reporting period, categorized as follows: alerts closed with no action (i.e., determined to be non-suspicious upon review), alerts escalated for further investigation, and alerts that resulted in the filing of a SAR. This breakdown enables the Committee to assess the efficiency of the alert review process and to identify potential issues such as an excessive volume of non-actionable alerts or an unusually low escalation rate.
SAR Conversion Rate. The percentage of total alerts that resulted in the filing of a SAR, calculated as the number of SARs filed divided by the total number of alerts generated. In CY 2024, the SAR conversion rate was approximately 9.3% (3,847 SARs filed ÷ 41,500 total alerts). The SAR conversion rate is a widely used benchmark for TMS effectiveness, and significant changes in this rate — in either direction — may warrant further investigation and analysis. A declining conversion rate could indicate over-alerting or a change in the risk profile of monitored activity, while an increasing rate could suggest improved targeting or a deterioration in the risk environment.
Model Performance Indicators. Detailed reporting on the performance of individual TMS scenarios and rules, including alert volumes by scenario, the results of any tuning adjustments made during the reporting period, and a history of threshold changes. This information is critical for understanding how the TMS is performing at a granular level and for supporting the independent model validation process.
TMS Upgrade Status. A progress report on the implementation of Veridian TMS version 10.0 ("v.10.0"), including the status of development, testing, data migration, and deployment activities against the Consent Order milestone requiring completion of user acceptance testing ("UAT") and deployment by August 1, 2025. The report should identify any implementation risks, resource constraints, or dependencies that could affect the timeline, together with planned mitigating actions.
Model Validation Status. A progress report on the independent model validation of the Veridian TMS, which the Consent Order requires to be completed by October 1, 2025. The report should note that the last independent model validation was conducted in March 2021 and the last model tuning exercise was completed in October 2022, representing a significant gap in the Bank's model risk management practices. The status update should include the identity of the selected model validation firm (if not Thornfield), the scope of the validation engagement, and the expected timeline for completion.
E. CDD/EDD Remediation Progress
The Consent Order identified deficient CDD/EDD procedures as a core compliance deficiency, particularly with respect to high-risk accounts onboarded through BaaS partner channels. The monthly report should include the following CDD/EDD remediation metrics:
Total Accounts Remediated During Reporting Period. The number of high-risk accounts for which CDD/EDD documentation has been obtained, reviewed, and determined to be satisfactory during the reporting period. The total population of accounts requiring remediation has been identified as approximately 47,000 high-risk accounts that were found to lack adequate CDD/EDD documentation as of the commencement of the remediation program.
Cumulative Accounts Remediated and Percentage of Completion. The total number of accounts remediated to date, expressed both as a raw number and as a percentage of the 47,000-account remediation target. This cumulative metric enables the Committee to assess whether the remediation is proceeding at a pace consistent with achieving the required milestones.
Milestone Tracking. Specific status reporting against the two CDD/EDD remediation milestones established by the Consent Order:
•  50% Milestone (23,500 accounts): Target completion date of July 15, 2025.
•  100% Milestone (47,000 accounts): Target completion date of January 15, 2026.
For each milestone, the report should indicate whether the Bank is on track, at risk, or behind schedule, together with an explanation of any variances and a description of corrective actions being taken or planned.
Remediation by BaaS Partner. A breakdown showing CDD/EDD remediation progress for accounts attributable to each of the Bank's significant BaaS partners, including NovaPay Technologies, FairLend Digital, VaultEdge, and other fintech partner-onboarded accounts. This partner-level detail is necessary to identify any partners whose account populations are proving particularly difficult to remediate and to assess partner cooperation with the remediation effort.
Account Closures / Exits. The number of accounts closed or exited during the reporting period due to the Bank's inability to obtain satisfactory CDD/EDD documentation within the required timeframes or in accordance with the Bank's enhanced risk acceptance criteria. Account closures should be tracked as a subset of the overall remediation effort and should be reported alongside the reasons for closure and any applicable regulatory notifications (e.g., SAR filings related to the closure).
Budget Utilization. Expenditures incurred during the reporting period and on a cumulative basis against the $4,300,000 CDD/EDD remediation budget, including costs attributable to internal staffing, temporary staffing, technology tools, and external support.
F. BaaS Partner Risk Ratings and Oversight
The BaaS portfolio represents a significant and growing component of BRB's business and was a central focus of the Consent Order's findings. The monthly report should include the following BaaS partner oversight metrics:
Risk Rating Summary. A summary table showing the current BSA/AML risk rating assigned to each of the Bank's 14 active BaaS fintech partners, using the standardized BSA/AML risk assessment template that is being developed as part of the remediation program. Risk ratings should reflect an assessment of each partner's transaction volumes, customer risk profiles, geographic risk factors, product and service types, regulatory history, and the adequacy of the partner's own compliance controls. The risk rating methodology and any changes thereto should be described in the report.
Top Partners by Transaction Volume. Specific data on the Bank's three largest BaaS partners by transaction volume, which currently account for the substantial majority of BaaS activity:
•  NovaPay Technologies: Approximately 41% of total BaaS transaction volume, representing approximately $30.5 billion in CY 2024 transaction volume.
•  FairLend Digital: Approximately 28% of total BaaS transaction volume.
•  VaultEdge: Approximately 18% of total BaaS transaction volume.
•  Remaining 11 partners: Collectively approximately 13% of total BaaS transaction volume.
Total BaaS Transaction Volume. The aggregate dollar volume of transactions processed through all BaaS partner channels during the reporting period. In CY 2024, total BaaS transaction volume was approximately $74.3 billion, making BaaS a material line of business for the Bank.
BaaS Revenue. The total revenue attributable to BaaS partner relationships during the reporting period. In CY 2024, BaaS revenue totaled approximately $127.4 million. Reporting on BaaS revenue alongside compliance metrics provides the Committee with a balanced view of the risk-reward profile of the BaaS program.
Compliance Addendum Execution Status. Tracking of which of the 14 active BaaS partners have executed the revised BaaS program compliance addendum that is being developed as part of the remediation program. The addendum is expected to impose enhanced compliance obligations on BaaS partners, including requirements for cooperation with BRB's compliance monitoring, data sharing, and independent testing. The report should show the execution status for each partner (executed / in negotiation / not yet sent) and the expected timeline for full execution.
Escalation Events. A description of any partner-specific compliance failures, escalated issues, or termination triggers identified during the reporting period. The report should describe the nature of the event, the partner involved, the Bank's response, and the current status of any remediation or enforcement actions being taken.
Status of Compliance Remediation Letters. An update on the status of the compliance remediation letters that have been sent to NovaPay Technologies (attention: Ethan Garrison, CEO) and FairLend Digital (attention: Aisha Okonkwo, CEO), including the date of issuance, a summary of the remediation requirements communicated to each partner, the status of each partner's response, and an assessment of each partner's progress toward meeting the stated requirements.
G. Staffing and Resource Utilization
Adequate staffing is essential to the success of the remediation program and to the ongoing effectiveness of BRB's BSA/AML compliance program. The monthly report should include the following staffing and resource utilization metrics:
BSA/AML Department Headcount. The current number of full-time equivalent ("FTE") employees in the BSA/AML department, compared against the planned post-remediation target of 77 permanent FTEs. As of January 2025, the BSA/AML department had a total of 62 FTEs, reflecting a deficit of 15 positions against the target. The Bank's remediation plan calls for the addition of 15 new permanent hires at a fully loaded cost of approximately $2,250,000. The monthly report should show the current FTE count, the number of open positions, and the staffing gap relative to the target.
Hiring Progress. A detailed update on the status of the 15 planned permanent hires, including the number of positions for which offers have been extended and accepted, the number of positions in active recruiting pipeline (with expected start dates), and the number of positions that remain vacant with no active candidates. The report should identify any positions that have proven particularly difficult to fill and any strategies being employed to accelerate hiring, such as the use of executive recruiters, relocation incentives, or adjusted compensation packages.
Temporary Staffing. The deployment status of temporary staffing provided by Pinnacle Compliance Solutions LLC ("Pinnacle"), including the number of Pinnacle analysts currently on-site and actively performing work versus the 30-FTE contracted headcount. The Pinnacle engagement is governed by a 12-month contract with a total value of $3,600,000 (Statement of Work Reference: PCS-BRB-2025-0012). The report should also describe the types of work being performed by Pinnacle analysts (e.g., alert review, SAR drafting, CDD/EDD remediation) and any quality or performance issues identified.
Attrition / Turnover. The number of departures from the BSA/AML department during the reporting period, including voluntary resignations, involuntary terminations, and transfers to other departments. Attrition should be reported alongside the reasons for departure (where known) and the impact on the Bank's ability to maintain staffing levels during the remediation period. Elevated attrition in a department undergoing intensive remediation is a significant risk factor that warrants close monitoring.
H. Independent Consultant Status
The Consent Order requires BRB to engage an independent consultant to assess the Bank's BSA/AML compliance program and to validate the remediation. BRB has engaged Thornfield Consulting Group ("Thornfield") for this purpose under engagement reference TCG-BRB-2025-001. The monthly report should include the following information regarding Thornfield's activities:
Summary of Thornfield Activities. A narrative summary of the work performed by Thornfield during the reporting period, including on-site activities, document reviews, interviews conducted, testing performed, and any other significant engagement activities. The summary should be prepared in coordination with Thornfield to ensure accuracy.
Key Findings, Observations, or Recommendations. A summary of any significant findings, observations, or recommendations communicated by Thornfield during the reporting period, whether in formal written reports or in informal communications. The engagement team includes Dr. Vivian Castellano (engagement lead), Robert Eastman, Jennifer Hwang, and Nathaniel Burgess. The report should describe the nature and significance of each finding and the Bank's planned response.
Milestone Status. A status update on Thornfield's engagement milestones:
•  On-site assessment commencement: March 1, 2025.
•  Preliminary gap assessment delivery: April 15, 2025.
•  Final validation report delivery: February 15, 2026.
For each milestone, the report should indicate whether Thornfield is on track to deliver by the stated date, together with an explanation of any anticipated delays and their potential impact on the overall remediation timeline.
Budget Status. A summary of fees invoiced and paid to Thornfield against the engagement budget, which consists of a $6,500,000 fixed fee (payable in monthly installments of $541,666.67) and a $400,000 expense cap, for a total engagement budget of $6,900,000. The report should identify any expense overruns or projected overruns and any disputes regarding invoicing.
I. Remediation Budget Tracking
Effective financial oversight of the remediation program is a core responsibility of the Compliance Committee and the Board. The monthly report should include a comprehensive budget tracking section covering the following:
Total Remediation Budget. Confirmation of the total Board-approved remediation budget of $42,500,000, exclusive of the $14,500,000 civil money penalty. The report should show total expenditure to date and remaining budget, both in absolute dollar terms and as a percentage of the total budget.
Line-Item Budget Utilization. A detailed breakdown of expenditures by budget line item, showing spend to date versus the approved budget for each category:
•  Outside Counsel (Calderwood & Harkness LLP): Spend to date versus the $8,000,000 fee estimate, broken down by Phase 1 (remediation planning and implementation, estimated at $4,800,000) and Phase 2 (regulatory submissions and ongoing advisory, estimated at $3,200,000). The report should note the ±15% fee collar applicable to the engagement and the $9,200,000 overrun threshold above which General Counsel approval is required for continued engagement.
•  Independent Consultant (Thornfield Consulting Group): Spend to date versus the $6,900,000 total budget ($6,500,000 in fees plus $400,000 in expenses).
•  Technology Upgrade (Veridian TMS v.10.0): Spend to date versus the $4,700,000 technology upgrade budget, consisting of $2,800,000 in implementation costs and $1,900,000 in Year 1 incremental licensing fees.
•  Temporary Staffing (Pinnacle Compliance Solutions LLC): Spend to date versus the $3,600,000 contracted amount.
•  Internal Headcount Additions: Spend to date versus the $2,250,000 budget for 15 new permanent BSA/AML FTEs.
•  SAR Lookback Project: Spend to date versus the $5,500,000 lookback project budget.
•  CDD/EDD Remediation: Spend to date versus the $4,300,000 CDD/EDD remediation budget.
•  Training and Policy Development: Spend to date versus the $1,800,000 training and policy development budget.
•  Board/Governance Restructuring: Spend to date versus the $500,000 board and governance restructuring budget.
CMP Payment Status. Confirmation that the $14,500,000 civil money penalty assessed under the Consent Order was paid by the March 16, 2025 payment deadline, together with confirmation of the payment method, the Bank account from which the payment was remitted, and any OCC acknowledgment of receipt.
Variance Analysis. An analysis of any budget line items that are tracking materially above or below plan, with an explanation of the reasons for the variance and a description of any proposed corrective actions. For line items tracking above plan, the report should assess whether the variance can be absorbed within the overall $42,500,000 budget through offsets from other line items or whether a budget increase request to the Board may be necessary. C&H recommends that any single line-item variance in excess of 10% of the approved line-item budget be specifically identified and discussed in the report.
IV. Quarterly Report — Additional Content Beyond Monthly Metrics
In addition to the monthly metrics described in Section III, each quarterly report should include the following additional content areas. These additions are designed to provide the Compliance Committee and the Board with deeper analytical insight, to support the preparation of the OCC quarterly progress reports, and to address topics that do not require monthly granularity but are essential for effective quarterly oversight.
A. Trend Analysis
The quarterly report should include a comprehensive trend analysis section that presents quarter-over-quarter trends for all key metrics enumerated in Section III. The trend analysis should enable the Committee to assess the trajectory of the remediation effort, identify areas of improving or deteriorating performance, and evaluate whether the pace of progress is consistent with achieving the Consent Order milestones.
Specifically, the trend analysis should include comparative analysis against pre-remediation baselines, using CY 2023 and CY 2024 data as reference points. This comparison is important because it demonstrates the distance traveled from the conditions that gave rise to the Consent Order and provides context for current performance levels.
The trend analysis should be accompanied by graphical presentations of key trends, including but not limited to: SAR filing volumes (monthly and cumulative), SAR filing timeliness (distribution and average), OFAC screening coverage percentage over time, CDD/EDD remediation trajectory (cumulative accounts remediated versus target curve), alert volumes and disposition rates, and SAR conversion rates. Charts and graphs should be clearly labeled with data sources and should include annotations highlighting significant events or changes.
B. Consent Order Milestone Compliance Status
The quarterly report should include a detailed status report on each Consent Order milestone, presented in chronological order. This section serves as the primary tool for the Committee and the Board to assess whether BRB is meeting its obligations under the Consent Order on a timely basis. The milestones, as set forth in the Consent Order, are as follows:
For each milestone, the quarterly report should include: (i) the current status (met, on track, at risk, or missed); (ii) evidence of completion, if the milestone has been met (e.g., confirmation of payment, OCC acknowledgment letter, Thornfield deliverable, or internal completion memo); and (iii) if the milestone is at risk or has been missed, a detailed explanation of the circumstances, the impact on the overall remediation program, and the corrective action plan being implemented to address the delay.
C. Regulatory Interaction Summary
The quarterly report should include a comprehensive summary of all communications between BRB and its regulators during the quarter, with a particular focus on communications with the OCC and FinCEN related to the Consent Order.
All communications with the OCC, whether with Jonathan Frey, Examiner-in-Charge, at the OCC Northeastern District Office located at 340 Madison Avenue, New York, New York 10017, or with any other OCC official, should be catalogued and summarized. Similarly, all communications with FinCEN, including any communications with Angela Drummond, Associate Director of the Enforcement Division, should be included in the summary.
The regulatory interaction summary should cover: (i) the date, format (letter, email, telephone, in-person meeting), and participants of each communication; (ii) a brief summary of the topics discussed or information exchanged; (iii) the status of any outstanding requests from the OCC or FinCEN, including document requests, information requests, and follow-up questions; (iv) the status of any open issues or action items arising from regulatory communications; and (v) C&H's assessment of the regulatory posture and any indications regarding potential additional enforcement action, the possibility of a criminal referral to the U.S. Department of Justice, or a separate FinCEN enforcement action.
This section of the quarterly report should be prepared in close coordination with C&H and the General Counsel to ensure that the summary is accurate, complete, and appropriately sensitive to privilege considerations and regulatory diplomacy.
D. Thornfield Consulting Quarterly Summary
The quarterly report should include a comprehensive summary of Thornfield Consulting Group's findings, validation activities, and recommendations for the quarter. This summary should be more detailed than the monthly Thornfield status update and should provide the Committee with a thorough understanding of Thornfield's assessment of the Bank's remediation progress.
Specifically, the quarterly summary should include: (i) a description of all significant workstreams and activities undertaken by Thornfield during the quarter; (ii) a summary of all findings, whether preliminary or final, communicated by Thornfield during the quarter; (iii) Thornfield's assessment of whether each of the five remediation workstreams is on track, at risk, or behind schedule; (iv) any recommendations from Thornfield for adjustments to the remediation plan, timeline, or resource allocation; and (v) an overall assessment of whether the remediation program is on track to achieve Thornfield's final validation and the Bank's February 15, 2026 compliance self-certification.
E. Risk Assessment Update
The quarterly report should include an updated risk assessment covering the following dimensions of risk associated with the remediation program and the Bank's BSA/AML compliance posture:
•  Regulatory Risk: The risk of additional enforcement action by the OCC, FinCEN, or other regulatory bodies, including the risk of an escalation from a consent order to a more severe enforcement measure (such as a formal cease and desist order, removal or prohibition actions against individuals, or the imposition of additional civil money penalties).
•  Operational Risk: The risk that the Bank's BSA/AML compliance operations will fail to detect, prevent, or report suspicious activity or sanctions violations, whether due to staffing shortages, system failures, process breakdowns, or other operational factors.
•  Reputational Risk: The risk of harm to the Bank's reputation arising from public disclosure of the Consent Order, adverse media coverage, customer attrition, or the loss of BaaS partner relationships.
•  Financial Risk: The risk of financial loss arising from the remediation program (including budget overruns), the civil money penalty, potential additional fines or penalties, litigation costs, or the loss of BaaS-related revenue.
The risk assessment should also evaluate the adequacy of remaining budget and resources to complete the remediation program and should identify any emerging risks that have materialized or become more likely since the prior quarterly assessment. Emerging risks might include, for example, new regulatory guidance that expands the scope of the required remediation, unexpected BaaS partner issues (such as a partner becoming the subject of its own enforcement action), technology implementation delays affecting the Veridian TMS upgrade, or staffing challenges arising from elevated attrition or a competitive hiring environment for BSA/AML professionals.
F. External Auditor and Independent Testing
The quarterly report should include a summary of any activities undertaken by the Bank's external auditor, Caldera & Pope LLP ("Caldera & Pope"), engagement partner Franklin Dorsey, that are related to BSA/AML independent testing or the financial statement audit implications of the remediation program and the Consent Order.
Specifically, the report should cover: (i) the status of any BSA/AML independent testing engagement conducted by Caldera & Pope, including the scope, methodology, and timeline of the testing; (ii) a summary of any findings or observations from completed or in-progress testing; (iii) an assessment of how the Consent Order and remediation program may affect the Bank's financial statements, including any provisions, contingent liabilities, or disclosures related to the civil money penalty, remediation costs, or other Consent Order-related expenses; and (iv) the schedule for the next BSA/AML independent test, which should be coordinated with the Compliance Committee, the Audit Committee, and the internal audit function to avoid duplication and ensure appropriate coverage.
This section should also note the role of the Head of Internal Audit, Derek Ballard, in coordinating internal audit activities related to BSA/AML compliance with external testing and Thornfield's independent consultant engagement.
V. Reporting Responsibilities and Workflow
This Section describes the roles and responsibilities of the individuals and teams involved in the preparation, review, approval, and distribution of the monthly and quarterly reports, as well as the recordkeeping requirements applicable to all reports produced under this Framework.
A. Report Preparation
The following individuals are designated as the primary report owners for the reporting areas indicated. Each report owner is responsible for ensuring the accuracy, completeness, and timeliness of the data and narratives within their designated area, and for coordinating with other report owners as necessary to produce a coherent and integrated final report.
•  Patricia Langston, Chief Compliance Officer — Overall report coordinator and signatory. Ms. Langston is responsible for assembling the final report from the contributions of each report owner, ensuring consistency of presentation and messaging, and certifying the completeness and accuracy of the report prior to submission for review.
•  Thomas Ikeda, BSA Officer / AML Program Director — Report owner for SAR filing metrics (Section III.B), OFAC sanctions screening metrics (Section III.C), and transaction monitoring metrics (Section III.D). Mr. Ikeda is also responsible for providing data on staffing and resource utilization for the BSA/AML department (Section III.G) and for coordinating with Pinnacle Compliance Solutions on temporary staffing metrics.
•  Warren Ashby, Head of Fintech Partnerships / BaaS Division — Report owner for BaaS partner risk ratings and oversight metrics (Section III.F), including partner transaction volumes, revenue, compliance addendum execution status, escalation events, and the status of compliance remediation letters.
•  Linda Petrosian, CIO / CTO — Report owner for technology upgrade status, including the Veridian TMS v.10.0 implementation (Section III.D, TMS upgrade status) and any other technology-related remediation activities such as data extraction automation and screening system enhancements.
•  Samantha Reeves, CFO — Report owner for budget tracking and financial data (Section III.I), including line-item budget utilization, CMP payment confirmation, variance analysis, and any financial statement implications of the remediation program.
•  Derek Ballard, Head of Internal Audit — Report owner for independent testing coordination and internal audit findings, and responsible for contributing to the quarterly external auditor and independent testing section (Section IV.F).
Each report owner should prepare their section of the report using the approved template and deliver the completed section to Ms. Langston no later than the fifth (5th) business day of each calendar month. Ms. Langston should then assemble the complete draft report and deliver it for review no later than the seventh (7th) business day of each calendar month.
B. Review and Approval Chain
The following multi-step review and approval process should be followed for each monthly and quarterly report prior to distribution to the Compliance Committee:
Step 1: Draft Preparation. Draft report sections prepared by the BSA/AML team and other report owners under the direction and coordination of Thomas Ikeda and Patricia Langston.
Step 2: First-Level Review. Review by Patricia Langston (Chief Compliance Officer) and Melissa Chu (Chief Risk Officer) for substantive accuracy, completeness, and consistency. Ms. Langston and Ms. Chu should confirm that all required metrics are included, that the data is accurate and reconciled to source systems, and that the narrative descriptions fairly represent the status of the remediation program.
Step 3: Legal Review. Review by Gregory Nardone (General Counsel) and Calderwood & Harkness LLP (Philip Hartmann and/or Yuki Nakamura) for privilege protection, regulatory messaging, accuracy of legal conclusions, and overall presentation. The legal review should ensure that the report does not contain inadvertent privilege waivers, that characterizations of regulatory interactions are accurate and appropriately nuanced, and that the report is consistent with the Bank's positions in any pending or anticipated regulatory proceedings.
Step 4: Final Approval. Final review and approval by the Compliance Committee Chair, James Rutherford, prior to distribution to the full Compliance Committee. Mr. Rutherford should confirm that the report is ready for distribution and, if applicable, for presentation at the scheduled Compliance Committee meeting.
For quarterly reports that will support the preparation of OCC quarterly progress report submissions, an additional review step should be inserted between Step 3 and Step 4, in which C&H prepares or reviews the OCC submission draft to ensure alignment between the internal quarterly report and the regulatory filing.
C. Distribution
Monthly reports should be distributed to all members of t

PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT

COMPLIANCE COMMITTEE REPORTING FRAMEWORK

Record

Parties

Dates

Amounts